chore(ci): commit composer.lock + drop obsolete symfony/console pin - #55
Merged
Conversation
CI ran `composer install --prefer-dist` against a gitignored composer.lock, so `install` silently degraded to a full fresh resolve every run — CI never tested the same dependency graph twice, and any transitive major (Symfony Console via illuminate/*) could land in CI unbidden with no source change. Root-cause fix: track the lock. This is a published phpstan-extension — consumers `require --dev` and resolve against their OWN composer.json constraints, so our lock is never consumed downstream; committing it pins only this repo's CI/dev toolchain (the determinism we want). Dependabot composer is already wired weekly to keep it fresh via reviewed PRs. The `symfony/console: ^7.2` require-dev pin (PR #29, SC#33) was a temporary workaround for an Infection 0.33.x runtime crash on Symfony Console 8 (`Unknown service QuestionHelper`). composer.json is now on infection/infection ^0.34.0, whose own constraint is `symfony/console ^6.4 || ^7.0 || ^8.0`. Verified empirically: with the pin dropped, the fresh resolve lands symfony/console v8.1.1 + infection/infection 0.34.0, and the full `composer mutation:ci` gate runs clean on Console 8 (--threads=4, no fatal, MSI 86.02% / 880 mutations / 757 killed / 123 escaped, all accepted equivalent family). Pin removed as obsolete; the committed lock now pins Console 8. Closes SC#33 / F-2 root cause; supersedes the temporary ^7.2 pin; relates to Issue #30. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0129qYnTu3C5qVK2yNcqHELD
Goosterhof
added
the
Agent Review Requested
dmooibroek
approved these changes
Jul 15, 2026
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
composer.lockand commit it (now tracked).symfony/console: ^7.2dev pin fromrequire-dev— now obsolete.Why (F-2 / SC#33 root cause)
CI runs
composer installagainst a gitignored lock. With no committed lock,installsilently degrades to a full fresh resolve every run — CI never tests the same dependency graph twice, and any transitive major can land unbidden. Thesymfony/console ^7.2pin was whack-a-mole over one such transitive (Console arrives viailluminate/*); it patched a symptom, not the class.The gitignored lock had already drifted:
composer.jsonrequiredinfection/infection ^0.34.0while the untracked lock still pinned 0.33.2 — proof it was never authoritative in CI.Committing the lock is the structural fix — it kills the entire fresh-resolve class. This is a published
phpstan-extension: consumersrequire --devand resolve against their own constraints, so our lock is never consumed and there is zero consumer impact. It pins only our CI/dev toolchain (the determinism we want). Dependabot composer is already wired weekly to keep it fresh via reviewed PRs.The pin is now obsolete — verified empirically
The original block was a runtime crash in Infection 0.33.x on Console 8 (
Unknown service QuestionHelper). We're now on Infection 0.34. With the pin removed, the fresh resolve lands symfony/console v8.1.1 + infection/infection 0.34.0, and:composer mutation:ciruns the full Infection gate clean on Console 8 — MSI 86.02% (880 mutations, 757 killed, 123 escaped = the long-accepted equivalent family; ≥75 gate, matches QM M5).install✓ ·phpstan(max) ✓ · 173 tests ✓ · coverage 89.83% ✓ ·mutation:ci86.02% ✓ ·pint✓ ·composer auditno advisories ✓.Closes the SC#33 crash / Issue #30 (pin removal) and the gitignored-lock half of the recurring-release-pipeline doctrine item.
Scope
Three files only —
.gitignore,composer.json,composer.lock. No rule source, tests, or fixtures touched. Non-consumer-facing (dev-tooling), so no CHANGELOG entry.🤖 Generated with Claude Code