Build and Push PHP-CLI Images #43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Push PHP-CLI Images | |
| # IMPORTANT: This workflow depends on php-base tier images being available. | |
| # Do NOT add push triggers for php-cli/** paths - this would cause race conditions | |
| # where php-cli tries to build before php-base images are pushed. | |
| # Instead, use repository_dispatch from php-base workflow or workflow_dispatch. | |
| on: | |
| # NO push trigger - php-cli depends on php-base images being built first | |
| # Use repository_dispatch from php-base workflow instead | |
| workflow_dispatch: | |
| inputs: | |
| php_version: | |
| description: 'PHP Version to build (8.2, 8.3, 8.4, or all)' | |
| required: false | |
| default: 'all' | |
| os_variant: | |
| description: 'OS variant to build (bookworm or all)' | |
| required: false | |
| default: 'all' | |
| repository_dispatch: | |
| types: [php-base-updated] | |
| schedule: | |
| # Weekly security rebuild - Monday 02:00 UTC (after php-base at 01:00) | |
| - cron: '0 2 * * 1' | |
| jobs: | |
| # ═══════════════════════════════════════════════════════════════════════════ | |
| # SLIM TIER - Minimal PHP with essential extensions only | |
| # ═══════════════════════════════════════════════════════════════════════════ | |
| build-slim-matrix: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| php_version: ['8.2', '8.3', '8.4', '8.5'] | |
| os_variant: ['bookworm'] | |
| uses: ./.github/workflows/_build-image.yml | |
| with: | |
| image-name: php-cli | |
| image-type: php-cli | |
| php-version: ${{ matrix.php_version }} | |
| os-variant: ${{ matrix.os_variant }} | |
| tier: slim | |
| target: slim-root | |
| tag-suffix: slim | |
| cache-scope-prefix: cli | |
| enable-patch-tags: true | |
| enable-cosign: false | |
| base-image-type: cli | |
| test-script: | | |
| echo "Testing slim image $IMAGE..." | |
| docker run --rm $IMAGE php -v | |
| docker run --rm $IMAGE php -m | grep -E "opcache|redis|pdo_mysql|gd" | |
| docker run --rm $IMAGE composer --version | |
| docker run --rm $IMAGE cbox-init --version | |
| secrets: inherit | |
| build-slim-rootless-matrix: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| php_version: ['8.2', '8.3', '8.4', '8.5'] | |
| os_variant: ['bookworm'] | |
| uses: ./.github/workflows/_build-image.yml | |
| with: | |
| image-name: php-cli | |
| image-type: php-cli | |
| php-version: ${{ matrix.php_version }} | |
| os-variant: ${{ matrix.os_variant }} | |
| tier: slim | |
| target: slim-rootless | |
| rootless: true | |
| tag-suffix: slim-rootless | |
| cache-scope-prefix: cli | |
| enable-patch-tags: true | |
| enable-cosign: false | |
| base-image-type: cli | |
| test-script: | | |
| echo "Testing slim rootless image $IMAGE..." | |
| docker run --rm $IMAGE id -u | grep -E "^(33|82)$" | |
| docker run --rm $IMAGE php -v | |
| docker run --rm $IMAGE composer --version | |
| secrets: inherit | |
| # ═══════════════════════════════════════════════════════════════════════════ | |
| # STANDARD TIER (DEFAULT) - With ImageMagick, vips, Node.js | |
| # ═══════════════════════════════════════════════════════════════════════════ | |
| build-matrix: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| php_version: ['8.2', '8.3', '8.4', '8.5'] | |
| os_variant: ['bookworm'] | |
| uses: ./.github/workflows/_build-image.yml | |
| with: | |
| image-name: php-cli | |
| image-type: php-cli | |
| php-version: ${{ matrix.php_version }} | |
| os-variant: ${{ matrix.os_variant }} | |
| tier: standard | |
| target: root | |
| tag-suffix: '' | |
| cache-scope-prefix: cli | |
| enable-patch-tags: true | |
| enable-latest-tag: true | |
| enable-cosign: false | |
| base-image-type: cli | |
| test-script: | | |
| echo "Testing $IMAGE..." | |
| docker run --rm $IMAGE php -v | |
| docker run --rm $IMAGE php -m | grep -E "opcache|redis|pdo_mysql|gd|imagick" | |
| docker run --rm $IMAGE composer --version | |
| docker run --rm $IMAGE node --version | |
| docker run --rm $IMAGE cbox-init --version | |
| secrets: inherit | |
| build-rootless-matrix: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| php_version: ['8.2', '8.3', '8.4', '8.5'] | |
| os_variant: ['bookworm'] | |
| uses: ./.github/workflows/_build-image.yml | |
| with: | |
| image-name: php-cli | |
| image-type: php-cli | |
| php-version: ${{ matrix.php_version }} | |
| os-variant: ${{ matrix.os_variant }} | |
| tier: standard | |
| target: rootless | |
| rootless: true | |
| tag-suffix: rootless | |
| cache-scope-prefix: cli | |
| enable-patch-tags: true | |
| enable-latest-tag: true | |
| enable-cosign: false | |
| base-image-type: cli | |
| test-script: | | |
| echo "Testing rootless image $IMAGE..." | |
| # Verify running as non-root (www-data = uid 33 on Debian Bookworm) | |
| docker run --rm $IMAGE id -u | grep -E "^33$" | |
| docker run --rm $IMAGE php -v | |
| docker run --rm $IMAGE php -m | grep -E "opcache|redis|pdo_mysql|gd|imagick" | |
| docker run --rm $IMAGE composer --version | |
| docker run --rm $IMAGE node --version | |
| docker run --rm $IMAGE cbox-init --version | |
| secrets: inherit | |
| # ═══════════════════════════════════════════════════════════════════════════ | |
| # CHROMIUM TIER - With Chromium for Browsershot/Dusk | |
| # ═══════════════════════════════════════════════════════════════════════════ | |
| build-chromium-matrix: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| php_version: ['8.2', '8.3', '8.4', '8.5'] | |
| os_variant: ['bookworm'] | |
| uses: ./.github/workflows/_build-image.yml | |
| with: | |
| image-name: php-cli | |
| image-type: php-cli | |
| php-version: ${{ matrix.php_version }} | |
| os-variant: ${{ matrix.os_variant }} | |
| tier: chromium | |
| target: chromium-root | |
| tag-suffix: chromium | |
| cache-scope-prefix: cli | |
| enable-patch-tags: true | |
| enable-cosign: false | |
| base-image-type: cli | |
| test-script: | | |
| echo "Testing chromium image $IMAGE..." | |
| docker run --rm $IMAGE php -v | |
| docker run --rm $IMAGE php -m | grep -E "opcache|redis|pdo_mysql|gd|imagick" | |
| docker run --rm $IMAGE composer --version | |
| docker run --rm $IMAGE node --version | |
| docker run --rm $IMAGE cbox-init --version | |
| # Verify Chromium is installed | |
| docker run --rm $IMAGE which chromium-browser || docker run --rm $IMAGE which chromium | |
| secrets: inherit | |
| build-chromium-rootless-matrix: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| php_version: ['8.2', '8.3', '8.4', '8.5'] | |
| os_variant: ['bookworm'] | |
| uses: ./.github/workflows/_build-image.yml | |
| with: | |
| image-name: php-cli | |
| image-type: php-cli | |
| php-version: ${{ matrix.php_version }} | |
| os-variant: ${{ matrix.os_variant }} | |
| tier: chromium | |
| target: chromium-rootless | |
| rootless: true | |
| tag-suffix: chromium-rootless | |
| cache-scope-prefix: cli | |
| enable-patch-tags: true | |
| enable-cosign: false | |
| base-image-type: cli | |
| test-script: | | |
| echo "Testing chromium rootless image $IMAGE..." | |
| docker run --rm $IMAGE id -u | grep -E "^(33|82)$" | |
| docker run --rm $IMAGE php -v | |
| docker run --rm $IMAGE composer --version | |
| docker run --rm $IMAGE which chromium-browser || docker run --rm $IMAGE which chromium | |
| secrets: inherit | |
| # ═══════════════════════════════════════════════════════════════════════════ | |
| # DEV TIER - Standard + Xdebug, PCOV, SPX for development/testing | |
| # ═══════════════════════════════════════════════════════════════════════════ | |
| build-dev-matrix: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| php_version: ['8.2', '8.3', '8.4', '8.5'] | |
| os_variant: ['bookworm'] | |
| uses: ./.github/workflows/_build-image.yml | |
| with: | |
| image-name: php-cli | |
| image-type: php-cli | |
| php-version: ${{ matrix.php_version }} | |
| os-variant: ${{ matrix.os_variant }} | |
| tier: dev | |
| target: dev-root | |
| tag-suffix: dev | |
| cache-scope-prefix: cli | |
| enable-patch-tags: true | |
| enable-cosign: false | |
| base-image-type: cli | |
| test-script: | | |
| echo "Testing dev image $IMAGE..." | |
| docker run --rm $IMAGE php -v | |
| docker run --rm $IMAGE php -m | grep -E "opcache|redis|pdo_mysql|gd|imagick|xdebug|pcov|spx" | |
| docker run --rm $IMAGE composer --version | |
| docker run --rm $IMAGE node --version | |
| docker run --rm $IMAGE cbox-init --version | |
| # Dev tier should have chromium (inherited from chromium tier) | |
| docker run --rm $IMAGE which chromium-browser || docker run --rm $IMAGE which chromium | |
| secrets: inherit | |
| build-dev-rootless-matrix: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| php_version: ['8.2', '8.3', '8.4', '8.5'] | |
| os_variant: ['bookworm'] | |
| uses: ./.github/workflows/_build-image.yml | |
| with: | |
| image-name: php-cli | |
| image-type: php-cli | |
| php-version: ${{ matrix.php_version }} | |
| os-variant: ${{ matrix.os_variant }} | |
| tier: dev | |
| target: dev-rootless | |
| rootless: true | |
| tag-suffix: dev-rootless | |
| cache-scope-prefix: cli | |
| enable-patch-tags: true | |
| enable-cosign: false | |
| base-image-type: cli | |
| test-script: | | |
| echo "Testing dev rootless image $IMAGE..." | |
| docker run --rm $IMAGE id -u | grep -E "^(33|82)$" | |
| docker run --rm $IMAGE php -v | |
| docker run --rm $IMAGE php -m | grep -E "xdebug|pcov|spx" | |
| secrets: inherit |