[coisa]

Use the common Fast Forward skill configuration: trust fast-forward/* with trusted-replace, retain auto-sync: true, source resources/skills without a package override, and discover Changelog's Composer-declared payload from GitHub at ^0.4.0 without a skill allowlist. Pin the reviewed schema, ignore generated tooling output and add a patch fragment.

Add a project PHPDoc profile that loads the consumer autoloader instead of DevTools 1.x's nonexistent nested autoloader, preserves existing copyright/file headers and checks PHPDoc structure. Explicitly allow the GrumPHP shim already required by DevTools.

Validation

Complete composer dev-tools passed: Rector, PHPDoc, code style, tests, metrics and generated API/guide documentation. PHPUnit passed 3 tests / 42 assertions, without errors or failures. Composer strict validation, native skill synchronization, committed Changelog contribution checks against origin/main, syntax and whitespace checks passed. Both normal commit hooks passed; no hook bypass was used.

No application behavior, runtime dependency upgrade, merge or release is included.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T12:13:04.156645Z	a98947e	PR opened
🔒 Security Review	✅ Completed 2026-10-24T12:16:03.177364Z	a98947e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

📝 Summary

Summary by CodeRabbit

• New Features
  • Bundled skills now synchronize from the project’s local skill sources and are restored during standard Composer installs and updates.
  • Changelog contributor skills are sourced from stable 0.4.x releases without requiring a separate allowlist.
  • Fast Forward Composer skills are trusted across the fast-forward/* namespace.
  • Run composer skills:update to refresh skills on demand.
• Developer Tooling
  • PHPDoc checks now load the project autoloader when DevTools is installed as a dependency.

Composer skill settings now support local skill synchronization, broader trusted donors, and a newer Changelog source. The repository also adds a PHP-CS-Fixer configuration for PHPDoc checks and updates related repository and Composer settings.

Changes: Composer skill sources

Layer / File(s)	Summary
Configure skill sources and synchronization skills.json, CONTRIBUTING.md, composer.json, .changelog/consistent-skill-sources.md	The skill configuration adds a local source, updates the GitHub Changelog source to ^0.4.0, and trusts Composer donors matching fast-forward/*. Contributor instructions describe automatic restoration and explicit updates. Composer plugin permissions and the patch changelog are updated.

PHPDoc checks

Layer / File(s)	Summary
Configure PHPDoc checks .php-cs-fixer.dist.php, .gitignore, .gitattributes	The new fixer configuration loads the project autoloader, excludes configured tooling directories, and enables PHPDoc rules. The repository ignores /.dev-tools/ and excludes the fixer configuration from exports.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: Minimal · up to a9894

No merge-blocking risk remains; the Markdown heading suggestion is unverified and non-blocking.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title "fix: align skill sources and PHPDoc bootstrap" matches the main changes: skill source and trust configuration in skills.json, CONTRIBUTING.md, and composer.json, plus the new PHPDoc/PHP-CS-…
Description check		The description matches the changeset. It explains the skill trust and source changes in skills.json and CONTRIBUTING.md, the schema pin, the PHPDoc profile that loads the consumer autoloader, the Gru…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "fix: align skill sources and PHPDoc bootstrap" matches the main changes: skill source and trust configuration in skills.json, CONTRIBUTING.md, and composer.json, plus the new PHPDoc/PHP-CS-Fixer bootstrap. It is specific and follows a conventional commit style. It omits the GrumPHP shim and the ignore/gitattributes updates, which is acceptable for a title.

Full details: Description check

Explanation

The description matches the changeset. It explains the skill trust and source changes in skills.json and CONTRIBUTING.md, the schema pin, the PHPDoc profile that loads the consumer autoloader, the GrumPHP shim allowance in composer.json, the ignore and export-ignore entries, and the patch changelog fragment. It also gives validation results.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (6 skipped: 6 unsupported.)

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the source list twice,
Then hops where bundled skills reside.
The Changelog blooms at point four,
While PHPDocs get rules to guide.
A tidy config joins the run,
And I bound off when checks are done.}

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Changelog

✅ Contribution check passed.

Head: a98947ecf85ee366ea7fbec2ad8ad42fdd274750

Base: 41271ad903372b4828d8ba1cfcb8f43ca0692ae3

Contribution: 1 new valid fragment(s). Policy: ordinary.

• consistent-skill-sources.md — changed, patch

  Synchronize the bundled local skill automatically and trust Fast Forward Composer skill donors through `fast-forward/*`. Resolve Changelog contributor skills from stable `0.4.x` releases without a redundant skill allowlist. Load the project autoloader for PHPDoc checks when DevTools is installed as a dependency.

[coderabbitai]

🔇 Additional comments: 7

.php-cs-fixer.dist.php: 1

1-38: LGTM!

.gitignore: 1

9-9: LGTM!

.gitattributes: 1

21-21: LGTM!

skills.json: 1

2-2: LGTM!

Also applies to: 11-11, 17-20, 24-24

CONTRIBUTING.md: 1

40-42: LGTM!

Also applies to: 44-48

composer.json: 1

46-46: LGTM!

Also applies to: 49-50

.changelog/consistent-skill-sources.md-6-6: 1

6-6: Minor · Maintainability & Code Quality · Quick win

⚠️ Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

Add a top-level heading after the front matter.

markdownlint-cli2 reports MD041 because the first Markdown content is plain text. Add an H1 before the fragment text.

Proposed fix

 ---
 category: changed
 type: patch
 ---
 
+# Consistent skill sources
+
 Synchronize the bundled local skill automatically and trust Fast Forward Composer

Source: Linters/SAST tools

---

Review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 7e3eaf7f-f8ff-455a-b8df-08594da7b31d

Commits

Reviewing files that changed from the base of the PR and between 41271ad and a98947e.

Files selected for processing: 7

• .changelog/consistent-skill-sources.md
• .gitattributes
• .gitignore
• .php-cs-fixer.dist.php
• CONTRIBUTING.md
• composer.json
• skills.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.