Repository navigation
Verify fork PR automation and fresh Composer distribution #2
Description
Outcome
Prove workflow and distribution behavior in fresh consumer environments after #1. Reference architecture: php-fast-forward/changelog Actions, public/internal reusable workflows and resources wrappers.
Acceptance
- Exercise real same-repo and fork PRs with exact base/head and readonly ephemeral hosted runners, no credentials persisted and no privileged target execution.
- Confirm rules/config/lock changes trigger full scans, no files succeeds and violations fail checks.
- Verify source archives and isolated fresh Composer installs, binary/config resource autoload and version/ref alignment.
- Test lowest/highest supported dependency graphs and PHP 8.3–8.5; distinguish tool runtime from consumer PHP compatibility.
- Document required-check ownership without changing protections, consumer sharing or permissions.
- No real consumer migration, self-hosted dispatch, manual tags or fake releases.
Depends on #1. Separate focused PRs with current-head checks, Codex and CodeRabbit approvals; no bypass when review unavailable.
Activity
coisa commentedon Oct 21, 2026
Confirmed a further path regression with a real disposable Git checkout whose root ends in space/tab/newline: current9666d99 rejects the actual root because trim(git rev-parse --show-toplevel) destroys significant pathname bytes. The regression test fails before the correction with 'Project directory must be the Git checkout root'.
A focused local correction uses Git's --show-prefix to validate root scope without decoding/trimming an absolute pathname; non-root prefixes retain their slash and remain rejected. It is isolated on codex/git-root-whitespace for full tests/independent review. Existing published HEADs are unchanged. This belongs to the initial #7 path-safety scope; integration will wait for #16's gates and then the resulting #7 HEAD will need fresh hosted checks/Codex/CodeRabbit before main. No merge or release is implied.
coisa commentedon Oct 25, 2026
Felipe's25Oct package-contract request is handled as a focused increment under this existing distribution issue, not a duplicate epic. Comparing current Changelog/DevTools/Container shows missing package metadata and skill discovery. Own runtime imports also require direct container-interop/service-provider and psr/container contracts; the installed binary relies on Composer's documented $_composer_autoload_path proxy, so composer-runtime-api^2.2 is required. The change preserves library type, published Container constraint, default PHP8.3/runtime distinction, plugins disabled and development-only publisher dependencies. JSON stays expanded; Composer self-check adds native metadata/platform validation. No DevTools dependency, plugin activation, coverage/reporting monolith or invented release/Pages URL is copied. This does not close the broader fork/lowest/highest-graph acceptance of#2.