Qualify PHP unit and Carbon jobs on read-only runtimes

.github/workflows/ci.yml

@@ -127,37 +127,114 @@ jobs:
   test:
     name: PHP ${{ matrix.php }}
     runs-on: ubuntu-24.04
+    needs: action-policy
     timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
-        php: ['8.1', '8.2', '8.3', '8.4']
+        php: ['8.1', '8.2', '8.4']
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
         with:
-          python-version: '3.12'
+          persist-credentials: false
+      - name: Check out the fixed APT prerequisite
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
+        with:
+          repository: durable-workflow/.github
+          ref: 18783be6bef737cc778e4c7282a8797e39daa61a
+          path: .central-apt-source
+          persist-credentials: false
+      - name: Select Ubuntu's Python 3.12
+        run: |
+          /usr/bin/python3 -I -S -c 'import sys; assert sys.version_info[:2] == (3, 12)'
+          echo /usr/bin >> "$GITHUB_PATH"
       - name: Select authenticated dependency trust
-        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5  # clean-trust
         with:
           clients: pip,python,composer,curl,git
       - name: Disable APT download retries (CVE-2026-109518)
         run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null
-      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240  # v2
+      - name: Prepare the reviewed PHP container runtime
+        run: bash "$GITHUB_WORKSPACE/scripts/ci/setup-php-container.sh" "${{ matrix.php }}"
+      - name: Verify Composer trust before requests
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5  # clean-trust
+      - run: composer validate --strict
+      - name: Verify Composer trust before requests
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5  # clean-trust
+      - run: composer install --no-interaction --prefer-dist
+      - name: Lint PHP
+        run: php scripts/ci/lint-php.php
+      - name: Verify Composer trust before requests
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5  # clean-trust
+      - run: |
+          mkdir -p build
+          php scripts/ci/reference-replay-clock-numbers.php > build/replay-clock-numbers.json
+          composer test -- --log-junit build/phpunit.xml
+      - name: Retain source numeric observations
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
-          php-version: ${{ matrix.php }}
-          tools: composer:2.10.3
+          name: replay-clock-numbers-php-${{ matrix.php }}
+          path: build/replay-clock-numbers.json
+          if-no-files-found: error
+          retention-days: 90
+      - name: Verify Composer trust before requests
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5  # clean-trust
+      - run: composer check-boundary
+      - name: Verify Composer trust before requests
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5  # clean-trust
+      - name: Preserve the HTTP-only PHP 8.1 platform
+        if: matrix.php == '8.1'
+        run: composer check-http-only-platform
+
+  test-php83:
+    name: PHP 8.3
+    runs-on: ubuntu-24.04
+    needs: action-policy
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
+        with:
+          persist-credentials: false
+      - name: Select Ubuntu's Python 3.12
+        run: |
+          /usr/bin/python3 -I -S -c 'import sys; assert sys.version_info[:2] == (3, 12)'
+          echo /usr/bin >> "$GITHUB_PATH"
+      - name: Create isolated Composer state
+        run: |
+          state="$(mktemp -d "$RUNNER_TEMP/php-check.XXXXXX")"
+          mkdir -m 700 "$state/home" "$state/cache" "$state/tmp"
+          {
+            echo "COMPOSER_HOME=$state/home"
+            echo "COMPOSER_CACHE_DIR=$state/cache"
+            echo "TMPDIR=$state/tmp"
+          } >> "$GITHUB_ENV"
+      - name: Select authenticated dependency trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5  # clean-trust
+        with:
+          clients: pip,python,composer,curl,git
+      - name: Disable APT download retries (CVE-2026-109518)
+        run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null
+      - uses: durable-workflow/.github/.github/actions/setup-php-linux@411a14ac07d32073eed6ab4977f2825eba4739a7  # bound-linux-php
+        with:
+          php-version: '8.3'
+          ini-file: production
+          tools: composer:2.10.3,phpunit:11.5.57
           coverage: none
+      - name: Require the existing process-control modules
+        run: |
+          php -r 'foreach (["pcntl", "posix"] as $extension) { if (!extension_loaded($extension)) { throw new RuntimeException("Missing extension: ".$extension); } }
+            foreach (["pcntl_fork", "pcntl_waitpid", "pcntl_signal", "pcntl_async_signals", "posix_kill"] as $function) { if (!function_exists($function)) { throw new RuntimeException("Missing function: ".$function); } }'
       - name: Verify Composer trust before requests
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5  # clean-trust
       - run: composer validate --strict
       - name: Verify Composer trust before requests
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5  # clean-trust
       - run: composer install --no-interaction --prefer-dist
       - name: Lint PHP
         run: find src tests examples -name '*.php' -print0 | xargs -0 -n1 php -l
       - name: Verify Composer trust before requests
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5  # clean-trust
       - run: |
           mkdir -p build
           php scripts/ci/reference-replay-clock-numbers.php > build/replay-clock-numbers.json
@@ -166,62 +243,62 @@ jobs:
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
-          name: replay-clock-numbers-php-${{ matrix.php }}
+          name: replay-clock-numbers-php-8.3
           path: build/replay-clock-numbers.json
           if-no-files-found: error
           retention-days: 90
       - name: Retain PHP 8.3 source test evidence
-        if: always() && matrix.php == '8.3'
+        if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: php-8.3-source-tests
           path: build/phpunit.xml
           if-no-files-found: error
           retention-days: 90
       - name: Verify Composer trust before requests
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5  # clean-trust
       - name: Enforce Avro Value regression budget
-        if: matrix.php == '8.3'
         run: composer benchmark-avro-value
       - name: Verify Composer trust before requests
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5  # clean-trust
       - run: composer check-boundary
-      - name: Verify Composer trust before requests
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
-      - name: Preserve the HTTP-only PHP 8.1 platform
-        if: matrix.php == '8.1'
-        run: composer check-http-only-platform
 
   carbon-2:
     name: PHP 8.1 with Carbon 2
     runs-on: ubuntu-24.04
+    needs: action-policy
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
         with:
           persist-credentials: false
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
+      - name: Check out the fixed APT prerequisite
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
         with:
-          python-version: '3.12'
+          repository: durable-workflow/.github
+          ref: 18783be6bef737cc778e4c7282a8797e39daa61a
+          path: .central-apt-source
+          persist-credentials: false
+      - name: Select Ubuntu's Python 3.12
+        run: |
+          /usr/bin/python3 -I -S -c 'import sys; assert sys.version_info[:2] == (3, 12)'
+          echo /usr/bin >> "$GITHUB_PATH"
       - name: Select authenticated dependency trust
-        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5  # clean-trust
         with:
           clients: pip,python,composer,curl,git
       - name: Disable APT download retries (CVE-2026-109518)
         run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null
-      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240  # v2
-        with:
-          php-version: '8.1'
-          tools: composer:2.10.3
-          coverage: none
+      - name: Prepare the reviewed PHP container runtime
+        run: bash "$GITHUB_WORKSPACE/scripts/ci/setup-php-container.sh" "8.1" carbon2
       - name: Constrain the manifest to the oldest supported Carbon major
         run: |
           php -r '$path = "composer.json";
             $manifest = json_decode((string) file_get_contents($path), flags: JSON_THROW_ON_ERROR);
             $manifest->require->{"nesbot/carbon"} = "^2.72.6";
             file_put_contents($path, json_encode($manifest, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_THROW_ON_ERROR)."\n");'
       - name: Verify Composer trust before requests
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5  # clean-trust
       - run: composer install --no-interaction --prefer-dist --no-progress
       - name: Require Carbon 2
         run: |
@@ -230,7 +307,7 @@ jobs:
             fwrite(STDOUT, "nesbot/carbon {$version}\n");
             exit(str_starts_with($version, "2.") ? 0 : 1);'
       - name: Verify Composer trust before requests
-        uses: durable-workflow/.github/.github/actions/verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
+        uses: durable-workflow/.github/.github/actions/verify-composer-trust@242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5  # clean-trust
       - run: |
           mkdir -p build
           php scripts/ci/reference-replay-clock-numbers.php > build/replay-clock-numbers.json
@@ -1023,6 +1100,7 @@ jobs:
       - action-policy
       - regression-corpus
       - test
+      - test-php83
       - carbon-2
       - framework-compat
       - laravel-transition-compat
@@ -1043,6 +1121,7 @@ jobs:
         env:
           CORPUS_RESULT: ${{ needs.regression-corpus.result }}
           TEST_RESULT: ${{ needs.test.result }}
+          PHP_83_RESULT: ${{ needs.test-php83.result }}
           CARBON_2_RESULT: ${{ needs.carbon-2.result }}
           FRAMEWORK_RESULT: ${{ needs.framework-compat.result }}
           LARAVEL_TRANSITION_RESULT: ${{ needs.laravel-transition-compat.result }}
@@ -1053,6 +1132,7 @@ jobs:
         run: |
           test "$CORPUS_RESULT" = success
           test "$TEST_RESULT" = success
+          test "$PHP_83_RESULT" = success
           test "$CARBON_2_RESULT" = success
           test "$FRAMEWORK_RESULT" = success
           test "$LARAVEL_TRANSITION_RESULT" = success