[neilime]

PHP discovery remains the implementation in this PR. A FIXME links the upstream parser correction; the native Node.js conversion is prepared separately in draft #16, pending a fixed stable composer-semver release.

When no PHP version is specified, derive it from composer.json instead of duplicating the support range in a version file and workflow matrix. CI tests the newest compatible stable patch of each minor; standalone setup selects the highest compatible release.

• Add a standalone get-php-versions action using a Docker image, Composer's constraint parser and PHP.net's release catalog. Handle patch bounds and disjoint ranges, retain explicitly supported end-of-life minors, exclude prereleases, and fail clearly when discovery cannot produce a valid result.
• Preserve explicit CI matrices, setup inputs, optional version files and Composer platform overrides. Automatic CI discovery uses require.php independently of local overrides.
• Build the action's Dockerfile and run its resolver with the runner's UID/GID and a read-only checkout mount. Reuse the same entry point for local builds. Discovery does not install PHP or Composer on the runner. The entry point preserves workspace containment and returns JSON; github-script publishes the existing outputs using its supplied exec and core helpers. Consumer Makefiles derive its revision from the existing workflow pins, so dependency updates also update local builds without a separate revision setting. Keep dependencies locked and maintained by the existing weekly Dependabot Composer configuration; /actions/**/* covers both the manifest and lockfile without a per-action directory list.
• Add focused unit and workflow integration coverage, keep PHP version selection, overrides and local Docker usage together in the generated action README, and record the selection policy in the existing ADR.
• Audit all 12 upstream action/workflow dependencies against their latest stable releases. Update every ci-github-common reference from 4.0.0 to 4.2.0, including the generated reporting example; the other 11 dependencies are already current. Preserve full commit pins and existing interfaces.

Validation: 18 PHPUnit tests (21 assertions) and the hosted integration suite passed before the dependency refresh. A real Docker test of the actual action script verifies owner-only Composer manifests, both outputs, rejection of missing/outside/symlink/invalid-project paths without outputs, and the unchanged local CLI. The default image runs unprivileged; source mounts reject writes. Trivy and Checkov pass with no exceptions (24 Checkov checks, zero skipped), along with actionlint, tracked-file Zizmor, Hadolint, formatting and documentation checks. All 84 external action/workflow uses were checked against 24 published interfaces, including inputs, secrets and referenced outputs. Hosted CI exercises the action, unchanged runner PHP, automatic matrices, absolute setup paths and explicit overrides.

Compatibility: the Docker action requires Linux with Docker. The image defaults to an unprivileged user; the composite wrapper maps the runner UID/GID, mounts the checkout read-only and publishes outputs from the host. No root-user scanner exemptions are needed. The default CI matrix now includes every stable minor allowed by require.php. Projects without a PHP constraint must declare one or select a version explicitly. Discovery requires access to PHP.net. Consumer migration PRs will pin this implementation for validation before switching to a stable release. No release or tag is created by this PR.

Consumer validation: TWBS #869, ANSI Twig #119, ANSI HTML #167, GeSHi Twig #128, and PHP CSS Lint #234. These draft PRs remove redundant PHP version files/matrices and use the shared resolver for local Docker builds. Their development pins must switch to the stable release before merge.

[github-actions]

Hi, thank you for creating your PR, we will check it out very soon

[github-actions]

PHP lint results

Lint: 0 errors · 0 warnings in 1 diagnostic report(s).

Lint details

Lint results

Lint Checks

Severity	Count
❌ Errors	0
⚠️ Warnings	0
Total	0

[github-actions]

PHP test results

Test: 1 passed · 0 failed · 0 skipped.

Test details

Test results

Test Results

Status	Count
✅ Passed	1
❌ Failed	0
⏭️ Skipped	0
Total	1

✅ Pass Rate: 100.0%

Coverage: 1 source report(s); percentages remain separate.

Coverage details

Coverage results

Coverage

Metric	Covered	Total	Percentage
Lines	1	1	100.00%

Overall: 100.00% 🟢
🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

[github-actions]

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
DOCKERFILE_HADOLINT	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
MARKDOWN	Pass ✅
MARKDOWN_PRETTIER	Pass ✅
NATURAL_LANGUAGE	Pass ✅
PRE_COMMIT	Pass ✅
RENOVATE	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter
Super-linter revision: 2da136927bd4a73596db63044b504547c62cb854
Super-linter version: 9.0.0