ci: gate every PR on tests, lint, and static analysis

[markshust]

Summary

Two problems, one root cause. packages/core carried 12 PHPStan errors and php-cs-fixer had drifted on 129 files, because this repo had no PR CI of any kind — the only workflows were auto-label, deploy-docs, readme-package-check, split, and sync-issue-templates. "develop is green" rested entirely on whoever last remembered to run the tools by hand, and pr-review-process.md's checklist never even listed PHPStan.

This fixes everything that was red and adds the gate that stops it recurring.

The 12 PHPStan errors were never failing tests

No test could have caught any of them — PHP tolerates every one at runtime. Extra arguments to a userland method are silently discarded; initInterception() exists on the trait so the call resolves; docblocks are invisible to the interpreter. The code worked. Its declared types lied about it.

Fix	What was wrong
PluginInterceptor	Passed a 3rd argument to generateInterfaceWrapper() / generateConcreteSubclass(), which take 2. Dead arguments removed.
PluginInterceptedInterface	Declared only getPluginTarget(), yet PluginInterceptor calls initInterception() through that type. Declared on the interface where the contract belongs.
ModuleManifest::$singletons	Annotated array<string, …> while list-style entries use int keys — exactly what BindingRegistry::registerModule() branches on via is_int(). The annotation made PHPStan call a live branch impossible. Behaviour unchanged, already covered by BindingRegistryTest.
Command, CommandDefinition	$aliases missing list<string>
InterceptorClassGenerator	collectInterfaceMethods() missing its ReflectionClass generic
Input	array_values() on a value that is already a list

Provenance: six arrived via PR #15 (the PluginProxy → generated-interceptor rewrite, 2026-04-05), the rest from the January CLI batches and a February routing fix. All went through normal review.

One error is ignored rather than fixed: trait.unused on PluginInterception. Every runtime consumer is an eval-generated class, so no source-visible use exists for PHPStan to find. It is a limitation of analysing generated code, not a defect — ignored narrowly by identifier and path, with the reason recorded in phpstan.neon. This is the repo's first PHPStan ignore, so it deserves a look. The alternative is replacing the trait with a collaborator object, which the trait's own docblock already flags as desirable ("a deliberate exception to the No Traits code standard") — worth its own PR, not this one.

The gate

Three jobs on every pull request, with no paths: filter so nothing can route around it:

Job	Runs
Tests	composer test
Lint	phpcs + php-cs-fixer --dry-run
Static analysis	composer phpstan

Also adds composer phpstan and composer ci (the whole gate in one command), and puts PHPStan into the review checklist that omitted it.

integration-destructive is deliberately not in the gate: it deletes vendor/ and composer.lock, runs composer update, and re-runs the entire suite in a subprocess, so it measures install integrity rather than behaviour and is order-dependent under --parallel. It now runs nightly instead of never, and bin/release.sh still runs it before any tag is cut.

The 142-file style commit

dd46d89 is mechanical only — every hunk is composer cs:fix output, no behaviour or test expectations touched. It is isolated in its own commit so the real changes stay readable.

Worth knowing: the two formatters disagreed on 12 files — phpcbf's multi-line reformatting produced output php-cs-fixer wanted to revert. cs:fix runs php-cs-fixer first and phpcbf second, so phpcbf wins and one pass converges. That ordering is now load-bearing for the Lint job rather than a convenience.

Test plan

• composer ci exits 0 — verified as a real exit code, not through a pipe
• Each command independently: phpcs 0, php-cs-fixer 0, phpstan 0, pest 0
• composer test — 6884 passed (up from 6871)
• tests/CiWorkflowTest.php — 10 tests asserting the gate has no paths: escape hatch, pins PHP 8.5 in every job, pins actions to a major version, keeps the destructive group on a schedule, and excludes the unparseable fixtures
• packages/core/tests/Unit/Plugin/PluginInterceptedInterfaceTest.php — pins the initInterception() contract against the trait's signature

Note on the fixture exclusions

php-cs-fixer lints before fixing and exits 4 when any file will not parse, even with zero files to change. Three fixtures are invalid PHP on purpose — the config and codeindexer packages test what happens when the tooling meets a broken file — so the Lint job would have failed on arrival, permanently, on a condition nobody could fix without deleting the test cases. Both linters now exclude them.

What the gate caught on its first run

Three tests passed locally and failed in CI — they had only ever run on one machine:

• ratelimiter/RenameReferencesTest and skeleton/PackageStructureTest hardcoded /opt/homebrew/Cellar/php/8.5.1_2/bin/php, with a /opt/homebrew/bin/composer fallback. pr-review-process.md forbids exactly this — "no hardcoded paths or environment-specific values, use PHP_BINARY" — but nothing enforced it. Now PHP_BINARY, and the composer lookup skips instead of guessing.
• devserver/PidFileTest built its process group via a string proc_open command, which runs through /bin/sh, so the reported pid is the shell's rather than PHP's. macOS sh execs in place and the pids coincide; Ubuntu's dash does not, so posix_setsid() created the group under a pid the assertions never inspected. Switched to the array form, which execs directly, plus a pcntl/posix guard.

That last one is a genuine portability bug in the test, not a CI quirk — it would have misled anyone debugging devserver on Linux.

Follow-ups this surfaced

Not fixed here, deliberately:

• PHPStan covers 1 of 70 packages. phpstan.neon analyses only packages/core/src. Across packages/*/src at the same level there are 262 errors.
• Core tests are excluded from PHPStan and carry 212 errors at level 6.