Divarion-D aa7befa375 build: gitignore dev packages under vendor + harden the prod-only gate ...

Belt-and-suspenders so dev packages can never land in git:

- .gitignore: whitelist the committed production set under src/vendor/ and ignore
  everything else (src/vendor/* + !autoload.php/!chrisyue/!composer/!gemorroj,
  then re-ignore composer/{pcre,semver,xdebug-handler,autoload_files.php}). A
  local `composer install` (for PHPStan/PHP-CS-Fixer) now writes dev packages
  into ignored paths, so `git add` can never stage them. gitignore never
  untracks, so the committed prod files stay tracked and updatable; a NEW prod
  dep just needs a `!` whitelist line.
- check-vendor-prod-only.sh: add a second check on the committed
  vendor/composer/installed.json — it must list no dev package. This covers the
  one thing .gitignore cannot: installed.json is a tracked file that
  `composer install` rewrites with dev entries. Both checks read the git INDEX,
  so a local dev install does not trip the gate, but a committed dev artifact does.

Verified: clean tree passes; a dev `composer install` in the working tree leaves
the gate green (index-based); a fabricated dev installed.json is detected; no dev
dir is stageable after `composer install`.

2026-06-25 21:59:46 +03:00

..

check_procedural_use.php

test/ci(psr4): add the missing migration regression gates

2026-06-25 20:57:53 +03:00

check-vendor-prod-only.sh

build: gitignore dev packages under vendor + harden the prod-only gate

2026-06-25 21:59:46 +03:00

verify-lb-archive.sh

build: ship a production-only vendor; install dev tools via Composer

2026-06-25 21:51:13 +03:00