build-php.yml

name: Build PHP

on:
  workflow_dispatch:
    inputs:
      php_version:
        description: 'PHP version to build (X.Y.Z, or X.Y to resolve to the latest patch)'
        required: true
        default: '8.4'
        type: string
      extensions:
        description: 'Extensions to include (comma-separated)'
        required: true
        default: 'curl,filter,openssl,pcntl,phar,posix,readline,zlib'
        type: string
      create_release:
        description: 'Create a GitHub release with the binaries'
        required: true
        default: true
        type: boolean
      debug:
        description: 'Enable debug output'
        required: false
        default: false
        type: boolean

env:
  SPC_VERSION: '2.8.5'
  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

jobs:
  # Resolve a minor version (e.g. 8.4) to the latest patch version (e.g. 8.4.20)
  # so all artifact names and the release tag include the full X.Y.Z.
  resolve-version:
    name: Resolve PHP version
    runs-on: ubuntu-latest
    outputs:
      php_version: ${{ steps.resolve.outputs.php_version }}
    steps:
      - name: Resolve to latest patch version
        id: resolve
        env:
          INPUT_PHP_VERSION: ${{ inputs.php_version }}
        run: |
          input="$INPUT_PHP_VERSION"
          if [[ "$input" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
            resolved="$input"
          elif [[ "$input" =~ ^[0-9]+\.[0-9]+$ ]]; then
            resolved=$(curl -fsSL "https://www.php.net/releases/?json&version=$input" | jq -er .version)
          else
            echo "Invalid PHP version: $input (expected X.Y or X.Y.Z)" >&2
            exit 1
          fi
          echo "Resolved PHP version: $resolved"
          echo "php_version=$resolved" >> "$GITHUB_OUTPUT"

  # Linux x86_64 build using Docker
  build-linux-amd64:
    name: Linux x86_64
    needs: resolve-version
    runs-on: ubuntu-latest
    steps:
      - name: Clone static-php-cli
        run: |
          git clone --depth 1 --branch ${{ env.SPC_VERSION }} https://github.com/crazywhalecc/static-php-cli.git spc

      - name: Build PHP in Docker
        run: |
          cd spc
          SPC_USE_ARCH=x86_64 ./bin/spc-alpine-docker download \
            --with-php=${{ needs.resolve-version.outputs.php_version }} \
            --for-extensions=${{ inputs.extensions }} \
            --prefer-pre-built \
            ${{ inputs.debug && '--debug' || '' }}
          SPC_USE_ARCH=x86_64 ./bin/spc-alpine-docker build \
            ${{ inputs.extensions }} \
            --build-cli \
            ${{ inputs.debug && '--debug' || '' }}

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: php-${{ needs.resolve-version.outputs.php_version }}-linux-amd64
          path: spc/buildroot/bin/php
          retention-days: 1

  # Linux ARM64 build using native ARM runner
  build-linux-arm64:
    name: Linux ARM64
    needs: resolve-version
    runs-on: ubuntu-24.04-arm
    steps:
      - name: Clone static-php-cli
        run: |
          git clone --depth 1 --branch ${{ env.SPC_VERSION }} https://github.com/crazywhalecc/static-php-cli.git spc

      - name: Build PHP in Docker
        run: |
          cd spc
          SPC_USE_ARCH=aarch64 ./bin/spc-alpine-docker download \
            --with-php=${{ needs.resolve-version.outputs.php_version }} \
            --for-extensions=${{ inputs.extensions }} \
            --prefer-pre-built \
            ${{ inputs.debug && '--debug' || '' }}
          SPC_USE_ARCH=aarch64 ./bin/spc-alpine-docker build \
            ${{ inputs.extensions }} \
            --build-cli \
            ${{ inputs.debug && '--debug' || '' }}

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: php-${{ needs.resolve-version.outputs.php_version }}-linux-arm64
          path: spc/buildroot/bin/php
          retention-days: 1

  # macOS ARM64 (Apple Silicon) build
  build-macos-arm64:
    name: macOS ARM64
    needs: resolve-version
    runs-on: macos-15
    steps:
      - name: Clone static-php-cli
        run: |
          git clone --depth 1 --branch ${{ env.SPC_VERSION }} https://github.com/crazywhalecc/static-php-cli.git spc

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.4'
          tools: composer
          extensions: curl, openssl, mbstring

      - name: Install dependencies
        run: |
          cd spc
          composer install --no-dev --classmap-authoritative

      - name: Setup build environment
        run: |
          cd spc
          ./bin/spc doctor --auto-fix

      - name: Download sources
        run: |
          cd spc
          ./bin/spc download \
            --with-php=${{ needs.resolve-version.outputs.php_version }} \
            --for-extensions=${{ inputs.extensions }} \
            --prefer-pre-built \
            ${{ inputs.debug && '--debug' || '' }}

      - name: Build PHP
        run: |
          cd spc
          ./bin/spc build \
            ${{ inputs.extensions }} \
            --build-cli \
            ${{ inputs.debug && '--debug' || '' }}

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: php-${{ needs.resolve-version.outputs.php_version }}-darwin-arm64
          path: spc/buildroot/bin/php
          retention-days: 1

  # macOS x86_64 (Intel) build
  build-macos-amd64:
    name: macOS x86_64
    needs: resolve-version
    runs-on: macos-15-intel
    steps:
      - name: Clone static-php-cli
        run: |
          git clone --depth 1 --branch ${{ env.SPC_VERSION }} https://github.com/crazywhalecc/static-php-cli.git spc

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.4'
          tools: composer
          extensions: curl, openssl, mbstring

      - name: Install dependencies
        run: |
          cd spc
          composer install --no-dev --classmap-authoritative

      - name: Setup build environment
        run: |
          cd spc
          ./bin/spc doctor --auto-fix

      - name: Download sources
        run: |
          cd spc
          ./bin/spc download \
            --with-php=${{ needs.resolve-version.outputs.php_version }} \
            --for-extensions=${{ inputs.extensions }} \
            --prefer-pre-built \
            ${{ inputs.debug && '--debug' || '' }}

      - name: Build PHP
        run: |
          cd spc
          ./bin/spc build \
            ${{ inputs.extensions }} \
            --build-cli \
            ${{ inputs.debug && '--debug' || '' }}

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: php-${{ needs.resolve-version.outputs.php_version }}-darwin-amd64
          path: spc/buildroot/bin/php
          retention-days: 1

  # Windows x64 build
  build-windows-amd64:
    name: Windows x64
    needs: resolve-version
    # Not windows-latest or windows-2025: those images now ship Visual Studio
    # 2026, and static-php-cli only looks for 2022 or 2019, so its doctor check
    # fails before anything is built.
    runs-on: windows-2022
    steps:
      - name: Check out repository code
        uses: actions/checkout@v7

      - name: Clone static-php-cli
        run: |
          git clone --depth 1 --branch ${{ env.SPC_VERSION }} https://github.com/crazywhalecc/static-php-cli.git spc

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.4'
          tools: composer
          extensions: curl, openssl, mbstring

      - name: Install dependencies
        run: |
          cd spc
          composer install --no-dev --classmap-authoritative

      # Schannel cannot use a CA file and the Windows certificate store
      # together, which the CLI needs. This must run before the download step,
      # which reads the dependencies it changes.
      - name: Build curl against OpenSSL, not Schannel
        run: php scripts/patch-spc-windows-curl.php spc

      - name: Setup build environment
        run: |
          cd spc
          ./bin/spc doctor

      # Note: Windows doesn't support pcntl and posix extensions.
      # readline uses libedit in static-php-cli, which requires ncurses (not supported on Windows).
      - name: Download sources
        run: |
          cd spc
          $extensions = "${{ inputs.extensions }}" -replace 'pcntl,?' -replace 'posix,?' -replace 'readline,?' -replace ',,',','
          $extensions = $extensions.Trim(',')
          ./bin/spc download --with-php=${{ needs.resolve-version.outputs.php_version }} --for-extensions="$extensions" --prefer-pre-built ${{ inputs.debug && '--debug' || '' }}

      - name: Build PHP
        run: |
          cd spc
          $extensions = "${{ inputs.extensions }}" -replace 'pcntl,?' -replace 'posix,?' -replace 'readline,?' -replace ',,',','
          $extensions = $extensions.Trim(',')
          ./bin/spc build "$extensions" --build-cli ${{ inputs.debug && '--debug' || '' }}

      # The CLI depends on the SSL backend: only OpenSSL can use a CA file and
      # the Windows certificate store together.
      - name: Check the SSL backend
        run: |
          $curl = & ./spc/buildroot/bin/php.exe -n -r "echo curl_version()['ssl_version'];"
          $openssl = & ./spc/buildroot/bin/php.exe -n -r "echo OPENSSL_VERSION_TEXT;"
          Write-Host "curl: $curl"
          Write-Host "openssl extension: $openssl"
          if ($curl -notlike 'OpenSSL/*') {
            throw "expected curl to be built against OpenSSL, got '$curl'"
          }

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        with:
          name: php-${{ needs.resolve-version.outputs.php_version }}-windows-amd64
          path: spc/buildroot/bin/php.exe
          retention-days: 1

  # Create GitHub release with all binaries
  create-release:
    name: Create Release
    needs:
      - resolve-version
      - build-linux-amd64
      - build-linux-arm64
      - build-macos-arm64
      - build-macos-amd64
      - build-windows-amd64
    runs-on: ubuntu-latest
    if: ${{ inputs.create_release }}
    permissions:
      contents: write
    env:
      PHP_VERSION: ${{ needs.resolve-version.outputs.php_version }}
    steps:
      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: artifacts

      - name: Prepare release assets
        run: |
          mkdir -p release

          # Linux x86_64
          cp artifacts/php-${PHP_VERSION}-linux-amd64/php \
             release/php-${PHP_VERSION}-linux-amd64
          chmod +x release/php-${PHP_VERSION}-linux-amd64

          # Linux ARM64
          cp artifacts/php-${PHP_VERSION}-linux-arm64/php \
             release/php-${PHP_VERSION}-linux-arm64
          chmod +x release/php-${PHP_VERSION}-linux-arm64

          # macOS ARM64
          cp artifacts/php-${PHP_VERSION}-darwin-arm64/php \
             release/php-${PHP_VERSION}-darwin-arm64
          chmod +x release/php-${PHP_VERSION}-darwin-arm64

          # macOS x86_64
          cp artifacts/php-${PHP_VERSION}-darwin-amd64/php \
             release/php-${PHP_VERSION}-darwin-amd64
          chmod +x release/php-${PHP_VERSION}-darwin-amd64

          # Windows x64
          cp artifacts/php-${PHP_VERSION}-windows-amd64/php.exe \
             release/php-${PHP_VERSION}-windows-amd64.exe

          # Generate checksums
          cd release
          sha256sum * > SHA256SUMS.txt
          cat SHA256SUMS.txt

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: php-${{ env.PHP_VERSION }}
          name: PHP ${{ env.PHP_VERSION }}
          body: |
            PHP ${{ env.PHP_VERSION }} static binaries for the Upsun CLI.

            ## Included Extensions

            ${{ inputs.extensions }}

            Note: `pcntl`, `posix`, and `readline` are not available on Windows.

            ## Build Details

            - Built with [static-php-cli](https://github.com/crazywhalecc/static-php-cli) v${{ env.SPC_VERSION }}
            - All binaries are statically linked (no external dependencies)
            - Linux builds use musl libc for maximum portability

            ## Verification

            Download `SHA256SUMS.txt` and verify:
            ```bash
            sha256sum -c SHA256SUMS.txt
            ```
          files: release/*
          fail_on_unmatched_files: true
          overwrite_files: true