ci: run every suite on PRs and main

[Newtdev]

There was no CI. Four test suites existed (referral-web, referral-mobile, referral-sdk-node, referral-sdk) and nothing ran them, so PRs merged on manual verification alone — including #16, which shipped with zero status checks.

Jobs

job	what it runs
javascript	test → typecheck → build, per package, on Node 18.14 and 24
php	zero-dependency scoring suite, then PHPUnit, on PHP 8.1 and 8.4
timezones	scoring suite under non-UTC PHP timezones, guarding #29
ci	aggregation gate — one stable check name for branch protection

Hardening

• permissions: contents: read — both npm ci and composer install run dependency lifecycle scripts, so a compromised transitive package must not get a token that can write to the repo
• persist-credentials: false — actions/checkout otherwise leaves the token in .git/config where any build script can read it
• shivammathur/setup-php pinned to commit f3e473d (v2.37.2) rather than the mutable v2 tag. actions/* are GitHub-owned, where tag pinning is accepted practice

Notes on a few choices

Version floors are intentionally EOL. Node 18.14 and PHP 8.1 are what engines and composer.json promise, so they stay tested; a declared floor doesn't make anyone secure or insecure, and dropping it wouldn't patch a user's runtime, only stop them installing. Each matrix also tests a current version, which is what actually catches breaks.

Concurrency cancels PR runs only. Cancelling on main would leave default-branch commits with no completed CI result, which breaks bisecting after a fast series of merges.

Composer cache keys on composer.json, not composer.lock — this is a library and deliberately ships no lockfile, so hashing the lock would resolve empty and the key would never invalidate.

The timezone job is one job, not a matrix. The suite is ~0.05s of work, so four runner VMs cost far more than they return. The loop runs every zone and reports all of them rather than aborting on the first failure — the pattern of which zones fail is what identifies an offset bug. It uses -d date.timezone, not TZ: PHP's date functions read the INI setting and ignore the environment variable (verified — TZ alone leaves date_default_timezone_get() at UTC and strtotime() unchanged). Offsets include 45-minute ones.

Verification

Every job simulated locally against post-#18 main: all three packages green on test/typecheck/build, and the scoring suite 14/14 under Africa/Lagos, America/New_York, Asia/Kolkata and Pacific/Chatham. Rebased onto main after #18 so the first run should be green rather than red-on-arrival.

Follow-up worth considering once this lands: require the ci check in branch protection.