Manage box, composer, and phpDocumentor via mise

[oschwald]

Summary

The release script previously downloaded box.phar 4.6.10 and phpDocumentor.phar 3.8.1 with wget, verifying hardcoded sha256 hashes, and used a local composer.phar kept current via self-update. This installs all three via mise's github: backend instead, upgrading to box 4.7.0 and phpDocumentor 3.10.0.

Integrity pinning moves to mise.lock, which records per-platform checksums, and mise additionally verifies SLSA provenance (box, phpDocumentor) or GitHub artifact attestations (composer) at install time. Future upgrades are mise upgrade instead of editing URLs and hashes in the script.

Same change as maxmind/minfraud-api-php (on its greg/stf-1074 release branch) and maxmind/MaxMind-DB-Reader-php.

Testing

box 4.7.0 compiles a working geoip2.phar (dev-bin/phar-test.php passes) and phpDocumentor 3.10.0 generates the API docs from src/. bash -n on the release script passes.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated release tooling to use externally managed PHAR utilities for packaging, dependency updates, and documentation generation.
  • Added pinned tool entries for Box, Composer, and phpDocumentor.
  • Simplified release checks and removed redundant download and verification steps.
  • Updated ignore rules so PHAR artifacts are no longer excluded.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 78eca067-2c28-4fcf-8daf-4edb3c1e5ead

📥 Commits

Reviewing files that changed from the base of the PR and between 0d5ec79 and 2a95d3d.

⛔ Files ignored due to path filters (1)

• mise.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• .gitignore
• dev-bin/release.sh
• mise.toml

💤 Files with no reviewable changes (1)

• .gitignore

---

📝 Walkthrough

Walkthrough

The release workflow now uses Box, Composer, and phpDocumentor phars managed by mise, with direct invocations replacing download, hash verification, and PHP-wrapper commands.

Changes

Release tooling

Layer / File(s)	Summary
Tool provisioning and pre-flight checks mise.toml, .gitignore, dev-bin/release.sh	mise adds latest Box, Composer, and phpDocumentor tools; release checks validate their phars, while PHAR ignore entries are removed.
Phar-based release execution dev-bin/release.sh	Build, dependency update, and documentation steps invoke the managed phars directly and remove download and checksum verification flows.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Poem

I’m a rabbit with tools in a row,
Box and Composer now ready to go.
No downloads to chase,
No hashes to trace,
Just phars through the release flow!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: managing Box, Composer, and phpDocumentor through mise.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch greg/stf-1074

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}