fix: restore the advertised PHP 7.4 runtime floor

[somethingwithproof]

Fixes #66.

What changed

• restore PHP 7.4-compatible signatures in every affected runtime file;
• retain precise generic types in PHPDoc while removing PHP 8-only native mixed and union declarations;
• replace the misleading PHP 8.1 syntax test with a compatibility-contract test;
• add an independent PHP 7.4 runtime lint job;
• document the supported Cacti and PHP floor in the README.

Root cause

INFO advertises Cacti 1.2.20 compatibility, but recent hardening introduced native mixed and int|false signatures. PHP 7.4 rejects the union outright and interprets many mixed parameter declarations as a class type, which would turn ordinary scalar and resource arguments into runtime TypeErrors.

The first report named audit_syslog.php, but the same contract violation existed in audit_functions.php and setup.php. All three are corrected here so the compatibility claim is real rather than parser-only.

Validation

• Linux php:7.4-cli: every production PHP file passes php -l.
• Linux php:8.1-cli: security helper, controller security, Syslog queue, and Syslog transport suites all pass.
• Linux actionlint: the updated workflow parses cleanly.
• git diff --check.

Review follow-up

• preserve Cacti empty-row semantics with canonical cacti_sizeof() guards;
• fail closed if CLI credential redaction encounters a PCRE error;
• refuse external delivery and Syslog enqueue when the source audit row is empty or incomplete;
• use the pinned MariaDB 10.11 integration service required by Cacti transaction-state checks.

Additional Linux Docker validation: PHPStan reports no errors, PHP-CS-Fixer reports all 15 plugin files clean, the Pest security suite passes 10 tests / 58 assertions, and explicit empty-row and redaction-failure regressions pass.

[Copilot]

Pull request overview

This pull request restores the plugin’s advertised runtime compatibility floor (Cacti 1.2.20 / PHP 7.4) by removing PHP 8-only native types from runtime code, tightening “fail closed” behavior when PCRE operations fail, and adding CI/tests that enforce the PHP 7.4 contract going forward.

Changes:

• Reworked runtime signatures to stay PHP 7.4-compatible while preserving rich PHPDoc generics/types.
• Added/updated security + compatibility tests (replacing the PHP 8.1 syntax-only check with a PHP 7.4 runtime contract test).
• Updated CI to lint runtime PHP on 7.4 and aligned the integration DB service with Cacti’s required MariaDB version.

Reviewed changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/syslog_queue_test.php	Extends queue coverage for empty/missing rows and failed delivery fetch behavior.
tests/syslog_functions_test.php	Adds regression coverage for Syslog header/PCRE-failure sanitization behavior.
tests/Security/SetupStructureTest.php	Loads setup.php under test bootstrap and adds “fail closed” realm/info tests.
tests/Security/PreparedStatementConsistencyTest.php	Locks audit purge logic to prepared-statement helpers.
tests/Security/Php81SyntaxTest.php	Removes the PHP 8.1+ syntax convention test that conflicted with the advertised floor.
tests/Security/Php74CompatibilityTest.php	Adds a contract test ensuring runtime files avoid PHP 8-only syntax and keep INFO compat explicit.
tests/security_functions_test.php	Expands fail-closed redaction and empty-row guards for external delivery/retry.
tests/index.php	Adds a redirect index to avoid direct browsing of the tests directory.
tests/controller_security_test.php	Asserts controller returns early on missing events before recording view events.
tests/bootstrap.php	Enhances Cacti function stubs for isolation and controllable DB/config behavior.
setup.php	Uses cacti_sizeof() guards for empty/failed realm fetches; suppresses INFO parse warnings for safe failure.
README.md	Documents Cacti/PHP support floor and the CI guardrail for PHP 7.4 syntax compatibility.
phpstan/stubs/index.php	Adds a redirect index to avoid direct browsing of the stubs directory.
phpstan/stubs/cacti.stub	Fixes stub implementation detail to satisfy analysis expectations.
phpstan/index.php	Adds a redirect index to avoid direct browsing of the phpstan directory.
CHANGELOG.md	Notes the PHP 7.4 floor restoration and fail-closed redaction work for issue #66.
audit.php	Adds empty-row guards, improves typing annotations, and moves purge queries to prepared helpers.
audit_syslog.php	Removes PHP 8-only native types, hardens validation to treat PCRE errors as invalid, and adds enqueue/queue guards.
audit_functions.php	Removes PHP 8-only native types, introduces safe “append objects” helper, and makes redaction fail closed on PCRE errors.
.phpstan.neon	Updates the scanned stub file path to the new stub filename.
.github/workflows/plugin-ci-workflow.yml	Switches the integration DB service image to pinned MariaDB 10.11.18.
.github/workflows/code-quality.yml	Adds a dedicated PHP 7.4 runtime lint job to prevent floor regressions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.