Modernise PHP codebase to PHP 7.4

[abhijitb]

Proposed changes

• Align first-party PHP tooling to the declared PHP 7.4 floor (composer platform, PHPCS testVersion, CI --runtime-set).
• Mechanically modernise in-scope code: short arrays [], null coalescing, light fn() usage.
• Add native param/return types (and typed properties where safe) across helpers, Admin/widgets, REST non-overrides, compat-check classes, and updates/bootstrap — without typing WP core parent overrides.
• Document contributor standards; defer PHPStan; leave vendor/ and out-of-scope files untouched.

Type of Change

Production

• Bugfix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Dependency update
• Refactoring / housekeeping (changes to files not directly related to functionality)

Development

• Tests
• Dependency update
• Environment update / refactoring
• Documentation Update

Visual

Checklist

• I have read the CONTRIBUTING doc
• I have viewed my change in a web-browser
• Linting and tests pass locally with my changes
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)

Further comments

[github-actions]

AI code review

✅ Strengths

• Brings the codebase in line with the declared PHP 7.4 floor across multiple touchpoints: composer platform, PHPCS runtime flag in CI, and modernized syntax (short arrays, null coalescing, light fn()).
• Sensible native typing: adding : void on first-party functions that aren’t WP core overrides is safe and improves readability without risking fatals.
• Safer PayPal BN code header handling by defensively reading headers with ?? [] and is_array() before accessing the key — reduces notices and odd edge cases when plugins pass a string.
• Good housekeeping: removal of the unused CachingController require lowers surface area and confusion given the module-level route exists; CLAUDE.md is excellent, comprehensive contributor guidance tailored to this repo.
• Developer experience: added PHPUnit phar workflow via scripts, updated .gitignore for local PHPUnit artifacts, and consistent PHPCS runtime testVersion usage in CI and composer scripts.

⚠️ Suggestions

• Double-check the plugin header Requires PHP in wp-plugin-web.php still matches 7.4 to avoid mixed signals to WordPress.org and sites. If it’s already 7.4, all good.
• Consider moving --runtime-set testVersion 7.4- into phpcs.xml (if not already there) and keeping CI flags minimal; this keeps local and CI results aligned even if scripts drift.
• You’ve clearly documented that vendor/bin/phpunit is broken for this plugin. To reduce confusion:
  • Consider dropping phpunit/phpunit from require-dev so vendor/bin/phpunit doesn’t even exist, or
  • Keep it but add a CI test job and a local test:ci script that runs composer run test:install-phpunit && composer run test, and call that from your workflows, making the intended path unmistakable.
• Ensure there are no remaining references to the removed inc/RestApi/CachingController.php (e.g., in inc/RestApi/rest-api.php, any router registration, or JS callers). If any stubs remain, follow up with a quick cleanup.
• Minor: in the BN code logic, you already guard nulls and non-arrays; optionally add is_string( $bn_code ) before stripos() for extra belt-and-suspenders safety, though the current short-circuiting makes it functionally safe.

❌ Issues

• None blocking found in this diff. The platform bump to PHP 7.4 will cause some prod deps (e.g., credis) to resolve to 7.4+ builds, which matches our stated floor. Just ensure the release process continues to use composer install --no-dev --optimize-autoloader as documented (it is, via npm run php-deps).
• Test coverage isn’t shown here; the only behavioral change in-scope is the more defensive BN header handling, which is low-risk. If we have an integration test around the PayPal header stamping, it could be updated to assert the null/non-array header cases too — non-blocking.

⚠️ Verdict: Merge with minor follow-ups

Overall this is a solid, low-risk modernization pass aligned with our 7.4 policy and contributor guidance. I recommend merging once you confirm the plugin header Requires PHP: 7.4, verify there are no lingering references to CachingController, and consider the PHPUnit dependency/script clarifications to prevent accidental vendor/bin/phpunit usage.