chore: dependabot + PHP 8.4/8.5 CI matrix + PHPUnit 13 allowance

[karlwaldman]

What

• dependabot.yml — composer + github-actions ecosystems, monthly cadence, PR-limit 3 (repo had none)
• CI matrix — adds PHP 8.4 and 8.5 (current stable) alongside 8.1–8.3
• PHPUnit — widen dev constraint to ^10.5 || ^11.0 || ^12.0 || ^13.0 so newer PHP runners get the current major

Verification (local)

• PHP 8.5.8 + PHPUnit 13.2.4: vendor/bin/phpunit → OK (16 tests, 80 assertions)
• Also green on PHPUnit 12.5.31 (pre-change baseline)
• composer validate --strict passes

No runtime code touched — the SDK has zero runtime dependencies (ext-curl/ext-json only).

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Added monthly automated checks for Composer and GitHub Actions dependency updates.
  • Expanded automated testing coverage to include PHP 8.4 and 8.5.
  • Updated development tooling support for newer PHPUnit versions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5d695a71-629e-4492-8187-e42ba715ffee

📥 Commits

Reviewing files that changed from the base of the PR and between 27c8c1e and d5fd521.

📒 Files selected for processing (3)

• .github/dependabot.yml
• .github/workflows/test.yml
• composer.json

---

📝 Walkthrough

Walkthrough

The pull request adds monthly Dependabot updates for Composer and GitHub Actions, expands the test matrix to PHP 8.4 and 8.5, and broadens the development PHPUnit version constraint.

Changes

Dependency maintenance

Layer / File(s)	Summary
Automated dependency updates .github/dependabot.yml	Adds monthly Dependabot checks for Composer and GitHub Actions, capped at three open pull requests per ecosystem.
PHP test compatibility .github/workflows/test.yml, composer.json	Adds PHP 8.4 and 8.5 to the test matrix and expands the PHPUnit development dependency range.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main changes: Dependabot, expanded PHP CI matrix, and broader PHPUnit allowance.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/ci-matrix-dependabot

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[karlwaldman]

CI note: the initial run failed on all 5 matrix jobs at the live-smoke step, not the unit tests — the OILPRICEAPI_TEST_KEY secret now gets HTTP 402 on /v1/prices/past_week (historical became a paid entitlement), so main would fail the same way today. Pushed 28e86c9: the smoke script treats 402/403 on the historical leg as a documented skip (latest() already proves auth/transport/parsing); any other error still fails. Verified locally with the same test key (exit 0, skip notice) and with a full-access key (exit 0, latest + past_week). Alternative if you prefer full coverage: swap the repo secret to a key with historical access.