feat(php): require a minimal patch version of PHP

CHANGELOG.md

@@ -19,6 +19,7 @@
   * Add support for pie
   * Add some PHP tooling (PHP-CS-Fixer, PHPStan, Twig-CS-Fixer)
   * Update Composer to version 2.8
+  * Require a minimal patch version of PHP, to force the upgrade after a security release
 * Builder
   * Update NodeJS to version 20.x LTS
   * Add support for autocomplete (composer & symfony)

infrastructure/docker/services/php/Dockerfile

@@ -23,6 +23,10 @@ RUN apt-get update \
     && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/share/doc/*
 
 ARG PHP_VERSION
+# Minimal patch version of each PHP branch, to bump after a security release: it
+# invalidates the build cache (local and registry) of the PHP packages, which would
+# keep the vulnerable version otherwise, and the build fails until Sury publishes it
+ARG PHP_MIN_VERSIONS="8.3.35 8.4.26 8.5.11"
 
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
@@ -40,7 +44,13 @@ RUN apt-get update \
         "php${PHP_VERSION}-xml" \
         "php${PHP_VERSION}-zip" \
     && apt-get clean \
-    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/share/doc/*
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/share/doc/* \
+    && for min in ${PHP_MIN_VERSIONS}; do \
+        if [ "${min%.*}" = "${PHP_VERSION}" ] && dpkg --compare-versions "$(php -r 'echo PHP_VERSION;')" lt "${min}"; then \
+            echo "PHP ${min} is required, packages.sury.org does not have it yet." >&2; \
+            exit 1; \
+        fi; \
+    done
 
 # Every PHP setting of every image: each stage enables its own ones with phpenmod
 COPY php/mods-available/ /etc/php/${PHP_VERSION}/mods-available/