Failure marker file should be excluded using a relative path

1. How is it possible that this was never noticed? 😱
2. How will we prevent this from reoccurring in the future? (No generic test coverage was added here, only test coverage for this one specific case.)

\PhpTuf\ComposerStager\Domain\Value\PathList\PathListInterface::add() has as a default implementation \PhpTuf\ComposerStager\Infrastructure\Value\PathList\PathList::add() which looks like this:

    public function add(array $paths): void
    {
        $this->assertValidInput($paths);
        $this->paths = array_merge($this->paths, $paths);
    }

which does:

    /**
     * @param array<string> $paths
     *
     * @throws \PhpTuf\ComposerStager\Domain\Exception\InvalidArgumentException
     */
    private function assertValidInput(array $paths): void
    {
        foreach ($paths as $path) {
            /** @psalm-suppress DocblockTypeContradiction */
            if (!is_string($path)) {
                $given = is_object($path)
                    ? $path::class
                    : gettype($path);

                throw new InvalidArgumentException(sprintf(
                    'Paths must be strings. Given %s.',
                    $given,
                ));
            }
        }
    }

So it just validates that it receives strings. Not relative paths. IOW: this needs an upstream bugfix in Composer Stager, because the input validation is inadequate.

Reopening for that.

… and we need a follow-up to either convert the test that was added here to a generic test, or to remove the test that was introduced here.

but absolute paths should only be used if they are within the source directory.

Makes sense. And that's indeed the upstream bug. Clarified that at https://github.com/php-tuf/composer-stager/issues/176#issuecomment-15733....

🥳

In which issue did Automatic Updates start requiring a Composer Stager version that includes this fix, which is what allowed us to close this?

I suspect this is now a duplicate of #3384637: FailureMarker should be responsible for excluding the marker file from stage operations.

This is a duplicate of a fixed issue, which had upstream aspects which were also corrected months ago. I think this is thoroughly done.