Development environment setup

.cursor/rules/snyk_rules.mdc

@@ -0,0 +1,14 @@
+---
+alwaysApply: true
+always_on: true
+trigger: always_on
+applyTo: "**"
+description: Snyk Security At Inception
+---
+
+# Project security best practices
+
+- Always run snyk_code_scan tool for new first party code that is generated in a Snyk-supported language.
+- If any security issues are found based on newly introduced or modified code or dependencies, attempt to fix the issues using the results context from Snyk.
+- Rescan the code after fixing the issues to ensure that the issues were fixed and that there are no newly introduced issues.
+- Repeat this process until no new issues are found.

.github/workflows/tests.yml

@@ -0,0 +1,44 @@
+name: Tests
+
+on:
+  push:
+    branches: [ main, master ]
+  pull_request:
+    branches: [ main, master ]
+
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ['8.4']
+
+    name: PHP ${{ matrix.php }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          tools: composer
+          coverage: none
+
+      - name: Cache Composer dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.composer/cache
+          key: composer-${{ matrix.php }}-${{ hashFiles('composer.lock') }}
+          restore-keys: composer-${{ matrix.php }}-
+
+      - name: Install dependencies
+        run: composer install --no-interaction --no-progress
+
+      - name: Run PHPStan
+        run: vendor/bin/phpstan analyse --memory-limit=2G
+
+      - name: Run tests
+        run: vendor/bin/phpunit tests/

.gitignore

@@ -1,3 +1,6 @@
 .phpunit.cache
 /vendor
-.idea
+.idea
+# Snyk Security Extension - AI Rules (auto-generated)
+.windsurf/rules/snyk_rules.md
+/coverage-html

.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+    "snyk.advanced.autoSelectOrganization": true
+}

AGENTS.md

@@ -0,0 +1,29 @@
+# AGENTS.md
+
+## Cursor Cloud-specific instructions
+
+### Project overview
+
+Warden is a Laravel security audit **package** (library), not a standalone application. It is tested using Orchestra Testbench, which bootstraps a minimal Laravel environment in-memory.
+
+### Prerequisites (installed in VM snapshot)
+
+- PHP 8.4 (from `ppa:ondrej/php`; extensions: cli, mbstring, xml, curl, zip, sqlite3)
+- Composer 2.x (installed to `/usr/local/bin/composer`)
+
+### Key commands
+
+| Task | Command |
+|---|---|
+| Install dependencies | `composer install --no-interaction` |
+| Static analysis (lint) | `composer phpstan` or `vendor/bin/phpstan analyse --memory-limit=2G` |
+| Run tests | `vendor/bin/phpunit tests/` |
+| Code quality (dry-run) | `vendor/bin/rector process --dry-run` |
+| Run package commands | `vendor/bin/testbench warden:audit` / `vendor/bin/testbench warden:syntax` |
+
+### Gotchas
+
+- **Tests target Laravel 12+**: The package supports Laravel 7–12, but `orchestra/testbench ^10.9` pins the test suite to Laravel 12+; CI runs against the latest supported Laravel.
+- **PHPStan with full framework**: When `orchestra/testbench` is installed (which brings in `laravel/framework`), PHPStan may report additional errors due to full type information replacing stubs. The CI workflow installs testbench, so check PHPStan passes with `composer phpstan`.
+- **testbench.yaml**: Registers `WardenServiceProvider` so `vendor/bin/testbench` can run the package's artisan commands (e.g., `warden:audit`).
+- **Test app**: To test the package inside a real Laravel app, create one in `/tmp`: `cd /tmp && composer create-project laravel/laravel warden-test-app` then `cd warden-test-app && composer config repositories.warden path /workspace && composer require dgtlss/warden:* --dev`.

composer.json

@@ -2,7 +2,7 @@
     "name": "dgtlss/warden",
     "description": "A Laravel package that proactively monitors your dependencies for security vulnerabilities by running automated composer audits and sending notifications via webhooks and email",
     "keywords": ["laravel", "composer", "security", "vulnerabilities", "audits", "notifications", "CVE"],
-    "version": "1.4.1",
+    "version": "1.5.0",
     "license": "MIT",
     "autoload": {
         "psr-4": {
@@ -34,7 +34,8 @@
     "require-dev": {
         "phpstan/phpstan": "^2.1",
         "rector/rector": "^2.2",
-        "larastan/larastan": "^3.0"
+        "larastan/larastan": "^3.0",
+        "orchestra/testbench": "^10.9"
     },
     "scripts": {
         "phpstan": "vendor/bin/phpstan analyse --memory-limit=2G"