[Matildevoldsen]

The SDK has no public CI, and its existing regression tests depend on the private NativeWatch server checkout. This adds an Orchestra Testbench harness so contributors and GitHub can run the package's existing tests with no production credentials.

CI validates Composer, audits dependencies, runs Pint, PHPStan level 7 and 100% PHP type coverage, and executes Pest across PHP 8.4/8.5 with Laravel 12/13. Actions use pinned commit hashes, read-only permissions and no persisted checkout credentials. Dependabot, a PR template and contribution instructions document the workflow.

Evidence: local composer test passed 40 tests and 115 assertions; composer validate --strict, composer audit and git diff --check passed. Details and initial failure evidence are in docs/review/sdk-ci.md. Actionlint also passed. GitHub matrix results will be verified before merging and enabling the required-check rules.

This tests PHP integration. Swift/Kotlin builds and real native crash/relaunch verification remain separate release checks.

Laravel 11 installation was rejected by Composer due to known security advisories. Required CI uses Laravel 12/13; advisory blocking stays enabled and no advisory ignores were introduced. The package's existing runtime compatibility constraints remain unchanged, but this CI does not verify Laravel 11.

[Matildevoldsen]

Merged and verified. Main CI passed all five jobs: Quality and PHP 8.4/8.5 × Laravel 12/13. Local regression results and initial failures are recorded in docs/review/sdk-ci.md.

Main protection is active: one approval, stale-approval dismissal, latest-push approval, resolved conversations, five required checks bound to GitHub Actions, up-to-date branches, linear history and no force push/deletion. No bypass actors. Squash-only merging, auto-merge, Update branch and deletion of merged branches are enabled. Published tags cannot be rewritten or deleted.

Enforcement proof: I temporarily included a disposable branch in this same ruleset and attempted an empty direct push with the administrator account. GitHub rejected it with GH013: “Changes must be made through a pull request” and “5 of 5 required status checks are expected”. Main was unchanged during this test; the probe branch and temporary selector were removed.

Actions use read-only tokens, cannot approve PRs, require SHA pinning and allow only GitHub-owned Actions plus shivammathur/setup-php. All external fork contributors require workflow approval. The bootstrap merged before these rules were activated; subsequent changes require another maintainer's approval. Laravel 11 remains outside required CI because Composer blocks its known advisories; no security checks were disabled.