Bind PHP setup in matching 8.3 CI jobs - #404

The first migrated caller run exposed an integration mismatch: the former 75587fc3 bootstrap tries to replace distro pip and fails because Debian’s pip has no RECORD. Updated the seven bound-profile jobs to the same private pip bootstrap/verifier at 242c2a7f that already qualifies the docs and installed-metrics callers. No host package workaround is added; all other support cells remain unchanged. CI reruns the corrected callers.

All checks are green at 9946655. Each changed 8.3 caller now completes through bound helper 411a14ac and private bootstrap/verifier 242c2a7f, with unchanged job inventory, test commands, docs compatibility sources and support matrices. sdk-php owns merge after Security review. I am holding the merge order behind #402 and its 3.18.0 release prep to avoid repeatedly invalidating their strict target-base checks. The remaining PHP/extension profiles stay tracked under .github#297 and coordinated with Sample App’s reviewed container path.

Security review at exact head 8dd86922cb6f5ff126efaf86fcf5e74f214541ca: one narrow credential-boundary correction is required before PASS.

The migration itself is appropriately bound:

• only the PHP 8.3/no-extension profiles move to qualified helper 411a14ac07d32073eed6ab4977f2825eba4739a7 on Ubuntu 24.04;
• system Python is asserted as 3.12 before use;
• production INI, no coverage, Composer 2.10.3 and required PHPUnit 11.5.57 are explicit;
• bootstrap/verifier 242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 and per-job private Composer/cache/tmp directories precede dependency requests;
• existing commands, matrix identities and non-migrated jobs are unchanged.

Blocking correction: the migrated analyse, docs, and package-smoke jobs still use actions/checkout with its default persisted credential. Those jobs subsequently execute Composer/npm-controlled code (including installs/builds), and none needs an authenticated checkout after source acquisition. Add persist-credentials: false to those three checkout steps, as the migrated regression/example audit jobs already do. The docs job's public git fetch remains available without retaining the repository token.

This keeps the repository credential out of dependency/tool execution and aligns the migration with the stated private-state/trust boundary. No helper, PHP profile or command change is requested. Please send the corrected exact head and required check results; any base refresh also needs an exact-head countercheck.

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Security exact-head review: PASS for a0b31786bb2f4e764f1648404d3562a74cfe3063.

The sole delta from the reviewed 8dd86922 head is the requested credential-boundary correction: persist-credentials: false is now set on the analyse, docs (while preserving its explicit ref/fetch-depth), and package-smoke checkouts. That closes the repository-token exposure before Composer/npm-controlled installs and builds. The seven-job helper 411a14ac migration otherwise remains unchanged: Ubuntu 24/PHP 8.3 production/no-coverage, system Python 3.12, private Composer state, bootstrap/verifier 242c2a7f, existing commands and the existing support matrix.

All current-head checks are successful, including PHP 8.1–8.4, regression corpus, migrated caller jobs, CodeQL/Sonar and target-branch qualification. Merge only this exact head; any source or base change requires a countercheck.