[koorchik]

Refs #35

Hi @antonfin! Thank you for merging #40 so quickly.

The problem

Packagist still doesn't learn about new commits of this repository: right now composer require validator/livr installs dev-master at 28079c5 (October 28), so users don't get LIVR 2.5 from #40, merged today. Without a hook, Packagist only crawls the repository about once a week. The LIVR test suite run on livr-spec.org installs the package from Packagist, so it shows PHP with the old code too (3 of 80 LIVR 2.5 cases).

#34 was closed in favour of setting up Packagist's own GitHub integration (#35), but that hasn't happened yet. This PR is the other way: it doesn't need any settings on GitHub's side or access to the Packagist account's GitHub connection, only an API token.

What this PR does

It adds .github/workflows/packagist.yml. After every push to master and every tag (and when started by hand), it calls Packagist's update-package API, so the new code is on Packagist within a minute.

What's needed from a maintainer

1. Merge this PR.
2. Add two repository secrets (Settings → Secrets and variables → Actions):
   • PACKAGIST_USERNAME: the packagist.org username of a maintainer of validator/livr;
   • PACKAGIST_TOKEN: that user's safe API token from https://packagist.org/profile/.
3. Start the workflow once by hand (Actions → Packagist → Run workflow), so Packagist gets the current master with LIVR 2.5 right away.

Until the secrets are set, the workflow only shows a warning and passes, so it doesn't break anything. A wrong token fails the job (Packagist answers 403), so the problem is visible.

If you'd rather use Packagist's GitHub integration instead (as described in #35), that works too, and then this PR can be closed. Either way, clicking Update on https://packagist.org/packages/validator/livr now would give users LIVR 2.5 today.

This PR was prepared with the help of an LLM; it is the same workflow as in #34. Thank you!