Repository navigation
feat: rebuild automatically when PHP or a library is updated - #3
Merged
Merged
Conversation
A daily workflow compares the sources of the latest release with the latest versions static-php-cli would download (including the latest PHP patch release), and rebuilds the same PHP minor version when any differ. It opens or updates an issue when the check or build fails. Build changes: - Build all libraries from source instead of static-php-cli's pre-built libraries, and skip suggested sources, so the recorded sources match the binaries. - Record the source archives of each platform in a sources.json release asset. - Tag each build as php-X.Y.Z-N and stop overwriting release assets, so released binaries never change. - Make build-php.yml reusable, and run it on pull requests without a release. - Default to the minor version of the latest release, and move the extension list to an env var: automatic rebuilds use one list. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Linux build directory is created by Docker as root, so the runner cannot write sources.json there. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Packages installed by spc doctor are also in .lock.json, and would be reported as missing every day. A failed release lookup was treated as a release without sources.json, which triggers a rebuild. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![upsun-dispatch[bot]](https://avatars.githubusercontent.com/in/4153575?s=60&v=4){kind=small}
There was a problem hiding this comment.
Warning
Changes suggested — 🟡 2 warnings · 🔵 3 minor points
🔍 Full review · 5 files reviewed
Verification
- In static-php-cli 2.8.5,
lock_as == 1(SPC_DOWNLOAD_SOURCE) andsource_type == "archive"match the lock entries written for downloaded source archives. - spc-alpine-docker mounts
./downloads, so the Linux jobs can readspc/downloads/.lock.jsonon the host. - The tag regex
${PHP_VERSION//./\\.}producesphp-8\.5\.11-([0-9]+), andsort -Vordersphp-8.5.11<-1<-2<-10as intended. - Every source the extension list needs (curl, openssl, zlib, libedit, ncurses, php-src) uses a versioned archive filename, so a filename comparison does detect upgrades.
The diff adds no tests. The only automated check is the new pull_request trigger on build-php.yml, which builds all five platforms without releasing. Nothing exercises check-updates.yml, check-sources.sh or the tag-numbering step before they run on a schedule.
Review details
- Commit: 08c0a8e
- Model: claude-opus-5-5
Review 1 of 10 for this pull request · View the full run
- Create releases with gh release create, which fails if another build took the same tag, instead of a concurrency group that could cancel a queued release without a report. - Keep the check schedule enabled, as GitHub disables schedules in public repositories after 60 days without activity. - Run one check at a time, so overlapping checks don't both rebuild. - Pass --no-alt to spc download, so a fallback source doesn't look like an upstream change. - Fix the build directory comment on non-Linux jobs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
🔵 Needs a closer look
Source-only builds across five platforms and unattended release publishing need end-to-end validation before approval.
0 open findings
What changed in this PR
Adds daily upstream update checks and automatic PHP rebuilds to keep the CLI’s bundled runtime and libraries current.
Changes:
- Records source archives and compares them with upstream versions.
- Builds libraries from source and publishes uniquely numbered releases.
- Enables reusable builds and pull-request builds without publishing.
| File | Description |
|---|---|
scripts/latest-release.sh |
Selects the latest PHP release by version and build number. |
scripts/check-sources.sh |
Compares recorded source archives with upstream downloads. |
README.md |
Documents automatic rebuilds and numbered releases. |
.github/workflows/check-updates.yml |
Schedules checks, triggers rebuilds, and reports failures. |
.github/workflows/build-php.yml |
Records sources and supports reusable builds and numbered releases. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A daily workflow (
check-updates.yml) rebuilds the latest release when PHP or any library in it has a new upstream release. Before this, builds only ran manually, so security fixes in PHP, libcurl or OpenSSL reached the CLI late or not at all.How it works
sources.jsonrelease asset (from static-php-cli'sdownloads/.lock.json).build-php.ymlto build and release again.Build changes
--prefer-pre-builtis removed, sosources.jsonmatches the binaries, and the builds no longer use static-php-cli's hosted pre-built libraries. Windows already built from source. Suggested sources are no longer downloaded (--without-suggestions), as they were not built.php-X.Y.Z-N, and release assets are no longer overwritten. Asset names are unchanged. The CLI will need to use the new tags (a follow-up there).build-php.ymlcan be called by other workflows, and runs on pull requests without creating a release.php_versiondefaults to the minor version of the latest release. The extension list is now an env var instead of an input, so manual and automatic builds use the same list.The first scheduled run will rebuild 8.5.11 as
php-8.5.11-1, asphp-8.5.11has nosources.json.🤖 Generated with Claude Code