feat(moduletools): provide standalone PHP 8.4 library with API 1.1

.coderabbit.yaml

@@ -0,0 +1,65 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+language: "en-US"
+early_access: false
+tone_instructions: >-
+  Expert PHP code reviewer. Focus on type safety, PSR-12, PHP 8.4+
+  compatibility, and security. This is a utility library requiring PHP 8.4+,
+  so modern language features are fine when they aid clarity within range.
+
+reviews:
+  profile: "assertive"
+  # Keep the reviewed set under CodeRabbit's 100-file limit: skip generated
+  # artifacts, stubs, baselines, docs and repo metadata; review src/ and config.
+  path_filters:
+    - "!resources/**"
+    - "!stubs/**"
+    - "!phpstan-baseline.neon"
+    - "!docs/**"
+    - "!tests/**"
+    - "!scripts/**"
+    - "!.github/**"
+    - "!**/*.md"
+    - "!LICENSE"
+    - "!CODEOWNERS"
+    - "!.editorconfig"
+    - "!.gitattributes"
+    - "!.gitignore"
+    - "!.scrutinizer.yml"
+    - "!sonar-project.properties"
+  request_changes_workflow: true
+  high_level_summary: true
+  poem: false
+  review_status: true
+  collapse_walkthrough: false
+  auto_review:
+    enabled: true
+    drafts: false
+  tools:
+    phpcs:
+      enabled: true
+    phpstan:
+      enabled: true
+    gitleaks:
+      enabled: true
+    markdownlint:
+      enabled: true
+    yamllint:
+      enabled: true
+    github-checks:
+      enabled: true
+      timeout_ms: 90000
+  path_instructions:
+    - path: "src/**/*.php"
+      instructions: >-
+        Review for PHP 8.4+ compatibility, type safety, and PSR-12 code style.
+        Modern PHP features are allowed when they improve clarity and remain
+        within the supported version range. Flag any hardcoded 'UTF-8' strings
+        that should use the ENCODING class constant.
+    - path: "tests/**/*.php"
+      instructions: >-
+        Review test code for proper assertions, test isolation, and edge
+        case coverage. Tests must remain compatible with this repository's
+        supported PHPUnit setup.
+
+chat:
+  auto_reply: true

.editorconfig

@@ -0,0 +1,26 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.php]
+indent_style = space
+indent_size = 4
+
+[*.{yml,yaml}]
+indent_style = space
+indent_size = 2
+
+[*.json]
+indent_style = space
+indent_size = 2
+
+[*.xml]
+indent_style = space
+indent_size = 4
+
+[*.md]
+trim_trailing_whitespace = false

.gitattributes

@@ -0,0 +1,39 @@
+# Auto detect text files and perform LF normalization
+* text=auto
+
+# Ensure LF line endings for specific file types
+*.php text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf
+*.json text eol=lf
+*.xml text eol=lf
+*.md text eol=lf
+*.txt text eol=lf
+*.dist text eol=lf
+
+# Export ignores (not included in Composer dist packages)
+/_archive export-ignore
+/tests export-ignore
+/stubs export-ignore
+/docs/internal export-ignore
+.github/ export-ignore
+.gitattributes export-ignore
+.gitignore export-ignore
+.editorconfig export-ignore
+.scrutinizer.yml export-ignore
+phpcs.xml export-ignore
+phpunit.xml.dist export-ignore
+phpstan.neon export-ignore
+phpstan-baseline.neon export-ignore
+qodana.yaml export-ignore
+renovate.json export-ignore
+.coderabbit.yaml export-ignore
+sonar-project.properties export-ignore
+CHANGELOG.md export-ignore
+CLAUDE.md export-ignore
+/scripts export-ignore
+/resources/migration export-ignore
+phpstan-bootstrap.php export-ignore
+rector.php export-ignore
+
+/resources/gate export-ignore

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,38 @@
+name: Bug report
+description: Report a defect or regression in XOOPS ModuleTools.
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: Describe the bug and the expected behavior.
+    validations:
+      required: true
+  - type: input
+    id: php_version
+    attributes:
+      label: PHP version
+      placeholder: "8.4.0 / 8.5.0 / 8.6.0"
+    validations:
+      required: true
+  - type: input
+    id: xoops_version
+    attributes:
+      label: XOOPS version
+      placeholder: "2.7.x / 2.8.x / custom"
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction
+      description: Include a minimal code sample or exact steps.
+      render: php
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Errors or logs
+      description: Paste stack traces, warnings, or screenshots if available.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security report
+    url: https://github.com/XOOPS/moduletools/security/policy
+    about: Report security issues privately through the repository security policy.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,25 @@
+name: Feature request
+description: Propose a new helper, adapter, or integration.
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem to solve
+      description: Describe the gap or developer pain point.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: Describe the API or behavior you want.
+    validations:
+      required: true
+  - type: textarea
+    id: compatibility
+    attributes:
+      label: Compatibility notes
+      description: Note any XOOPS, PHP, or BC concerns.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,14 @@
+## Summary
+
+- Explain what changed.
+- Link any related issue or discussion.
+
+## Validation
+
+- [ ] `composer validate --strict`
+- [ ] `composer test`
+- [ ] `composer analyse`
+
+## Notes
+
+- Mention any compatibility, migration, or follow-up work.

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: composer
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -0,0 +1,42 @@
+name: CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  qa:
+    name: QA (PHP ${{ matrix.php }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ['8.4', '8.5']
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          extensions: mbstring, intl, gd
+          coverage: none
+          tools: composer:v2
+
+      - name: Install dependencies
+        run: composer install --prefer-dist --no-interaction --no-progress
+
+      - name: Validate composer.json
+        run: composer validate --strict
+
+      - name: Quality gate
+        run: composer qa

.github/workflows/code-coverage.yml

@@ -0,0 +1,38 @@
+name: Code Coverage
+
+on:
+  push:
+    branches: [main, master]
+
+permissions:
+  contents: read
+
+jobs:
+  coverage:
+    name: Coverage Report
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.4'
+          extensions: mbstring, intl, zip
+          coverage: xdebug
+
+      - name: Install dependencies
+        run: composer install --prefer-dist --no-interaction --no-progress
+
+      - name: Generate coverage
+        run: vendor/bin/phpunit --coverage-clover=coverage.xml
+
+      - name: Upload to Codecov
+        uses: codecov/codecov-action@v7
+        with:
+          files: coverage.xml
+          fail_ci_if_error: false
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/dependency-review.yml

@@ -0,0 +1,23 @@
+name: Dependency Review
+
+# actions/dependency-review-action needs the repository's Dependency Graph
+# (Settings → Code security → Dependency graph). It is enabled for this
+# repository, so the step is a hard gate: a vulnerable dependency change fails CI.
+
+on:
+  pull_request:
+    branches: [main, master]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Dependency review
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

.gitignore

@@ -0,0 +1,24 @@
+# Dependencies / build artifacts
+/vendor/
+/.build/
+/composer.lock
+coverage.clover
+coverage.xml
+
+# Local config overrides (only .dist files are tracked)
+/phpunit.xml
+/.phpcs.xml
+/.phpunit.result.cache
+/.phpunit.cache/
+
+# Editor / tooling noise
+*.bak
+*~
+\#*
+.idea/
+.claude/
+CLAUDE.md
+/tasks/
+
+# Internal project history (audits, strategy notes) — never published
+/docs/internal/

.scrutinizer.yml

@@ -0,0 +1,20 @@
+build:
+  environment:
+    php: 8.4
+  nodes:
+    analysis:
+      tests:
+        override:
+          - php-scrutinizer-run
+
+filter:
+  excluded_paths:
+    - '_archive/*'
+    - 'tests/*'
+    - 'vendor/*'
+    - 'docs/*'
+  dependency_paths:
+    - 'stubs/'
+
+tools:
+  php_analyzer: true