[imanimanyara]

Why: a repository that cannot depend on package-tools carries a local port of the credential scanner, and nothing compared the port with the original. On 2026-10-20, notifications' copy was still on the pre-0.1.10 rules, with no purpose check and none of the false-positive exclusions, while three other copies were current. Nothing had failed.

What this adds:

• CredentialLiterals::RULES_VERSION (0.1.10): the release in which the rules last changed.
• CredentialLiteralsRulesVersionTest: it pins a fingerprint of the scanner's source, so a rule cannot change without the version moving.
• scripts/verify-credential-guard-copies.py: it reuses verify-trait-copies.py's transport and sources, and checks every repository's NoLiteralCredentialsTest.php.
  • A file that imports AssertsNoLiteralCredentials is the shared guard and needs nothing.
  • Anything else is a copy. It must declare @credential-guard-copy reason=<slug> mirrors=<version>.
  • The reason (php-floor-below-package-tools or outside-laranail) must still hold against that repository's composer.json.
  • mirrors must equal RULES_VERSION.
  • A run that inspects nothing fails.
• Hygiene: a new step runs the script on schedule over laranail and simtabi.
• Docs: a "Local copies" section in docs/tools/test-credentials.md.
• CHANGELOG: an entry under [Unreleased].

Already landed: the four copies' declarations, and notifications' port to 0.1.10:

• Declare the local credential guard as a copy enumerator#42
• Port the local credential guard to the 0.1.10 rules notifications#29
• simtabi/sis-sdk#25
• Declare the local credential guard as a copy simtabi/lacommerce#12

Verification:

• Live run: over both orgs it inspected 131 repositories (65 shared guards, 4 copies) and passed all four.
• Before the declarations: the same script over the local trees flagged all four as undeclared.
• Script test (VerifyCredentialGuardCopiesScriptTest):
  • passes a shared guard and current, justified copies;
  • fails an undeclared copy, a stale copy and two expired reasons;
  • fails a run that inspected nothing.
• Fingerprint test: it fails when one rule character changes.
• Full pest: 1707 passed, 3 skipped. laranail-pint --test, PHPStan and Rector all pass.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.