Motivation
Several small supply-chain/hygiene gaps, best fixed together:
- No CI job runs
composer validate --strict, composer audit (CVE gate), or ergebnis/composer-normalize --dry-run.
composer.json "homepage": "http://go.aopphp.com/" 301s to https://.tracy/tracy: ^2.10 (require-dev) has zero references anywhere in the repo — grep for Tracy matches only composer.json.doctrine/orm: ^2.5 is an unrealistically old floor for the --prefer-lowest CI leg; ^2.19 || ^3.0 would make that leg test something real.
Proposed change
- New
qa.yml workflow (or extend an existing one) with validate/audit/normalize jobs.
- Normalize
composer.json once, fix the homepage scheme, drop tracy/tracy, raise the ORM floor.
Acceptance criteria
- QA jobs green on master and PRs;
--prefer-lowest leg installs ORM ≥ 2.19; no unused dev deps remain.
Motivation
Several small supply-chain/hygiene gaps, best fixed together:
composer validate --strict,composer audit(CVE gate), orergebnis/composer-normalize --dry-run.composer.json"homepage": "http://go.aopphp.com/"301s tohttps://.tracy/tracy: ^2.10(require-dev) has zero references anywhere in the repo — grep forTracymatches only composer.json.doctrine/orm: ^2.5is an unrealistically old floor for the--prefer-lowestCI leg;^2.19 || ^3.0would make that leg test something real.Proposed change
qa.ymlworkflow (or extend an existing one) with validate/audit/normalize jobs.composer.jsononce, fix the homepage scheme, droptracy/tracy, raise the ORM floor.Acceptance criteria
--prefer-lowestleg installs ORM ≥ 2.19; no unused dev deps remain.