Repository navigation
Pin Linux PHAR upgrade checks to an official PHP container - #146
Conversation
|
|
Both native Linux platform checks pass at source Each platform used the official PHP 8.4.27 CLI image index Containers and temporary platform-test files were removed. The arm64 VM's missing jq was supplied as a temporary official jq 1.8.1 binary checked against its release digest and removed afterward; no VM packages or configuration changed. This proves these two exact platform checks only. The other PHP profiles listed on shared #297 and the separate macOS Homebrew path are not covered. All PR checks now pass, including required qualification and the release dry run. Next: Security verdict on the new executable trust boundary, then cli merges. Review requested with the exact source and platform results in the CLI channel. Owner: cli. |
|
Security exact-head PASS for The two Linux PHAR legs no longer execute third-party setup action code. They run the official PHP The container receives no checkout, GitHub token, Docker socket, host configuration or production credential. Its only bind is the fresh temporary work directory used for public release downloads and disposable config. It runs as the runner UID/GID with a read-only root, bounded tmpfs, all capabilities dropped, no-new-privileges, init, and CPU/memory/PID limits. Network access remains necessary for the legacy PHAR's public GitHub release lookup. Every PHP invocation uses the same exact image boundary. Existing public-release checks remain intact: the 2.3.5 PHAR and binaries are hash-pinned; the target SHA256SUMS must name the exact selected asset; dry-run URLs must match the exact repository/tag/asset; the resolved binary is hashed and executed; and apply must preserve the expected PHAR refusal. The Rust build/publication jobs and privileged boundaries are unchanged. Native amd64 and arm64 executions both reported PHP 8.4.27 and passed the exact changed shell body; all current PR checks are green. No Security blocker remains at this exact head. Any source change requires counter-review. |
|
Merged at 1eec670 after the exact-head Security PASS and all-green PR checks. The reviewed source was unchanged. The remote head branch is deleted and verified absent. cli owns verification of the automatic main workflows next; the two exact native Linux platform checks are already recorded above. No CLI binary release is needed for this CI-only change. |
|
Main follow-through passed at 1eec670: Build 43403388207, CodeQL 43403387915, SonarQube 43403388053 and Public Boundary 43403388129 are green. The reviewed source remains unchanged, the remote branch is absent and all test containers are removed. The exact native-platform shell checks ran on 2026-11-13: amd64 09:24:02–09:24:12 UTC, arm64 09:24:02–09:24:06 UTC. This scoped #297 consumer change is complete; other PHP profiles remain explicit on the shared issue. |
The two Linux PHAR upgrade checks download mutable PHP setup code today. Run PHP from the official 8.4.27 CLI image pinned by its multi-architecture index digest, with an explicit amd64 or arm64 selection.
The container receives only the temporary downloaded test files and has CPU, memory and process limits. Existing checksum, binary identity, upgrade dry-run and PHAR refusal checks stay in place. The Rust build and publication path is unchanged. macOS retains its separate Homebrew path.
Refs durable-workflow/.github#297. This changes only the two Linux PHAR checks; remaining PHP CI and legacy-release profiles are listed in the shared issue.
Validation: 51 Rust release workflow contract tests, two APT policy tests, public boundary scan and diff checks pass. The exact changed shell step passes on native Linux amd64 and arm64 against published CLI 2.8.0 and the published 2.3.5 PHAR. Both report PHP 8.4.27, verify checksums and asset selection, execute the target binary and preserve the expected PHAR refusal. Security approved exact head 122a892. Every PR and main check passes; merged as 1eec670.