[vitormattos]

Tracking

Implements the package work tracked by LibreSign/libresign#8978. The tracking issue remains open until a stable Composer-installable breaking release is published. No changes to the main LibreSign repository.

Migration

• Require PHP ^8.2 and Behat ^4.0 at runtime. Declare Symfony Config/EventDispatcher dependencies explicitly.
• Migrate all 35 step definitions from PHPDoc annotations to Behat 4 attributes, preserving existing regex patterns, assertions, inbox count checks, message opening, body/attachment reading, and explicit purge behavior.
• Replace behat.yml.dist with Behat 4 behat.dist.php, using a fully qualified extension class.
• Keep the existing Behat public context initializer and event subscriber APIs. Handle Behat 4 Gherkin tags with an @ prefix while retaining a configurable purge_tag and the legacy non-prefixed input.
• Remove an obsolete guzzlehttp/psr7:^1.6 test-only dependency that prevented Composer installation due to security advisories, without disabling security checks.
• Add PHPUnit regressions for missing-message diagnostics, API/connection errors, storage injection and prefixed scenario/feature tags; add an integration scenario outline proving inbox purge before each example.
• Refresh README and preserve the Mailpit-isolated CI integration service with a readiness check.

Checks on HEAD 61c2209476f0c525904f02325532a4c60ca2f27c

All seven GitHub Actions workflows passed:

• Behat + isolated Mailpit PHP 8.2 and 8.3: 13 scenarios passed, 54 steps passed in each matrix cell.
• PHPUnit PHP 8.2 and 8.3, including Behat job: 51 tests, 71 assertions passed per run.
• Standalone PHPUnit workflow: 51 tests, 71 assertions passed.
• PHP syntax, CodeSniffer, PHPStan, Psalm static analysis, and PHPMD: passed.

Relevant Behat workflow: https://github.com/LibreSign/mailpit-behat-extension/actions/runs/42072808797

No local Composer/Docker test run is claimed; the tests were executed in GitHub Actions with isolated Mailpit.

Out of scope / release follow-up

After human code review, authorized merge and compatibility verification in the LibreSign consumer, publish a new breaking major release (likely v1.0.0 after verifying the current tags); verify Packagist ingestion and Composer stable installation. No merge, releases, or main-repository modifications were performed here.