mirror of
https://github.com/Vateron-Media/XC_VM.git
synced 2026-10-24 12:03:17 +02:00
Divarion-D
baf6c8e231
Switch from "commit vendor with dev deps + strip at release" to the standard application model: the committed src/vendor/ is PRODUCTION-ONLY, and dev tooling (PHPStan, PHP-CS-Fixer + ~37 transitive deps) is installed on demand with "composer install". - Regenerate the committed src/vendor/ via "composer install --no-dev" (34 MB -> ~0.5 MB; only the Composer autoloader + gemorroj/m3u-parser + chrisyue/php-m3u8 remain). This also stops PHPStan\PharAutoloader registering in production. - Commit src/composer.lock (un-ignored) — this is an application, so the lock is committed to make "composer install" reproducible across dev/CI. - Revert the release-time strip step (Makefile hooks + tools/build/ strip-dev-vendor.sh) — no longer needed; the archive ships the prod vendor as-is. - CI: the phpstan and code-style jobs now run "composer install --working-dir=src" (with tools: composer) to obtain the dev tools before running. - New gate tools/ci/check-vendor-prod-only.sh (+ make check-vendor-prod-only, wired into "make gates"): asserts no require-dev package from composer.lock is committed under src/vendor/ — guards against accidentally committing a dev-bloated vendor. Inspects git-tracked files, so it is correct even in a CI job that already ran "composer install". - Fix verify-lb-archive.sh: LB legitimately ships most of Cli/Commands and Cli/CronJobs (edge commands + certbot/cache/cleanup crons), so flag only the genuinely privileged dirs + the specific install/root files, not the whole dirs. - .gitignore / composer.json notes updated. Verified before pruning: PHPStan no errors, PHPUnit 303, cs + gates green. After pruning: PHPUnit 303 (prod-only vendor), all three gates green. Local dev tools restored afterwards with "composer install" (not committed).