[rmcdaniel]

Five current #310 jobs stop before tests because the pinned shared PHP archive returns HTTP 404. The same setup action is used by published-image acceptance, so publishing #311 through that path would fail before its Composer and request-budget checks. Replace the six references in four workflows with the exact reviewed archive-refresh source from central #404. Installer and extraction rules, PHP versions/extensions, permissions, and acceptance assertions remain unchanged. Normal integration requires the shared action’s fresh hosted qualification and central policy acceptance, then current Waterline CI and independent source review.

The publication guide also still requires credential migration despite the standing operator decision and Waterline Security correction authorizing the existing repository credentials. Correct that obsolete prerequisite while preserving protected-main publication, credential-free builds, inert verification before login, and credential cleanup.

Validation: 73 focused workflow, release identity, native/published entry, and OCI controls pass; diff check passes. The original HTTP 404 failures remain failures. This PR changes no runtime/package/image bytes, credentials or environment settings and selects no tag, publisher, #310 cell, or M1 effect. The accepted #311 source/artifacts remain 9f2c1358 / native run 43590467209; any publisher from a later main commit requires the complete exact updated publication binding before selection.

Refs #311 and #310.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security source review PASS for exact 8b3ee293dcf31a0550fc2c6071ec5fee557b6de0, scoped to this five-file repair and not to a tag/publication effect.

All six retired 411a14ac… consumers are replaced by the same immutable 5c1ddbff… setup action reviewed in central PR #404; the workflow inputs, permissions, assertions, and downstream commands are unchanged, and no retired reference remains in current workflows. The publication documentation now matches the explicit operator decision in Cloud #450 and its Waterline #241 superseding disposition: existing repository credentials are authorized for normal protected publication, while candidate/native build jobs remain credential-free and the inert handoff precedes login. The actual publisher still uses the release-publication environment and its reviewed login step.

This verdict is conditional on central #404 completing its separate immutable-policy activation and fresh hosted setup qualification. The current Waterline central-policy failure and the known failed automatic acceptance jobs remain NONPASS; do not merge this pin or treat the earlier publication packet as complete until that dependency is accepted and the exact successor workflows pass. A revised exact publisher packet is still required after integration.

[rmcdaniel]

Security review at exact 8b3ee293dcf31a0550fc2c6071ec5fee557b6de0: PASS for the narrow source delta; integration remains held on central policy activation.

All six and only the six live setup-php-linux consumers move from retired 411a14ac… to immutable 5c1ddbff…; PHP versions, tools, extensions, permissions, trust bootstrap, installer inputs, and downstream assertions are unchanged. No 411a14ac consumer remains in these workflows. The action subtree at 5c1ddbff is byte-identical to central #404's final reviewed d8826b08 source, and central's closed policy records name 5c1ddbff as the new bound-linux-PHP action identity. Current Waterline jobs that reached it demonstrate the repaired setup path, while the retained original 404s are not relabeled.

The publication-guide correction is also supported by the exact standing decisions: Cloud #450 comment 6556442784 explicitly authorizes the existing repository DOCKERHUB_USERNAME/DOCKERHUB_TOKEN and Environment arrangements for normal publication, and Waterline #241 comment 6557110452 expressly supersedes credential rotation/removal as a release prerequisite. The edit retains protected-main publication, credential-free build jobs, inert verification before login, removal of authentication before anonymous acceptance, and all normal provenance/artifact gates.

The current central action-policy and target-branch failures remain real. Do not merge/select a tag or publisher until central #404's immutable required-policy transition is administered and accepted, then fresh exact-head Waterline gates reconcile. This verdict changes no credential, environment, runtime, package, image, tag, publisher, #310, or M1 state.