ci: run all checks on a single worker for PHP 8.5

[pekral]

Summary

Sjednocuje CI checkery na jeden worker pro jednu PHP verzi (8.5). Doposud běžel matrix 8.4 + 8.5, tedy dva workery; tím se spotřeba GitHub Actions minut zhruba půlí.

Všechny kontroly (composer test, composer check, composer phpstan, composer rector, composer check-unused-sniffs) zůstávají beze změny — jen běží jednou.

Resolves #59

Testing

• composer build lokálně OK (PHPCS, PHPStan, Rector, unused-sniffs, 10 testů)
• Workflow se spustí na této PR — ověř, že job Checks (PHP 8.5) proběhne zeleně a že je jen jeden běh místo dvou.

Poznámka / TODO

• Knihovna deklaruje php: ^8.4, ale CI nově testuje pouze 8.5. Je to vědomý kompromis dle zadání (fix ci #59) kvůli úspoře Actions limitů. Pokud by bylo potřeba garantovat kompatibilitu s 8.4, lze do budoucna zvážit občasný matrix běh (např. jen na master).

[pekral]

Status: needs-fix
Counts: Critical 0 · Moderate 1 · Minor 1 · Refactoring 0
Last updated: 2026-06-29T00:00:00Z
Issue tracker summary: posted summary to issue #59

---

Findings

🟠 Moderate 1. Declared PHP floor (8.4) is no longer exercised by CI

• Location: .github/workflows/ci.yml:12,28
• Rule: n/a — CI configuration quality (package supports "php": "^8.4" in composer.json)
• Impact: the package declares php: ^8.4, but the matrix was collapsed to the ceiling (8.5) instead of the floor. A regression that relies on PHP 8.5-only behaviour now passes CI yet breaks for every consumer installing on PHP 8.4 — the declared minimum is no longer verified anywhere.
• Faulty Example:

  # only the ceiling is tested; 8.4 (the declared minimum) is unverified
  php-version: '8.5'

• Expected behavior: the single CI worker exercises the declared minimum PHP version, so a green pipeline guarantees the whole supported range builds and passes (or the supported range is narrowed to match what CI proves).
• Test hint: run the workflow on this PR and confirm the single job runs against the declared floor; locally composer install && composer build under PHP 8.4 must stay green.
• Suggested fix: keep one worker but pin it to the floor, or narrow the constraint so CI and composer.json agree:

  # option A — test the declared minimum on the single worker
  php-version: '8.4'

  // option B — if 8.4 support is intentionally dropped, align composer.json
  "require": { "php": "^8.5" }

🟡 Minor 1. Status-check context renamed — reconcile with branch protection

• Location: .github/workflows/ci.yml:12
• Note: the check context changed from PHP 8.4 / PHP 8.5 to Checks (PHP 8.5). If master branch protection pins the old names as required status checks, PRs will wait forever on contexts that never report (merge blocked) or the protection silently lapses. The PR's mergeStateStatus is CLEAN, so no pinned old names appear active today — confirm the branch-protection required-checks list before merging.

---

Refactoring proposals

1. Title: Drop deprecated --no-suggest from the Composer install step
   Scope: .github/workflows/ci.yml:31 (pre-existing, out of scope of this diff)
   Reason: Composer 2.10 reports --no-suggest as "deprecated … has no effect and will break in Composer 3".
   Approach: remove the flag: composer install --prefer-dist --no-progress.

2. Title: Add a concurrency group to cancel superseded runs
   Scope: .github/workflows/ci.yml job/workflow level
   Reason: directly furthers the Actions-minute saving goal of fix ci #59 — outdated in-flight runs on the same ref keep consuming minutes.
   Approach: add concurrency: { group: ci-${{ github.ref }}, cancel-in-progress: true } so a new push cancels the previous run.

---

Summary: 0 Critical · 1 Moderate · 1 Minor · 0 Refactoring · assignment conformance: conformant · posted summary to issue #59

[pekral]

Code review — resolution

Final state: 0 Critical · 0 Moderate · 0 blocking Minor

Moderate (resolved)

composer.json declared "php": "^8.4" while CI only tested 8.5, leaving the declared floor untested. Resolved by aligning the declared support with the single tested version (commit a6b5bfe):

• composer.json: "php": "^8.5"
• .github/workflows/composer-update.yml: setup-php 8.5 (the scheduled composer install would otherwise fail against ^8.5)
• README.md: "Supports PHP 8.5+."

This is a deliberate, owner-approved drop of PHP 8.4 support so the package no longer advertises an untested version.

Minor (verified, no action needed)

Status-check context rename (PHP 8.4/PHP 8.5 → Checks (PHP 8.5)): the master branch has no branch protection, so no required-check names are pinned. Merge is unaffected.

Security review: no findings (YAML-only change, actions pinned on unchanged lines).