[mambax7]

CI has failed on master since the PHP 8.4 modernization, so every open Dependabot PR (#637–#641) inherits the failures. This fixes the causes on master.

• composer.json.dist: inline the dependency list from xoops/base-requires and drop that package. The repo is archived and Packagist marks it abandoned, the Packagist dev-master still has the pre-8.4 dependency set, and the ../base-requires path repository only existed on developer machines. firebase/php-jwt moves to ^7.0, because every 6.x release is blocked by GHSA-2x45-7fc3-mxwq. The old smarty/smarty >=5.0 conflict is dropped, since ^4.5.6 already excludes 5.x.
• ci.yml, sonarcloud.yml: run php console/console.php ci-bootstrap before the tests. The suite needs htdocs/mainfile.php and its config file, which the old Travis setup generated and the Actions port dropped. No database is needed.
• qodana.yaml: use the qodana-php:2025.3 linter, to match the 2025.3 CLI the action ships.
• sonarcloud.yml: pin setup-php to v2.40.0. The previous pin ran on Node 20, which has been removed from the runners.

Verified locally on PHP 8.4 from a clean checkout, the same way CI runs: composer update resolves with no advisory blocks, and the suite passes with 3156 tests and 0 failures.

After merging, @dependabot rebase #637–#641.

Summary by Sourcery

Restore reliable PHP 8.4 CI by modernizing dependency resolution, generating test configuration, and aligning code-quality workflows with current tooling.

Bug Fixes:

• Restore CI test setup by generating the required test configuration before running the test and analysis workflows.
• Replace the unavailable local dependency repository with explicit Composer dependencies and update JWT constraints to resolve PHP 8.4 and security-related dependency issues.

Enhancements:

• Align Qodana with the 2025.3 linter release and run scans only when a Qodana token is available.
• Pin the SonarCloud PHP setup action to a runner-compatible release.

CI:

• Update CI, SonarCloud, and Qodana workflow configuration for reliable current GitHub Actions execution.

Summary by CodeRabbit

• Chores
  • Updated automated build and test checks to prepare test configuration before running.
  • Refreshed code-quality tooling and adjusted scan execution based on credential availability.
  • Clarified the project’s declared PHP extension and library requirements.
  • No end-user-facing features or behavior changes are included; these updates affect development and automated checks only.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Repairs PHP 8.4 CI failures by removing a developer-only Composer repository, regenerating the configuration required by tests in both workflows, and aligning setup-php and Qodana versions with the current GitHub Actions environment. The change was locally verified against the updated dependency set with 3,156 tests passing.

Sequence diagram for CI test configuration bootstrap

sequenceDiagram
    participant CI as GitHub Actions workflow
    participant Composer
    participant Bootstrap as console/console.php
    participant Tests

    CI->>Composer: composer update
    Composer-->>CI: Install dependencies from Packagist
    CI->>Bootstrap: ci-bootstrap
    Bootstrap-->>CI: Generate htdocs/mainfile.php and config
    CI->>Tests: Run test suite
    Tests-->>CI: 3156 tests passed

Loading

File-Level Changes

Change	Details	Files
Remove the CI-only Composer path dependency so dependency installation resolves from Packagist.	Delete the ../base-requires repository configuration. Allow xoops/base-requires to resolve through the normal Composer repository.	composer.json.dist
Restore generation of the test environment before CI and SonarCloud test execution.	Run ci-bootstrap after dependency installation and platform checks. Generate htdocs/mainfile.php and its test configuration without requiring a database.	.github/workflows/ci.yml .github/workflows/sonarcloud.yml
Align CI tooling versions with the supported runner and action-provided CLI.	Pin setup-php to the v2.40.0 commit to avoid the removed Node 20 runtime. Upgrade the Qodana PHP linter image from 2025.2 to 2025.3.	.github/workflows/sonarcloud.yml qodana.yaml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: XOOPS/XoopsCore26/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Essentials
• Run ID: 4334ffac-6732-4b6d-a889-1b7324293350

📥 Commits

Reviewing files that changed from the base of the PR and between 1287240 and 0889fa4.

📒 Files selected for processing (4)

• .github/workflows/ci.yml
• .github/workflows/sonarcloud.yml
• composer.json.dist
• qodana.yaml

Included review availability: This review used your included allowance. Your plan provides up to 5 included reviews per hour; 4 remain after this review.

---

Walkthrough

The CI and SonarCloud workflows now run ci-bootstrap. SonarCloud pins the PHP setup action to v2.40.0. Composer declares extension and library requirements directly instead of using the local xoops/base-requires path package. Qodana uses PHP linter image 2025.3.

Changes

CI and tooling configuration

Layer / File(s)	Summary
CI and analysis tooling setup .github/workflows/ci.yml, .github/workflows/sonarcloud.yml, qodana.yaml	Both workflows now run ci-bootstrap. SonarCloud pins the PHP setup action to v2.40.0. Qodana uses PHP linter image 2025.3.
Direct Composer requirements composer.json.dist	The local xoops/base-requires path dependency is removed. PHP extension and library requirements are declared directly, and the PHP constraint remains ^8.4.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 0889f

No actionable issue remains from this review; the change is mergeable after normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely summarizes the main changes: removing the local path repository, generating test configuration, and updating the Qodana linter.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[gitar-bot]

Gitar is working

_Gitar

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Approved.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[Copilot]

🟢 Approval recommended

The focused configuration changes correctly address the identified CI failures, subject to the documented external dependency merge.

0 open findings

What changed in this PR

Restores CI and analysis compatibility for PHP 8.4.

Changes:

• Resolves dependencies through Packagist.
• Generates required test configuration before PHPUnit.
• Updates Qodana and setup-php tooling.

File	Description
composer.json.dist	Removes the local-only repository.
.github/​workflows/​ci.yml	Bootstraps test configuration.
.github/​workflows/​sonarcloud.yml	Updates PHP setup and bootstraps tests.
qodana.yaml	Updates the PHP linter image.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sourcery withdrew this approval because the latest commits introduced blocking findings.

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️

[sourcery-ai]

Sourcery assessment

Approved.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud