From 9c51942ce4bd64c8330122b13c8b6d4ed3f957e1 Mon Sep 17 00:00:00 2001
From: Imani Manyara <imanimanyara@users.noreply.github.com>
Date: Wed, 16 Sep 2026 08:31:54 -0400
Subject: [PATCH] Resolve dependencies from the manifest, and cache them

CI pinned versions into composer.json before running the suite. `composer
require --no-update` EDITS the file -- verified: `^13.0` becomes `13.*` -- so
every run tested a manifest the package does not ship. Nothing broke, because
the forced constraint happened to agree with the declared one; it would have
broken silently the first time either changed, and widening a package to
`^13.0 || ^14.0` would never have been tested at all.

The matrix keys feeding those pins are gone with them. Several were already
inert: `testbench` and `carbon` were declared in the matrix and referenced by
no step, so they pinned nothing and always resolved from composer.json.

Also here, all measured rather than assumed:

- A composer cache. Most workflows re-downloaded every dependency on every
  run, which is the largest avoidable draw on the Actions budget.
- The cache drops laranail/* archives before installing. Those resolve through
  a single MOVING v0.1.0 tag, so composer's dist cache is keyed on a name whose
  contents change underneath it -- without the eviction a restored archive is
  silently stale, which is the failure this org has already hit once.
- fail-fast off where it was on. "8.5 fails too" and "only 8.5 fails" are
  different bugs, and fail-fast hides which one a run found.
- No coverage driver where nothing consumed the report. pcov instruments every
  file on every run; generating a report nobody reads is time billed for
  nothing. Untouched wherever an upload or a --min gate uses it.
- paths-ignore '*.md' -> '**.md'. The root-only glob never matched docs/**, so
  documentation-only changes ran the full suite.