Skip to content

Commit f46c587

Browse files
asgrimasgrim
authored
Merge pull request #443 from asgrim/static-php-experiment
Experimentally provide executable version of PIE
2 parents be5f142 + d8d008f commit f46c587

File tree

15 files changed

+315
-96
lines changed

15 files changed

+315
-96
lines changed

‎.github/workflows/build-and-push-docker-image.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# in a way to pass those permissions on, e.g.:
33
#
44
# build-and-push-docker-image:
5-
# needs: build-phar
5+
# needs: build-assets
66
# permissions:
77
# contents: read
88
# id-token: write

‎.github/workflows/build-assets.yml‎

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
# Invoking this pipeline requires additional permissions, so must be invoked
2+
# in a way to pass those permissions on, e.g.:
3+
#
4+
# build-assets:
5+
# permissions:
6+
# contents: read
7+
# id-token: write
8+
# attestations: write
9+
# uses: ./.github/workflows/build-assets.yml
10+
11+
name: "Build the PIE assets"
12+
13+
on:
14+
workflow_call:
15+
16+
permissions:
17+
contents: read
18+
19+
jobs:
20+
build-phar:
21+
runs-on: ${{ matrix.operating-system }}
22+
strategy:
23+
matrix:
24+
operating-system:
25+
- ubuntu-latest
26+
php-versions:
27+
- '8.1'
28+
permissions:
29+
# id-token:write is required for build provenance attestation.
30+
id-token: write
31+
# attestations:write is required for build provenance attestation.
32+
attestations: write
33+
steps:
34+
- name: Setup PHP
35+
uses: shivammathur/setup-php@v2
36+
with:
37+
coverage: none
38+
tools: composer, box
39+
php-version: "${{ matrix.php-version }}"
40+
- uses: actions/checkout@v6
41+
with:
42+
fetch-depth: 0
43+
# Fixes `git describe` picking the wrong tag - see https://github.com/php/pie/issues/307
44+
- run: git fetch --tags --force
45+
# Ensure some kind of previous tag exists, otherwise box fails
46+
- run: git describe --tags HEAD || git tag 0.0.0
47+
- uses: ramsey/composer-install@v3
48+
- name: Build PHAR
49+
run: box compile
50+
- name: Check the PHAR executes
51+
run: php pie.phar --version
52+
- name: Generate build provenance attestation
53+
# It does not make sense to do this for PR builds, nor do contributors
54+
# have permission to do. We can't write attestations to `php/pie` in an
55+
# unprivileged context, otherwise anyone could send a PR with malicious
56+
# code, which would store attestation that `php/pie` built the PHAR, and
57+
# it would look genuine. So this should NOT run for PR builds.
58+
if: github.event_name != 'pull_request'
59+
uses: actions/attest-build-provenance@v3
60+
with:
61+
subject-path: '${{ github.workspace }}/pie.phar'
62+
- uses: actions/upload-artifact@v5
63+
with:
64+
name: pie-${{ github.sha }}.phar
65+
path: pie.phar
66+
67+
build-executable:
68+
needs:
69+
- build-phar
70+
runs-on: ${{ matrix.operating-system }}
71+
strategy:
72+
fail-fast: false
73+
matrix:
74+
operating-system:
75+
- ubuntu-24.04
76+
- ubuntu-24.04-arm
77+
- macos-15-intel
78+
- macos-26
79+
- windows-2025
80+
permissions:
81+
# id-token:write is required for build provenance attestation.
82+
id-token: write
83+
# attestations:write is required for build provenance attestation.
84+
attestations: write
85+
steps:
86+
- uses: actions/checkout@v6
87+
88+
- name: Download SPC (non-Windows)
89+
if: runner.os != 'Windows'
90+
run: |
91+
# @todo find a better way to do this :/
92+
# Source URL: https://static-php.dev/en/guide/manual-build.html#build-locally-using-spc-binary-recommended
93+
case "${{ matrix.operating-system }}" in
94+
ubuntu-24.04)
95+
curl -fsSL -o spc https://dl.static-php.dev/static-php-cli/spc-bin/nightly/spc-linux-x86_64
96+
;;
97+
98+
ubuntu-24.04-arm)
99+
curl -fsSL -o spc https://dl.static-php.dev/static-php-cli/spc-bin/nightly/spc-linux-aarch64
100+
;;
101+
102+
macos-15-intel)
103+
curl -fsSL -o spc https://dl.static-php.dev/static-php-cli/spc-bin/nightly/spc-macos-x86_64
104+
;;
105+
106+
macos-26)
107+
curl -fsSL -o spc https://dl.static-php.dev/static-php-cli/spc-bin/nightly/spc-macos-aarch64
108+
;;
109+
110+
*)
111+
echo "unsupported operating system: ${{ matrix.operating-system }}"
112+
exit 1
113+
;;
114+
esac
115+
chmod +x spc
116+
echo "SPC_BINARY=./spc" >> $GITHUB_ENV
117+
echo "PIE_BINARY_OUTPUT=pie-${{ runner.os }}-${{ runner.arch }}" >> $GITHUB_ENV
118+
- name: Download SPC (Windows)
119+
if: runner.os == 'Windows'
120+
run: |
121+
curl.exe -fsSL -o spc.exe https://dl.static-php.dev/static-php-cli/spc-bin/nightly/spc-windows-x64.exe
122+
chmod +x spc.exe
123+
echo "SPC_BINARY=.\spc.exe" >> $env:GITHUB_ENV
124+
echo "PIE_BINARY_OUTPUT=pie-${{ runner.os }}-${{ runner.arch }}.exe" >> $env:GITHUB_ENV
125+
126+
- name: Grab the pie.phar from artifacts
127+
uses: actions/download-artifact@v5
128+
with:
129+
name: pie-${{ github.sha }}.phar
130+
131+
- name: Build for ${{ runner.os }} ${{ runner.arch }} on ${{ matrix.operating-system }}
132+
run: ${{ env.SPC_BINARY }} craft resources/spc/craft.yml
133+
env:
134+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
135+
- name: Bundle pie.phar into executable PIE binary
136+
run: ${{ env.SPC_BINARY }} micro:combine pie.phar --output=${{ env.PIE_BINARY_OUTPUT }}
137+
138+
- name: Setup PHP
139+
uses: shivammathur/setup-php@v2
140+
with:
141+
coverage: none
142+
tools: composer
143+
php-version: "7.4"
144+
- name: Quick validation that the binary runs
145+
run: ./${{ env.PIE_BINARY_OUTPUT }} show --all
146+
147+
- name: Generate build provenance attestation
148+
# It does not make sense to do this for PR builds, nor do contributors
149+
# have permission to do. We can't write attestations to `php/pie` in an
150+
# unprivileged context, otherwise anyone could send a PR with malicious
151+
# code, which would store attestation that `php/pie` built the binaries,
152+
# and it would look genuine. So this should NOT run for PR builds.
153+
if: github.event_name != 'pull_request'
154+
uses: actions/attest-build-provenance@v3
155+
with:
156+
subject-path: '${{ github.workspace }}/${{ env.PIE_BINARY_OUTPUT }}'
157+
158+
- uses: actions/upload-artifact@v5
159+
with:
160+
name: pie-${{ github.sha }}-${{ runner.os }}-${{ runner.arch }}.bin
161+
path: ${{ env.PIE_BINARY_OUTPUT }}

‎.github/workflows/build-phar.yml‎

Lines changed: 0 additions & 65 deletions
This file was deleted.

‎.github/workflows/continuous-integration.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -187,14 +187,14 @@ jobs:
187187
- name: Run phpstan
188188
run: vendor/bin/phpstan
189189

190-
build-phar:
190+
build-assets:
191191
needs:
192192
- unit-tests
193193
- coding-standards
194194
- static-analysis
195-
# See build-phar.yml for a list of the permissions and why they are needed
195+
# See build-assets.yml for a list of the permissions and why they are needed
196196
permissions:
197197
contents: read
198198
id-token: write
199199
attestations: write
200-
uses: ./.github/workflows/build-phar.yml
200+
uses: ./.github/workflows/build-assets.yml

‎.github/workflows/docker-nightly-image-push.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,18 +11,18 @@ permissions:
1111
contents: read
1212

1313
jobs:
14-
build-phar:
14+
build-assets:
1515
if: github.ref_name == github.event.repository.default_branch
16-
# See build-phar.yml for a list of the permissions and why they are needed
16+
# See build-assets.yml for a list of the permissions and why they are needed
1717
permissions:
1818
contents: read
1919
id-token: write
2020
attestations: write
21-
uses: ./.github/workflows/build-phar.yml
21+
uses: ./.github/workflows/build-assets.yml
2222

2323
build-and-push-docker-image:
2424
if: github.ref_name == github.event.repository.default_branch
25-
needs: build-phar
25+
needs: build-assets
2626
# See build-and-push-docker-image.yml for a list of the permissions and why they are needed
2727
permissions:
2828
contents: read

‎.github/workflows/docs.yml‎

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,20 +17,20 @@ concurrency:
1717
cancel-in-progress: false
1818

1919
jobs:
20-
build-phar:
20+
build-assets:
2121
if: github.ref_name == github.event.repository.default_branch
22-
# See build-phar.yml for a list of the permissions and why they are needed
22+
# See build-assets.yml for a list of the permissions and why they are needed
2323
permissions:
2424
contents: read
2525
id-token: write
2626
attestations: write
27-
uses: ./.github/workflows/build-phar.yml
27+
uses: ./.github/workflows/build-assets.yml
2828

2929
build-docs-package:
3030
if: github.ref_name == github.event.repository.default_branch
3131
runs-on: ubuntu-latest
3232
needs:
33-
- build-phar
33+
- build-assets
3434
steps:
3535
- name: Checkout
3636
uses: actions/checkout@v6
@@ -40,12 +40,22 @@ jobs:
4040
uses: actions/download-artifact@v6
4141
with:
4242
name: pie-${{ github.sha }}.phar
43-
- name: Verify the PHAR
43+
- name: Fetch the executable PIEs from artifacts
44+
uses: actions/download-artifact@v5
45+
with:
46+
path: executable-pie-binaries
47+
pattern: pie-${{ github.sha }}-*.bin
48+
merge-multiple: true
49+
- name: Verify the PHAR and binaries
4450
env:
4551
GH_TOKEN: ${{ github.token }}
46-
run: gh attestation verify pie.phar --repo ${{ github.repository }}
52+
run: |
53+
gh attestation verify pie.phar --repo ${{ github.repository }} ;
54+
find executable-pie-binaries -type f -exec gh attestation verify {} --repo ${{ github.repository }} \;
4755
- name: Copy PHAR into docs
4856
run: cp pie.phar docs-package/pie-nightly.phar
57+
- name: Copy executables into docs
58+
run: cp executable-pie-binaries/* docs-package/
4959
- name: Upload artifact
5060
uses: actions/upload-pages-artifact@v4
5161
with:

0 commit comments

Comments
 (0)