chore: QA tooling ratchet — PHPStan max + strict rules, Rector Laravel sets, CI gate

[dan2k3k4]

Inspired by https://joeymckenzie.tech/blog/artisanally-laravibing.

PHPStan (config only, no runtime risk)

• Level 6 → max, plus phpstan/phpstan-strict-rules and tomasvotruba/type-coverage
• Baseline regenerated: 4248 pre-existing findings frozen; new code must be max+strict clean
• Type-coverage ratchet floors set at measured values (return 98 / param 82 / property 97)
• parseModelCastsMethod: true so larastan reads the Laravel 11+ style casts() method

Rector (one commit per set, full suite green after each)

• UP_TO_PHP_83 → UP_TO_PHP_84, then deadCode, codeQuality, earlyReturn, typeDeclarations, UP_TO_LARAVEL_130_WITHOUT_ATTRIBUTES
• Skipped privatization/codingStyle (Laravel magic / fights Pint) and MigrateToSimplifiedAttributeRector (drops the accessor return types larastan uses to type magic properties)
• Hand-fixes where rector's inference was wrong, each with a rector skip so CI dry-run stays clean — notably the queue.failer singleton closure that rector typed array but receives the Application instance

CI

• New rector --dry-run step in tests.yml (same ratchet philosophy as Pint/PHPStan)
• Dropped squizlabs/php_codesniffer + phpcs.xml.dist (not in CI, superseded by Pint)

Deliberately skipped from the article

Deptrac (layering lives in separate composer packages), Infection (52% coverage base → mutant noise), bleedingEdge.neon (per-release churn).

Verification: 575 tests / 2364 assertions green after every set; phpstan, pint --test, rector --dry-run all clean at HEAD.

Greptile Summary

This PR raises the repository’s static-analysis and automated-refactoring standards while applying the corresponding Laravel 13 and PHP 8.4 transformations throughout the application.

• Raises PHPStan to maximum strictness and adds type-coverage ratchets.
• Adds Laravel-aware Rector sets and enforces a Rector dry run in CI.
• Migrates framework conventions such as model casts() methods and consolidated queue traits.
• Removes the superseded PHP_CodeSniffer dependency and applies behavior-preserving type and control-flow cleanup.

Confidence Score: 5/5

The PR appears safe to merge because no concrete changed-code failure remained after reviewing the framework migrations and behavior-affecting rewrites.

The tooling dependencies, Laravel 13 transformations, queue-trait consolidation, model-cast migrations, and reviewed control-flow rewrites are coordinated, with no accepted runtime, build, authorization, persistence, or security defect.

Important Files Changed

Filename	Overview
rector.php	Enables PHP 8.4, code-quality, type-declaration, early-return, and Laravel 13 transformation sets with targeted skips.
phpstan.neon	Raises analysis to maximum strictness, enables Laravel model-cast parsing, and adds measured type-coverage floors.
composer.json	Adds the Rector Laravel, PHPStan strict-rules, and type-coverage development dependencies while removing PHP_CodeSniffer.
.github/workflows/tests.yml	Adds Rector dry-run compliance to the existing CI quality gate.
app/Jobs/ProcessPolydockStoreWebhookCall.php	Migrates the queued job to Laravel’s consolidated Queueable trait without changing its delivery and retry flow.
app/Models/PolydockAppInstance.php	Migrates casts to the Laravel method convention and applies typed, behavior-preserving control-flow simplifications.
config/sanctum.php	Updates the CSRF middleware symbol to the Laravel 13 convention.
app/Polydock/Clients/Lagoon/ClientTraits/ProjectTrait.php	Applies stricter declarations and automated control-flow cleanup to Lagoon GraphQL project operations without an established contract change.

_{Reviews (1): Last reviewed commit: "chore: import queueable trait and skip g..." | Re-trigger Greptile}

Context used (5)

• Knowledge Base — App Instance Job Pipeline
• Knowledge Base — Models and Persistence
• Knowledge Base — External Clients: Lagoon and AmazeeAI
• Knowledge Base — Hosted External Forms
• Knowledge Base — Auth, Permissions, and Shared Support Utilities

[dan2k3k4]

@greptile-apps