qa v0.1.3

QA 0.1.3

Require Symfony Process 8.0.5 or newer to exclude
CVE-2026-24739
from consumer dependency resolution. The command and strict-mode contracts are unchanged.

Update sympress/qa with Composer and review the resulting lockfile. This fixes
the package's allowed dependency range; it does not establish that an installed
consumer was vulnerable.

qa v0.1.2

Missing required QA tools or configuration previously produced successful SKIP results in CI. CI now fails closed by default, and repository Composer scripts invoke strict QA explicitly. Local non-strict use remains an explicit diagnostic option; disabled optional tools are handled separately from missing mandatory checks.

Stable dependencies require the published Coding Standards1.1.1 SQL rule, and export rules preserve the executable/runtime resources while excluding development artifacts. A weekly dependency canary uses the reviewed immutable reusable workflow.

Validation: doctor, syntax, PHPCS and PHPStan passed; PHPUnit 28 tests / 145 assertions. Independent failure probes cover missing tools/configuration and CI strict behavior. Native actionlint and exact-commit distribution validation passed. Candidate version v0.1.2; historical tags are retained.

SymPress QA 0.1.1

Adds qa lint:php, a shared PHP syntax checker using the current PHP interpreter.

• Supports --package and repeatable package-relative --exclude directories.
• Checks public entrypoints; skips dependencies, generated output, caches and symlinks.
• Preserves interpreter failure exit codes without executing checked source files.
• Keeps the existing aggregate gates unchanged; adoption is explicit through Composer scripts.
• Corrects doctor validation for additional opt-in gates.

Validated on PHP 8.5.9 with PHPCS, PHPStan and 21 tests / 84 assertions.

QA 0.1.0

First tagged release of the existing SymPress QA toolchain, with stable Coding Standards 1.1 dependencies and PHPUnit 10.5, 11.5 or 13 support. Requires PHP 8.5.

Validation: clean Packagist-only install with 56 stable packages; Composer validation and audit, coding standards, static analysis and 15 tests / 68 assertions passed. PR #4 CI passed. This dependency-only release does not change command behavior.

The annotated tag is SSH-signed with release key fingerprint SHA256:t63b+AEbAYq0XN04EJw/SAF3zsIdpzXoLyjlgsbD9ow and verified locally. GitHub account registration of the signing key is pending.