feat(NO-TASK): Share the branch-scoped coding-standards check

[aaronware]

linchpin/actions' php-checks.yml runs composer check-branch-cs, so every repo calling that shared workflow must provide it. Each one has been carrying its own copy:

Repo	Class	Lines
mantle	Mantle\Dev\Composer\Actions	88
block-alchemy	Block_Alchemy\Dev\Composer\Actions	73
discovery	about to add a third	—

The two that exist have already drifted from each other. All three — plus linchpin-blocks — already have linchpin/coding-standards in require-dev, so this is the obvious shared home. One copy, one place to fix a bug in.

The one behavioural change

Scoped to changed lines rather than changed files.

Sniffing each changed file whole is fine on a clean tree and wrong on any other: editing one line of a file carrying inherited findings reports all of them against the PR that touched it. The check then fails for reasons its author did not cause and cannot fix in passing — and a gate like that gets switched off rather than fixed.

Concretely, on linchpin/discovery: normalising array() → [] across twelve legacy files reported 397 findings, of which 5 were on a line the change had touched. It blocked its own formatting commit.

The trade: a finding on an untouched line goes unreported until somebody edits that line. That's the intent — debt gets paid down by the changes passing through it.

Also new

check_staged_cs — the same filtering against a pre-commit diff, so a husky hook catches a violation where it's cheapest to fix. It diffs the working tree against HEAD rather than the index, because lint-staged stashes unstaged work before running tasks and re-stages their modifications only after every task finishes; reading --cached reports the errors an autofixer task fixed a moment earlier.

run() is public and takes plain arguments, so it can be exercised without constructing a Composer event.

Written to this package's PHP 8.0 floor rather than the callers' 8.4.

Adopting it

Per repo, delete dev/Composer/Actions.php, drop the autoload-dev entry, and point the script at the shared class:

"check-branch-cs": "Linchpin\\Composer\\Actions::check_branch_cs",
"check-staged-cs": "Linchpin\\Composer\\Actions::check_staged_cs"

linchpin/discovery is ready to do that as soon as this releases.

Two pre-existing observations, neither caused by this branch

Both reproduce on main without these changes. CI is green either way, so neither blocks this:

1. composer validate --no-check-all --strict fails locally (Composer 2.10.2) with php-parallel-lint/php-parallel-lint and php-console-highlighter required but absent from composer.lock. The same command passes in CI, so this looks like a Composer version difference rather than a broken lockfile — worth a look, since a local composer validate is what developers run before pushing.
2. composer test errors with 2 failures in tests/FixtureTests.php (a PHPCS Ruleset error), on main as well.

🤖 Generated with Claude Code