Repository navigation
Replace remaining setup-php callers with pinned PHP containers #340
Description
The four remaining setup-php call sites select mutable transitive installer/PHP archive bytes even though the action commit is pinned. This affects both PHP 8.4/8.5 application matrices, PHP playground journeys and committed lock audits. The actual bound helper only supports PHP 8.3, which cannot run this application's PHP ^8.4 contract.
Owner: sample-app. General selected digest-pinned official PHP 8.4/8.5 containers on .github#297 and in chat. This work is separate from the package tuple refresh in #338 / #339.
Use a repository Dockerfile and a small PHP/Composer launcher so the existing host Python/Rust/Docker journeys keep working. Reuse the fixed-APT preflight, digest-verified phpredis source, current Composer and authenticated CA verifier. Preserve both PHP matrix cells, all requested extensions and production INI/coverage-none behavior. No mutable setup-php path or new installer framework.
Acceptance: all six existing caller jobs run their original checks through the pinned PHP images; focused behavior tests prove extension/INI versions and fail closed on bad trust input; ordinary CI passes; an independent reviewer records the exact source/image/tool verdict on .github#297. Keep the shared issue open for other consumers.
Implemented in draft #341, head 598310116b42db78ca7756e8498f13274c3762e9, on isolated branch agent/sample-app/pinned-php-ci. All 73 source-security tests pass (the Docker runtime control is separately executed on both real images). All six root/microservice/audit/playground caller jobs pass on exact current head 5983101, including per-setup TLS controls. CodeQL passes. Other normal checks are completing. The latest source adds immutable inspected image-ID binding and a persistent TLS 1.2 Composer HTTPS control, proven on both PHP versions. Real PHP 8.4 controls prove production INI, coverage none, requested extensions, Composer 2.10.3, clean-CA acceptance, altered-hash refusal and blocked-root refusal. Exact source/tool identities and outcomes are recorded in .github#297.
Next: General admits the exact reviewed container setup/launcher/CA handoff in shared policy; it currently recognizes only setup-php and the bound PHP 8.3 helper. Sample App then reruns the existing gate, completes playground/actual-image checks, merges after required checks pass. Security independently approved the exact source/trust boundary; any source or bound identity change requires counter-review. Builds on the shared lab use at most two jobs.
Activity
rmcdaniel commentedon Nov 13, 2026
Delivered through PR #341, merged as
c680ef92d578ee837d2d960c4235d5919d890134. The signed merge has the reviewed source tree and ordered parents, and main still selects that commit.Actual-main verification passes for all six migrated callers: the PHP 8.4/8.5 application and microservice cells, committed lock audit, and real PHP/Python/Rust playground journeys. Application CI, lock audit, playground journeys, polyglot smoke and native embedded smoke pass. All three protected main checks pass. The two unchanged broader SDK timer experiments are still running; no result is attributed to them here.
Security independently approved exact source
5983101, the shared policy correction passed independent review and actual-main verification in .github#377, and all 34 PR checks passed before the ordinary merge. Every setup exercises the actual Composer HTTPS accept/refuse control; image ID, extensions, production INI, coverage none and Composer trust are preserved. No owned containers remain.This completes the requested CI-only migration. It needs no package release or developer-image publication because runtime packages and the shipped tuple are unchanged in this PR. The package update remains in #338/#339; shared .github#297 remains open for other callers.