Merge pull request 'fix(release): repack zip root-level for the Composer registry' (!14) from fix/release-registry-zip into main

Reviewed-on: #14

.config/shopware-extension.yml

@@ -14,6 +14,8 @@ build:
           - AGENTS.md
           - CLAUDE.md
           - QWEN.md
+          - .config
+          - .gitea
           - .claude
           - .scratch
           - .wayfinder

.gitea/workflows/plugin-checks.yml

@@ -22,26 +22,24 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
 
-      - name: Check version bump and changelog entry
+      # The version must be higher than the latest *published release* (not just higher than main), so main can
+      # carry a version whose release failed or was withdrawn without blocking the next PR.
+      - name: Check version is unreleased and changelog entry exists
+        env:
+          TOKEN: ${{ secrets.RELEASE_TOKEN }}
         run: |
           set -e
           PR_VERSION=$(grep -m1 '"version"' composer.json | sed -E 's/.*"version"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/')
-          MAIN_VERSION=$(git show origin/main:composer.json | grep -m1 '"version"' | sed -E 's/.*"version"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/')
+          LATEST=$(curl -sf -H "Authorization: token ${TOKEN}" "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/releases?limit=100" \
+            | jq -r '.[].tag_name' | sed 's/^v//' | sort -V | tail -n1)
+          LATEST="${LATEST:-0.0.0}"
 
-          echo "main version: $MAIN_VERSION"
+          echo "latest release: $LATEST"
           echo "PR version:     $PR_VERSION"
 
-          if [ "$MAIN_VERSION" = "$PR_VERSION" ]; then
-            echo "::error::composer.json version ($PR_VERSION) was not bumped from main ($MAIN_VERSION)"
-            exit 1
-          fi
-
-          HIGHEST=$(printf '%s\n%s\n' "$MAIN_VERSION" "$PR_VERSION" | sort -V | tail -n1)
-          if [ "$HIGHEST" != "$PR_VERSION" ]; then
-            echo "::error::composer.json version ($PR_VERSION) is not greater than main's ($MAIN_VERSION)"
+          if [ "$PR_VERSION" = "$LATEST" ] || [ "$(printf '%s\n%s\n' "$LATEST" "$PR_VERSION" | sort -V | tail -n1)" != "$PR_VERSION" ]; then
+            echo "::error::composer.json version ($PR_VERSION) is not greater than the latest release ($LATEST)"
             exit 1
           fi
 
@@ -50,7 +48,7 @@ jobs:
             exit 1
           fi
 
-          echo "OK: version bumped to $PR_VERSION and documented in CHANGELOG.md"
+          echo "OK: $PR_VERSION is unreleased and documented in CHANGELOG.md"
 
   # Packages the extension (builds admin/storefront assets) and validates the resulting zip,
   # which is the artifact that ships. A separate directory validate would only repeat these checks.
@@ -98,28 +96,41 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: plugin-src
-      - name: Month stamp (refreshes the cached project monthly)
-        id: stamp
-        run: echo "month=$(date +%Y-%m)" >> "$GITHUB_OUTPUT"
-      # The project (incl. vendor/ and phpunit) does not depend on the plugin, so it is cached on its own.
-      - name: Restore prepared Shopware project
-        id: project
-        uses: actions/cache/restore@v4
-        with:
-          path: shopware
-          key: shopware-6.6-prepared-${{ steps.stamp.outputs.month }}
-      - name: Create Shopware 6.6 project
-        if: steps.project.outputs.cache-hit != 'true'
+      # The cache key follows the Shopware version: a new release inside the plugin's supported range changes
+      # the key, so the old project + database are never reused. Bump -v1 to force a refresh by hand.
+      - name: Resolve the latest Shopware Version
+        id: sw
         run: |
           set -e
-          composer create-project shopware/production:6.6.* shopware --no-interaction --no-scripts
-          composer require --dev phpunit/phpunit:^10 --no-interaction --no-scripts -d shopware
-      - name: Save prepared Shopware project
-        if: steps.project.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v4
+          # The plugin's own constraint (require.shopware/core, e.g. ~6.6.0) decides which versions are acceptable;
+          # Composer lists the matching ones newest first, the first stable one is the latest.
+          CONSTRAINT=$(php -r 'echo json_decode(file_get_contents("plugin-src/composer.json"), true)["require"]["shopware/core"];')
+          VERSION=$(composer show shopware/core "$CONSTRAINT" --all --format=json --no-interaction 2>/dev/null \
+            | php -r '$d = json_decode(stream_get_contents(STDIN), true); foreach ($d["versions"] as $v) { if (preg_match("/^v?\d+(\.\d+)+$/", $v)) { echo ltrim($v, "v"); exit; } }')
+          test -n "$VERSION" || { echo "::error::could not resolve a Shopware version for ${CONSTRAINT}"; exit 1; }
+          echo "Shopware ${VERSION} (constraint ${CONSTRAINT})"
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+      # Project (vendor/, phpunit, config) and the installed database as a SQL dump. Neither depends on the plugin.
+      - name: Restore Shopware project and database
+        id: shopware
+        uses: actions/cache/restore@v4
         with:
-          path: shopware
-          key: shopware-6.6-prepared-${{ steps.stamp.outputs.month }}
+          path: |
+            shopware
+            !shopware/var/cache
+            !shopware/var/log
+            shopware-db.sql.gz
+          key: shopware-${{ steps.sw.outputs.version }}-installed-v1
+      - name: Create Shopware project
+        if: steps.shopware.outputs.cache-hit != 'true'
+        run: |
+          set -e
+          composer create-project "shopware/production:${{ steps.sw.outputs.version }}" shopware --no-interaction --no-scripts
+          composer require --dev phpunit/phpunit:^10 --no-interaction --no-scripts -d shopware
+      - name: Ensure the MariaDB client
+        run: |
+          command -v mariadb-dump >/dev/null || command -v mysqldump >/dev/null && exit 0
+          (apt-get update -q && apt-get install -y -q --no-install-recommends mariadb-client) || apk add --no-cache mariadb-client
       - name: Wait for the database
         run: |
           for i in $(seq 60); do
@@ -127,9 +138,39 @@ jobs:
             sleep 2
           done
           echo "::error::database service did not come up"; exit 1
-      - name: Relax database durability (throwaway CI database, speeds up the migrations)
+      - name: Relax database durability (throwaway CI database, speeds up the install and the restore)
         run: |
           php -r '$p = new PDO("mysql:host=database;port=3306", "root", "root"); $p->exec("SET GLOBAL innodb_flush_log_at_trx_commit=0"); $p->exec("SET GLOBAL sync_binlog=0");'
+      # One install into shopware_test; the bootstrapper then sees an installed DB, skips its own install and
+      # only activates the plugin (tests/TestBootstrap.php forces plugin installation).
+      - name: Install Shopware
+        if: steps.shopware.outputs.cache-hit != 'true'
+        working-directory: shopware
+        run: bin/console system:install --basic-setup --create-database --force --no-interaction
+      - name: Dump the installed database
+        if: steps.shopware.outputs.cache-hit != 'true'
+        run: |
+          set -e
+          DUMP=$(command -v mariadb-dump || command -v mysqldump)
+          "$DUMP" -h database -P 3306 -u root -proot --skip-ssl --single-transaction --routines --triggers \
+            --databases shopware_test | gzip > shopware-db.sql.gz
+          ls -l shopware-db.sql.gz
+      - name: Save Shopware project and database
+        if: steps.shopware.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v4
+        with:
+          path: |
+            shopware
+            !shopware/var/cache
+            !shopware/var/log
+            shopware-db.sql.gz
+          key: shopware-${{ steps.sw.outputs.version }}-installed-v1
+      - name: Restore the database from the cache
+        if: steps.shopware.outputs.cache-hit == 'true'
+        run: |
+          set -e
+          CLIENT=$(command -v mariadb || command -v mysql)
+          gunzip -c shopware-db.sql.gz | "$CLIENT" -h database -P 3306 -u root -proot --skip-ssl
       - name: Resolve plugin name and install the plugin sources
         run: |
           # plugin directory name = short class name of extra.shopware-plugin-class
@@ -138,11 +179,6 @@ jobs:
           echo "PLUGIN_NAME=${PLUGIN_NAME}" >> "$GITHUB_ENV"
           rm -rf "shopware/custom/plugins/${PLUGIN_NAME}"
           cp -r plugin-src "shopware/custom/plugins/${PLUGIN_NAME}"
-      # One install into shopware_test; the bootstrapper sees an installed DB, skips its own install and
-      # only activates the plugin (tests/TestBootstrap.php forces plugin installation).
-      - name: Install Shopware (once)
-        working-directory: shopware
-        run: bin/console system:install --basic-setup --create-database --force --no-interaction
       - name: Run phpunit
         working-directory: shopware
         run: vendor/bin/phpunit -c "custom/plugins/${PLUGIN_NAME}/phpunit.xml"

.gitea/workflows/release.yml

@@ -126,7 +126,8 @@ jobs:
           fi
           test -f "$ROOT/composer.json" || { echo "::error::no composer.json found in the packaged zip"; exit 1; }
           OUT="$PWD/.build/composer-${{ steps.meta.outputs.zip }}"
-          (cd "$ROOT" && zip -qr "$OUT" .)
+          # explicit file list with the leading "./" stripped, so entries are stored as "composer.json", "src/..."
+          (cd "$ROOT" && find . -mindepth 1 | sed 's|^\./||' | zip -q "$OUT" -@)
           unzip -l "$OUT" | grep -E ' composer\.json$' > /dev/null || { echo "::error::repacked zip has no root-level composer.json"; exit 1; }
           echo "repacked: $OUT"
 

CHANGELOG.md

@@ -7,26 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [0.1.1] - 2026-10-04
-
-### Fixed
-
-- Release pipeline: the Composer registry rejected the packaged zip (`composer.json file is missing`) because `shopware-cli` zips wrap everything in a top-level folder. The same prebuilt content is now repacked root-level for the registry upload.
-- Release steps are idempotent (existing release and asset are reused, registry 409 counts as published) and the "tag exists -> skip" guard is gone, so a failed release can be re-run to completion.
-
-## [0.1.0] - 2026-10-03
+## [0.0.6] - 2026-10-04
 
 ### Changed
 
 - Services and routes are now configured in YAML; the plugin requires PHP `^8.2`.
-- Release pipeline: the packaged `shopware-cli` zip (with prebuilt assets) is validated and used for both the Gitea Release and the Composer registry; the release is created through the Gitea API after packaging, so a failed build no longer leaves an orphan tag.
-- New PR checks: `shopware-cli` validate, package build and phpunit.
+- Release pipeline: the packaged `shopware-cli` zip (with prebuilt assets) is validated and used for the Gitea Release; the Composer registry gets the same content repacked root-level (Gitea requires `composer.json` at the zip root). The release is created through the Gitea API after packaging, so a failed build no longer leaves an orphan tag.
+- New PR checks: `shopware-cli` validate, package build and phpunit (with a cached Shopware project and database).
+- The PR version check compares against the latest published release instead of the version on `main`.
 
 ### Added
 
 - Dedicated `aeon_dump_manager` monolog channel; dump jobs, deletions and purges are logged.
 - Extension icon and `.config/shopware-extension.yml`.
 
+### Fixed
+
+- The packaged zip no longer contains `.gitea/` and `.config/`.
+- Release steps are idempotent (existing release and asset are reused, registry 409 counts as published), so a failed release can be re-run to completion.
+
 ### Removed
 
 - Empty plugin lifecycle overrides.

CLAUDE.md

@@ -53,9 +53,11 @@ activates this plugin inside a real Shopware kernel for the test run (`KERNEL_CL
 `Shopware\Core\Kernel` in `phpunit.xml`). This means tests require a working Shopware installation/DB
 to bootstrap against — they are not runnable as an isolated PHP package.
 
-In CI (`phpunit` job) a Shopware 6.6 project is prepared once (`composer create-project` + phpunit,
-cached monthly), the plugin is copied into `custom/plugins`, and `system:install` runs once into
-`shopware_test` (MariaDB 10.11 service), so the bootstrapper only activates the plugin.
+In CI (`phpunit` job) the latest Shopware version allowed by the plugin's `require.shopware/core` constraint
+is resolved with Composer. The prepared project (`composer create-project` + phpunit, then `system:install`
+into `shopware_test` on a MariaDB 10.11 service) plus a SQL dump of the installed database are cached under
+a key that contains that version, so a new Shopware release invalidates the cache. On a hit the dump is restored instead of reinstalling; the plugin
+is then copied into `custom/plugins` and the bootstrapper only activates it.
 
 ```bash
 vendor/bin/phpunit                              # full suite
@@ -75,8 +77,9 @@ Gitea workflows in `.gitea/`, plugin-agnostic (name/version come from `composer.
 runs from its official Docker image, intentionally unpinned (`latest`): a red build after a CLI release
 means fix the config.
 
-- `workflows/plugin-checks.yml` (PRs into `main`) has three jobs: `version-changelog` (every PR into
-  `main` must bump `composer.json` version and add a matching `## [x.y.z]` CHANGELOG heading), `package`
+- `workflows/plugin-checks.yml` (PRs into `main`) has three jobs: `version-changelog` (the
+  `composer.json` version must be greater than the latest published Gitea release and have a matching
+  `## [x.y.z]` CHANGELOG heading), `package`
   (shared composite action `actions/package`: `shopware-cli extension package`, `extension validate` on
   the zip, `scripts/ci/assert-built-assets.sh`), and `phpunit`. The package job caches the tested zip
   keyed by the commit's tree hash.

composer.json

@@ -3,7 +3,7 @@
     "description": "Export database dumps for Shopware 6 environments.",
     "type": "shopware-platform-plugin",
     "license": "MIT",
-    "version": "0.1.1",
+    "version": "0.0.6",
     "keywords": [
         "shopware",
         "shopware6",

docs/research/changelog-and-php-floor.md

@@ -0,0 +1,167 @@
+# Research: shopware-cli changelog handling and the PHP floor for a Shopware 6.6 plugin
+
+Sources are primary only: `shopware/shopware-cli` source (main branch, fetched 2026-10-04),
+`shopware/docs` (the repo behind developer.shopware.com, main), and `shopware/shopware` tags.
+Paths below are relative to those repos. Refs are branch heads or tags as noted; no commit SHAs
+were pinned.
+
+## Summary
+
+- **`extension package --release` does not parse CHANGELOG.md.** It only generates one, from git commits, and only if `changelog.enabled: true` is set in `.config/shopware-extension.yml`. Our pipeline does not pass `--release`.
+- **Parsing happens elsewhere:** in `account producer extension upload` (Store push) and in `extension get-changelog`. The parser treats every line starting with `#` as a version key.
+- **Our Keep-a-Changelog file is not compatible with that parser.** The key becomes `# [0.1.0] - 2026-10-03`, never `0.1.0`, so the Store upload would fail with "english changelog is missing". This only matters if we later use `account producer extension upload`; today we publish to Gitea and a Composer registry.
+- **Minimal fix if we ever upload to the Store:** add `CHANGELOG_en-GB.md` with `# x.y.z` headings and flat bullets, with no `###` sub-headings. Keep `CHANGELOG.md` for humans; the localized file wins for `en-GB`.
+- **PHP:** Shopware 6.6.x requires `~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0` (6.6.0.0 was `~8.2.0 || ~8.3.0`). Our `php: ^8.2` is consistent but broader than core; it is harmless because `shopware/core ~6.6.0` already pins the effective range.
+- **Recommendation:** keep `^8.2` or use `>=8.2`. Do not copy core's tilde list. Shopware's own docs skeleton declares no `php` at all, only `shopware/core`.
+
+## Q1. Changelog handling
+
+### 1.1 What the parser does (verified in source)
+
+File: `internal/extension/changelog.go` (shopware-cli, main).
+
+File discovery and locale:
+
+```go
+files, err := filepath.Glob(path + "/CHANGELOG*.md")
+...
+language := strings.Trim(strings.ReplaceAll(strings.ReplaceAll(filepath.Base(file), "CHANGELOG", ""), ".md", ""), "_")
+if len(language) == 0 { language = "en-GB" }
+```
+
+- `CHANGELOG.md` maps to `en-GB`.
+- `CHANGELOG_en-GB.md` maps to `en-GB`, and `CHANGELOG_de-DE.md` maps to `de-DE`.
+- If both `CHANGELOG.md` and `CHANGELOG_en-GB.md` exist, both land in the same map slot. `filepath.Glob` returns lexically sorted names and `.` sorts before `_`, so `CHANGELOG_en-GB.md` is processed last and overwrites. This ordering is inferred from Go's documented sorted-directory behaviour; I did not run it.
+
+Section splitting (`parseMarkdownChangelog`):
+
+```go
+for _, line := range strings.Split(content, "\n") {
+    if strings.HasPrefix(line, "#") {
+        ...
+        currentVersion = strings.Trim(strings.TrimPrefix(line, "#"), " ")
+```
+
+- Every line that starts with `#`, at any heading depth, starts a new "version" section.
+- The key is the line minus one leading `#`, with spaces trimmed. Only a single `#` is removed.
+- The body is converted to HTML with goldmark via `internal/markdown`. Headings inside bodies are rendered as `<span class="hN">`.
+- Upstream's own tests use this exact shape: `"# 1.0.0\n\n- Test\n- Test2\n# 2.0.0\n- Test3\n- Test4\n"` (`internal/extension/changelog_test.go`).
+
+Version lookup (`parseExtensionMarkdownChangelog`):
+
+- The key looked up is `ext.GetVersion().String()`, which is the plain version from `composer.json`, for example `0.1.0`.
+- `changelogs["en-GB"][version]` must exist, or it returns an error ("english changelog is missing").
+- `de-DE` is optional and falls back to the English file. If a `de-DE` file exists but lacks the version, it errors.
+- The docs agree: "The zip file contains a `CHANGELOG*.md` file with a changelog entry for the new version. Having a German changelog is optional." (`products/tools/cli/shopware-account-commands/releasing-extension-to-shopware-store.md`).
+
+### 1.2 Where it is used
+
+`GetChangelog()` is called in only two non-test places:
+
+- `internal/account-api/producer_store_upload.go`: `account producer extension upload` sends `de_DE` and `en_GB` texts as the Store changelog.
+- `cmd/extension/extension_changelog.go`: `extension get-changelog`.
+
+Not called from `cmd/extension/extension_package.go`, nor from validation: no `changelog` reference was found under `internal/validation`.
+
+### 1.3 What `--release` does
+
+`cmd/extension/extension_package.go`:
+
+```go
+extensionPackageCmd.Flags().BoolVar(&extensionReleaseMode, "release", false, "Prepare a release build: generate the changelog if enabled and, for apps, remove the secret from manifest.xml")
+```
+
+`internal/extension/zip.go`, `PrepareExtensionForRelease`:
+
+```go
+if ext.GetExtensionConfig().Changelog.Enabled {
+    ...
+    changelogFile := fmt.Sprintf("# %s\n%s", v.String(), content)
+    os.WriteFile(path.Join(extensionRoot, "CHANGELOG_en-GB.md"), ...)
+}
+if ext.GetType() == "plugin" { return nil }
+// apps only: remove setup/secret from manifest.xml
+```
+
+- **Added:** a generated `CHANGELOG_en-GB.md`, containing `# <version>` plus one bullet per git commit between the last tag and the current commit (template `internal/changelog/changelog.tpl`). It only happens if `changelog.enabled: true`. The default is false (`internal/changelog/changelog.go`, `Enabled bool`).
+- **Stripped:** the app secret in `manifest.xml`. This does not apply to plugins, which return early.
+- **Not stripped or rewritten:** an existing `CHANGELOG.md` is left untouched. When enabled, the generated file overwrites any existing `CHANGELOG_en-GB.md`.
+- This confirms `# x.y.z` is the format the tool itself writes.
+- Docs on release mode and `changelog.enabled`: `products/tools/cli/extension-commands/build.md`, "Release mode" section.
+
+### 1.4 Our repo
+
+- `.gitea/actions/package/action.yml:29` runs `shopware-cli extension package . --output-directory .build --filename ... --git-commit "$GITHUB_SHA"`. There is no `--release`, and no `changelog:` key was found in `.config` or `.gitea`.
+- The release notes come from our own awk in `.gitea/workflows/release.yml`, which matches `## [x.y.z]`. That is independent of shopware-cli.
+- `CHANGELOG.md` uses `## [0.1.0] - 2026-10-03` and `### Added/Changed/...`.
+
+### 1.5 Compatibility verdict
+
+Walking `CHANGELOG.md` through `parseMarkdownChangelog` by hand (not executed):
+
+- `## [0.1.0] - 2026-10-03` gives key `# [0.1.0] - 2026-10-03`, which never equals `0.1.0`.
+- Each `### Added` and similar heading becomes its own bogus "version", so the entries under it are split off.
+
+Result: **incompatible.** `account producer extension upload` and `extension get-changelog` would fail with "english changelog is missing". `extension package`, with or without `--release`, would not fail, because it does not call the parser. `extension validate` does not parse it either, as far as I could find.
+
+Minimal change, only needed if we adopt Store upload:
+
+```markdown
+# 0.1.0
+
+- Services and routes are now configured in YAML; the plugin requires PHP `^8.2`.
+- Release pipeline: ...
+```
+
+- Put it in `CHANGELOG_en-GB.md` at the plugin root, with one `# <exact composer version>` section per release and flat bullets. Prefix bullets with Added/Changed/Fixed if the categories matter.
+- No `###` sub-headings, and no brackets or dates in the heading.
+- `CHANGELOG_de-DE.md` is optional.
+- The alternative is to enable `changelog.enabled: true` plus `--release` and let the CLI generate it from commits. That would not use our hand-written entries.
+- The packaged zip must contain the file. I did not verify whether `.config/shopware-extension.yml` pack excludes would remove it.
+
+Not verified: the Store's own server-side handling of the changelog HTML. The CLI source only shows what is sent (`de_DE`/`en_GB` text), not what the Store renders. The Store API and backend are not public.
+
+## Q2. PHP constraint
+
+### 2.1 What Shopware 6.6 requires
+
+`require.php` in `shopware/shopware` `src/Core/composer.json` and the root `composer.json`:
+
+| Ref | `require.php` |
+|---|---|
+| `v6.6.0.0` | `"php": "~8.2.0 \|\| ~8.3.0"` |
+| `v6.6.10.28` (latest 6.6 tag seen) | `"php": "~8.2.0 \|\| ~8.3.0 \|\| ~8.4.0 \|\| ~8.5.0"` |
+
+- The `v6.6.10.28` root `composer.json` has the same line as core.
+- A fetch of the `6.6.x` branch-head `composer.json` returned no usable content, so only the two tags above are verified.
+- Official docs, `guides/hosting/index.md` ("Recommended stack and supported versions"): PHP minimum `8.2+`, recommended `8.4`.
+- `guides/development/dev-environment.md`: "PHP Version | `8.2`, `8.3`, `8.4`, `8.5`".
+- Fetching the rendered developer.shopware.com requirements page returned no PHP row. It defers to the hosting guide, which is the source above.
+- The repo's own `CLAUDE.md` says PHP `^8.1`. That is stale for 6.6, since core requires 8.2+. It is outside this task's scope.
+
+### 2.2 Is `php: ^8.2` right?
+
+`composer.json` today:
+
+```json
+"require": { "php": "^8.2", "shopware/core": "~6.6.0" }
+```
+
+- `^8.2` means `>=8.2.0 <9.0.0`. It is consistent with core's floor.
+- It is wider than core's ceiling (`<8.6`). The plugin's PHP range is the intersection of its own constraint and core's. Because `shopware/core ~6.6.0` is also required, Composer resolves to core's tilde list anyway. The plugin constraint adds no extra restriction in practice.
+- Copying core's `~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0` would only make sense if the plugin itself breaks on a specific PHP minor. That would also force a release every time Shopware adds a PHP minor.
+- Practical conclusion: `^8.2` is fine and not too strict. `>=8.2` behaves the same in practice. The only real argument for changing it is wanting the plugin's PHP floor to stay visible in its own metadata, which `^8.2` already does.
+
+### 2.3 What Shopware's skeletons recommend
+
+- `guides/plugins/plugins/creating-plugins.md` (docs repo): the example plugin `composer.json` has only `"require": { "shopware/core": "~6.7.0" }`. There is no `php` key, and "Depending on other plugins" repeats the same shape.
+- shopware-cli's scaffolding (`internal/extension/create.go`) does not set a `php` constraint; the only `"php"` hit in that package is a test fixture, `internal/extension/root_test.go:233`, with `">=8.1"`.
+- So the official guidance is to constrain `shopware/core` and leave PHP to core. A plugin `php` constraint is optional. If you want one, mirroring the supported floor (`>=8.2` or `^8.2`) is reasonable.
+- I did not find a `SwagPluginSkeleton` repo (fetching `shopware/SwagPluginSkeleton` returned 404).
+
+## Could not verify
+
+- That the Store's server-side processing matches what the CLI sends. The Store backend is not public.
+- That `.config/shopware-extension.yml` pack excludes would keep or remove a `CHANGELOG_en-GB.md` in the zip.
+- The exact ordering behaviour of `filepath.Glob` for the two `en-GB` files was inferred from Go's documented sorted results, not run.
+- No source evidence of whether the Store accepts HTML headings; the CLI renders headings as `<span class="hN">` per a comment in `internal/markdown`.