Keep tests and dev tooling out of installed packages

.gitattributes

@@ -93,3 +93,16 @@ Procfile text filter=spabs
 *.md text filter=spabs
 LICENSE text filter=spabs
 AUTHORS text filter=spabs
+
+# Not part of the installed package: Composer's dist downloads and
+# `git archive` leave these out.
+/.github export-ignore
+/tests export-ignore
+/phpstan.neon export-ignore
+/phpunit.xml export-ignore
+/composer.lock export-ignore
+/.gitattributes export-ignore
+/.gitconfig export-ignore
+/.gitignore export-ignore
+/CODE_OF_CONDUCT.md export-ignore
+/CONTRIBUTING.md export-ignore

.github/workflows/ci.yml

@@ -38,6 +38,16 @@ jobs:
       - name: Show extensions
         run: php -m | grep -iE '^(curl|json|iconv)$' || true
 
+      - name: Check package contents
+        # what Composer installs is `git archive`; anything else is export-ignore'd
+        run: |
+          extra=$(git archive HEAD | tar -t | grep -vE '^(LICENSE|README\.md|composer\.json|owa-autoloader\.php|src/.*)$' || true)
+          if [ -n "$extra" ]; then
+            echo "Not export-ignore'd in .gitattributes:"
+            echo "$extra"
+            exit 1
+          fi
+
       - name: Install dependencies
         run: composer install --no-interaction --no-progress --prefer-dist
 

src/sdk.php

@@ -18,7 +18,7 @@
  */
 class sdk {
 
-    const VERSION = '1.1.0';
+    const VERSION = '1.1.1';
 
     private array $config;
 

tests/fixtures/echo-server.php

@@ -3,6 +3,13 @@
 // Router for `php -S`: echoes the request back as JSON so transports can be
 // tested against a real socket.
 
+// Never answer under a real web server: it would echo visitors' cookies back.
+if ( PHP_SAPI !== 'cli-server' ) {
+
+    http_response_code( 404 );
+    return;
+}
+
 if ( ( $_SERVER['REQUEST_URI'] ?? '' ) === '/status/404' ) {
 
     http_response_code( 404 );