ci: migrate to the awcodes/.github shared workflows

[awcodes]

Moves this package onto the shared reusable CI workflows in awcodes/.github, replacing the hand-rolled tests.yml and lint.yml with a single caller of filament-plugin.yml@v1 scoped to 3.x.

The blocker: Laravel 13 could never have worked

The old tests.yml listed laravel: [13.*, 12.*] with testbench: 11.* for the 13 rows, but composer.json capped orchestra/testbench at ^9.0|^10.0. Those rows could not install — testbench 11 was simply unreachable. Widening the constraint to ^9.0|^10.0|^11.0 fixes it. This is require-dev only: nothing in the published require block changes, and "php": "^8.2" stays.

All seven matrix rows were resolved locally before being committed. The two Laravel 13 rows now resolve laravel/framework v13.31.0 + orchestra/testbench v11.2.0 + filament/filament v5.8.1, and the full suite passes against exactly that set: 175 tests, 297 assertions.

Tooling

• phpstan.neon.dist — adds reportUnmatchedIgnoredErrors: false and analyses config/ and workbench/ alongside src/. workbench/storage is excluded with the optional (?) marker because it is gitignored but fills with compiled Blade the moment the workbench app runs. There is no root database/, so that path stays out.
• The larastan extension.neon include is deliberately absent. phpstan/extension-installer is in require-dev and registers larastan already; an explicit include double-registers it and phpstan aborts with "This file is included multiple times" before analysing anything.
• phpstan-baseline.neon — was a committed 0-byte file. Regenerating over the wider paths, a year after it was last generated, gives 13 entries covering 16 errors: twelve are the larastan view-string family, plus two MasonRenderer array-shape mismatches, one always-true condition, a deprecated VerifyCsrfToken constant in the workbench panel provider, and the two workbench factories' definition() return types under checkModelProperties.
• rector.php — adds workbench/ (29 hand-written PHP files) and skips workbench/storage. This repo's copy keeps its imported-exception form rather than the template's fully-qualified catch, which is what makes it pint-clean.
• pint.json already matched the canonical template byte for byte, so it is untouched and no reformat sweep was needed.
• composer.json — adds the canonical test:types script, wired into test.

Rector produced three real code changes, not formatting: two arrow-function return types and one closure void return type. One of them needed a hand fix — rector emits the view() union as two fully-qualified names, and pint's fully_qualified_strict_types then strips the leading backslash from only the first member, leaving a half-qualified Factory | \Illuminate\Contracts\View\View that both tools report as clean. Both classes are imported explicitly instead.

Assets

resources/dist/mason.js and mason-entry.js are committed and shipped, so this repo carries the assets job: it rebuilds with esbuild and fails if the tree moves. Verified locally — a clean npm ci && npm run build reproduces both bundles byte for byte, so the committed dist is current.

run-build stays false. The suite reads the committed bundles' registration in MasonServiceProvider, not their contents, and passes with no build step; freshness is the assets job's concern.

workbench/** is added to the path filters — a deliberate addition to the template, since rector and phpstan now analyse workbench/ and a workbench-only commit has to be able to turn CI red.

Not in scope

The branch-protection ruleset and "Allow auto-merge" are not set up here; dependabot-auto-merge.yml is inert-by-design until the required ci / All Checks check exists, and its header says so.

🤖 Generated with Claude Code

https://claude.ai/code/session_017QxdNSNdqXRproytP5odgW