Confine the remaining CI and perf downloads (#677)

.github/workflows/kubernetes-validation.yml

@@ -43,10 +43,13 @@ jobs:
           install_dir="${RUNNER_TEMP}/bin"
           mkdir -p "${install_dir}"
 
-          curl -fsSL -o "${install_dir}/kind" https://kind.sigs.k8s.io/dl/v0.23.0/kind-linux-amd64
+          # Pinned by the projects' published SHA-256 sums (server#677).
+          curl --proto =https --tlsv1.2 -fsSL -o "${install_dir}/kind" https://kind.sigs.k8s.io/dl/v0.23.0/kind-linux-amd64
+          echo "1d86e3069ffbe3da9f1a918618aecbc778e00c75f838882d0dfa2d363bc4a68c  ${install_dir}/kind" | sha256sum --check --strict
           chmod +x "${install_dir}/kind"
 
-          curl -fsSL -o "${install_dir}/kubectl" https://dl.k8s.io/release/v1.29.9/bin/linux/amd64/kubectl
+          curl --proto =https --tlsv1.2 -fsSL -o "${install_dir}/kubectl" https://dl.k8s.io/release/v1.29.9/bin/linux/amd64/kubectl
+          echo "7b0de2466458cc3c12cf8742dc800c77d4fa72e831aa522df65e510d33b329e2  ${install_dir}/kubectl" | sha256sum --check --strict
           chmod +x "${install_dir}/kubectl"
 
           echo "${install_dir}" >> "${GITHUB_PATH}"

.github/workflows/server-perf-soak.yml

@@ -31,7 +31,7 @@ on:
         description: "Experimental HTTP runtime built from the exact published image"
         required: false
         type: choice
-        options: [apache, nginx-fpm, apache-event-fpm, frankenphp, swoole, openswoole]
+        options: [apache, nginx-fpm, apache-event-fpm]
         default: apache
       fixed_envelope:
         description: "Apply Server #137 fixed resource limits to every compared service"

docs/perf-runner.md

@@ -138,11 +138,10 @@ Artifacts land in `build/perf/` by default. The script removes the Compose proje
 
 For the Server #137 HTTP-runtime comparison, dispatch `Server Perf Soak` on
 `main` with an exact `published_server_image` digest, `fixed_envelope=true`,
-and `http_variant=apache`, `swoole`, or `openswoole`. Each dispatch uses the
-same published application, queue worker, scheduler, SDK fixture, workload,
-host plan, and 1-CPU/1-GiB HTTP cap. The Swoole variants build local Octane
-images from the selected published digest with 12 request workers and a
-500-request recycle limit; the official image remains the Apache baseline.
+and `http_variant=apache`, `nginx-fpm`, or `apache-event-fpm`. Each dispatch
+uses the same published application, queue worker, scheduler, SDK fixture,
+workload, host plan, and 1-CPU/1-GiB HTTP cap; the official image remains the
+Apache baseline. The Octane variants were removed in server#677.
 The fixed overlay pins MySQL, Redis, Composer and PHP image digests, caps the
 other services, and sets identical worker/query poll admission limits across
 variants. `server-image.json` records the actual HTTP

scripts/conformance/server-parity/native-image-corpus.sh

@@ -91,7 +91,7 @@ docker run --label "dev.durable-workflow.qualification.scope=$RESOURCE_SCOPE" -d
   "$image" -c 'while :; do php artisan workflow:v2:repair-pass --json; php artisan schedule:evaluate --limit=100 --json; sleep 1; done' >/dev/null
 
 mkdir -p parity-consumers
-curl --fail --location --retry 3 --silent --output parity-consumers/dw.phar https://github.com/durable-workflow/cli/releases/download/2.2.0/dw.phar
+curl --proto =https --proto-redir =https --fail --location --retry 3 --silent --output parity-consumers/dw.phar https://github.com/durable-workflow/cli/releases/download/2.2.0/dw.phar
 printf '%s  %s\n' "$(jq -r '.visibility.cli.phar_sha256' tests/Fixtures/ServerParity/visibility-current-runs.json)" parity-consumers/dw.phar \
   | sha256sum -c > parity-evidence/cli-artifact.txt
 export DW_PARITY_CLI_PHAR=/source/parity-consumers/dw.phar