codeigniter4
diff --git a/‎.gitattributes‎
Lines changed: 2 additions & 2 deletions b/‎.gitattributes‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎.github/labeler.yml‎
Lines changed: 4 additions & 4 deletions b/‎.github/labeler.yml‎
Lines changed: 4 additions & 4 deletions
diff --git a/‎.github/scripts/random-tests-config.txt‎
Lines changed: 20 additions & 20 deletions b/‎.github/scripts/random-tests-config.txt‎
Lines changed: 20 additions & 20 deletions
diff --git a/‎.github/scripts/run-random-tests.sh‎
Lines changed: 91 additions & 62 deletions b/‎.github/scripts/run-random-tests.sh‎
Lines changed: 91 additions & 62 deletions
diff --git a/‎.github/workflows/deploy-apidocs.yml‎
Lines changed: 1 addition & 1 deletion b/‎.github/workflows/deploy-apidocs.yml‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎.github/workflows/deploy-distributables.yml‎
Lines changed: 3 additions & 3 deletions b/‎.github/workflows/deploy-distributables.yml‎
Lines changed: 3 additions & 3 deletions
diff --git a/‎.github/workflows/deploy-userguide-latest.yml‎
Lines changed: 2 additions & 2 deletions b/‎.github/workflows/deploy-userguide-latest.yml‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎.github/workflows/label-pr.yml‎
Lines changed: 28 additions & 1 deletion b/‎.github/workflows/label-pr.yml‎
Lines changed: 28 additions & 1 deletion
@@ -22,12 +22,12 @@ utils/                       export-ignore
 .php-cs-fixer.no-header.php  export-ignore
 .php-cs-fixer.tests.php      export-ignore
 .php-cs-fixer.user-guide.php export-ignore
-deptrac.yaml                 export-ignore
+structarmed.php              export-ignore
 phpmetrics.json              export-ignore
 phpstan-baseline.php         export-ignore
 phpstan-bootstrap.php        export-ignore
 phpstan.neon.dist            export-ignore
-phpunit.xml.dist             export-ignore
+phpunit.dist.xml             export-ignore
 psalm-baseline.xml           export-ignore
 psalm.xml                    export-ignore
 psalm_autoload.php           export-ignore
 
@@ -10,14 +10,14 @@
   - any-glob-to-any-file:
     - '.github/workflows/*'
 
-# Add the `documentation` label to PRs that change any file in the `user_guide_src/source/` directory.
+# Add the `documentation` label to PRs for documentation only.
 'documentation':
 - changed-files:
   - any-glob-to-all-files:
-    - 'user_guide_src/source/*'
+    - 'user_guide_src/source/**'
 
-# Add the `testing` label to PRs that change files in the `tests/` directory ONLY.
+# Add the `testing` label to PRs that changes tests only.
 'testing':
 - changed-files:
   - any-glob-to-all-files:
-    - 'tests/*'
+    - 'tests/**'
@@ -9,41 +9,41 @@
 # Reference: https://github.com/codeigniter4/CodeIgniter4/issues/9968
 
 API
-# AutoReview
-# Autoloader
+AutoReview
+Autoloader
 # Cache
 CLI
-# Commands
-# Config
-# Cookie
+Commands
+Config
+Cookie
 # DataCaster
 # DataConverter
 # Database
 # Debug
 # Email
 # Encryption
 # Entity
-# Events
-# Files
+Events
+Files
 # Filters
-# Format
+Format
 # HTTP
 # Helpers
-# Honeypot
-# HotReloader
+Honeypot
+HotReloader
 # I18n
 # Images
-# Language
-# Log
+Language
+Log
 # Models
-# Pager
-# Publisher
-# RESTful
+Pager
+Publisher
+RESTful
 # Router
-# Security
+Security
 # Session
-# Test
-# Throttle
-# Typography
+Test
+Throttle
+Typography
 # Validation
-# View
+View
@@ -23,6 +23,7 @@
 ################################################################################
 
 set -u
+export LC_NUMERIC=C
 trap 'kill "${bg_pids[@]:-}" 2>/dev/null; wait 2>/dev/null' EXIT INT TERM
 
 ################################################################################
@@ -476,77 +477,105 @@ run_component_tests() {
 
     local output_file="$results_dir/random_test_output_${component}_$$.log"
     local events_file="$results_dir/random_test_events_${component}_$$.log"
-    local random_seed=$(generate_phpunit_random_seed)
     local exit_code=0
-
-    # Security: Use array to avoid eval and prevent command injection
-    local -a phpunit_args=(
-        "vendor/bin/phpunit"
-        "$test_dir"
-        "--colors=never"
-        "--no-coverage"
-        "--order-by=random"
-        "--random-order-seed=${random_seed}"
-        "--log-events-text"
-        "$events_file"
-    )
-
-    if [[ $timeout_seconds -gt 0 ]] && command -v timeout >/dev/null 2>&1; then
-        (cd "$project_root" && timeout --kill-after=2s "${timeout_seconds}s" "${phpunit_args[@]}") > "$output_file" 2>&1
-        exit_code=$?
-    elif [[ $timeout_seconds -gt 0 ]] && command -v gtimeout >/dev/null 2>&1; then
-        (cd "$project_root" && gtimeout --kill-after=2s "${timeout_seconds}s" "${phpunit_args[@]}") > "$output_file" 2>&1
-        exit_code=$?
-    else
-        local timeout_marker="$output_file.timeout"
-        (cd "$project_root" && "${phpunit_args[@]}") > "$output_file" 2>&1 &
-        local test_pid=$!
-
-        if [[ $timeout_seconds -gt 0 ]]; then
-            # Watchdog: monitors test process and kills it after timeout
-            # Uses 1-second sleep intervals to respond quickly when test finishes early
-            (
-                local elapsed=0
-                while [[ $elapsed -lt $timeout_seconds ]]; do
-                    sleep 1
-                    elapsed=$((elapsed + 1))
-                    kill -0 "$test_pid" 2>/dev/null || exit 0
-                done
-
-                if kill -0 "$test_pid" 2>/dev/null; then
-                    touch "$timeout_marker"
-                    local pids_to_kill=$(pgrep -P "$test_pid" 2>/dev/null)
-
-                    kill -TERM "$test_pid" 2>/dev/null || true
-                    if [[ -n "$pids_to_kill" ]]; then
-                        echo "$pids_to_kill" | xargs kill -TERM 2>/dev/null || true
-                    fi
-
-                    sleep 2
+    local attempt=1
+    local -r max_attempts=2
+    local random_seed
+    local -a phpunit_args
+
+    # Retry loop: the Composer classmap autoloader occasionally fails to load
+    # CodeIgniter\CodeIgniter under parallel CI load — a transient infra race,
+    # not a real test failure. Retry once on that signature with a fresh random
+    # seed; a second miss is reported as genuine failure.
+    while true; do
+        random_seed=$(generate_phpunit_random_seed)
+
+        # Security: Use array to avoid eval and prevent command injection
+        phpunit_args=(
+            "vendor/bin/phpunit"
+            "$test_dir"
+            "--colors=never"
+            "--no-coverage"
+            "--do-not-cache-result"
+            "--order-by=random"
+            "--random-order-seed=${random_seed}"
+            "--log-events-text"
+            "$events_file"
+        )
+
+        if [[ $timeout_seconds -gt 0 ]] && command -v timeout >/dev/null 2>&1; then
+            (cd "$project_root" && timeout --kill-after=2s "${timeout_seconds}s" "${phpunit_args[@]}") > "$output_file" 2>&1
+            exit_code=$?
+        elif [[ $timeout_seconds -gt 0 ]] && command -v gtimeout >/dev/null 2>&1; then
+            (cd "$project_root" && gtimeout --kill-after=2s "${timeout_seconds}s" "${phpunit_args[@]}") > "$output_file" 2>&1
+            exit_code=$?
+        else
+            local timeout_marker="$output_file.timeout"
+            (cd "$project_root" && "${phpunit_args[@]}") > "$output_file" 2>&1 &
+            local test_pid=$!
+
+            if [[ $timeout_seconds -gt 0 ]]; then
+                # Watchdog: monitors test process and kills it after timeout
+                # Uses 1-second sleep intervals to respond quickly when test finishes early
+                (
+                    local elapsed=0
+                    while [[ $elapsed -lt $timeout_seconds ]]; do
+                        sleep 1
+                        elapsed=$((elapsed + 1))
+                        kill -0 "$test_pid" 2>/dev/null || exit 0
+                    done
 
                     if kill -0 "$test_pid" 2>/dev/null; then
-                        kill -KILL "$test_pid" 2>/dev/null || true
+                        touch "$timeout_marker"
+                        local pids_to_kill=$(pgrep -P "$test_pid" 2>/dev/null)
+
+                        kill -TERM "$test_pid" 2>/dev/null || true
                         if [[ -n "$pids_to_kill" ]]; then
-                            echo "$pids_to_kill" | xargs kill -KILL 2>/dev/null || true
+                            echo "$pids_to_kill" | xargs kill -TERM 2>/dev/null || true
+                        fi
+
+                        sleep 2
+
+                        if kill -0 "$test_pid" 2>/dev/null; then
+                            kill -KILL "$test_pid" 2>/dev/null || true
+                            if [[ -n "$pids_to_kill" ]]; then
+                                echo "$pids_to_kill" | xargs kill -KILL 2>/dev/null || true
+                            fi
+                            # Security: Quote and escape test_dir for safe pattern matching
+                            pkill -KILL -f "phpunit.*${test_dir//\//\\/}" 2>/dev/null || true
                         fi
-                        # Security: Quote and escape test_dir for safe pattern matching
-                        pkill -KILL -f "phpunit.*${test_dir//\//\\/}" 2>/dev/null || true
                     fi
-                fi
-            ) &
-            disown $! 2>/dev/null || true
+                ) &
+                disown $! 2>/dev/null || true
+            fi
+
+            wait "$test_pid" 2>/dev/null
+            exit_code=$?
+
+            if [[ -f "$timeout_marker" ]]; then
+                exit_code=124
+                rm -f "$timeout_marker"
+            elif [[ $exit_code -eq 143 || $exit_code -eq 137 ]]; then
+                exit_code=124
+            fi
         fi
 
-        wait "$test_pid" 2>/dev/null
-        exit_code=$?
+        # Success, exhausted attempts, or a non-infra failure: stop retrying.
+        if [[ $exit_code -eq 0 ]] || [[ $attempt -ge $max_attempts ]]; then
+            break
+        fi
 
-        if [[ -f "$timeout_marker" ]]; then
-            exit_code=124
-            rm -f "$timeout_marker"
-        elif [[ $exit_code -eq 143 || $exit_code -eq 137 ]]; then
-            exit_code=124
+        # Only retry on the known transient autoload race signatures.
+        # Matching on error messages (not line numbers) so the pattern survives
+        # unrelated edits to MockCodeIgniter/CIUnitTestCase.
+        if ! grep -qE 'Failed to open stream: No such file or directory|Class "CodeIgniter.CodeIgniter" not found' "$output_file" 2>/dev/null; then
+            break
         fi
-    fi
+
+        print_debug "Transient autoload failure detected in $component; retrying (attempt $((attempt + 1))/${max_attempts})"
+        ((attempt++))
+        rm -f "$events_file"
+    done
 
     local elapsed=$((($(date +%s%N) - $start_time) / 1000000))
     local result_file="$results_dir/random_test_result_${elapsed}_${component}.txt"
@@ -610,7 +639,7 @@ run_component_tests() {
         fi
 
         {
-            echo "> ${phpunit_args[@]:0:6}"
+            echo "> ${phpunit_args[@]:0:7}"
             echo ""
             echo "$output"
             echo "$predecessor_info"
 
@@ -44,7 +44,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
         with:
           php-version: '8.2'
           tools: phive
 
@@ -72,7 +72,7 @@ jobs:
         run: ./source/.github/scripts/deploy-framework ${GITHUB_WORKSPACE}/source ${GITHUB_WORKSPACE}/framework ${GITHUB_REF##*/}
 
       - name: Release
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{secrets.ACCESS_TOKEN}}
           script: |
@@ -126,7 +126,7 @@ jobs:
         run: ./source/.github/scripts/deploy-appstarter ${GITHUB_WORKSPACE}/source ${GITHUB_WORKSPACE}/appstarter ${GITHUB_REF##*/}
 
       - name: Release
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{secrets.ACCESS_TOKEN}}
           script: |
@@ -190,7 +190,7 @@ jobs:
         run: ./source/.github/scripts/deploy-userguide ${GITHUB_WORKSPACE}/source ${GITHUB_WORKSPACE}/userguide ${GITHUB_REF##*/}
 
       - name: Release
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{secrets.ACCESS_TOKEN}}
           script: |
 
@@ -30,7 +30,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
         with:
           php-version: '8.2'
           coverage: none
@@ -59,7 +59,7 @@ jobs:
 
       # Create an artifact of the html output
       - name: Upload artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: HTML Documentation
           path: user_guide_src/build/html/
 
@@ -14,7 +14,34 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Verify PR source for workflow file changes
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const prFiles = await github.paginate(github.rest.pulls.listFiles.endpoint.merge({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.payload.pull_request.number,
+            }));
+            const workflowFileChanged = prFiles.some(file => file.filename === '.github/workflows/label-pr.yml');
+
+            if (workflowFileChanged) {
+              if (context.payload.pull_request.head.repo.full_name !== 'codeigniter4/CodeIgniter4') {
+                throw new Error('Changes to label-pr.yml are not allowed from forks.');
+              }
+
+              console.log('Workflow file changed, but PR is from the main repository. Proceeding with label addition.');
+              return;
+            }
+
+            console.log('No changes to workflow file detected, proceeding with label addition.');
+
       - name: Add labels
-        uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+        uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
         with:
           sync-labels: true # Remove labels when matching files are reverted