From ef71c2c557928cc35b5eef515008aa04a43b536f Mon Sep 17 00:00:00 2001 From: Eirini Galati Date: Sun, 1 Nov 2026 00:23:43 +0100 Subject: [PATCH 1/7] fix: pin phpstan and record two intentional findings The phpstan job has been red on every branch since April, and the errors kept changing because composer.phpstan.json asked for ^2.1 with its lock file gitignored, so each run resolved whatever was newest. In September it reported two curl_getinfo stub errors at Client.php:156-157; it now reports two entirely different ones. Pinning to an exact version stops the target moving. Against 2.3.4 the two remaining findings are correct, not false positives: 127 Comparison operation ">=" between 0|1 and 0 is always true 199 Unreachable statement - code above always terminates Every path through the Client::request retry loop returns, continues or throws, and a continue only happens while $retries > 0. So $retries is only ever 0 or 1 at the condition check, and the loop never ends by exhausting its bound, which makes the trailing throw dead today. Both constructs are deliberate -- the bound documents the retry budget and the throw guards against a future edit introducing a fall-through path -- so they are recorded in ignoreErrors with that reasoning rather than removed. Worth a maintainer decision if you would rather drop the throw. Verified: phpstan reports no errors on both PHP 7.4 (what CI uses) and 8.3. --- composer.phpstan.json | 2 +- phpstan.neon | 14 ++++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/composer.phpstan.json b/composer.phpstan.json index 223a3cf..be4c190 100644 --- a/composer.phpstan.json +++ b/composer.phpstan.json @@ -4,6 +4,6 @@ "vendor-dir": "vendor-phpstan" }, "require": { - "phpstan/phpstan": "^2.1" + "phpstan/phpstan": "2.3.4" } } diff --git a/phpstan.neon b/phpstan.neon index d6b47fe..cf575f1 100644 --- a/phpstan.neon +++ b/phpstan.neon @@ -3,3 +3,17 @@ parameters: level: 5 paths: - lib + ignoreErrors: + # Client::request retries by decrementing $retries and every path + # through the loop body returns, continues or throws. A continue only + # happens while $retries > 0, so at the condition check $retries is + # always 0 or 1 and the bound is never what ends the loop. Both of the + # findings below follow from that and are deliberate: the bound states + # the retry budget, and the trailing throw guards against a future edit + # introducing a path that falls out of the loop. + - + identifier: greaterOrEqual.alwaysTrue + path: lib/Tinify/Client.php + - + identifier: deadCode.unreachable + path: lib/Tinify/Client.php From 0f5b3adda5db503c889c9f6887bc40861929b3d9 Mon Sep 17 00:00:00 2001 From: Eirini Galati Date: Mon, 2 Nov 2026 10:34:49 +0100 Subject: [PATCH 2/7] fix: unbreak the macOS and PHP 5.4 Windows CI jobs Neither failure is about dependency resolution, and neither needs a committed composer.lock. PHP 5.4 resolves and tests fine today on both ubuntu and macOS; only specific runner/OS combinations are broken. macOS, PHP 5.6/7.4/8.0/8.5: killed at exactly 10m04s by timeout-minutes, every time, inside setup-php and before actions/checkout runs. macOS 5.4 finishes in 37s, so the others are compiling rather than fetching a prebuilt binary. Raised the timeout to 30 minutes for both jobs. Windows, PHP 5.4: composer exits 1 roughly a quarter of a second after "Loading composer repositories", printing nothing at all. A resolution failure would explain itself, so this is a crash. It passed in September and nothing in the repo changed, so the runner moved. composer 2.3 raised its floor to PHP 7.2.5 and `tools: composer:v2` installs the newest 2.x, which makes an incompatible composer the most likely cause, so the 5.x jobs now ask for the 2.2 LTS line explicitly. The Windows change is a best guess that CI can confirm or refute quickly. If 5.4 on Windows still crashes, the fallback is to drop that one combination; 5.4 stays genuinely covered by ubuntu and macOS either way. --- .github/workflows/ci-cd.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci-cd.yaml b/.github/workflows/ci-cd.yaml index 214caa1..2576912 100644 --- a/.github/workflows/ci-cd.yaml +++ b/.github/workflows/ci-cd.yaml @@ -7,7 +7,7 @@ permissions: {} jobs: Unit_tests: runs-on: ${{ matrix.os }} - timeout-minutes: 10 + timeout-minutes: 30 strategy: fail-fast: false matrix: @@ -23,7 +23,9 @@ jobs: - uses: shivammathur/setup-php@2.32.0 with: php-version: ${{ matrix.php-version }} - tools: composer:v2 + # composer 2.3 raised its floor to PHP 7.2.5, so the 5.x jobs need + # the 2.2 LTS line. composer:v2 resolves to the newest 2.x. + tools: ${{ startsWith(matrix.php-version, '5.') && 'composer:2.2' || 'composer:v2' }} - uses: actions/checkout@v3 - name: Validate composer.json and composer.lock run: composer validate --strict @@ -34,7 +36,7 @@ jobs: Integration_tests: if: github.event_name == 'push' runs-on: ${{ matrix.os }} - timeout-minutes: 10 + timeout-minutes: 30 needs: Unit_tests strategy: fail-fast: false From 23817cbda7fed20e3adbd5d10b314c28a11bfa2e Mon Sep 17 00:00:00 2001 From: Eirini Galati Date: Mon, 2 Nov 2026 10:54:35 +0100 Subject: [PATCH 3/7] ci: temporarily surface PHP errors to diagnose the 5.4 Windows crash --- .github/workflows/ci-cd.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci-cd.yaml b/.github/workflows/ci-cd.yaml index 2576912..4b13d18 100644 --- a/.github/workflows/ci-cd.yaml +++ b/.github/workflows/ci-cd.yaml @@ -26,6 +26,9 @@ jobs: # composer 2.3 raised its floor to PHP 7.2.5, so the 5.x jobs need # the 2.2 LTS line. composer:v2 resolves to the newest 2.x. tools: ${{ startsWith(matrix.php-version, '5.') && 'composer:2.2' || 'composer:v2' }} + # TEMPORARY: setup-php's production ini sets display_errors=Off, which + # is why the 5.4 Windows crash prints nothing. Surface it. + ini-values: display_errors=On, error_reporting=-1 - uses: actions/checkout@v3 - name: Validate composer.json and composer.lock run: composer validate --strict From ef06a1bc82b84448903378cde7a87b0dbee7df2d Mon Sep 17 00:00:00 2001 From: Eirini Galati Date: Mon, 2 Nov 2026 10:57:56 +0100 Subject: [PATCH 4/7] ci: add composer -vvv to diagnose the 5.4 Windows crash --- .github/workflows/ci-cd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-cd.yaml b/.github/workflows/ci-cd.yaml index 4b13d18..f833c39 100644 --- a/.github/workflows/ci-cd.yaml +++ b/.github/workflows/ci-cd.yaml @@ -33,7 +33,7 @@ jobs: - name: Validate composer.json and composer.lock run: composer validate --strict - name: Install Dependencies - run: composer install --no-ansi --no-interaction --no-progress + run: composer install -vvv --no-ansi --no-interaction --no-progress 2>&1 - name: Run test suite run: vendor/bin/phpunit Integration_tests: From ca20989846f70d43303f9927bf4a6f1321789c34 Mon Sep 17 00:00:00 2001 From: Eirini Galati Date: Mon, 2 Nov 2026 11:02:48 +0100 Subject: [PATCH 5/7] ci: drop the PHP 5.4 Windows job and revert the diagnostics Reverts the temporary display_errors and composer -vvv changes from the two preceding commits, now that they have answered the question. composer -vvv showed the job reaching Downloading https://repo.packagist.org/packages.json and the process then exiting 1 with no output whatsoever, 0.17s later. Nothing was printed even with display_errors=On and error_reporting=-1, so this is not a suppressed PHP error; the process dies. The CA bundle is located and reported valid immediately beforehand, so it is not certificate discovery either. PHP 5.4.45 on Windows NT 6.2 cannot complete a TLS handshake with packagist and crashes rather than failing. On ubuntu and macOS, PHP 5.4 links the system OpenSSL and passes. Packagist's TLS requirements are not ours to change and the PHP 5.4 Windows binaries are long EOL, so nothing in this repo can fix this combination. It passed in September; the runner image moved, not the repo. PHP 5.4 support is unaffected. It stays in the matrix and stays genuinely tested, on ubuntu and macOS, and composer.json still declares >=5.3.0. --- .github/workflows/ci-cd.yaml | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci-cd.yaml b/.github/workflows/ci-cd.yaml index f833c39..fc42271 100644 --- a/.github/workflows/ci-cd.yaml +++ b/.github/workflows/ci-cd.yaml @@ -19,6 +19,21 @@ jobs: "8.5", ] os: [ubuntu-latest, macOS-latest, windows-latest] + exclude: + # PHP 5.4 on Windows dies on its first TLS connection to packagist: + # composer -vvv reaches "Downloading https://repo.packagist.org/ + # packages.json" and the process exits 1 with no output at all, even + # with display_errors=On and error_reporting=-1. The CA bundle is + # found and reported valid first, so this is not certificate + # discovery. PHP 5.4's bundled OpenSSL on Windows cannot negotiate + # with packagist's current TLS, and crashes rather than erroring. + # It passed in September; the runner moved, not this repo. + # + # Nothing in this repo can fix that, so the combination is dropped. + # PHP 5.4 stays covered on ubuntu and macOS, where it links the + # system OpenSSL and passes. + - php-version: "5.4" + os: windows-latest steps: - uses: shivammathur/setup-php@2.32.0 with: @@ -26,14 +41,11 @@ jobs: # composer 2.3 raised its floor to PHP 7.2.5, so the 5.x jobs need # the 2.2 LTS line. composer:v2 resolves to the newest 2.x. tools: ${{ startsWith(matrix.php-version, '5.') && 'composer:2.2' || 'composer:v2' }} - # TEMPORARY: setup-php's production ini sets display_errors=Off, which - # is why the 5.4 Windows crash prints nothing. Surface it. - ini-values: display_errors=On, error_reporting=-1 - uses: actions/checkout@v3 - name: Validate composer.json and composer.lock run: composer validate --strict - name: Install Dependencies - run: composer install -vvv --no-ansi --no-interaction --no-progress 2>&1 + run: composer install --no-ansi --no-interaction --no-progress - name: Run test suite run: vendor/bin/phpunit Integration_tests: From fb4ca71fe7fcb3ece83dea04d8b34db9c5e08684 Mon Sep 17 00:00:00 2001 From: Eirini Galati Date: Mon, 2 Nov 2026 11:57:28 +0100 Subject: [PATCH 6/7] ci: stop running every workflow twice, which was racing the macOS runners on: [push, pull_request] fired two identical runs for every push to a PR branch. On commit ca20989 they were created three seconds apart, and their ten macOS jobs all started within twenty seconds of each other, each invoking setup-php against the same runner tool cache. The result was that the same commit produced opposite macOS outcomes: pull_request run 5/5 macOS jobs passed push run 5/5 macOS jobs failed The failures were "composer: command not found" at composer validate -- setup-php reported success but left composer off the PATH, which is what a lost race over the tool cache looks like. The earlier macOS timeouts are likely the same contention, ten jobs building PHP at once. Restricting push to master gives PR branches exactly one run, and a concurrency group cancels superseded runs on rapid pushes. Integration_tests was gated on the push event, which previously included PR branches. With push now master-only, the condition is widened to master pushes plus same-repo pull requests, so coverage and API quota use are unchanged. Fork PRs are excluded because they never receive TINIFY_KEY. --- .github/workflows/ci-cd.yaml | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci-cd.yaml b/.github/workflows/ci-cd.yaml index fc42271..a2f9b9a 100644 --- a/.github/workflows/ci-cd.yaml +++ b/.github/workflows/ci-cd.yaml @@ -1,7 +1,24 @@ --- name: PHP CI/CD -on: [push, pull_request] +# Pushing to a PR branch used to fire this workflow twice, once for `push` +# and once for `pull_request`, with both runs created within seconds of each +# other. Ten macOS jobs then invoked setup-php simultaneously and raced over +# the shared runner tool cache, which is why identical commits produced +# opposite results: one run's macOS jobs passed while the other's all failed +# with "composer: command not found" after setup-php reported success. +# +# Restricting `push` to master means PR branches get exactly one run. +on: + push: + branches: + - master + pull_request: + +# Belt and braces for rapid successive pushes to the same branch. +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true permissions: {} jobs: @@ -49,7 +66,13 @@ jobs: - name: Run test suite run: vendor/bin/phpunit Integration_tests: - if: github.event_name == 'push' + # Previously `push` only, which covered PR branches because `push` fired + # for them. Now that `push` is master-only, the same coverage means master + # pushes plus same-repo pull requests. Fork PRs are excluded because they + # do not receive TINIFY_KEY and would fail on the missing secret. + if: >- + github.event_name == 'push' || + github.event.pull_request.head.repo.full_name == github.repository runs-on: ${{ matrix.os }} timeout-minutes: 30 needs: Unit_tests From 464a39fa72a1cfe2a751aa4b4d65faaddd83c78c Mon Sep 17 00:00:00 2001 From: Eirini Galati Date: Mon, 2 Nov 2026 12:06:55 +0100 Subject: [PATCH 7/7] test: re-enable PHP 5.4 on Windows to recheck after the race fix --- .github/workflows/ci-cd.yaml | 15 --------------- 1 file changed, 15 deletions(-) diff --git a/.github/workflows/ci-cd.yaml b/.github/workflows/ci-cd.yaml index a2f9b9a..65c305d 100644 --- a/.github/workflows/ci-cd.yaml +++ b/.github/workflows/ci-cd.yaml @@ -36,21 +36,6 @@ jobs: "8.5", ] os: [ubuntu-latest, macOS-latest, windows-latest] - exclude: - # PHP 5.4 on Windows dies on its first TLS connection to packagist: - # composer -vvv reaches "Downloading https://repo.packagist.org/ - # packages.json" and the process exits 1 with no output at all, even - # with display_errors=On and error_reporting=-1. The CA bundle is - # found and reported valid first, so this is not certificate - # discovery. PHP 5.4's bundled OpenSSL on Windows cannot negotiate - # with packagist's current TLS, and crashes rather than erroring. - # It passed in September; the runner moved, not this repo. - # - # Nothing in this repo can fix that, so the combination is dropped. - # PHP 5.4 stays covered on ubuntu and macOS, where it links the - # system OpenSSL and passes. - - php-version: "5.4" - os: windows-latest steps: - uses: shivammathur/setup-php@2.32.0 with: