diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c2a7b442..ca9be203 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -127,37 +127,114 @@ jobs: test: name: PHP ${{ matrix.php }} runs-on: ubuntu-24.04 + needs: action-policy timeout-minutes: 15 strategy: fail-fast: false matrix: - php: ['8.1', '8.2', '8.3', '8.4'] + php: ['8.1', '8.2', '8.4'] steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: - python-version: '3.12' + persist-credentials: false + - name: Check out the fixed APT prerequisite + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + with: + repository: durable-workflow/.github + ref: 18783be6bef737cc778e4c7282a8797e39daa61a + path: .central-apt-source + persist-credentials: false + - name: Select Ubuntu's Python 3.12 + run: | + /usr/bin/python3 -I -S -c 'import sys; assert sys.version_info[:2] == (3, 12)' + echo /usr/bin >> "$GITHUB_PATH" - name: Select authenticated dependency trust - uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust with: clients: pip,python,composer,curl,git - name: Disable APT download retries (CVE-2026-109518) run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null - - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 + - name: Prepare the reviewed PHP container runtime + run: bash "$GITHUB_WORKSPACE/scripts/ci/setup-php-container.sh" "${{ matrix.php }}" + - name: Verify Composer trust before requests + uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust + - run: composer validate --strict + - name: Verify Composer trust before requests + uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust + - run: composer install --no-interaction --prefer-dist + - name: Lint PHP + run: php scripts/ci/lint-php.php + - name: Verify Composer trust before requests + uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust + - run: | + mkdir -p build + php scripts/ci/reference-replay-clock-numbers.php > build/replay-clock-numbers.json + composer test -- --log-junit build/phpunit.xml + - name: Retain source numeric observations + if: always() + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: - php-version: ${{ matrix.php }} - tools: composer:2.10.3 + name: replay-clock-numbers-php-${{ matrix.php }} + path: build/replay-clock-numbers.json + if-no-files-found: error + retention-days: 90 + - name: Verify Composer trust before requests + uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust + - run: composer check-boundary + - name: Verify Composer trust before requests + uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust + - name: Preserve the HTTP-only PHP 8.1 platform + if: matrix.php == '8.1' + run: composer check-http-only-platform + + test-php83: + name: PHP 8.3 + runs-on: ubuntu-24.04 + needs: action-policy + timeout-minutes: 15 + steps: + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 + with: + persist-credentials: false + - name: Select Ubuntu's Python 3.12 + run: | + /usr/bin/python3 -I -S -c 'import sys; assert sys.version_info[:2] == (3, 12)' + echo /usr/bin >> "$GITHUB_PATH" + - name: Create isolated Composer state + run: | + state="$(mktemp -d "$RUNNER_TEMP/php-check.XXXXXX")" + mkdir -m 700 "$state/home" "$state/cache" "$state/tmp" + { + echo "COMPOSER_HOME=$state/home" + echo "COMPOSER_CACHE_DIR=$state/cache" + echo "TMPDIR=$state/tmp" + } >> "$GITHUB_ENV" + - name: Select authenticated dependency trust + uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust + with: + clients: pip,python,composer,curl,git + - name: Disable APT download retries (CVE-2026-109518) + run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null + - uses: durable-workflow/.github/.github/actions/setup-php-linux@411a14ac07d32073eed6ab4977f2825eba4739a7 # bound-linux-php + with: + php-version: '8.3' + ini-file: production + tools: composer:2.10.3,phpunit:11.5.57 coverage: none + - name: Require the existing process-control modules + run: | + php -r 'foreach (["pcntl", "posix"] as $extension) { if (!extension_loaded($extension)) { throw new RuntimeException("Missing extension: ".$extension); } } + foreach (["pcntl_fork", "pcntl_waitpid", "pcntl_signal", "pcntl_async_signals", "posix_kill"] as $function) { if (!function_exists($function)) { throw new RuntimeException("Missing function: ".$function); } }' - name: Verify Composer trust before requests - uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust - run: composer validate --strict - name: Verify Composer trust before requests - uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust - run: composer install --no-interaction --prefer-dist - name: Lint PHP run: find src tests examples -name '*.php' -print0 | xargs -0 -n1 php -l - name: Verify Composer trust before requests - uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust - run: | mkdir -p build php scripts/ci/reference-replay-clock-numbers.php > build/replay-clock-numbers.json @@ -166,12 +243,12 @@ jobs: if: always() uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: - name: replay-clock-numbers-php-${{ matrix.php }} + name: replay-clock-numbers-php-8.3 path: build/replay-clock-numbers.json if-no-files-found: error retention-days: 90 - name: Retain PHP 8.3 source test evidence - if: always() && matrix.php == '8.3' + if: always() uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: php-8.3-source-tests @@ -179,41 +256,41 @@ jobs: if-no-files-found: error retention-days: 90 - name: Verify Composer trust before requests - uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust - name: Enforce Avro Value regression budget - if: matrix.php == '8.3' run: composer benchmark-avro-value - name: Verify Composer trust before requests - uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust - run: composer check-boundary - - name: Verify Composer trust before requests - uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust - - name: Preserve the HTTP-only PHP 8.1 platform - if: matrix.php == '8.1' - run: composer check-http-only-platform carbon-2: name: PHP 8.1 with Carbon 2 runs-on: ubuntu-24.04 + needs: action-policy timeout-minutes: 15 steps: - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: persist-credentials: false - - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + - name: Check out the fixed APT prerequisite + uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: - python-version: '3.12' + repository: durable-workflow/.github + ref: 18783be6bef737cc778e4c7282a8797e39daa61a + path: .central-apt-source + persist-credentials: false + - name: Select Ubuntu's Python 3.12 + run: | + /usr/bin/python3 -I -S -c 'import sys; assert sys.version_info[:2] == (3, 12)' + echo /usr/bin >> "$GITHUB_PATH" - name: Select authenticated dependency trust - uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust with: clients: pip,python,composer,curl,git - name: Disable APT download retries (CVE-2026-109518) run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null - - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 - with: - php-version: '8.1' - tools: composer:2.10.3 - coverage: none + - name: Prepare the reviewed PHP container runtime + run: bash "$GITHUB_WORKSPACE/scripts/ci/setup-php-container.sh" "8.1" carbon2 - name: Constrain the manifest to the oldest supported Carbon major run: | php -r '$path = "composer.json"; @@ -221,7 +298,7 @@ jobs: $manifest->require->{"nesbot/carbon"} = "^2.72.6"; file_put_contents($path, json_encode($manifest, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_THROW_ON_ERROR)."\n");' - name: Verify Composer trust before requests - uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust - run: composer install --no-interaction --prefer-dist --no-progress - name: Require Carbon 2 run: | @@ -230,7 +307,7 @@ jobs: fwrite(STDOUT, "nesbot/carbon {$version}\n"); exit(str_starts_with($version, "2.") ? 0 : 1);' - name: Verify Composer trust before requests - uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 # clean-trust + uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5 # clean-trust - run: | mkdir -p build php scripts/ci/reference-replay-clock-numbers.php > build/replay-clock-numbers.json @@ -1023,6 +1100,7 @@ jobs: - action-policy - regression-corpus - test + - test-php83 - carbon-2 - framework-compat - laravel-transition-compat @@ -1043,6 +1121,7 @@ jobs: env: CORPUS_RESULT: ${{ needs.regression-corpus.result }} TEST_RESULT: ${{ needs.test.result }} + PHP_83_RESULT: ${{ needs.test-php83.result }} CARBON_2_RESULT: ${{ needs.carbon-2.result }} FRAMEWORK_RESULT: ${{ needs.framework-compat.result }} LARAVEL_TRANSITION_RESULT: ${{ needs.laravel-transition-compat.result }} @@ -1053,6 +1132,7 @@ jobs: run: | test "$CORPUS_RESULT" = success test "$TEST_RESULT" = success + test "$PHP_83_RESULT" = success test "$CARBON_2_RESULT" = success test "$FRAMEWORK_RESULT" = success test "$LARAVEL_TRANSITION_RESULT" = success