Skip to content
ci

Run PHP 8.4 and 8.5 checks in pinned official containers #1057

Sign in to view logs

Run PHP 8.4 and 8.5 checks in pinned official containers

Run PHP 8.4 and 8.5 checks in pinned official containers #1057

Workflow file for this run

.github/workflows/ci.yml at 5983101
name: ci
on:
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:
permissions:
contents: read
jobs:
test:
name: php artisan test (php ${{ matrix.php }})
runs-on: ubuntu-latest
timeout-minutes: 30
strategy:
fail-fast: false
matrix:
php: ['8.4', '8.5']
services:
mysql:
image: mysql:8.0
env:
MYSQL_ROOT_PASSWORD: secret
MYSQL_DATABASE: sample
MYSQL_USER: laravel
MYSQL_PASSWORD: password
ports:
- 3306/tcp
options: >-
--health-cmd="mysqladmin ping -h 127.0.0.1 -u root --password=secret"
--health-interval=5s
--health-timeout=5s
--health-retries=20
redis:
image: redis:7-alpine
ports:
- 6379/tcp
options: >-
--health-cmd="redis-cli ping"
--health-interval=3s
--health-timeout=3s
--health-retries=10
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
with:
python-version: '3.13'
- name: Select authenticated dependency trust
uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
with:
clients: pip,python,composer,curl,git,npm
- name: Disable APT download retries (CVE-2026-109518)
run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null
- name: Check out the accepted PHP container build source
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
repository: durable-workflow/.github
ref: 18783be6bef737cc778e4c7282a8797e39daa61a
path: .central-apt-source
persist-credentials: false
- name: Build the pinned PHP runtime and install launchers
run: bash "$GITHUB_WORKSPACE/scripts/ci/setup-php-container.sh" "${{ matrix.php }}"
- name: Verify actual Composer trust before dependency requests
uses: durable-workflow/.github/.github/actions/verify-composer-trust@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
- name: Install dependencies
run: composer install --prefer-dist --no-progress --no-interaction
- name: Verify the playground Composer configuration
uses: durable-workflow/.github/.github/actions/verify-composer-trust@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
with:
working-directory: playground/php-runtime
- name: Validate packages and stable artifact tuple
run: |
composer validate --strict --no-check-all
composer audit --locked
composer install --working-dir=playground/php-runtime --prefer-dist --no-dev --no-progress --no-interaction
scripts/resolve-current-artifacts.sh
php scripts/ci/validate-composer-artifact-graph.php
composer docs:check-ai-contract
- name: Prepare application
run: |
cp .env.example .env
php artisan key:generate
if getent hosts mysql >/dev/null 2>&1; then
{
echo "DB_HOST=mysql"
echo "DB_PORT=3306"
echo "SHARED_DB_HOST=mysql"
echo "SHARED_DB_PORT=3306"
echo "REDIS_HOST=redis"
echo "REDIS_PORT=6379"
} >> "$GITHUB_ENV"
else
{
echo "DB_HOST=127.0.0.1"
echo "DB_PORT=${{ job.services.mysql.ports['3306'] }}"
echo "SHARED_DB_HOST=127.0.0.1"
echo "SHARED_DB_PORT=${{ job.services.mysql.ports['3306'] }}"
echo "REDIS_HOST=127.0.0.1"
echo "REDIS_PORT=${{ job.services.redis.ports['6379'] }}"
} >> "$GITHUB_ENV"
fi
- uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
node-version: '22.23.4'
- name: Verify Node before running application tooling
run: node docker/verify-node-trust.mjs
- name: Run application tests
env:
DB_CONNECTION: mysql
DB_DATABASE: sample
DB_USERNAME: laravel
DB_PASSWORD: password
SHARED_DB_DATABASE: sample
SHARED_DB_USERNAME: laravel
SHARED_DB_PASSWORD: password
REDIS_CLIENT: phpredis
run: |
php artisan test
npm run test:node
microservice-test:
name: microservice composer and tests (php ${{ matrix.php }})
runs-on: ubuntu-latest
timeout-minutes: 15
defaults:
run:
working-directory: microservice
strategy:
fail-fast: false
matrix:
php: ['8.4', '8.5']
services:
mysql:
image: mysql:8.0
env:
MYSQL_ROOT_PASSWORD: secret
MYSQL_DATABASE: microservice
MYSQL_USER: laravel
MYSQL_PASSWORD: password
ports:
- 3306/tcp
options: >-
--health-cmd="mysqladmin ping -h 127.0.0.1 -u root --password=secret"
--health-interval=5s
--health-timeout=5s
--health-retries=20
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
with:
python-version: '3.13'
- name: Select authenticated dependency trust
uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
with:
clients: pip,python,composer,curl,git
- name: Disable APT download retries (CVE-2026-109518)
run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null
- name: Check out the accepted PHP container build source
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
repository: durable-workflow/.github
ref: 18783be6bef737cc778e4c7282a8797e39daa61a
path: .central-apt-source
persist-credentials: false
- name: Build the pinned PHP runtime and install launchers
run: bash "$GITHUB_WORKSPACE/scripts/ci/setup-php-container.sh" "${{ matrix.php }}"
- name: Verify actual Composer trust before dependency requests
uses: durable-workflow/.github/.github/actions/verify-composer-trust@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
with:
working-directory: microservice
- name: Install and test
env:
DB_CONNECTION: mysql
DB_HOST: 127.0.0.1
DB_PORT: ${{ job.services.mysql.ports['3306'] }}
DB_DATABASE: microservice
DB_USERNAME: laravel
DB_PASSWORD: password
SHARED_DB_HOST: 127.0.0.1
SHARED_DB_PORT: ${{ job.services.mysql.ports['3306'] }}
SHARED_DB_DATABASE: microservice
SHARED_DB_USERNAME: laravel
SHARED_DB_PASSWORD: password
run: |
composer validate --strict --check-lock --no-check-all
composer install --prefer-dist --no-progress --no-interaction
composer audit --locked
php artisan test
action-policy:
name: Central action policy preflight
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
repository: durable-workflow/.github
ref: main
path: .central-action-policy
persist-credentials: false
- uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
with:
python-version: '3.13'
- name: Bootstrap patched pip trust
uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 # clean-trust
- run: 'python -m pip install --only-binary :all: PyYAML==6.0.2'
- name: Require centrally approved immutable action commits
run: >-
python .central-action-policy/scripts/qualification_policy.py validate
--policy .central-action-policy/qualification/policy.json
--target sample-app
--workflow-directory .github/workflows
image-security-tests:
name: Image security behavior
runs-on: ubuntu-24.04
timeout-minutes: 5
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
with:
python-version: '3.13'
- run: python -m unittest discover -s tests/ci -p 'test_*.py'
target-branch-qualification:
name: Target branch qualification
if: always()
needs: [test, microservice-test, action-policy, image-security-tests]
runs-on: ubuntu-latest
timeout-minutes: 2
steps:
- name: Require application tests
run: test "${{ needs.test.result }}" = success
- name: Require microservice tests
run: test "${{ needs.microservice-test.result }}" = success
- name: Require action policy
env:
ACTION_POLICY_RESULT: ${{ needs.action-policy.result }}
run: test "$ACTION_POLICY_RESULT" = success
- name: Require image security behavior
env:
IMAGE_SECURITY_RESULT: ${{ needs.image-security-tests.result }}
run: test "$IMAGE_SECURITY_RESULT" = success