[FEATURE] Add PHP mutation testing with Infection

[vitormattos]

We already have PHPUnit tests and code coverage for the PHP code, but coverage alone does not tell us how well the tests detect changes in the code.

Add Infection to LibreSign to introduce mutation testing for the PHP test suite.

The xobject-template package can be used as a reference, but the implementation should follow the current LibreSign structure and dependencies.

Acceptance criteria

• Infection is installed using the existing bamarni/composer-bin-plugin pattern, with its dependencies isolated under vendor-bin/infection.

• An infection.json5 configuration file is added to the repository root, configured to run mutation testing against the PHP source code in lib/.

• Infection uses the existing PHPUnit setup.

• A mutation:test script is added to the root composer.json, so mutation tests can be executed with:

  composer mutation:test

• A GitHub Actions workflow runs mutation tests for relevant PHP changes and prevents the check from passing when the configured mutation score is not reached.

• Run Infection once without an MSI gate to get the initial scores. Use the resulting MSI and Covered Code MSI values as the initial minMsi and minCoveredMsi values.

• The mutation test can be executed successfully both locally and in CI.

These files from xobject-template may be useful as references:

• infection.json5
• vendor-bin/mutation/composer.json
• mutation.yml

Good first issue

This should be a good opportunity to learn how the LibreSign PHP tests and CI are organized and to get some experience with mutation testing.

The implementation touches different parts of the test tooling. Please keep commits small and focused instead of putting the complete implementation in one large commit.

Additional context

• If you have questions, feel free to ask in this issue.
• Give a ⭐️ star to this repository if you find LibreSign useful and would like to support the project.
• You can also join our community: https://t.me/LibreSign

[UmairRathore]

Hi! I'd like to work on this issue.

I've reviewed the acceptance criteria and the existing Composer bin/PHPUnit setup. I plan to keep the change scoped to the Infection dependency/configuration, the composer mutation:test command, and the CI workflow, using an initial ungated run to establish the MSI thresholds as described.

I'll keep the changes focused and validate the setup locally before opening a PR. If nobody is already working on this, I'll start on it.

[vitormattos]

Go ahead

[UmairRathore]

Submitted PR #8038 to address this. It adds Infection mutation testing, CI integration, baseline thresholds, and the test-safety adjustment required for process signaling during mutation testing. Feedback is welcome.