[pjcdawkins]

Uses the per-build release tags from upsun/cli-php-builds#3 (php-X.Y.Z-N), pins checksums, and adds a daily workflow that opens a pull request when there is a new build.

• Makefile: adds PHP_BUILD next to PHP_VERSION (which stays the plain PHP version for ldflags), and downloads from php-$(PHP_VERSION)-$(PHP_BUILD).
• Checksums: internal/legacy/php_sha256sums.txt is a copy of the release's SHA256SUMS.txt. Downloads are verified against it, and the file is deleted on mismatch.
• CA bundle: downloads a dated cacert-<CACERT_DATE>.pem and verifies CACERT_SHA256, instead of fetching the latest one without verification.
• The Windows CI job verifies its downloads in the same way. The release workflow's PHP cache key now uses the checksums file, so a new build number isn't served from the cache.
• update-php workflow (daily and workflow_dispatch): runs scripts/update-php.sh. The script finds the latest release for the current PHP minor version (sort -V) and the latest CA bundle, then updates the Makefile and checksums. The workflow then runs make download-php and checks the PHP version. If anything changed, it pushes automated/update-php and opens or updates a pull request. The PR body lists the changed sources.json archives (old vs. new, by platform). It does not push again if the branch already has the same update.
  • The push and PR use a token from the upsun-cli-php-updates GitHub App (actions/create-github-app-token, pinned by SHA), so CI runs on the PR. The job uses the php-updates environment (APP_ID variable, APP_PRIVATE_KEY secret). Other steps use GITHUB_TOKEN with contents: read.
• Updates CLAUDE.md.

🤖 Generated with Claude Code

[upsun-dispatch]

Warning

Changes suggested — 🟡 1 warning · 🔵 1 minor point

🔍 Full review · 7 files reviewed

Verification

• The ^PHP_BUILD = patterns in ci.yml and update-php.sh (read and sed -i write) cannot match PHP_BUILDS_REPO = ..., because they need a space after PHP_BUILD.
• In the Makefile, a missing or empty checksum fails at test -n, and .DELETE_ON_ERROR removes the bad download.
• With pipefail on, the release lookup ends in || true, so finding no matching tag exits through the 'No release found' error, not a silent set -e abort.
• sort -V orders tags like php-8.5.9-3 before php-8.5.11-0, and build -1 before -10, so the latest-tag pick is numeric.
• The release cache key now hashes php_sha256sums.txt; a restored php-version file whose tag doesn't match still forces a re-download through the FORCE rule.

The PR adds no tests. The Makefile checksum path is exercised by the CI integration-test job (make php), and the Windows download and checksum steps by the windows-cert-store job. update-php.yml and scripts/update-php.sh only run on schedule or manual dispatch; no CI job tests the script's tag comparison or checksum handling.

Review details

• Commit: 9ff3595
• Model: claude-opus-5-5

---

Review 1 of 10 for this pull request · View the full run