Update CI matrix and actions

Run on pull requests, cover PHP 8.2 and 8.3, and stop using the retired
actions/checkout@v2 and ramsey/composer-install@v1.

PHP 7.3 and 7.4 leave the matrix. Composer 2.10, which setup-php installs
today, only accepts laminas-diactoros 2.18.1 and newer as a provider of
psr/http-factory-implementation, and those releases require PHP 8.0+, so
the dev dependencies cannot be installed on 7.3/7.4 at all - with or
without the changes in this branch. PHPStan moves to PHP 8.0 for the same
reason.

The lowest-dependency jobs stay on PHP 8.0: Slim 3.0, Pimple 3.0 and
vfsStream 1.6.8 predate PHP 8.1 and fatal on load there, and raising those
dev bounds is not an option either, because the first Slim 3 release that
supports PHP 8.1 (3.13.0) requires PHP 8.1.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: snapshotpl

.github/workflows/tests.yml

@@ -1,46 +1,65 @@
 name: CI
 on:
-    - push
+    push:
+        branches:
+            - master
+    pull_request:
 jobs:
     phpstan:
         runs-on: ubuntu-latest
         steps:
             -   name: Checkout
-                uses: actions/checkout@v2
+                uses: actions/checkout@v4
 
             -   name: Setup PHP, with composer and extensions
                 uses: shivammathur/setup-php@v2
                 with:
-                    php-version: 7.3
+                    php-version: '8.0'
 
             -   name: Install dependencies with Composer
-                uses: ramsey/composer-install@v1
+                uses: ramsey/composer-install@v3
 
             -   name: Run phpstan
                 run: vendor/bin/phpstan analyse --level=6 src/
     tests:
         strategy:
+            fail-fast: false
             matrix:
                 dependencies:
                     - highest
                     - lowest
+                # PHP 7.3 and 7.4 are not built here: no laminas-diactoros release
+                # that Composer 2.10+ accepts as a psr/http-factory-implementation
+                # provider supports them, so the dev dependencies cannot even be
+                # installed on those versions.
                 php-versions:
-                    - 7.3
-                    - 7.4
-                    - 8.0
-                    - 8.1
+                    - '8.0'
+                    - '8.1'
+                    - '8.2'
+                    - '8.3'
+                exclude:
+                    # Lowest bounds of the dev dependencies (Slim 3.0, Pimple 3.0,
+                    # vfsStream 1.6.8) were released before PHP 8.1 and fatal on load
+                    # there. That is a limitation of those old releases, not of this
+                    # library: every tested PHP version is covered by the highest jobs.
+                    -   dependencies: lowest
+                        php-versions: '8.1'
+                    -   dependencies: lowest
+                        php-versions: '8.2'
+                    -   dependencies: lowest
+                        php-versions: '8.3'
         runs-on: ubuntu-latest
         steps:
             -   name: Checkout
-                uses: actions/checkout@v2
+                uses: actions/checkout@v4
 
             -   name: Setup PHP, with composer and extensions
                 uses: shivammathur/setup-php@v2
                 with:
                     php-version: ${{ matrix.php-versions }}
 
             -   name: Install dependencies with Composer
-                uses: ramsey/composer-install@v1
+                uses: ramsey/composer-install@v3
                 with:
                     dependency-versions: ${{ matrix.dependencies }}