[tyrsson]

xsi:noNamespaceSchemaLocation pointed at https://schema.phpunit.de/13.1/phpunit.xsd. That is wrong two ways.

It makes the mutation job depend on the network

Infection validates phpunit.xml.dist against that schema before it runs a single mutant (XmlConfigurationManipulator::validate()). A URL there is therefore a live HTTP fetch on every mutation run. When schema.phpunit.de answers 522 the leg dies in under a minute having mutated nothing:

PHP Warning:  DOMDocument::schemaValidate(https://schema.phpunit.de/13.1/phpunit.xsd):
              Failed to open stream: HTTP request failed! HTTP/1.1 522
[Error] Failed to locate the main schema resource at 'https://schema.phpunit.de/13.1/phpunit.xsd'
Script infection handling the mutation-test event returned with error code 1

schema.phpunit.de is currently in exactly that state, which is what surfaced this.

The series does not match the installed PHPUnit

The URL pins 13.1 while consumers install PHPUnit 13.3. PHPUnit's own migration rewrites any URL to Version::series(), so the config is silently describing a schema that is two minor versions behind the code it validates. A 13.3-only attribute would be reported invalid, and Infection would refuse to run.

The fix

Point at the vendored copy:

- xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/13.1/phpunit.xsd"
+ xsi:noNamespaceSchemaLocation="vendor/phpunit/phpunit/phpunit.xsd"

This is not a workaround, it is what PHPUnit itself writes. phpunit --generate-configuration prefers the relative path and only falls back to the URL when the file is absent:

if (defined('PHPUNIT_COMPOSER_INSTALL') &&
    is_file($directory . '/vendor/phpunit/phpunit/phpunit.xsd')) {
    $schemaLocation = 'vendor/phpunit/phpunit/phpunit.xsd';
} else {
    $schemaLocation = sprintf('https://schema.phpunit.de/%s/phpunit.xsd', Version::series());
}

phpunit --migrate-configuration agrees: it returns early on a relative path, and rewrites any URL to the installed series. A relative path is the steady state; a URL is the fallback.

Verification

• The schema resolves inside the installed package and validates the config offline: valid=yes, 0 errors, while the URL fails with Failed to locate the main schema resource.
• The same form is already live in webware-console, where the mutation leg passes with enable_infection: true and min_msi: 100.
• The config is also valid under schema/13.1.xsd, 13.2.xsd and the vendored root, so no existing content depends on the old pin.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!