ci: run mutation tests with Infection

[roxblnfk]

What was changed

• New Mutation Tests workflow: Infection on the Testo Unit suite, PHP 8.4 + Xdebug, on PRs and pushes to 4.x, with --min-msi=90 --min-covered-msi=90. Pushes to 4.x upload the report to the Stryker dashboard; the README gets its badge.
• Local run: 161 mutants, MSI 90%, mutation code coverage 100% (15 escaped, 2 timeouts). Escaped mutants are mostly json_decode() depth ±1, string/array casts and the small-body shortcut in PSR7Worker::streamToGenerator().
• Needs the STRYKER_DASHBOARD_API_KEY secret (repo or org) for the dashboard upload.

Review notes

• Infection runs only the Unit suite (testFrameworkOptions): Feature tests start a server on the fixed port 6002, so parallel mutant runs collide on it, and a timed-out mutant run leaves the server alive and fails every later run, which shows up as falsely killed mutants.
• Infection is installed with composer require in the workflow, not from the phar: the Testo adapter bundled in the 0.35.6 phar writes a bootstrap calling the unscoped \Infection\StreamWrapper\IncludeInterceptor, while the phar only contains the scoped class, so every mutant ends as an error. It is not in require-dev because Infection ≥ 0.33 needs PHP 8.3+, and the package supports 8.2.

Checklist

• Tested
  • Infection run locally on PHP 8.4

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 15 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: da002379-8c64-4339-9169-dc7a0f91f2c8

---

📥 Commits

Reviewing files that changed from the base of the PR and between f88a365 and b17bb42.

---

📒 Files selected for processing (3)

• .github/workflows/mutation.yml
• README.md
• infection.json5

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}