Sync shared files from infrastructure

.gitattributes

@@ -7,6 +7,8 @@ expected-counts.json  export-ignore
 composer.lock         export-ignore
 .gitattributes        export-ignore
 .gitignore            export-ignore
+.php-cs-fixer.php     export-ignore
+.rector.php           export-ignore
 .github/              export-ignore
 .idea/                export-ignore
 CLAUDE.md             export-ignore

.github/workflows/lint.yml

@@ -0,0 +1,27 @@
+name: Lint
+
+on:
+    push:
+        branches: [main]
+    pull_request:
+    workflow_dispatch:
+
+jobs:
+    lint:
+        runs-on: ubuntu-latest
+
+        steps:
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+            - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240  # 2.37.2
+              with:
+                  php-version: '8.3'
+
+            - name: Install dependencies
+              run: composer install --no-interaction --no-progress
+
+            - name: PHP CS Fixer
+              run: php vendor/bin/php-cs-fixer fix --diff --dry-run
+
+            - name: Rector
+              run: php vendor/bin/rector -c .rector.php --dry-run

.gitignore

@@ -1,2 +1,3 @@
 /vendor/
-/.idea/
+/.idea/
+/.php-cs-fixer.cache

.php-cs-fixer.php

@@ -0,0 +1,42 @@
+<?php
+
+$config = new PhpCsFixer\Config();
+return $config
+    ->setRiskyAllowed(true)
+    ->setParallelConfig(new PhpCsFixer\Runner\Parallel\ParallelConfig())
+    ->setRules([
+        // see https://cs.symfony.com/doc/ruleSets/PER-CS2.0.html
+        '@PER-CS2.0' => true,
+        // RISKY: Use && and || logical operators instead of and and or.
+        'logical_operators' => true,
+        // RISKY: Replaces intval, floatval, doubleval, strval and boolval function calls with according type casting operator.
+        'modernize_types_casting' => true,
+        // PHP84: Adds or removes ? before single type declarations or |null at the end of union types when parameters have a default null value.
+        'nullable_type_declaration_for_default_null_value' => true,
+        // Convert double quotes to single quotes for simple strings.
+        'single_quote' => true,
+        // PHPdoc stuff
+        'phpdoc_indent' => true,
+        'phpdoc_param_order' => true,
+        'phpdoc_single_line_var_spacing' => true,
+        'phpdoc_trim' => true,
+        'phpdoc_trim_consecutive_blank_line_separation' => true,
+    ])
+    ->setFinder(
+        PhpCsFixer\Finder::create()
+            // Same canonical list as the maho repo; only the dirs that exist in
+            // this repo are scanned, so the one config works for app-only modules.
+            ->in(array_values(array_filter([
+                __DIR__ . '/app',
+                __DIR__ . '/lib',
+                __DIR__ . '/public',
+                __DIR__ . '/tests',
+                __DIR__ . '/src',
+            ], 'is_dir')))
+            // Root-level entry points (e.g. the infra tool's sync.php / config.php).
+            // glob skips dotfiles, so these very config files aren't included.
+            ->append(glob(__DIR__ . '/*.php') ?: [])
+            ->name('*.php')
+            ->ignoreDotFiles(true)
+            ->ignoreVCS(true)
+    );

.rector.php

@@ -0,0 +1,78 @@
+<?php
+
+declare(strict_types=1);
+
+use Rector\CodeQuality\Rector as CodeQuality;
+use Rector\CodingStyle\Rector as CodingStyle;
+use Rector\Config\RectorConfig;
+use Rector\DeadCode\Rector as DeadCode;
+use Rector\EarlyReturn\Rector as EarlyReturn;
+use Rector\TypeDeclaration\Rector as TypeDeclaration;
+
+// Shared by every repo that consumes the org baseline. Only standard Rector
+// rules, so it needs no extra dependency: maho's own .rector.php (with the
+// Maho\Rector\* rules and the Varien->Maho migration) stays in maho and is not
+// synced. Only the paths that exist in a given repo are scanned, so the one
+// config works for app-only modules and the infra tool's src/ alike.
+return RectorConfig::configure()
+    ->withPaths(array_values(array_merge(
+        array_filter([
+            __DIR__ . '/app',
+            __DIR__ . '/lib',
+            __DIR__ . '/public',
+            __DIR__ . '/src',
+        ], 'is_dir'),
+        // Root-level entry points (e.g. the infra tool's sync.php / config.php).
+        // glob skips dotfiles, so this very config file isn't included.
+        glob(__DIR__ . '/*.php') ?: [],
+    )))
+    // No argument: Rector reads the target PHP version from composer.json
+    // (require.php's floor, else config.platform.php), which the sync keeps in
+    // step with maho.
+    ->withPhpSets()
+    // The sets above are taken wholesale, unlike maho's own config, which pins
+    // them to an old target and hand-picks the newer rules by name. These three
+    // are what that policy guards against, and they are wrong for a published
+    // package:
+    //
+    //  - AddTypeToConst emits `const string FOO`. That is new syntax, not a
+    //    rewrite, so a repo that declares no require.php floor (such as
+    //    maho-composer-plugin) would ship code its own metadata never promised.
+    //    A composer plugin also runs on the user's PHP, not on the platform the
+    //    project resolved against.
+    //  - ReadOnlyClass / ReadOnlyProperty change the contract, not the code: a
+    //    readonly class cannot be extended by a normal child, and a readonly
+    //    property cannot be written from one. Maho modules exist to be extended.
+    //
+    // Everything else in the sets is a safe rewrite, so keep the derivation.
+    ->withSkip([
+        Rector\Php81\Rector\Property\ReadOnlyPropertyRector::class,
+        Rector\Php82\Rector\Class_\ReadOnlyClassRector::class,
+        Rector\Php83\Rector\ClassConst\AddTypeToConstRector::class,
+    ])
+    ->withRules([
+        CodeQuality\BooleanNot\ReplaceMultipleBooleanNotRector::class,
+        CodeQuality\FuncCall\ChangeArrayPushToArrayAssignRector::class,
+        CodeQuality\FuncCall\CompactToVariablesRector::class,
+        CodeQuality\Identical\SimplifyArraySearchRector::class,
+        CodeQuality\Identical\SimplifyConditionsRector::class,
+        CodeQuality\Identical\StrlenZeroToIdenticalEmptyStringRector::class,
+        CodeQuality\LogicalAnd\LogicalToBooleanRector::class,
+        CodeQuality\NotEqual\CommonNotEqualRector::class,
+        CodeQuality\Ternary\SimplifyTautologyTernaryRector::class,
+        CodeQuality\Ternary\SwitchNegatedTernaryRector::class,
+        CodingStyle\ClassMethod\MakeInheritedMethodVisibilitySameAsParentRector::class,
+        DeadCode\ClassMethod\RemoveUselessParamTagRector::class,
+        DeadCode\ClassMethod\RemoveUselessReturnTagRector::class,
+        DeadCode\MethodCall\RemoveNullArgOnNullDefaultParamRector::class,
+        DeadCode\Property\RemoveUselessVarTagRector::class,
+        EarlyReturn\If_\ChangeNestedIfsToEarlyReturnRector::class,
+        EarlyReturn\If_\RemoveAlwaysElseRector::class,
+        Rector\Php83\Rector\ClassMethod\AddOverrideAttributeToOverriddenMethodsRector::class,
+        TypeDeclaration\StmtsAwareInterface\SafeDeclareStrictTypesRector::class,
+    ])
+    ->withConfiguredRule(Rector\Php82\Rector\Param\AddSensitiveParameterAttributeRector::class, [
+        'sensitive_parameters' => [
+            'token', 'apiKey', 'email', 'useremail', 'username', 'password',
+        ],
+    ]);

composer.json

@@ -16,7 +16,9 @@
         "ext-intl": "*",
         "sokil/php-isocodes": "^4.4",
         "sokil/php-isocodes-db-i18n": "^4.0",
-        "symfony/translation": "^7.4"
+        "symfony/translation": "^7.4",
+        "friendsofphp/php-cs-fixer": "*",
+        "rector/rector": "*"
     },
     "autoload": {
         "psr-4": {