ci: make the workflow install the dependencies it analyses

Three problems, all of which made the pipeline's result depend on
something other than the code under test.

**The dependency cache was frozen.** The cache key was
`composer-${{ runner.os }}-${{ hashFiles('composer.lock') }}`, but
composer.lock is in .gitignore, so hashFiles() returned the empty string
and the key was the constant `composer-Linux-` on every branch and every
run. GitHub cache entries are immutable per key, so the first run ever to
save one froze `vendor` for good, and the analysis jobs — which only
restore the cache and never install — have been analysing those versions
ever since. The key is now hashed from the composer.json files, so
widening a constraint invalidates it.

That is why PHPStan reported `Point.php:109` on one PR and not on the
next commit of the same branch: the two runs restored different vendors.
The call site is guarded now, so the analysis no longer depends on which
brick/math is installed. The mask is as wide as the longer operand and
can never be empty; the guard is there because that cannot be proven
statically.

**Rector renamed `expectExceptionMessage()` to
`expectExceptionMessageIsOrContains()`** in 125 places, because it
resolves PHPUnit from composer and gets 13. But `castor phpunit` runs
`phpunit-11`, pinned because the PHP 8.2 image ships nothing newer, and
that method only exists from PHPUnit 12. Every one of those call sites
died with `Call to undefined method`. The rename is reverted and
`RenameMethodRector` is skipped under tests/; it made no other change
there. The pin has to stay while the matrix tests PHP 8.2.

Verified with `phpunit-11`, the binary CI runs, rather than the newer one
in vendor/bin: 777 tests, 0 failures.

Author: Spomky

.ci-tools/rector.php

@@ -6,6 +6,7 @@
 use Rector\Doctrine\Set\DoctrineSetList;
 use Rector\PHPUnit\CodeQuality\Rector\Class_\PreferPHPUnitThisCallRector;
 use Rector\PHPUnit\Set\PHPUnitSetList;
+use Rector\Renaming\Rector\MethodCall\RenameMethodRector;
 use Rector\Set\ValueObject\LevelSetList;
 use Rector\Set\ValueObject\SetList;
 use Rector\ValueObject\PhpVersion;
@@ -36,6 +37,7 @@
 );
 $builder->withSkip([
     PreferPHPUnitThisCallRector::class,
+    RenameMethodRector::class => [__DIR__ . '/../tests'],
     __DIR__ . '/../src/Library/Core/JWKSet.php',
     __DIR__ . '/../src/Bundle/JoseFramework/DependencyInjection/Source/KeyManagement/JWKSource.php',
     __DIR__ . '/../src/Bundle/JoseFramework/DependencyInjection/Source/KeyManagement/JWKSetSource.php',

.github/workflows/ci.yml

@@ -46,7 +46,7 @@ jobs:
       - uses: actions/checkout@v5
 
       - id: cache-key-generator
-        run: echo "key=composer-${{ runner.os }}-${{ hashFiles('composer.lock') }}" >> $GITHUB_OUTPUT
+        run: echo "key=composer-${{ runner.os }}-${{ hashFiles('composer.json', 'src/*/composer.json') }}" >> $GITHUB_OUTPUT
 
       - uses: actions/cache@v4
         with:

src/Library/Core/Util/Ecc/Point.php

@@ -5,6 +5,7 @@
 namespace Jose\Component\Core\Util\Ecc;
 
 use Brick\Math\BigInteger;
+use InvalidArgumentException;
 use function strlen;
 use const STR_PAD_LEFT;
 
@@ -99,14 +100,19 @@ private static function cswapBoolean(bool $a, bool $b, int $cond): array
     }
 
     /**
+     * The mask is as wide as the longer of the two operands, so it is never empty; the guard is there because
+     * `BigInteger::fromBase()` requires a non-empty string and the width cannot be proven statically.
+     *
      * @return array{BigInteger, BigInteger}
      */
     private static function cswapBigInteger(BigInteger $sa, BigInteger $sb, int $cond): array
     {
         $size = max(strlen($sa->toBase(2)), strlen($sb->toBase(2)));
-        $mask = (string) (1 - $cond);
-        $mask = str_pad('', $size, $mask, STR_PAD_LEFT);
-        $mask = BigInteger::fromBase($mask, 2);
+        $bits = str_pad('', $size, (string) (1 - $cond), STR_PAD_LEFT);
+        if ($bits === '') {
+            throw new InvalidArgumentException('Unable to compute the mask');
+        }
+        $mask = BigInteger::fromBase($bits, 2);
         $taA = $sa->and($mask);
         $taB = $sb->and($mask);
         $sa = $sa->xor($sb)

tests/Bundle/JoseFramework/Functional/Serializer/JWEEncoderTest.php

@@ -87,7 +87,7 @@ public function theJWEEncoderThrowsOnNonExistingRecipient(string $serializerId):
 
         ['jwe' => $jwe] = self::createJWE();
 
-        $this->expectExceptionMessageIsOrContains(sprintf('Cannot encode JWE to %s format.', 'jwe_compact'));
+        $this->expectExceptionMessage(sprintf('Cannot encode JWE to %s format.', 'jwe_compact'));
         $serializer->encode($jwe, 'jwe_compact', [
             'recipient_index' => 2,
         ]);
@@ -129,7 +129,7 @@ public function theJWEEncoderShouldThrowOnUnsupportedFormatWhenEncoding(): void
 
         ['jwe' => $jwe] = self::createJWE();
 
-        $this->expectExceptionMessageIsOrContains('Cannot encode JWE to jwe_json_flattened format.');
+        $this->expectExceptionMessage('Cannot encode JWE to jwe_json_flattened format.');
         $serializer->encode($jwe, 'jwe_json_flattened');
     }
 
@@ -159,7 +159,7 @@ public function theJWEEncoderShouldThrowOnUnsupportedFormatWhenDecoding(): void
 
         ['jwe_json_flattened' => $jweString] = self::createJWE();
 
-        $this->expectExceptionMessageIsOrContains('Cannot decode JWE from jwe_json_flattened format.');
+        $this->expectExceptionMessage('Cannot decode JWE from jwe_json_flattened format.');
         $serializer->decode($jweString, 'jwe_json_flattened');
     }
 

tests/Bundle/JoseFramework/Functional/Serializer/JWSEncoderTest.php

@@ -123,7 +123,7 @@ public function theJWSSerializerShouldThrowOnUnsupportedFormatWhenEncoding(): vo
 
         ['jws' => $jws] = static::createJWS();
 
-        $this->expectExceptionMessageIsOrContains('Cannot encode JWS to jws_json_flattened format.');
+        $this->expectExceptionMessage('Cannot encode JWS to jws_json_flattened format.');
         $serializer->encode($jws, 'jws_json_flattened');
     }
 
@@ -154,7 +154,7 @@ public function theJWSSerializerShouldThrowOnUnsupportedFormatWhenDecoding(): vo
 
         $jwsString = '{"payload":"SGVsbG8gV29ybGQh","protected":"eyJhbGciOiJIUzI1NiJ9","signature":"ZIKPsa3NtNoACjvh6fhfg6PZgmKiuss_9sDPtMZxtNU"}';
 
-        $this->expectExceptionMessageIsOrContains('Cannot decode JWS from jws_json_flattened format.');
+        $this->expectExceptionMessage('Cannot decode JWS from jws_json_flattened format.');
         $serializer->decode($jwsString, 'jws_json_flattened');
     }
 

tests/Component/Checker/AlgorithmHeaderCheckerTest.php

@@ -18,7 +18,7 @@ final class AlgorithmHeaderCheckerTest extends TestCase
     public function anAlgorithmMustBeAString(): void
     {
         $this->expectException(InvalidHeaderException::class);
-        $this->expectExceptionMessageIsOrContains('"alg" must be a string.');
+        $this->expectExceptionMessage('"alg" must be a string.');
 
         $checker = new AlgorithmChecker(['foo']);
         $checker->checkHeader(1);
@@ -28,7 +28,7 @@ public function anAlgorithmMustBeAString(): void
     public function theAlgorithmHeaderIsNotAllowed(): void
     {
         $this->expectException(InvalidHeaderException::class);
-        $this->expectExceptionMessageIsOrContains('Unsupported algorithm.');
+        $this->expectExceptionMessage('Unsupported algorithm.');
 
         $checker = new AlgorithmChecker(['foo']);
         $checker->checkHeader('bar');

tests/Component/Checker/AudienceClaimCheckerTest.php

@@ -18,7 +18,7 @@ final class AudienceClaimCheckerTest extends TestCase
     public function anAudienceClaimMustBeAStringOrAnArrayOfStrings(): void
     {
         $this->expectException(InvalidClaimException::class);
-        $this->expectExceptionMessageIsOrContains('Bad audience.');
+        $this->expectExceptionMessage('Bad audience.');
 
         $checker = new AudienceChecker('foo');
         $checker->checkClaim(1);
@@ -28,7 +28,7 @@ public function anAudienceClaimMustBeAStringOrAnArrayOfStrings(): void
     public function theAudienceClaimIsNotKnown(): void
     {
         $this->expectException(InvalidClaimException::class);
-        $this->expectExceptionMessageIsOrContains('Bad audience.');
+        $this->expectExceptionMessage('Bad audience.');
 
         $checker = new AudienceChecker('foo');
         $checker->checkClaim('bar');
@@ -38,7 +38,7 @@ public function theAudienceClaimIsNotKnown(): void
     public function theAudienceClaimListDoesNotContainTheCurrentAudience(): void
     {
         $this->expectException(InvalidClaimException::class);
-        $this->expectExceptionMessageIsOrContains('Bad audience.');
+        $this->expectExceptionMessage('Bad audience.');
 
         $checker = new AudienceChecker('foo');
         $checker->checkClaim(['bar']);

tests/Component/Checker/AudienceHeaderCheckerTest.php

@@ -18,7 +18,7 @@ final class AudienceHeaderCheckerTest extends TestCase
     public function anAudienceHeaderMustBeAStringOrAnArrayOfStrings(): void
     {
         $this->expectException(InvalidHeaderException::class);
-        $this->expectExceptionMessageIsOrContains('Bad audience.');
+        $this->expectExceptionMessage('Bad audience.');
 
         $checker = new AudienceChecker('foo');
         $checker->checkHeader(1);
@@ -28,7 +28,7 @@ public function anAudienceHeaderMustBeAStringOrAnArrayOfStrings(): void
     public function theAudienceHeaderIsNotKnown(): void
     {
         $this->expectException(InvalidHeaderException::class);
-        $this->expectExceptionMessageIsOrContains('Bad audience.');
+        $this->expectExceptionMessage('Bad audience.');
 
         $checker = new AudienceChecker('foo');
         $checker->checkHeader('bar');
@@ -38,7 +38,7 @@ public function theAudienceHeaderIsNotKnown(): void
     public function theAudienceHeaderListDoesNotContainTheCurrentAudience(): void
     {
         $this->expectException(InvalidHeaderException::class);
-        $this->expectExceptionMessageIsOrContains('Bad audience.');
+        $this->expectExceptionMessage('Bad audience.');
 
         $checker = new AudienceChecker('foo');
         $checker->checkHeader(['bar']);

tests/Component/Checker/CallableCheckerTest.php

@@ -20,7 +20,7 @@ final class CallableCheckerTest extends TestCase
     public function theCallableIsCallable(): void
     {
         $this->expectException(InvalidArgumentException::class);
-        $this->expectExceptionMessageIsOrContains('The $callable argument must be a callable.');
+        $this->expectExceptionMessage('The $callable argument must be a callable.');
 
         new CallableChecker('foo', 'not_a_callable');
     }

tests/Component/Checker/ClaimCheckerManagerFactoryTest.php

@@ -33,7 +33,7 @@ public function theAliasListOfTheClaimCheckerManagerFactoryIsAvailable(): void
     public function theAliasDoesNotExist(): void
     {
         $this->expectException(InvalidArgumentException::class);
-        $this->expectExceptionMessageIsOrContains('The claim checker with the alias "foo" is not supported.');
+        $this->expectExceptionMessage('The claim checker with the alias "foo" is not supported.');
 
         $this->getClaimCheckerManagerFactory()
             ->create(['foo']);
@@ -71,7 +71,7 @@ public function iCanCheckValidPayloadClaims(): void
     public function theMandatoryClaimsAreNotSet(): void
     {
         $this->expectException(MissingMandatoryClaimException::class);
-        $this->expectExceptionMessageIsOrContains('The following claims are mandatory: bar.');
+        $this->expectExceptionMessage('The following claims are mandatory: bar.');
 
         $clock = new MockClock();
         $now = $clock->now()