test(plugin): compare a real-plugin install against upstream Composer

Run upstream Composer and Shirabe over pristine copies of a fixture
project at the same path and require composer.lock, the whole vendor tree
(including the plugin-generated GeneratedConfig.php), the plugin's IO
lines and the exit code to match byte for byte.

The plugin under test (phpstan/extension-installer 1.4.3) is downloaded by
fixtures/e2e/fetch — pinned to an upstream commit and hash-verified — into
a git-ignored directory rather than committed; the test skips while it is
absent, like the other real-PHP prerequisites. Its dependencies are
minimal stand-ins resolved from local repositories, so test runs stay
offline. A zip dist would exercise the known lossy-string byte-precision
debt in RemoteFilesystem, so the fixture serves the plugin through a path
dist until that is resolved.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

1 files changed, 33 insertions, 0 deletions

diff --git a/crates/shirabe/tests/plugin/fixtures/e2e/fetch b/crates/shirabe/tests/plugin/fixtures/e2e/fetch
new file mode 100755
index 00000000..a4179955
--- /dev/null
+++ b/crates/shirabe/tests/plugin/fixtures/e2e/fetch
@@ -0,0 +1,33 @@
+#!/bin/sh
+# Fetches the external plugin the E2E test runs against, into the git-ignored ext/
+# directory. The plugin is pinned to an immutable upstream commit and the extracted
+# files are verified by hash, so the test stays deterministic without the third-party
+# source ever entering this repository. Requires network once; the E2E test skips
+# itself while ext/ is absent.
+set -eu
+
+# phpstan/extension-installer 1.4.3
+commit=85e90b3942d06b2326fba0403ec24fe912372936
+dir="$(dirname "$0")/ext/phpstan-extension-installer-1.4.3"
+
+if [ -f "$dir/src/Plugin.php" ]; then
+    echo "already fetched: $dir"
+    exit 0
+fi
+
+mkdir -p "$dir"
+curl -fsSL "https://codeload.github.com/phpstan/extension-installer/tar.gz/$commit" \
+    | tar -xz -C "$dir" --strip-components=1
+
+# GitHub archives are content-addressed by the commit, but the archive encoding is not
+# guaranteed stable; the extracted files are what the test consumes, so they are what
+# gets pinned.
+(cd "$dir" && sha256sum -c --quiet) <<'EOF' || { rm -rf "$dir"; echo "hash mismatch; discarded the fetched tree" >&2; exit 1; }
+92d8a5f0f9da0ebe198fe466bc4efc1793d90d8da93efd912fdc9dc414a56885  LICENSE
+76197285d0c2a8dec7cff9f8562638bda879367829fd982281cba53068c7f153  README.md
+71f6125d095522d8b24925d9144d361b2419f41be6174607b026473ae65c2604  composer.json
+fc46b5548e9656fab230ed4b97fdf13b54712743d04498374d40ebae2610bac1  src/GeneratedConfig.php
+5803a3fb8c272d52848e4aa240707370e301fa081fc632b487fafacfe4985af7  src/Plugin.php
+EOF
+
+echo "fetched: $dir"