chore(release): 0.2.2

Reviewed-on: #37

.gitea/workflows/docker-publish.yml

@@ -19,6 +19,9 @@ on:
         required: true
         type: string
 
+env:
+  REGISTRY: git.arthurerlich.de
+
 jobs:
   build-push:
     runs-on: ubuntu-latest
@@ -40,12 +43,6 @@ jobs:
           fi
           git checkout "refs/tags/${{ inputs.tag }}"
 
-      # Strip the protocol from the server URL to get the registry hostname.
-      # e.g. https://gitea.example.com → gitea.example.com
-      - name: Derive registry hostname
-        run: |
-          echo "REGISTRY=$(echo '${{ gitea.server_url }}' | sed 's|https://||;s|http://||')" >> $GITHUB_ENV
-
       # Generates OCI-compliant tags and labels from the provided release tag.
       # 1.2.3 → image tags: 1.2.3 / 1.2 / 1
       - name: Extract Docker metadata
@@ -73,17 +70,6 @@ jobs:
           username: ${{ gitea.actor }}
           password: ${{ secrets.REGISTRY_TOKEN }}
 
-      # Build a single-arch image locally so Trivy can inspect it before the real push.
-      - name: Build local image for scanning
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          target: final
-          platforms: linux/amd64
-          load: true
-          tags: scan-target:${{ inputs.tag }}
-          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache
-
       - name: Build and push
         uses: docker/build-push-action@v5
         with:
@@ -91,6 +77,7 @@ jobs:
           target: final
           platforms: linux/amd64,linux/arm64
           push: true
+          pull: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           # Registry-based layer cache — survives between runs without a separate cache store.

.gitea/workflows/release.yml

@@ -0,0 +1,62 @@
+# Cuts a release: moves CHANGELOG.md's [Unreleased] section under a new
+# version heading, commits it to main, then creates and pushes the version tag.
+# Trigger manually via workflow_dispatch, entering the semver to release.
+# The pushed tag can then be built with docker-publish.yml.
+
+name: Create Release Tag
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to release (semver, e.g. 1.2.3)"
+        required: true
+        type: string
+
+jobs:
+  tag:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.RELEASE_TOKEN }}
+
+      - name: Validate version and Unreleased section
+        run: |
+          if ! [[ "${{ inputs.version }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Error: '${{ inputs.version }}' is not a valid semver (e.g. 1.2.3)."
+            exit 1
+          fi
+          if git rev-parse "refs/tags/${{ inputs.version }}" >/dev/null 2>&1; then
+            echo "Error: tag '${{ inputs.version }}' already exists."
+            exit 1
+          fi
+          awk '/^## \[Unreleased\]/{f=1;next}/^## \[/{f=0}f' CHANGELOG.md > /tmp/unreleased.md
+          if ! grep -q '[^[:space:]]' /tmp/unreleased.md; then
+            echo "Error: CHANGELOG.md's [Unreleased] section is empty — nothing to release."
+            exit 1
+          fi
+
+      - name: Move Unreleased entries under the new version heading
+        run: |
+          today=$(date +%Y-%m-%d)
+          awk -v ver="${{ inputs.version }}" -v date="$today" '
+            /^## \[Unreleased\]/ { print; print ""; print "## [" ver "] - " date; next }
+            { print }
+          ' CHANGELOG.md > /tmp/CHANGELOG.md
+          mv /tmp/CHANGELOG.md CHANGELOG.md
+
+      - name: Commit and tag
+        run: |
+          git config user.name "gitea-actions"
+          git config user.email "actions@noreply.git.arthurerlich.de"
+          git add CHANGELOG.md
+          git commit -m "chore(release): ${{ inputs.version }}"
+          git tag "${{ inputs.version }}"
+          git push origin HEAD:main
+          git push origin "${{ inputs.version }}"

.gitea/workflows/test.yml

@@ -0,0 +1,78 @@
+name: Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  REGISTRY: git.arthurerlich.de
+
+jobs:
+  build-dev:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Gitea registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Build dev image (PHP 8.4 + composer deps)
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile.dev
+          target: dev
+          load: true
+          tags: graph-dev:ci
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-dev
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-dev,mode=max
+
+      - name: Run tests in dev image
+        run: |
+          cid=$(docker create graph-dev:ci sh -c "
+            composer install --no-interaction &&
+            vendor/bin/phpunit --testdox &&
+            composer phpstan
+          ")
+          docker cp . "$cid":/app
+          rc=0
+          docker start -a "$cid" || rc=$?
+          docker rm "$cid" > /dev/null
+          exit $rc
+
+  build-prod:
+    needs: build-dev
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Gitea registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Build prod image (final target)
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile
+          target: final
+          push: false
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-prod
+          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-prod,mode=max

CHANGELOG.md

@@ -7,6 +7,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.2] - 2026-10-23
+
+### Changed
+
+- Added `symfony/flex` so `extra.symfony.require: "7.4.*"` is enforced — every Symfony component, including transitive ones, now stays on 7.4 LTS
+- Renovate groups all Symfony components into a single PR and restricts them to `~7.4`
+- Dependency updates:
+  - Symfony components 7.4.x → latest 7.4 patch (`cache`, `console`, `framework-bundle`, `http-client`, `http-kernel`, `yaml`, … → 7.4.20)
+  - `symfony/dependency-injection` back to 7.4.20 (a transitive update had pulled in 8.0.15)
+  - `symfony/monolog-bundle` 4.0.2 → 4.1.0
+  - `monolog/monolog` 3.10.0 → 3.12.1
+  - `phpstan/phpstan` 2.2.5 → 2.2.16
+- Docker builds copy `symfony.lock` so Flex doesn't re-apply recipes during `composer install`
+
+### Fixed
+
+- Renovate no longer pins `symfony/monolog-bundle` to `~7.4` — it is versioned independently (4.x) and was blocked from updates (#39)
+
+### Security
+
+- Release images are built against the latest PHP 8.4.27 for CVE-2026-109618 and CVE-2026-109619 (critical RCE)
+
+## [0.2.1] - 2026-07-31
+
+### Added
+
+- Gitea Actions `test.yml` workflow — builds dev and prod images and runs PHPUnit and PHPStan on pushes and PRs to `main`
+
+### Fixed
+
+- Removed a leftover `composer dump-env prod` call in the prod Docker build stage — the command doesn't exist in this project's Composer setup and broke every image build
+
 ## [0.2.0] - 2026-07-12
 
 ### Added
@@ -79,7 +111,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Docker multi-stage build (`base → deps → build → final`)
 - Basic `/health` endpoint
 
-[Unreleased]: https://github.com/ArthurErlich/git-contribution-graph/compare/0.2.0...HEAD
+[Unreleased]: https://github.com/ArthurErlich/git-contribution-graph/compare/0.2.2...HEAD
+[0.2.2]: https://github.com/ArthurErlich/git-contribution-graph/compare/0.2.1...0.2.2
+[0.2.1]: https://github.com/ArthurErlich/git-contribution-graph/compare/0.2.0...0.2.1
 [0.2.0]: https://github.com/ArthurErlich/git-contribution-graph/compare/0.1.0...0.2.0
 [0.1.0]: https://github.com/ArthurErlich/git-contribution-graph/compare/0.0.1...0.1.0
 [0.0.1]: https://github.com/ArthurErlich/git-contribution-graph/releases/tag/0.0.1

CLAUDE.md

@@ -138,12 +138,29 @@ Workflow files live in [.gitea/workflows/](.gitea/workflows/). This project uses
 - Secrets are set under Repository → Settings → Secrets → Actions
 - The registry hostname must be derived from `gitea.server_url` (strip the protocol prefix)
 - Triggers use standard `on:` syntax; `tags: '*.*.*'` matches semver pushes without a `v` prefix
+- Do not use `cache-from/cache-to: type=gha` — on this instance's act_runner (v2.0.0), the internal GitHub Actions-cache-compatible proxy is not reachable from job containers (`dial tcp <ip>:<port>: i/o timeout`), a known act_runner docker-executor networking limitation, not a workflow bug. Use `type=registry` instead (push cache blobs to `${{ env.REGISTRY }}/<repo>:buildcache*` — see both `test.yml` and `docker-publish.yml`); it requires a registry login step even for jobs that don't push the final image.
 
 **Current workflows:**
 
 | File                 | Trigger          | Purpose                                                   |
 | -------------------- | ---------------- | --------------------------------------------------------- |
 | `docker-publish.yml` | Push tag `*.*.*` | Build & push multi-arch image to Gitea container registry |
+| `test.yml`           | Push/PR to `main`| Build dev+prod images, run PHPUnit and PHPStan            |
+
+### Release testing with `act`
+
+Before tagging a release (anything that would trigger `docker-publish.yml`), run `test.yml` locally with [`act`](https://github.com/nektos/act) to catch pipeline failures before pushing. `test.yml` uses plain GitHub Actions syntax (no `gitea.*` contexts), so it runs under `act` unmodified.
+
+```bash
+act -j test \
+  -P ubuntu-latest=catthehacker/ubuntu:act-latest \
+  --artifact-server-path /tmp/act-artifacts
+```
+
+- `-P ubuntu-latest=catthehacker/ubuntu:act-latest` — default act runner image lacks a Docker CLI, which the `test` job needs for its nested `docker run` steps
+- `--artifact-server-path` — required for the `upload-artifact`/`download-artifact` steps to work; without it they silently no-op
+
+**If `act` is not installed:** warn the user it's missing and how to install it (`sudo pacman -S act`, or see the repo above) — do not install it yourself or force the check. `docker-publish.yml` is out of scope for `act` (it needs real `gitea.*` context and a live registry secret); don't try to run it locally.
 
 ## Docker
 

Dockerfile

@@ -17,7 +17,7 @@ WORKDIR /app
 # ── deps stage (prod vendor) ───────────────────────────────────────────────────
 FROM base AS deps
 COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
-COPY composer.json composer.lock* ./
+COPY composer.json composer.lock* symfony.lock ./
 RUN composer install \
     --no-dev \
     --no-scripts \
@@ -30,8 +30,7 @@ FROM deps AS build
 COPY . .
 RUN composer dump-autoload --classmap-authoritative --no-dev --no-interaction && \
     mkdir -p var/cache var/log && \
-    APP_ENV=prod APP_SECRET=placeholder php bin/console cache:warmup --no-debug && \
-    composer dump-env prod
+    APP_ENV=prod APP_SECRET=placeholder php bin/console cache:warmup --no-debug
 
 # ── final (prod) stage — no composer binary ────────────────────────────────────
 FROM base AS final

Dockerfile.dev

@@ -22,7 +22,7 @@ WORKDIR /app
 COPY docker/php/xdebug.ini /usr/local/etc/php/conf.d/docker-xdebug.ini
 COPY docker/php/conf.d/20-app.dev.ini $PHP_INI_DIR/app.conf.d/
 COPY docker/frankenphp/Caddyfile.dev /etc/caddy/Caddyfile
-COPY composer.json composer.lock* ./
+COPY composer.json composer.lock* symfony.lock ./
 RUN composer install --no-scripts --no-interaction --prefer-dist
 
 EXPOSE 8080

TODO.md

@@ -1,267 +0,0 @@
-# TODO: persist contribution history in SQLite + audit cleanup
-
-Backend-only work. Follow Red → Green → Refactor per `CLAUDE.md` for every
-step that adds behavior (store, retention, provider `$since` handling).
-Order matters — later steps assume earlier ones are done.
-
-## 1. Audit cleanup
-
-- [x] **Remove `eightpoints/guzzle-bundle` + `idci/graphql-client-bundle`.**
-      They exist only to build one near-static GitHub GraphQL query string
-      (`GitHubProvider.php:59-74`); the bundle's own HTTP transport is already
-      bypassed (comment at `GitHubProvider.php:76-77`).
-  - [x] Replace
-        `$graphqlClient->buildQuery(...)->getGraphQLQuery()` with a plain
-        `sprintf`/heredoc query string. Delete the two packages from
-        `composer.json`, `config/bundles.php`, and delete
-        `config/packages/eight_points_guzzle.yaml` +
-        `config/packages/idci_graphql_client.yaml`. Run `composer update` and
-        commit the regenerated `composer.lock`.
-
-- [x] **Dedupe `baseUrl` normalization.** `GitLabProvider.php` (lines 41, 53) and `GiteaProvider.php` (lines 42, 54) each call
-      `rtrim($this->baseUrl..., '/')` twice — once in `ping()`, once in
-      `fetch()`. Compute it once as a `private readonly string $baseUrl` in
-      the constructor instead.
-
-## 2. Fix stale `config/services.yaml` (found during exploration, blocks step 1 & 4)
-
-- [x] `services.yaml` still binds `$username`/`$token`/`$baseUrl` to the
-      pre-refactor FQCNs (`App\Service\GitHubProvider` etc.) and
-      `_instanceof: App\Service\ProviderInterface`, left over from the
-      `Service/` → `Provider/`+`Renderer/` namespace reorg. Update all of
-      these to `App\Service\Provider\...`. Currently these bindings silently
-      no-op, and scalar constructor args can't autowire without them — any
-      edit to these constructors (steps 1, 4) needs this fixed first, or the
-      container fails to compile.
-
-## 3. `ContributionStore` (SQLite via native PDO)
-
-> Docs: [PDO](https://www.php.net/manual/en/book.pdo.php) ·
-> [PDO_SQLITE driver](https://www.php.net/manual/en/ref.pdo-sqlite.php) ·
-> [PDO::prepare / prepared statements](https://www.php.net/manual/en/pdo.prepare.php) ·
-> [SQLite `INSERT ... ON CONFLICT` upsert](https://www.sqlite.org/lang_upsert.html) ·
-> [SQLite `STRICT` tables](https://www.sqlite.org/stricttables.html) ·
-> [SQLite `WITHOUT ROWID` tables](https://www.sqlite.org/withoutrowid.html) ·
-> [SQLite datatypes (why `date` is `INTEGER`/unixtime, not `TEXT`)](https://www.sqlite.org/datatype3.html)
-
-- [x] New `src/Service/ContributionStore.php`. PDO SQLite, DB file at
-      `%kernel.project_dir%/var/data/contributions.db` (configurable
-      constructor arg), table created lazily. **Schema note:** `date` is
-      stored as a Unix timestamp (`INTEGER`), not `TEXT` — matches the
-      current implementation:
-  ```sql
-  CREATE TABLE IF NOT EXISTS contributions (
-      provider TEXT NOT NULL,
-      date     INTEGER NOT NULL,
-      count    INTEGER NOT NULL CHECK (count >= 0),
-      PRIMARY KEY (provider, date)
-  ) WITHOUT ROWID, STRICT;
-  ```
-- [x] `add(string $provider, int $unixtime, int $count): void` — plain
-      insert (done, needs test coverage — see below).
-- [x] Fix `add()`: currently a plain `INSERT`, so re-adding an existing
-      `(provider, date)` throws a unique-constraint violation instead of
-      upserting. Switch to
-      `INSERT ... ON CONFLICT(provider, date) DO UPDATE SET count = excluded.count`
-      (see SQLite upsert doc above), or keep `add()` insert-only and add a
-      separate `merge()` for the upsert case used by step 5.
-- [x] `remove(string $provider, int $unixtime): void` — started, has a
-      bug: `DELETE contributions WHERE ...` is invalid SQL, missing the
-      `FROM` keyword (must be `DELETE FROM contributions WHERE ...`); also
-      drop the `LIKE` on `provider` (exact match, use `=`) since it's an
-      unindexed wildcard scan for what should be an exact key lookup.
-- [x] **`Contribution` entity.** Small immutable value object
-      (`src/Entity/Contribution.php`) wrapping one row: `provider` (string),
-      `date` (unix timestamp int, or `\DateTimeImmutable` — pick one and
-      use it consistently everywhere, including `add()`/`all()`), `count`
-      (int). Gives `ContributionStore::all()` and the aggregator something
-      typed to pass around instead of raw arrays/tuples.
-- [x] **`ContributionCollection`.** Typed collection
-      (`src/Entity/ContributionCollection.php`) wrapping
-      `array<Contribution>` — implement `IteratorAggregate` + `Countable`
-      at minimum ([`IteratorAggregate`](https://www.php.net/manual/en/class.iteratoraggregate.php),
-      [`Countable`](https://www.php.net/manual/en/class.countable.php)) so
-      it can be `foreach`'d and `count()`'d like a normal array. This is
-      what `ContributionStore::all()` should return instead of a bare
-      `date => count` array.
-- [x] `latestDate(string $provider): ?int` — `SELECT MAX(date) WHERE provider = ?`
-      (returns a unix timestamp, not a string, per the schema above).
-- [x] `merge(string $provider, array $dateCounts): void` — upsert via
-      `INSERT ... ON CONFLICT(provider, date) DO UPDATE SET count = excluded.count`;
-      `$dateCounts` keyed by unix timestamp.
-- [x] `all(string $provider, ?int $sinceDays = null): ContributionCollection` —
-      fetch all rows for a provider, or since a given range. `null` returns
-      full history (no arbitrary cutoff), a value filters to rows where
-      `date >= (now - sinceDays * 86400)`. **Bug:** current stub in
-      `ContributionStore.php:58` has invalid PHP (`$provider == null` instead
-      of `?string $provider = null` — this won't parse) and returns `void`
-      instead of `ContributionCollection`; fix the signature when implementing.
-- [x] `prune(): void` — `DELETE FROM contributions WHERE date < ?` using
-      the configured retention window (a unix timestamp cutoff); no-ops if
-      retention is unset/0.
-- [x] Constructor takes `?int $retentionDays` bound from new env var
-      `CONTRIBUTIONS_RETENTION_DAYS` (empty/default = keep forever). _(constructor
-      param wired; the env binding itself is step 6's job.)_
-- [x] Tests: `tests/Unit/Service/ContributionStoreTest.php` — store &
-      retrieve, upsert overwrites existing date, `sinceDays` filtering,
-      `prune()` no-ops when retention unset, `prune()` deletes rows older
-      than the window when set.
-- [x] Tests: `tests/Unit/Entity/ContributionTest.php` and
-      `ContributionCollectionTest.php` — construction, iteration, `count()`.
-
-## 4. Wire `$since`/`$until` through providers
-
-Root cause of the live `MaxExecutionTimeError` crash: every cache-miss
-request re-fetches the full ~365-day history from every host, and
-GitLab's pagination is unbounded and sequential. Bounding the fetch
-window (step 5's 3-day trailing overlap) is what actually fixes it — a
-PHP `max_execution_time` fatal can't be caught by `try/catch` at all, so
-"catch it better" was never on the table.
-
-- [x] `ProviderInterface::startFetch()` → `startFetch(?\DateTimeImmutable $since = null, ?\DateTimeImmutable $until = null): mixed`
-      (interface already split into `startFetch`/`resolveFetch` for
-      concurrency — this doc previously said `fetch()`, which predates that
-      split).
-- [x] `GitHubProvider::startFetch()` — already builds explicit `from`/`to`
-      GraphQL args (`GitHubProvider.php:51-58`); swap the hardcoded
-      `-365 days`/`now` for `$since ?? -365 days` / `$until ?? now`.
-- [x] `GitLabProvider::startFetch()` — add a `before` query param alongside
-      the existing `after` (`GitLabProvider.php:77-84`), fed by `$until`;
-      `$since` already flows into `after` (this is what actually shrinks the
-      pagination loop).
-- [x] `GiteaProvider::resolveFetch()` — heatmap endpoint has no query
-      params (always returns full history); add an `$until` upper-bound
-      filter alongside the existing `$cutoff` lower bound.
-- [x] Update `GitHubProviderTest.php`, `GitLabProviderTest.php`,
-      `GiteaProviderTest.php` — add cases asserting a passed `$since`/`$until`
-      narrows the request window/query params.
-
-## 5. Wire `ContributionStore` into `ContributionAggregator`
-
-- [x] Fix `ContributionStore` wiring in `config/services.yaml` first —
-      it's currently dead code (nothing calls it). The constructor default
-      `$dbPath` string (`%kernel.project_dir%/var/data/contributions.db`) is
-      a plain PHP default, not a resolved container parameter; bind it
-      explicitly (same pattern as the provider bindings):
-  ```yaml
-  App\Service\ContributionStore:
-    arguments:
-      $dbPath: "%kernel.project_dir%/var/data/contributions.db"
-      $retentionDays: "%env(int:CONTRIBUTIONS_RETENTION_DAYS)%"
-  ```
-  Add `env(CONTRIBUTIONS_RETENTION_DAYS): ''` to `parameters:` (empty →
-  casts to `0` → `prune()`'s existing `retentionDays === 0` check already
-  treats that as "keep forever"). Document the var in `.env`.
-- [x] Inject `ContributionStore` into `ContributionAggregator`.
-- [x] Per configured provider: `$latest = $store->latestDate($name)` →
-      `$since = $latest !== null ? (new \DateTimeImmutable('@' . $latest))->modify('-3 days') : null`
-      (3-day overlap for late corrections — old stored days are immutable and
-      never re-fetched, only this trailing window + anything new hits the
-      network), else `null` (first run, provider's own default lookback).
-      `$until = null` (always "up to now" on the normal request path).
-- [x] `startFetch($since, $until)` / `resolveFetch()` as today,
-      `$store->merge($name, $fresh)` on success, then read back
-      `$store->all($name, sinceDays: 371)` for the render window
-      (53 weeks × 7 days) — a `ContributionCollection` — and merge its
-      contributions into the returned array (the store becomes the source
-      of truth for what gets rendered, not the fresh fetch alone).
-- [x] Call `$store->prune()` once per `aggregate()` call, after all
-      providers have merged.
-- [x] Keep the existing try/catch-and-log-per-provider behavior — a
-      provider failure leaves its DB history stale, doesn't break the render.
-- [x] Update `ContributionAggregatorTest.php` with store-interaction
-      (`latestDate` consulted, `merge` called, `all()` feeds the result,
-      `prune()` runs once) and a case confirming a provider failure leaves
-      other providers' stored data intact.
-
-## 6. Docker / env
-
-- [x] `docker-compose.yml` — add a `data` named volume mounted at
-      `/app/var/data` (same pattern as `cache`/`logs`), and pass through
-      `CONTRIBUTIONS_RETENTION_DAYS: "${CONTRIBUTIONS_RETENTION_DAYS:-}"`.
-- [x] `Dockerfile` — add `var/data` to the `mkdir -p` in the `final` stage
-      alongside `var/cache/prod/pools var/log`, owned by `app`.
-- [x] `.env` — document `CONTRIBUTIONS_RETENTION_DAYS` (empty by default),
-      same style as the existing `ALLOWED_HOSTS` comment.
-
-## 9. `graph:contributions:refetch` console command
-
-Manual escape hatch for forcing a full or ranged re-fetch (e.g. after
-adding a new host, or if the store needs rebuilding) — bypasses step 5's
-incremental `latestDate()` window entirely for the providers/range given.
-
-- [x] `src/Command/RefetchContributionsCommand.php`, `#[AsCommand]` +
-      constructor-promoted readonly properties (matches this codebase's
-      attribute-first style), using `SymfonyStyle`
-      ([console styling guide](https://symfony.com/doc/current/console/style.html)).
-      Inject `iterable $providers` (`#[AutowireIterator('app.provider')]`,
-      same as `ContributionAggregator`) and `ContributionStore`.
-- [x] Options: `--provider=github,gitlab` (repeatable/comma-split,
-      restricts to named provider(s), default = all configured; unknown name
-      → `$io->error()` + `Command::FAILURE`), `--from=YYYY-MM-DD` (default
-      today − 365 days), `--to=YYYY-MM-DD` (default today), `--all` (shorthand
-      for `--from` far enough back — e.g. 2005-01-01 — to mean "existing full
-      history"; combinable with `--provider`).
-- [x] **Batch by range**: split `[from, to]` into ≤365-day chunks
-      (GitHub's GraphQL `contributionsCollection` rejects windows over a
-      year; chunking also caps GitLab's pagination per call, so a big
-      `--all` re-fetch can't reintroduce the original runaway-pagination
-      timeout). Iterate chunks oldest-first.
-- [x] Per provider, per chunk: `$io->section(...)`, `startFetch($chunkFrom, $chunkTo)`
-      / `resolveFetch()`, `$store->merge($name, $result)` immediately (don't
-      accumulate all chunks in memory), `ProgressBar` across chunks.
-- [x] Catch per-provider/per-chunk `\Throwable` → `$io->warning(...)`,
-      continue with remaining chunks/providers (same graceful-degradation
-      philosophy as `ContributionAggregator`).
-- [x] Finish with `$io->table(...)` summary (provider, days written,
-      chunks fetched, any errors) and `$io->success()`/`$io->error()`; exit
-      `Command::SUCCESS` if at least one provider fully succeeded, else
-      `Command::FAILURE`.
-- [x] Tests: `tests/Unit/Command/RefetchContributionsCommandTest.php`
-      using `CommandTester` with fake `ProviderInterface` stubs and a
-      `:memory:` `ContributionStore` — assert chunking count for a >365-day
-      range, store ends up populated, unknown `--provider` name fails
-      cleanly, a provider throwing doesn't abort the others.
-
-## 10. PHPStan
-
-- [x] `composer require --dev phpstan/phpstan` (plain PHPStan — no
-      Symfony extension needed for this app's size).
-- [x] Add `phpstan.neon`: `paths: [src, tests]`, `level: 8`.
-- [x] Add composer script `"phpstan": "phpstan analyse"`.
-- [x] Update README.md docs with new command and php stan static lintin.
-- [x] Document in PHP-Stan-Errors.md whatever level-8 flags on first run.
-
-## 11. `CLAUDE.md` update
-
-- [x] Architecture section: add the `ContributionStore` (SQLite) tier
-      between providers and the renderer; note the two-tier cache (1h SVG
-      cache → SQLite raw-data store → provider APIs).
-- [x] Environment variables table: add `CONTRIBUTIONS_RETENTION_DAYS`.
-- [x] Document `app:contributions:refetch` (options, batching behavior).
-- [x] Development section: add `composer phpstan` next to the existing
-      `vendor/bin/phpunit` commands.
-- [x] Remove any remaining mentions of the two deleted bundles. (none found —
-      already clean)
-
-## Verification
-
-- `vendor/bin/phpunit --testdox` green after every step.
-- `composer phpstan` clean at level 8.
-- `composer install` succeeds with no dangling references to the removed bundles.
-- `docker compose up -d --build`; clear the FS cache
-  (`docker compose exec graph rm -rf var/cache/*`); hit
-  `/graph.svg?theme=dark` twice; check `docker compose logs -f graph` shows
-  a narrower `since` window on the second fetch.
-- Set `CONTRIBUTIONS_RETENTION_DAYS=30`; confirm rows older than 30 days
-  are gone after the next refresh
-  (`sqlite3 var/data/contributions.db "SELECT date FROM contributions ORDER BY date LIMIT 1"`).
-- `curl localhost:8080/health` still reports all configured providers healthy.
-- `docker compose exec graph bin/console app:contributions:refetch --all`
-  populates `var/data/contributions.db` from empty; re-run with no flags
-  and confirm logs show only the trailing-window re-fetch.
-- `docker compose exec graph bin/console app:contributions:refetch --provider=github --from=2020-01-01 --to=2023-01-01`
-  exercises multi-chunk batching.
-- Confirm the original crash scenario is gone: an account with heavy
-  GitLab history no longer triggers `MaxExecutionTimeError` on a cold
-  cache (bounded by the 3-day trailing window, not full history).

composer.json

@@ -8,6 +8,7 @@
         "monolog/monolog": "^3.10",
         "symfony/cache": "7.4.*",
         "symfony/console": "7.4.*",
+        "symfony/flex": "^2",
         "symfony/framework-bundle": "7.4.*",
         "symfony/http-client": "7.4.*",
         "symfony/monolog-bundle": "^4.0",
@@ -33,6 +34,7 @@
         "optimize-autoloader": true,
         "sort-packages": true,
         "allow-plugins": {
+            "symfony/flex": true,
             "symfony/runtime": true
         }
     },

renovate.json

@@ -9,10 +9,15 @@
   },
   "packageRules": [
     {
-      "allowedVersions": "^7.0",
-      "description": "Keep Symfony on 7.x LTS until EOL",
+      "groupName": "symfony",
+      "allowedVersions": "~7.4",
+      "description": "Keep all Symfony components on 7.4 LTS and update them together (symfony/flex enforces extra.symfony.require for transitive ones)",
       "matchPackageNames": [
-        "/^symfony//"
+        "/^symfony//",
+        "!symfony/flex",
+        "!symfony/monolog-bundle",
+        "!/^symfony/polyfill-/",
+        "!/-contracts$/"
       ]
     },
     {

symfony.lock

@@ -0,0 +1,99 @@
+{
+    "phpstan/phpstan": {
+        "version": "2.2.16"
+    },
+    "phpunit/phpunit": {
+        "version": "11.5",
+        "recipe": {
+            "repo": "github.com/symfony/recipes",
+            "branch": "main",
+            "version": "11.1",
+            "ref": "ca0bc067abfb40a8de1b2561b96cbfc2b833c314"
+        },
+        "files": [
+            ".env.test",
+            "phpunit.xml.dist",
+            "tests/bootstrap.php",
+            "bin/phpunit"
+        ]
+    },
+    "symfony/console": {
+        "version": "7.4",
+        "recipe": {
+            "repo": "github.com/symfony/recipes",
+            "branch": "main",
+            "version": "5.3",
+            "ref": "1781ff40d8a17d87cf53f8d4cf0c8346ed2bb461"
+        },
+        "files": [
+            "bin/console"
+        ]
+    },
+    "symfony/flex": {
+        "version": "2.11",
+        "recipe": {
+            "repo": "github.com/symfony/recipes",
+            "branch": "main",
+            "version": "2.4",
+            "ref": "52e9754527a15e2b79d9a610f98185a1fe46622a"
+        },
+        "files": [
+            ".env",
+            ".env.dev"
+        ]
+    },
+    "symfony/framework-bundle": {
+        "version": "7.4",
+        "recipe": {
+            "repo": "github.com/symfony/recipes",
+            "branch": "main",
+            "version": "7.4",
+            "ref": "5ea2ed9cd29ca8fc2cb9bca9cb7b7e0a8d2be1dc"
+        },
+        "files": [
+            "config/packages/cache.yaml",
+            "config/packages/framework.yaml",
+            "config/preload.php",
+            "config/routes/framework.yaml",
+            "config/services.yaml",
+            "public/index.php",
+            "src/Controller/.gitignore",
+            "src/Kernel.php",
+            ".editorconfig"
+        ]
+    },
+    "symfony/monolog-bundle": {
+        "version": "4.0",
+        "recipe": {
+            "repo": "github.com/symfony/recipes",
+            "branch": "main",
+            "version": "3.7",
+            "ref": "feb8fd9520b5694c7d0d2ba17fd4b4d33f9dd9cf"
+        },
+        "files": [
+            "config/packages/monolog.yaml"
+        ]
+    },
+    "symfony/phpunit-bridge": {
+        "version": "7.4",
+        "recipe": {
+            "repo": "github.com/symfony/recipes",
+            "branch": "main",
+            "version": "7.3",
+            "ref": "56f87409c45ff6654b0bf07c5cc359aebf6016ab"
+        }
+    },
+    "symfony/routing": {
+        "version": "7.4",
+        "recipe": {
+            "repo": "github.com/symfony/recipes",
+            "branch": "main",
+            "version": "7.4",
+            "ref": "bc94c4fd86f393f3ab3947c18b830ea343e51ded"
+        },
+        "files": [
+            "config/packages/routing.yaml",
+            "config/routes.yaml"
+        ]
+    }
+}