[neilime]

The PHP version discovery action currently builds and runs a PHP container. This draft moves it to GitHub's native Node.js 24 runtime with bundled dependencies, preserving the working-directory input, both version outputs, Composer constraint semantics and workspace containment. Local Docker builds retain their existing interface and run the same bundle as an unprivileged user.

ci-github-php 2.0.0 ships the validated PHP implementation from #15. This draft is rebased onto the released main commit and contains one migration commit. .github/workflows/__pull-request-ci.yml is unchanged; its main-only trigger now runs the full repository CI for this draft.

Dependency blocker

Do not merge this draft yet. composer-semver-ts #1 corrects eight Composer parsing differences found during the migration. The manifest, lockfile and committed bundle currently use the published composer-semver 0.1.1. All regression tests remain active; no parser patches, skipped tests or unpublished dependency are committed.

Before marking this PR ready:

• Wait for a stable composer-semver release containing the upstream corrections.
• Update the manifest and lockfile, rebuild the bundle, and remove the dependency FIXME.
• Rebase onto the released main after feat!: discover PHP versions from Composer constraints #15.
• Enable Dependency graph for this repository: the first run against main reports that Dependency Review is not supported. Keep the review check enabled.
• Pass the complete repository CI, including action/setup integration and distribution checks.

Implementation

• Replace the action's Composer project and PHP source with a standalone npm package, native entry point and committed minified ncc distribution with license notices. Minification removes dependency documentation examples that otherwise trigger secret-scanning false positives.
• Follow the parse-ci-reports test pattern: source-adjacent tests, shared Node.js CI, JUnit/LCOV reports, combined reporting and shared isolated-distribution verification.
• Use recursive Dependabot discovery and the shared distribution rebuild/writer workflows for npm dependency updates. Keep the existing Composer fixture coverage.
• Update the local Makefile, generated action/workflow guides and existing ADR. Generated bundle exclusions use wildcard patterns.

Validation

• Node.js 24, committed dependency: 63/71 tests pass; eight known parser regressions fail. No skipped tests.
• Isolated validation copy using a local package built from upstream PR commit cc5844b8ea2109de7ee9bba1806a118a311c17ae: 71/71 tests pass. This candidate is not a released package and is not committed here.
• Five isolated-bundle contract tests pass on Node.js 24 without adjacent dependencies; check:dist and Gitleaks pass on the minified distribution. Secret-scanning rules remain enabled.
• Native and unprivileged Docker resolvers return the same PHP.net result for the Composer fixture.
• Biome, actionlint, hadolint, Markdown, duplicate-code and security checks pass. Runtime npm audit reports zero vulnerabilities.
• CI Dokumentor regenerated the action and workflow overviews from YAML metadata.

[github-actions]

PHP test results

Test: 1 passed · 0 failed · 0 skipped.

Test details

Test results

Test Results

Status	Count
✅ Passed	1
❌ Failed	0
⏭️ Skipped	0
Total	1

✅ Pass Rate: 100.0%

Coverage: 1 source report(s); percentages remain separate.

Coverage details

Coverage results

Coverage

Metric	Covered	Total	Percentage
Lines	1	1	100.00%

Overall: 100.00% 🟢
🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

[github-actions]

PHP lint results

Lint: 0 errors · 0 warnings in 1 diagnostic report(s).

Lint details

Lint results

Lint Checks

Severity	Count
❌ Errors	0
⚠️ Warnings	0
Total	0

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

Internal - Pull request - Continuous Integration - Test results

Workflow run and full reports · Commit 5bc7721

Jobs: 1 success · 1 failure · 0 cancelled · 0 skipped · 0 abandoned.

Test: 63 passed · 8 failed · 0 skipped.

Test details

Test results

Test Results

Status	Count
✅ Passed	63
❌ Failed	8
⏭️ Skipped	0
Total	71

❌ Pass Rate: 88.7%

Failed Tests

• honors the Composer constraint: 8.2.x (suite: Unknown Suite)
  • File: /home/runner/work/ci-github-php/ci-github-php/actions/get-php-versions/src/PhpVersions.test.js
  • Error: malformed constraint: 8.2.x
• honors the Composer constraint: 8.2 - 8.4 (suite: Unknown Suite)
  • File: /home/runner/work/ci-github-php/ci-github-php/actions/get-php-versions/src/PhpVersions.test.js
  • Error: Expected values to be strictly deep-equal:&build(deps): update GitHub Actions and workflows #10;+ actual - expected&build(deps): update GitHub Actions and workflows #10;&build(deps): update GitHub Actions and workflows #10; {&build(deps): update GitHub Actions and workflows #10;+ 'php-version': '8.4.0',&build(deps): update GitHub Actions and workflows #10;- 'php-version': '8.4.1',&build(deps): update GitHub Actions and workflows #10; 'php-versions': [&build(deps): update GitHub Actions and workflows #10; '8.2.10',&build(deps): update GitHub Actions and workflows #10; ...
• honors the Composer constraint: !=8.3.* (suite: Unknown Suite)
  • File: /home/runner/work/ci-github-php/ci-github-php/actions/get-php-versions/src/PhpVersions.test.js
  • Error: Missing expected rejection.
• honors the Composer constraint: >=8.3.0RC1 <8.4 (suite: Unknown Suite)
  • File: /home/runner/work/ci-github-php/ci-github-php/actions/get-php-versions/src/PhpVersions.test.js
  • Error: malformed constraint: >=8.3.0RC1
• honors the Composer constraint: 8.2.0 as 8.3.0 (suite: Unknown Suite)
  • File: /home/runner/work/ci-github-php/ci-github-php/actions/get-php-versions/src/PhpVersions.test.js
  • Error: malformed constraint: as

... and 3 more failures

Job results and report availability

Job	Result	Report artifacts
lint	success	3
test-action-get-php-versions	failure	1

Only this attempt is included. On partial reruns, rerun all producer jobs for complete reports. CodeQL findings remain in code scanning; other diagnostics remain in the job logs.

[github-actions]

Internal - Pull request - Continuous Integration - Code coverage

Workflow run and full reports · Commit 5bc7721

Jobs: 1 success · 1 failure · 0 cancelled · 0 skipped · 0 abandoned.

Coverage: 1 source report(s); percentages remain separate.

Coverage details

Coverage results

Coverage

Metric	Covered	Total	Percentage
Lines	168	168	100.00%
Branches	65	68	95.59%
Functions	9	9	100.00%

Overall: 100.00% 🟢
🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

Job results and report availability

Job	Result	Report artifacts
lint	success	3
test-action-get-php-versions	failure	1

Only this attempt is included. On partial reruns, rerun all producer jobs for complete reports. CodeQL findings remain in code scanning; other diagnostics remain in the job logs.

[github-actions]

Internal - Pull request - Continuous Integration - Lint results

Workflow run and full reports · Commit 5bc7721

Jobs: 1 success · 1 failure · 0 cancelled · 0 skipped · 0 abandoned.

Lint: Collected diagnostics and Super-Linter summaries. Execution status is included in the job outcomes.

Lint: 1 errors · 0 warnings in 2 diagnostic report(s).

Lint details

Lint results

Lint Checks

Severity	Count
❌ Errors	1
⚠️ Warnings	0
Total	1

Errors

• src/Sample.php:9:1 - Method TestCi\Sample::sample() should return int but returns string.
  • Rule: return.type

Super-Linter details

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
DOCKERFILE_HADOLINT	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
MARKDOWN	Pass ✅
MARKDOWN_PRETTIER	Pass ✅
NATURAL_LANGUAGE	Pass ✅
PRE_COMMIT	Pass ✅
RENOVATE	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter
Super-linter revision: 2da136927bd4a73596db63044b504547c62cb854
Super-linter version: 9.0.0

Job results and report availability

Job	Result	Report artifacts
lint	success	3
test-action-get-php-versions	failure	1

Only this attempt is included. On partial reruns, rerun all producer jobs for complete reports. CodeQL findings remain in code scanning; other diagnostics remain in the job logs.