ci: make the QA gates and the test suite pass again on 4.1.x

[Spomky]

Why

All three QA gates are red on 4.1.x, and two of them never ran at all — the job died on a config constant that upstream had removed, before analysing a single file. That is the same breakage #669 repaired on 4.2.x; it was never backported, and Rector has since broken the same way on both branches.

This blocks every PR against 4.1.x, including #675.

What was wrong

ECS imported SetList::PHPUNIT and SetList::STRICT, both removed from Easy Coding Standard. Dropped — STRICT's three fixers were already registered explicitly. The failure was well hidden: ECS crashed inside its own error printer (str_repeat(): Argument #2 must be >= 0) while trying to report the undefined constant. Run the docker command without -it to see the real message.

OrderedImportsFixer was also registered bare, which silently discarded the class, function, const order that CLEAN_CODE sets. It is now configured explicitly, which is why 35 files are reformatted here — that is the config contradicting itself, not drift.

Rector imported PHPUnitSetList::PHPUNIT_120, folded upstream into the version-aware sets. Dropped; withComposerBased(phpunit: true) was already selecting the right rules, so nothing is lost. The 89 files Rector then wanted to rewrite are applied in this PR:

rule	files
RenameMethodRector (PHPUnit 12 renames)	46
RemoveReadonlyPropertyVisibilityOnReadonlyClassRector	16
CommandConfigureToAttributeRector / CommandHelpToAttributeRector	18
SimplifyBoolIdenticalTrueRector	7
dead-code and useless-tag removal	12

PHPStan ran, but against ergebnis/phpstan-rules and phpstan-beberlei-assert. Both extensions are dropped to match 4.2.x. ergebnis alone accounted for 777 of the 1694 baseline entries — the code never followed it, and beberlei/assert is unused in src/.

The PHPStan errors are fixed, not baselined

Stripping ergebnis exposed 34 real errors, mostly types tightened by brick/math and Symfony. They are fixed in code, following the rule that a new baseline entry should mean a new problem:

• non-empty-string for BigInteger::fromBase() — guarded in BigInteger, RSAKey, Math, AbstractECDH, KeyConverter, ESKeyAnalyzer
• positive lengths for random_bytes() / randomBits() — Curve, RSACrypt, JWKFactory
• crit and key_ops validated as lists of strings — HeaderCheckerManager, JWKSet, UsageAnalyzer
• json_decode() no longer passed JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE, which are encode-only flags and did nothing

Most of these are ports of the equivalent fix already on 4.2.x. Where a 4.2.x file also carried features that do not belong on 4.1.x — Brainpool curves in AbstractECDH, the RFC 7516 §7.2.1 header-disjointness change in JWEBuilder — only the type hunk was taken.

Two Symfony denormalizer covariance errors stay baselined, as they are on 4.2.x: fixing them would mean changing a public return type.

The baseline goes from 1694 to 910 entries. 777 removed with ergebnis, 9 more because the underlying code is now fixed.

One behaviour change

JWKFactory::createOctKey() now rejects sizes below 8 bits. Previously createOctKey(0) returned a key built from an empty secret; sizes 1–7 already threw. This matches 4.2.x.

Verification

• ECS, PHPStan, Rector: all exit 0 locally against ghcr.io/spomky-labs/phpqa:8.5
• Test suite unchanged: the same 38 pre-existing failures, all in the Symfony bundle configuration tests, before and after. Verified by diffing the failing-test list against a stashed baseline.

Watch out when reviewing

php-cs-fixer's LongToShorthandOperatorFixer rewrites $s[0] = $s[0] ^ "\xff" into $s[0] ^= "\xff", which PHP rejects at runtime with Cannot use assign-op operators with string offsets. It would have broken two Chacha20 tests. They now use substr_replace(), as on 4.2.x. Worth remembering for any byte-flip test.

[Spomky]

Update: the test job as well

Once the three QA gates went green, the test job actually ran for the first time — and exposed 38 failing bundle configuration tests, previously invisible because the job was skipped whenever a gate failed. They are fixed here too.

Cause. Every one of them failed with Failed asserting that exception message '' contains ..., whatever the configuration actually reported. ConfigurationValuesAreInvalidConstraint hands the caught exception object to PHPUnit's ExceptionMessageIsOrContains, but since PHPUnit 10.0.15 that constraint matches against the message string:

protected function matches(mixed $other): bool
{
    if (!is_string($other)) {
        return false;          // an exception object lands here
    }
    return str_contains($other, $this->expectedMessage);
}

So the assertion could never pass, and the failure description always printed an empty message. matthiasnoback/symfony-config-test v6.2.0 is the latest release and still does this — there is nothing to upgrade to.

Fix. ConfigurationAssertionsTrait keeps the upstream assertions and replaces only assertConfigurationIsInvalid(), comparing the message itself. The 38 call sites are untouched; the twelve test classes just swap which trait they use.

Also removed the Ergebnis\PHPUnit\SlowTestDetector\Extension bootstrap from the PHPUnit config. The package is not a dependency, so PHPUnit emitted a runner warning and exited 1 on every run even with no failing test — the job could not have gone green while it was there.

Result: 777 tests, 0 failures, exit 0.

Note on brick/math

The Point.php:109 PHPStan error that failed the first run here was version-specific: brick/math ≤ 0.17 declares fromBase(non-empty-string $number) in a way that PHPStan cannot satisfy at that call site. The range on 4.1.x now includes 0.19, which resolves it. Worth knowing that running PHPStan against an older brick/math in the allowed range will still report it.