Repository navigation
Update github-actions (major) #122
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # https://help.github.com/en/categories/automating-your-workflow-with-github-actions | |
| name: "Build Turbo compile images" | |
| # Builds .github/turbo-build/Dockerfile natively on x86_64 and arm64 | |
| # runners and publishes ghcr.io/phpstan/turbo-build:gnu-php{8.3,8.4,8.5,8.6} | |
| # and the thread-safe gnu-php8.6-zts as multi-arch manifests. The | |
| # turbo-compile gnu legs in phar.yml run in these images, so their only | |
| # network dependency is a GHCR pull — no apt, no ports.ubuntu.com, no PPA at | |
| # compile time. | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| paths: | |
| - ".github/turbo-build/**" | |
| - ".github/workflows/turbo-build-image.yml" | |
| push: | |
| branches: | |
| - "2.3.x" | |
| paths: | |
| - ".github/turbo-build/**" | |
| - ".github/workflows/turbo-build-image.yml" | |
| schedule: | |
| # weekly rebuild so PHP patch releases and security updates flow into | |
| # the baked images — the compile jobs never run apt themselves | |
| - cron: '30 2 * * 1' | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: turbo-build-image-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| build: | |
| name: "Build image (php${{ matrix.tag }}, ${{ matrix.platform.arch }})" | |
| if: github.repository == 'phpstan/phpstan-src' | |
| runs-on: ${{ matrix.platform.runs-on }} | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: read | |
| packages: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # <minor>[-zts]; a -zts tag builds a thread-safe PHP of that minor | |
| tag: ["8.3", "8.4", "8.5", "8.6", "8.6-zts"] | |
| platform: | |
| - arch: "amd64" | |
| runs-on: "ubuntu-latest" | |
| - arch: "arm64" | |
| runs-on: "ubuntu-24.04-arm" | |
| env: | |
| IMAGE: "ghcr.io/phpstan/turbo-build:gnu-php${{ matrix.tag }}-${{ matrix.platform.arch }}" | |
| TAG: ${{ matrix.tag }} | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| - name: "Checkout" | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: "Build" | |
| run: | | |
| MINOR="${TAG%-zts}" | |
| ZTS=$([ "$MINOR" != "$TAG" ] && echo 1 || echo 0) | |
| docker build --build-arg "PHP_MINOR=$MINOR" --build-arg "PHP_ZTS=$ZTS" -t "$IMAGE" .github/turbo-build | |
| - name: "Smoke test (interpreter matches the matrix, toolchain present)" | |
| run: | | |
| MINOR="${TAG%-zts}" | |
| ZTS=$([ "$MINOR" != "$TAG" ] && echo 1 || echo 0) | |
| VERSION="$(docker run --rm "$IMAGE" php -r 'echo PHP_VERSION, " ", (int) PHP_ZTS;')" | |
| echo "image reports PHP $VERSION (version, ZTS), expected $MINOR.* $ZTS" | |
| [ "${VERSION%.* *}" = "$MINOR" ] | |
| [ "${VERSION##* }" = "$ZTS" ] | |
| docker run --rm "$IMAGE" sh -c 'php-config --version && git --version && g++ --version && make --version && curl --version' | |
| # PR runs stop here: build + smoke validate the Dockerfile change, | |
| # only pushes to 2.3.x (and the cron/manual runs) publish. | |
| - name: "Log in to GHCR" | |
| if: github.event_name != 'pull_request' | |
| run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin | |
| - name: "Push" | |
| if: github.event_name != 'pull_request' | |
| run: docker push "$IMAGE" | |
| manifest: | |
| name: "Publish multi-arch manifest (php${{ matrix.tag }})" | |
| if: github.repository == 'phpstan/phpstan-src' && github.event_name != 'pull_request' | |
| needs: build | |
| runs-on: "ubuntu-latest" | |
| timeout-minutes: 10 | |
| permissions: | |
| packages: write | |
| strategy: | |
| matrix: | |
| tag: ["8.3", "8.4", "8.5", "8.6", "8.6-zts"] | |
| env: | |
| TAG: "ghcr.io/phpstan/turbo-build:gnu-php${{ matrix.tag }}" | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| - name: "Log in to GHCR" | |
| run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin | |
| - name: "Create and push the manifest" | |
| run: docker buildx imagetools create -t "$TAG" "$TAG-amd64" "$TAG-arm64" | |
| - name: "Verify both platforms are present" | |
| run: | | |
| docker buildx imagetools inspect "$TAG" | tee manifest.txt | |
| grep -q "linux/amd64" manifest.txt | |
| grep -q "linux/arm64" manifest.txt |