Repository navigation
ci: check dependency licenses - #5
Merged
Merged
Conversation
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Use one six-target native workflow for exact published-source PR checks and production builds. Preserve the PHP binding and native loader names. Require locked Cargo/std and pinned Zig runtime notices, actual embedded bytes and sidecars, archive member guards and PHP tests on matching CPUs. Keep pure consumers unchanged and download distribution artifacts only. No release, version change or publication is invoked. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Include the verified Rust 1.99.1 compiler-builtins, LLVM compiler-rt and libm collection in native Cargo/std notices. Preserve fourteen complete original materials, four full legal/credits documents and exact source, Git blob and SHA256 identities. Keep the compiler-builtins MIT AND Apache-2.0 WITH LLVM-exception expression unchanged. Stage the collector, profile, originals and regression tests before the original-source checkout in the shared native producer. Preserve all previous Cargo, std, Zig/runtime, resource and source fields, parser APIs and versions. This is a conservative compiler-source collection, not a linked-code inventory, MSVC/SDK terms approval or historical package repair. No local build/test, tag/release or publication is performed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The existing Windows PHP installer selects x64 even on an ARM64 runner. Do not present emulated x64 PHP as native ARM64 DLL consumer evidence. Build an isolated CI-only PHP 8.2 CLI/phpdbg host from the hash-pinned official source archive, pinned official PHP SDK and pinned vcpkg libffi port. Require a genuine ARM64 runner, actual ARM64 PE files and native FFI calls. Upload only bounded diagnostic data, not interpreter binaries. Keep all Ktav source, dependencies, versions, tests, native producers, release workflows and published assets unchanged. This is host feasibility, not final GNU C ABI consumer acceptance or a redistribution grant. No local builds/tests, publication, tags, merge or deployment. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The official hash-pinned PHP 8.2.35 archive contains a regular ext/fileinfo/data_file.c of 42,528,803 bytes. The initial 32 MiB member limit rejected it before any host compilation. Independent inert tar inspection found no unsafe paths, links, duplicates or other violations. Allow only that exact path, size and SHA-256 above the ordinary limit. Retain all path/type/duplicate/archive/decoded size guards, report the rejected member, and save archive provenance before validation so early failures still deliver diagnostic evidence. Do not skip the archive gate or change project code, dependencies, versions or publication behavior. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The ARM64 runner successfully builds libffi using Visual Studio 18, but the PHP SDK invocation requested absent VS17. PHP 8.2.35 and the pinned official SDK already support VS18. Select that actual installed host compiler without installing or upgrading tools or changing targets. Keep all source/archive/PE/FFI guards and Ktav product sources, versions, dependencies and distribution workflows unchanged. No local builds/tests, package publication, Microsoft agreement acceptance, merge or deployment. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Build original PHP 0.8.1 C ABI source for genuine Windows x64 and ARM64 GNU/LLVM targets with exact reviewed core/lock, SDK inputs, retained objects, compiler originals and complete original runtime grants. Require unchanged native/pure PHP suites on real matching CPU PHP CLI hosts, exact delivered DLL identity and no Rust/SDK paths. ARM64 uses the source-built host already proved in CI, with bundled mbstring, tokenizer, ctype and filter required by the original tests. x64 PHP on ARM is used only for Composer preparation, never as native CPU proof. Keep the six original documented canonical gaps explicit. Fail on new skips, pending/excluded tests or failed/errored cases. Do not patch tests, APIs, versions or dependencies. Move the standalone host probe to manual invocation now that the real consumer owns the same host preparation. Production/native release workflows remain unchanged. No local builds, tests or native execution, interpreter redistribution, publication, tag, merge, deployment, Microsoft agreement acceptance or historical repair. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The original x64 suites pass 2618 cases with six documented canonical skips. Their two unchanged ValueCycleSpec callbacks execute bounded children but contain no Kahlan expect calls, so Kahlan classifies them as pending after successful execution. The new proof incorrectly treated that original framework classification as an unexecuted product test. Require separate ordinary native and pure cycle children with bounded execution, exact exit codes and completion markers. Permit the two original pending locations only after this mandatory proof; reject any other pending, excluded, failed or errored test. Keep native corpus pending at zero and account for all summary categories exactly. Preserve original source/spec/tests and all six documented canonical gaps unchanged. Save actual JSON before validation for failure diagnosis. No local tests/builds, publication, version bump, merge or deployment. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Reuse the independently verified original-source GNU producer from the shared PR/production native preparation path. Replace only the two old Windows MSVC rows; preserve the other four targets, compatibility asset filenames, exact source contract and all original publication gates. Require genuine x64/ARM64 PHP consumers and ordinary bounded cycle child proof before staging exact DLLs and complete embedded/adjacent compiler, runtime and source-grant materials. Keep the six existing canonical gaps and exact original framework pending classification explicit. Add negative CI contract regressions and generate/check a proposed new EN/RU/ZH runtime documentation unit only in CI. Preserve all existing doc units and defer source/generated Markdown finalization to verified artifact readback. No local generator, builds/tests, version/API changes, publication, tag, merge, deployment or historical asset repair. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Commit the reviewed new EN/RU/ZH Windows runtime unit, its exact manifest insertion and byte-identical CI-generated Markdown. Preserve all prior doc units and generated content. Describe genuine target/consumer CPU, unchanged asset names, full embedded/adjacent grant/source resources, external PHP/FFI requirements and self-contained pure mode. Keep six original canonical gaps explicit and require separate ordinary native/pure proof for the two no-expectation cycle specifications. The source-built ARM interpreter remains only a CI tool, never a bundled consumer dependency. Historical assets remain outside this preparation. Remove only the temporary proposal fixtures and generator job. Preserve all native producers, genuine consumers, raw role and publication guards. No local generator/builds/tests, version changes, publication, tag, merge, deployment or Microsoft redistribution agreement acceptance. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PHPCraftdream
marked this pull request as ready for review
November 2, 2026 12:33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Limitations
The Composer graph is resolved on Linux without a committed lockfile; other platforms or future resolutions may differ. License metadata does not establish compliance with notice, attribution, or source-distribution obligations.
Verification
GitHub CI pending. No local tests or builds were run.
🤖 Generated with Claude Code