Release 5.1: PHP patches within the hour, signed images, PHP 8.6-rc, and more

.github/workflows/action_publish-images-beta.yml

@@ -55,8 +55,18 @@ jobs:
     with:
       ref: ${{ needs.release.outputs.tag }}
 
-  build:
+  base:
     needs: [release, setup]
+    uses: ./.github/workflows/service_build-php-base.yml
+    permissions:
+      contents: read
+      id-token: write
+    with:
+      matrix: ${{ needs.setup.outputs.base-matrix }}
+      ref: ${{ needs.release.outputs.tag }}
+
+  build:
+    needs: [release, setup, base]
     name: build ${{ matrix.variation }}
     strategy:
       fail-fast: false
@@ -73,10 +83,9 @@ jobs:
       registry-repositories: "docker.io/serversideup/php,ghcr.io/serversideup/php"
       tag-prefix: "beta"
       release-type: "testing"
-    secrets: inherit
 
   test:
-    needs: [release, setup, build]
+    needs: [release, setup, base, build]
     if: always() && needs.setup.result == 'success'
     uses: ./.github/workflows/service_test-images.yml
     permissions:
@@ -96,7 +105,9 @@ jobs:
       id-token: write
     with:
       ref: ${{ needs.release.outputs.tag }}
-    secrets: inherit
+    secrets:
+      DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
+      DOCKER_HUB_ACCESS_TOKEN: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
 
   report:
     needs: [release, setup, build, test, publish]
@@ -106,4 +117,3 @@ jobs:
       contents: read
     with:
       matrix: ${{ needs.setup.outputs.matrix }}
-      ref: ${{ needs.release.outputs.tag }}

.github/workflows/action_publish-images-production.yml

@@ -3,11 +3,17 @@ run-name: >-
   Production images (${{
     github.event.release.tag_name ||
     (github.event_name == 'schedule' && 'weekly rebuild') ||
+    inputs.reason ||
     'manual rebuild'
   }})
 
 on:
   workflow_dispatch:
+    inputs:
+      reason:
+        description: 'Shown in the run title (example: PHP 8.5.13 release). Left empty, the run is a "manual rebuild".'
+        type: string
+        required: false
   release:
     types: [released]
   schedule:
@@ -55,8 +61,18 @@ jobs:
     with:
       ref: ${{ needs.release.outputs.tag }}
 
-  build:
+  base:
     needs: [release, setup]
+    uses: ./.github/workflows/service_build-php-base.yml
+    permissions:
+      contents: read
+      id-token: write
+    with:
+      matrix: ${{ needs.setup.outputs.base-matrix }}
+      ref: ${{ needs.release.outputs.tag }}
+
+  build:
+    needs: [release, setup, base]
     name: build ${{ matrix.variation }}
     strategy:
       fail-fast: false
@@ -73,10 +89,9 @@ jobs:
       registry-repositories: "docker.io/serversideup/php,ghcr.io/serversideup/php"
       tag-prefix: ''
       release-type: "latest"
-    secrets: inherit
 
   test:
-    needs: [release, setup, build]
+    needs: [release, setup, base, build]
     if: always() && needs.setup.result == 'success'
     uses: ./.github/workflows/service_test-images.yml
     permissions:
@@ -96,7 +111,19 @@ jobs:
       id-token: write
     with:
       ref: ${{ needs.release.outputs.tag }}
-    secrets: inherit
+    secrets:
+      DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
+      DOCKER_HUB_ACCESS_TOKEN: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
+
+  # Scans what was just published: counts in the run summary, fixable findings as code scanning alerts.
+  scan:
+    needs: [release, publish]
+    if: needs.publish.result == 'success'
+    uses: ./.github/workflows/service_scan-images.yml
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
 
   report:
     needs: [release, setup, build, test, publish]
@@ -106,4 +133,3 @@ jobs:
       contents: read
     with:
       matrix: ${{ needs.setup.outputs.matrix }}
-      ref: ${{ needs.release.outputs.tag }}

.github/workflows/action_publish-images-prs.yml

@@ -38,8 +38,26 @@ jobs:
     with:
       ref: ${{ inputs.pr_number && format('refs/pull/{0}/head', inputs.pr_number) || github.ref }}
 
-  build:
+  # Pull requests from forks skip the base phase and build on the official images.
+  base:
     needs: [setup]
+    uses: ./.github/workflows/service_build-php-base.yml
+    permissions:
+      contents: read
+      id-token: write
+    with:
+      matrix: ${{ needs.setup.outputs.base-matrix }}
+      ref: ${{ inputs.pr_number && format('refs/pull/{0}/head', inputs.pr_number) || github.ref }}
+      publish: >-
+        ${{
+          github.event_name == 'workflow_dispatch' ||
+          github.event.pull_request.head.repo.full_name == github.repository
+        }}
+
+  build:
+    needs: [setup, base]
+    # Forks skip every job in the base phase, so build when it was skipped or succeeded.
+    if: ${{ !cancelled() && needs.setup.result == 'success' && (needs.base.result == 'success' || needs.base.result == 'skipped') }}
     name: build ${{ matrix.variation }}
     strategy:
       fail-fast: false
@@ -57,20 +75,15 @@ jobs:
       tag-prefix: ${{ inputs.pr_number || github.event.pull_request.number }}
       release-type: testing
       # Only save and publish when the code comes from this repository or a maintainer asked for it.
-      # Pull requests from forks are built but never leave Depot's isolated builders. Dependabot
-      # runs have no access to the registry secrets, so they are treated the same way.
+      # Pull requests from forks are built but never leave Depot's isolated builders.
       publish: >-
         ${{
           github.event_name == 'workflow_dispatch' ||
-          (
-            github.event.pull_request.head.repo.full_name == github.repository &&
-            github.actor != 'dependabot[bot]'
-          )
+          github.event.pull_request.head.repo.full_name == github.repository
         }}
-    secrets: inherit
 
   test:
-    needs: [setup, build]
+    needs: [setup, base, build]
     if: always() && needs.setup.result == 'success'
     uses: ./.github/workflows/service_test-images.yml
     permissions:
@@ -91,7 +104,9 @@ jobs:
     with:
       ref: ${{ inputs.pr_number && format('refs/pull/{0}/head', inputs.pr_number) || github.ref }}
       authenticate_with_ghcr: false
-    secrets: inherit
+    secrets:
+      DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
+      DOCKER_HUB_ACCESS_TOKEN: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
 
   report:
     needs: [setup, build, test, publish]
@@ -101,18 +116,14 @@ jobs:
       contents: read
     with:
       matrix: ${{ needs.setup.outputs.matrix }}
-      ref: ${{ inputs.pr_number && format('refs/pull/{0}/head', inputs.pr_number) || github.ref }}
 
   comment:
-    needs: [build, test, publish, report]
+    needs: [base, build, test, publish, report]
     if: >-
       always() &&
       (
         github.event_name == 'workflow_dispatch' ||
-        (
-          github.event.pull_request.head.repo.full_name == github.repository &&
-          github.actor != 'dependabot[bot]'
-        )
+        github.event.pull_request.head.repo.full_name == github.repository
       )
     runs-on: ubuntu-24.04
     timeout-minutes: 5
@@ -122,6 +133,7 @@ jobs:
       GH_TOKEN: ${{ github.token }}
       GH_REPO: ${{ github.repository }}
       PR_NUMBER: ${{ inputs.pr_number || github.event.pull_request.number }}
+      BASE_RESULT: ${{ needs.base.result }}
       BUILD_RESULT: ${{ needs.build.result }}
       TEST_RESULT: ${{ needs.test.result }}
       PUBLISH_RESULT: ${{ needs.publish.result }}
@@ -141,6 +153,11 @@ jobs:
             failure) TEST_CELL="❌ Failed" ;;
             *)       TEST_CELL="⏭️ Skipped" ;;
           esac
+          # A failed base skips every build, which leaves the test phase nothing to test.
+          if [ "$BASE_RESULT" = "failure" ] || [ "$BASE_RESULT" = "cancelled" ]; then
+            BUILD_CELL="❌ PHP base images failed to compile"
+            TEST_CELL="⏭️ Skipped"
+          fi
           case "$PUBLISH_RESULT" in
             success) PUBLISH_CELL="✅ Published to serversideup/php-dev" ;;
             failure) PUBLISH_CELL="❌ Failed" ;;

.github/workflows/action_update-dockerhub-readme.yml

@@ -8,18 +8,23 @@ on:
     paths:
       - README.md
 
+permissions: {}
+
 jobs:
   update_container_readme:
     runs-on: ubuntu-24.04
     name: Push README to Docker Hub
+    permissions:
+      contents: read
     steps:
       - name: git checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           ref: main
 
       - name: push README to Dockerhub
-        uses: peter-evans/dockerhub-description@v5
+        uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
         with:
           username: ${{ secrets.DOCKER_HUB_README_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_README_PASSWORD }}

.github/workflows/scheduled-task_scorecard.yml

@@ -0,0 +1,46 @@
+name: OpenSSF Scorecard
+
+# Scores the repository's supply chain practices (pinned dependencies, token permissions,
+# signed releases, branch protection, and more) and publishes the result to
+# scorecard.dev, which serves the badge in the README. Publishing only works while this
+# workflow follows Scorecard's rules: no workflow-level env, defaults, or write
+# permissions, and only Scorecard's approved actions in the job.
+on:
+  workflow_dispatch:
+  branch_protection_rule:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: '41 6 * * 3'
+
+permissions: {}
+
+jobs:
+  analysis:
+    # Forks inherit the cron schedule. Their weekly rebuilds always fail and email whoever last edited the schedule upstream.
+    if: github.event_name != 'schedule' || github.repository == 'serversideup/docker-php'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+      id-token: write
+    steps:
+      - name: Check out code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run Scorecard
+        uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: Upload the results to the Security tab
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        with:
+          sarif_file: results.sarif

.github/workflows/scheduled-task_update-readme.yml

@@ -7,6 +7,6 @@ jobs:
   update-readme:
     # Forks inherit the cron schedule. Their weekly rebuilds always fail and email whoever last edited the schedule upstream.
     if: github.event_name != 'schedule' || github.repository == 'serversideup/docker-php'
-    uses: serversideup/.github/.github/workflows/update-readme.yml@master
+    uses: serversideup/.github/.github/workflows/update-readme.yml@0cc5de42120438871a6c36a91b6a7dc2a15dbd7f # v1.0.1
     permissions:
       contents: write