ci: run tests and linting on pull requests

[pannoury]

Why

Nothing ran on pull requests. Tests only executed inside the publish workflows, after a merge to main — so a broken change was caught while it was being released, not before. There was also no linting anywhere.

What changed

A new CI workflow runs on every pull request and on pushes to main. It reuses the release workflow's paths-filter, so a PR that only touches python/ doesn't spin up Node and PHP runners. A final ci job aggregates the three and is the one to mark as a required check in branch protection — it stays green when a language is skipped for being untouched.

Per language:

	Lint	Static analysis	Tests
JavaScript	oxlint	tsc --noEmit	vitest on Node 20, 22
Python	ruff check + ruff format --check	mypy, strict	pytest on 3.9, 3.13
PHP	PHP_CodeSniffer (PSR-12)	PHPStan level 8	PHPUnit on 8.1, 8.4

Lint and type checks run once per language, on the newest runtime — older versions only need to prove the tests pass.

On the JavaScript linter

typescript-eslint is the obvious choice and it does not work here: its peer range is typescript >=4.8.4 <6.1.0, and this package is on TypeScript 7. npm install refuses outright. oxlint has no TypeScript peer dependency, covers the same correctness rules, and runs in milliseconds. If the repo ever moves back to TypeScript 5.x, swapping to typescript-eslint is a small change.

no-await-in-loop is disabled — the retry loop awaits sequentially by design. require-await is disabled on EmailService.send with a comment, because async there is what turns its argument validation into a rejected promise rather than a synchronous throw.

Fixes found along the way

The JavaScript build was already broken on main. tsup --dts loads rollup-plugin-dts, which reads the TypeScript compiler API and crashes on TypeScript 7 (Cannot read properties of undefined (reading 'useCaseSensitiveFileNames')). Since npm run build only ran during publish, this would have failed the next release. Declarations now come from tsc --emitDeclarationOnly via a tsconfig.build.json that excludes test files. Verified by type-checking a consumer against the emitted dist/ under node16 resolution.

A PHP test asserted the wrong thing. testAcceptsArrayRecipients asserted on the mocked response body, which is fixed by the test itself — it passed no matter how recipients were serialised. It now asserts on the request payload, which is what the test is named for.

Baseline cleanup

Bringing three linters to zero touched a fair number of files, all mechanical:

• Python: docstrings on the remaining __init__ methods, Optional[X] → X | None (safe: every module has from __future__ import annotations), and explicit types where strict mypy could not follow Any through the transport.
• PHP: non-empty-string on the HTTP method parameter, array value types on test helpers, \CurlHandle on the header callback, and three PSR-12 brace placements.

Verified locally

Python 60 passed, ruff and mypy clean. JavaScript 55 passed, oxlint, tsc --noEmit and build clean. PHP 56 passed / 86 assertions, phpcs and PHPStan clean.