From 83ece1c74a833cd260d69512be8094dfbff7800f Mon Sep 17 00:00:00 2001 From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com> Date: Fri, 13 Nov 2026 09:22:30 +0000 Subject: [PATCH 1/3] Use qualified PHP setup for matching 8.3 CI jobs --- .github/workflows/ci.yml | 105 +++++++++++++++++------ .github/workflows/example-lock-audit.yml | 21 +++-- 2 files changed, 96 insertions(+), 30 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e189caee..96596405 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -80,19 +80,30 @@ jobs: with: fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 - with: - python-version: '3.12' + - name: Select Ubuntu's Python 3.12 + run: | + /usr/bin/python3 -I -S -c 'import sys; assert sys.version_info[:2] == (3, 12)' + echo /usr/bin >> "$GITHUB_PATH" + - name: Create isolated Composer state + run: | + state="$(mktemp -d "$RUNNER_TEMP/php-check.XXXXXX")" + mkdir -m 700 "$state/home" "$state/cache" "$state/tmp" + { + echo "COMPOSER_HOME=$state/home" + echo "COMPOSER_CACHE_DIR=$state/cache" + echo "TMPDIR=$state/tmp" + } >> "$GITHUB_ENV" - name: Select authenticated dependency trust uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust with: clients: pip,python,composer,curl,git - name: Disable APT download retries (CVE-2026-109518) run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null - - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 + - uses: durable-workflow/.github/.github/actions/setup-php-linux@411a14ac07d32073eed6ab4977f2825eba4739a7 # bound-linux-php with: php-version: '8.3' - tools: composer:2.10.3 + ini-file: production + tools: composer:2.10.3,phpunit:11.5.57 coverage: none - name: Verify Composer trust before requests uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust @@ -492,19 +503,30 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 - with: - python-version: '3.12' + - name: Select Ubuntu's Python 3.12 + run: | + /usr/bin/python3 -I -S -c 'import sys; assert sys.version_info[:2] == (3, 12)' + echo /usr/bin >> "$GITHUB_PATH" + - name: Create isolated Composer state + run: | + state="$(mktemp -d "$RUNNER_TEMP/php-check.XXXXXX")" + mkdir -m 700 "$state/home" "$state/cache" "$state/tmp" + { + echo "COMPOSER_HOME=$state/home" + echo "COMPOSER_CACHE_DIR=$state/cache" + echo "TMPDIR=$state/tmp" + } >> "$GITHUB_ENV" - name: Select authenticated dependency trust uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust with: clients: pip,python,composer,curl,git - name: Disable APT download retries (CVE-2026-109518) run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null - - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 + - uses: durable-workflow/.github/.github/actions/setup-php-linux@411a14ac07d32073eed6ab4977f2825eba4739a7 # bound-linux-php with: php-version: '8.3' - tools: composer:2.10.3 + ini-file: production + tools: composer:2.10.3,phpunit:11.5.57 coverage: none - name: Verify Composer trust before requests uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust @@ -529,9 +551,10 @@ jobs: with: ref: ${{ matrix.source == 'current' && github.sha || matrix.source }} fetch-depth: 0 - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 - with: - python-version: '3.12' + - name: Select Ubuntu's Python 3.12 + run: | + /usr/bin/python3 -I -S -c 'import sys; assert sys.version_info[:2] == (3, 12)' + echo /usr/bin >> "$GITHUB_PATH" - name: Select the temporary tooling directory run: echo "DOCS_TOOLING_DIRECTORY=$RUNNER_TEMP/docs-tooling" >> "$GITHUB_ENV" - name: Prepare exact current tooling against the selected source @@ -546,16 +569,26 @@ jobs: run: python "$DOCS_TOOLING_DIRECTORY/scripts/test-docs-release-channel.py" - name: Test presentation and published SDK source isolation run: python "$DOCS_TOOLING_DIRECTORY/scripts/prepare-docs-presentation.test.py" + - name: Create isolated Composer state + run: | + state="$(mktemp -d "$RUNNER_TEMP/php-check.XXXXXX")" + mkdir -m 700 "$state/home" "$state/cache" "$state/tmp" + { + echo "COMPOSER_HOME=$state/home" + echo "COMPOSER_CACHE_DIR=$state/cache" + echo "TMPDIR=$state/tmp" + } >> "$GITHUB_ENV" - name: Select authenticated dependency trust uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust with: clients: pip,python,composer,curl,git,npm - name: Disable APT download retries (CVE-2026-109518) run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null - - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 + - uses: durable-workflow/.github/.github/actions/setup-php-linux@411a14ac07d32073eed6ab4977f2825eba4739a7 # bound-linux-php with: php-version: '8.3' - tools: composer:2.10.3 + ini-file: production + tools: composer:2.10.3,phpunit:11.5.57 coverage: none - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 with: @@ -637,19 +670,30 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 - with: - python-version: '3.12' + - name: Select Ubuntu's Python 3.12 + run: | + /usr/bin/python3 -I -S -c 'import sys; assert sys.version_info[:2] == (3, 12)' + echo /usr/bin >> "$GITHUB_PATH" + - name: Create isolated Composer state + run: | + state="$(mktemp -d "$RUNNER_TEMP/php-check.XXXXXX")" + mkdir -m 700 "$state/home" "$state/cache" "$state/tmp" + { + echo "COMPOSER_HOME=$state/home" + echo "COMPOSER_CACHE_DIR=$state/cache" + echo "TMPDIR=$state/tmp" + } >> "$GITHUB_ENV" - name: Select authenticated dependency trust uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust with: clients: pip,python,composer,curl,git - name: Disable APT download retries (CVE-2026-109518) run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null - - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 + - uses: durable-workflow/.github/.github/actions/setup-php-linux@411a14ac07d32073eed6ab4977f2825eba4739a7 # bound-linux-php with: php-version: '8.3' - tools: composer:2.10.3 + ini-file: production + tools: composer:2.10.3,phpunit:11.5.57 coverage: none - name: Verify Composer trust before requests uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust @@ -685,19 +729,30 @@ jobs: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 - with: - python-version: '3.12' + - name: Select Ubuntu's Python 3.12 + run: | + /usr/bin/python3 -I -S -c 'import sys; assert sys.version_info[:2] == (3, 12)' + echo /usr/bin >> "$GITHUB_PATH" + - name: Create isolated Composer state + run: | + state="$(mktemp -d "$RUNNER_TEMP/php-check.XXXXXX")" + mkdir -m 700 "$state/home" "$state/cache" "$state/tmp" + { + echo "COMPOSER_HOME=$state/home" + echo "COMPOSER_CACHE_DIR=$state/cache" + echo "TMPDIR=$state/tmp" + } >> "$GITHUB_ENV" - name: Select authenticated dependency trust uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust with: clients: pip,python,composer,curl,git - name: Disable APT download retries (CVE-2026-109518) run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null - - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 + - uses: durable-workflow/.github/.github/actions/setup-php-linux@411a14ac07d32073eed6ab4977f2825eba4739a7 # bound-linux-php with: php-version: '8.3' - tools: composer:2.10.3 + ini-file: production + tools: composer:2.10.3,phpunit:11.5.57 coverage: none - name: Verify Composer trust before requests uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust diff --git a/.github/workflows/example-lock-audit.yml b/.github/workflows/example-lock-audit.yml index 6d32f47a..5ce2e6be 100644 --- a/.github/workflows/example-lock-audit.yml +++ b/.github/workflows/example-lock-audit.yml @@ -24,19 +24,30 @@ jobs: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 - with: - python-version: '3.12' + - name: Select Ubuntu's Python 3.12 + run: | + /usr/bin/python3 -I -S -c 'import sys; assert sys.version_info[:2] == (3, 12)' + echo /usr/bin >> "$GITHUB_PATH" + - name: Create isolated Composer state + run: | + state="$(mktemp -d "$RUNNER_TEMP/php-check.XXXXXX")" + mkdir -m 700 "$state/home" "$state/cache" "$state/tmp" + { + echo "COMPOSER_HOME=$state/home" + echo "COMPOSER_CACHE_DIR=$state/cache" + echo "TMPDIR=$state/tmp" + } >> "$GITHUB_ENV" - name: Select authenticated dependency trust uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust with: clients: pip,python,composer,curl,git - name: Disable APT download retries (CVE-2026-109518) run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null - - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 + - uses: durable-workflow/.github/.github/actions/setup-php-linux@411a14ac07d32073eed6ab4977f2825eba4739a7 # bound-linux-php with: php-version: '8.3' - tools: composer:2.10.3 + ini-file: production + tools: composer:2.10.3,phpunit:11.5.57 coverage: none - name: Verify Composer trust before requests uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust From 99466553b2cbce372bc1452f0b61ac2ddcde6e1b Mon Sep 17 00:00:00 2001 From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com> Date: Fri, 13 Nov 2026 09:26:34 +0000 Subject: [PATCH 2/3] Use the private pip bootstrap qualified with bound PHP setup --- .github/workflows/ci.yml | 26 ++++++++++++------------ .github/workflows/example-lock-audit.yml | 4 ++-- 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 96596405..c753b811 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -94,7 +94,7 @@ jobs: echo "TMPDIR=$state/tmp" } >> "$GITHUB_ENV" - name: Select authenticated dependency trust - uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust with: clients: pip,python,composer,curl,git - name: Disable APT download retries (CVE-2026-109518) @@ -106,7 +106,7 @@ jobs: tools: composer:2.10.3,phpunit:11.5.57 coverage: none - name: Verify Composer trust before requests - uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust - run: composer install --no-interaction --prefer-dist --no-progress - name: Require durable replay and codec evidence env: @@ -517,7 +517,7 @@ jobs: echo "TMPDIR=$state/tmp" } >> "$GITHUB_ENV" - name: Select authenticated dependency trust - uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust with: clients: pip,python,composer,curl,git - name: Disable APT download retries (CVE-2026-109518) @@ -529,10 +529,10 @@ jobs: tools: composer:2.10.3,phpunit:11.5.57 coverage: none - name: Verify Composer trust before requests - uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust - run: composer install --no-interaction --prefer-dist - name: Verify Composer trust before requests - uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust - run: composer analyse docs: @@ -579,7 +579,7 @@ jobs: echo "TMPDIR=$state/tmp" } >> "$GITHUB_ENV" - name: Select authenticated dependency trust - uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust with: clients: pip,python,composer,curl,git,npm - name: Disable APT download retries (CVE-2026-109518) @@ -594,7 +594,7 @@ jobs: with: node-version: '24' - name: Verify Composer trust before requests - uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust - run: composer --working-dir="$DOCS_TOOLING_DIRECTORY" install --no-interaction --prefer-dist - run: npm --prefix "$DOCS_TOOLING_DIRECTORY" ci --ignore-scripts - run: npm --prefix "$DOCS_TOOLING_DIRECTORY" audit --audit-level=moderate @@ -604,7 +604,7 @@ jobs: - name: Test selected presentation asset validation run: python "$DOCS_TOOLING_DIRECTORY/scripts/check-docs-analytics.test.py" - name: Verify Composer trust before requests - uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust - run: bash "$DOCS_TOOLING_DIRECTORY/scripts/build-docs.sh" - run: node "$DOCS_TOOLING_DIRECTORY/scripts/check-docs-portal.mjs" build/site - run: php "$DOCS_TOOLING_DIRECTORY/scripts/check-docs-analytics.php" build/site @@ -684,7 +684,7 @@ jobs: echo "TMPDIR=$state/tmp" } >> "$GITHUB_ENV" - name: Select authenticated dependency trust - uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust with: clients: pip,python,composer,curl,git - name: Disable APT download retries (CVE-2026-109518) @@ -696,7 +696,7 @@ jobs: tools: composer:2.10.3,phpunit:11.5.57 coverage: none - name: Verify Composer trust before requests - uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust - name: Install into a clean consumer project run: | consumer="$(mktemp -d)" @@ -710,7 +710,7 @@ jobs: "$consumer/vendor/autoload.php" \ source-development - name: Verify Composer trust before requests - uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust - name: Verify release identity and reject stale package metadata run: | release_tag=$(php -r '$manifest = json_decode(file_get_contents("composer.json"), true, flags: JSON_THROW_ON_ERROR); echo $manifest["extra"]["durable-workflow"]["product-train"];') @@ -743,7 +743,7 @@ jobs: echo "TMPDIR=$state/tmp" } >> "$GITHUB_ENV" - name: Select authenticated dependency trust - uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust with: clients: pip,python,composer,curl,git - name: Disable APT download retries (CVE-2026-109518) @@ -755,7 +755,7 @@ jobs: tools: composer:2.10.3,phpunit:11.5.57 coverage: none - name: Verify Composer trust before requests - uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust with: working-directory: examples/laravel-http # Audits the committed lock only: no install, plugins or scripts. Composer's diff --git a/.github/workflows/example-lock-audit.yml b/.github/workflows/example-lock-audit.yml index 5ce2e6be..a9073ee2 100644 --- a/.github/workflows/example-lock-audit.yml +++ b/.github/workflows/example-lock-audit.yml @@ -38,7 +38,7 @@ jobs: echo "TMPDIR=$state/tmp" } >> "$GITHUB_ENV" - name: Select authenticated dependency trust - uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust with: clients: pip,python,composer,curl,git - name: Disable APT download retries (CVE-2026-109518) @@ -50,7 +50,7 @@ jobs: tools: composer:2.10.3,phpunit:11.5.57 coverage: none - name: Verify Composer trust before requests - uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust with: working-directory: examples/laravel-http - name: Audit the committed example lock From a0b31786bb2f4e764f1648404d3562a74cfe3063 Mon Sep 17 00:00:00 2001 From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com> Date: Fri, 13 Nov 2026 09:56:27 +0000 Subject: [PATCH 3/3] Remove checkout credentials before migrated dependency and build jobs --- .github/workflows/ci.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c753b811..beb83eda 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -503,6 +503,8 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + with: + persist-credentials: false - name: Select Ubuntu's Python 3.12 run: | /usr/bin/python3 -I -S -c 'import sys; assert sys.version_info[:2] == (3, 12)' @@ -549,6 +551,7 @@ jobs: steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: + persist-credentials: false ref: ${{ matrix.source == 'current' && github.sha || matrix.source }} fetch-depth: 0 - name: Select Ubuntu's Python 3.12 @@ -670,6 +673,8 @@ jobs: timeout-minutes: 10 steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + with: + persist-credentials: false - name: Select Ubuntu's Python 3.12 run: | /usr/bin/python3 -I -S -c 'import sys; assert sys.version_info[:2] == (3, 12)'