refactor: run PHP version discovery on native Node.js

.gitattributes

@@ -0,0 +1 @@
+actions/**/dist/** linguist-generated=true -whitespace

.github/codeql/config.yml

@@ -0,0 +1,3 @@
+name: Maintained JavaScript sources
+paths-ignore:
+  - actions/**/dist/**

.github/dependabot.yml

@@ -56,6 +56,24 @@ updates:
           - "*"
     cooldown:
       default-days: 7
+  - package-ecosystem: npm
+    commit-message:
+      prefix: build
+      include: scope
+    open-pull-requests-limit: 20
+    versioning-strategy: increase
+    directories:
+      - /actions/**/*
+    schedule:
+      interval: weekly
+      day: friday
+      time: "04:00"
+    groups:
+      npm-dependencies:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 7
   - package-ecosystem: devcontainers
     commit-message:
       prefix: build

.github/linters/.codespellrc

@@ -0,0 +1,2 @@
+[codespell]
+skip = *actions/*/dist/*

.github/linters/.jscpd.json

@@ -2,6 +2,7 @@
   "threshold": 5,
   "ignore": [
     "**/vendor/**",
+    "actions/**/dist/**",
     "**/actions/**/README.md",
     "**/.github/workflows/*.md"
   ]

.github/renovate.json

@@ -43,5 +43,8 @@
       "datasourceTemplate": "github-releases",
       "depNameTemplate": "composer/composer"
     }
+  ],
+  "gitIgnoredAuthors": [
+    "128996893+hoverkraft-bot[bot]@users.noreply.github.com"
   ]
 }

.github/workflows/__commit-action-distributions.yml

@@ -0,0 +1,22 @@
+name: Internal - Commit action distributions
+
+on: # zizmor: ignore[dangerous-triggers] Trusted writer validates origin, actor, PR head and paths; it never executes PR code.
+  workflow_run:
+    workflows: [Internal - Rebuild action distributions]
+    types: [completed]
+
+permissions: {}
+
+jobs:
+  distributions:
+    uses: hoverkraft-tech/ci-github-common/.github/workflows/action-distributions.yml@d07ee49b460ae2f3815804b5153fe918092aa321 # 4.2.0
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: read
+    with:
+      pull-request-authors: |
+        ["dependabot", "renovate", {"login":"hoverkraft-bot[bot]","id":128996893,"branch-prefix":"renovate/"}]
+      github-app-client-id: ${{ vars.CI_BOT_APP_CLIENT_ID }}
+    secrets:
+      github-app-key: ${{ secrets.CI_BOT_APP_PRIVATE_KEY }}

.github/workflows/__rebuild-action-distributions.yml

@@ -0,0 +1,18 @@
+name: Internal - Rebuild action distributions
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions: {}
+
+jobs:
+  distributions:
+    uses: hoverkraft-tech/ci-github-common/.github/workflows/action-distributions.yml@d07ee49b460ae2f3815804b5153fe918092aa321 # 4.2.0
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: read
+    with:
+      pull-request-authors: |
+        ["dependabot", "renovate", {"login":"hoverkraft-bot[bot]","id":128996893,"branch-prefix":"renovate/"}]

.github/workflows/__shared-ci.yml

@@ -3,7 +3,8 @@ on:
   workflow_call: null
 permissions: {}
 jobs:
-  linter:
+  lint:
+    name: linter
     uses: hoverkraft-tech/ci-github-common/.github/workflows/linter.yml@d07ee49b460ae2f3815804b5153fe918092aa321 # 4.2.0
     permissions:
       contents: read
@@ -14,6 +15,7 @@ jobs:
       actions: read
       security-events: write
     with:
+      comment: false
       linter-env: |-
         VALIDATE_PHP_BUILTIN=false
         VALIDATE_PHP_PHPCS=false
@@ -29,6 +31,9 @@ jobs:
     permissions:
       contents: read
       id-token: write
+      packages: read
+      pull-requests: write
+      security-events: write
   test-action-setup-php:
     uses: $/.github/workflows/__test-action-setup-php.yml
     permissions:
@@ -76,3 +81,16 @@ jobs:
     uses: $/.github/workflows/__test-workflow-documentation.yml
     permissions:
       contents: read
+  test-bundled-actions:
+    uses: hoverkraft-tech/ci-github-common/.github/workflows/test-action-distributions.yml@d07ee49b460ae2f3815804b5153fe918092aa321 # 4.2.0
+    permissions:
+      contents: read
+  reports:
+    needs: [lint, test-action-get-php-versions]
+    if: always()
+    uses: hoverkraft-tech/ci-github-common/.github/workflows/ci-reports.yml@d07ee49b460ae2f3815804b5153fe918092aa321 # 4.2.0
+    permissions:
+      contents: read
+      pull-requests: write
+    with:
+      job-results: ${{ toJSON(needs) }}

.github/workflows/__test-action-get-php-versions.yml

@@ -4,14 +4,19 @@ on:
 permissions: {}
 jobs:
   unit:
-    uses: $/.github/workflows/continuous-integration.yml
+    uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@fbd3522b68c55a6314aadbededaa487825ba9b35 # 3.0.0
     permissions:
       contents: read
       id-token: write
+      packages: read
+      pull-requests: write
+      security-events: write
     with:
       working-directory: actions/get-php-versions
-      lint: "false"
-      dependency-review: false
+      build: ""
+      lint: ""
+      code-ql: '{"languages":"typescript","config-file":".github/codeql/config.yml"}'
+      test: '{"comment":false,"report-group":"test-action-get-php-versions"}'
   integration:
     runs-on: ubuntu-latest
     permissions:

.github/workflows/continuous-integration.md

@@ -34,14 +34,14 @@ they execute even when dependency installation scripts are disabled. An empty
 
 Use `runs-on` for a JSON array of Linux runner labels, for example
 `runs-on: '["self-hosted", "linux"]'`. Every job uses those labels.
-Docker must be available for the PHP version discovery action.
+PHP version discovery uses GitHub's native Node.js runtime with bundled dependencies.
 Set `checks: false` to skip lint, tests, dependency review and distribution checks.
 
 ### Runtime and dependencies
 
 With no `php-versions` input, CI reads `composer.json`'s `require.php` and
-discovers released stable versions from PHP.net using Composer's constraint parser.
-Discovery runs in its own container without changing the runner's PHP installation.
+discovers released stable versions from PHP.net using Composer constraint semantics.
+Discovery leaves the runner's PHP installation unchanged.
 It tests the newest compatible patch of every matching minor, including end-of-life
 versions still allowed by the project. Prereleases are excluded. Missing or invalid
 constraints and release-catalog failures stop discovery instead of choosing an arbitrary runtime.

.github/workflows/continuous-integration.yml

@@ -19,14 +19,14 @@
 #
 # Use `runs-on` for a JSON array of Linux runner labels, for example
 # `runs-on: '["self-hosted", "linux"]'`. Every job uses those labels.
-# Docker must be available for the PHP version discovery action.
+# PHP version discovery uses GitHub's native Node.js runtime with bundled dependencies.
 # Set `checks: false` to skip lint, tests, dependency review and distribution checks.
 #
 # ### Runtime and dependencies
 #
 # With no `php-versions` input, CI reads `composer.json`'s `require.php` and
-# discovers released stable versions from PHP.net using Composer's constraint parser.
-# Discovery runs in its own container without changing the runner's PHP installation.
+# discovers released stable versions from PHP.net using Composer constraint semantics.
+# Discovery leaves the runner's PHP installation unchanged.
 # It tests the newest compatible patch of every matching minor, including end-of-life
 # versions still allowed by the project. Prereleases are excluded. Missing or invalid
 # constraints and release-catalog failures stop discovery instead of choosing an arbitrary runtime.

.gitignore

@@ -22,6 +22,8 @@ cobertura.xml
 
 # Build artifacts
 dist/
+!actions/**/dist/
+node_modules/
 build/
 coverage/
 

Makefile

@@ -1,6 +1,7 @@
-.PHONY: help setup deps-install deps-update deps-update-interactive deps-audit test ci lint lint-fix
+.PHONY: help setup deps-install deps-update deps-update-interactive deps-audit build test ci lint lint-fix
 
 COMPOSER_DIRECTORIES := $(patsubst %/composer.json,%,$(shell git ls-files '**/composer.json'))
+NPM_DIRECTORIES := $(patsubst %/package.json,%,$(shell git ls-files 'actions/**/package.json' ':!:actions/**/dist/**'))
 
 help: ## Display help
 	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
@@ -11,11 +12,13 @@ deps-install: ## Install action and fixture dependencies without hooks or plugin
 	@set -e; for directory in $(COMPOSER_DIRECTORIES); do \
 		composer --working-dir="$$directory" --no-interaction --no-plugins install --no-scripts --prefer-dist; \
 	done
+	@set -e; for directory in $(NPM_DIRECTORIES); do npm --prefix="$$directory" ci --ignore-scripts; done
 
 deps-update: ## Update action and fixture dependencies and lockfiles
 	@set -e; for directory in $(COMPOSER_DIRECTORIES); do \
 		composer --working-dir="$$directory" --no-interaction --no-plugins update --no-scripts --prefer-dist; \
 	done
+	@set -e; for directory in $(NPM_DIRECTORIES); do npm --prefix="$$directory" update --ignore-scripts; done
 
 deps-update-interactive: ## Interactively select fixture dependency updates
 	@set -e; for directory in $(COMPOSER_DIRECTORIES); do \
@@ -26,19 +29,25 @@ deps-audit: ## Audit action and fixture dependencies
 	@set -e; for directory in $(COMPOSER_DIRECTORIES); do \
 		composer --working-dir="$$directory" --no-interaction --no-plugins audit; \
 	done
+	@set -e; for directory in $(NPM_DIRECTORIES); do npm --prefix="$$directory" audit; done
 
-test: ## Run fixture lint and Composer project tests
+build: ## Rebuild standalone JavaScript action distributions
+	@set -e; for directory in $(NPM_DIRECTORIES); do npm --prefix="$$directory" run build; done
+
+test: ## Run fixture lint and standalone action tests
 	composer --working-dir=tests/php-project lint:ci
 	@set -e; for directory in $(COMPOSER_DIRECTORIES); do \
 		if php -r 'exit(isset(json_decode(file_get_contents($$argv[1]), true)["scripts"]["test"]) ? 0 : 1);' "$$directory/composer.json"; then \
 			composer --working-dir="$$directory" test; \
 		fi; \
 	done
+	@set -e; for directory in $(NPM_DIRECTORIES); do npm --prefix="$$directory" test; done
 
 ci: ## Install, audit, test and lint without rewriting source files
 	$(MAKE) deps-install
 	$(MAKE) deps-audit
 	$(MAKE) test
+	@set -e; for directory in $(NPM_DIRECTORIES); do npm --prefix="$$directory" run check:dist; done
 	$(MAKE) lint
 
 lint: ## Execute linting
@@ -76,4 +85,4 @@ endef
 # Argument fix workaround
 #############################
 %:
-	@:
+	@:

actions/get-php-versions/.dockerignore

@@ -1,5 +1,3 @@
 *
-!composer.json
-!composer.lock
-!src/PhpVersions.php
-!src/cli.php
+!dist/
+!dist/**

actions/get-php-versions/Dockerfile

@@ -1,12 +1,10 @@
-FROM composer:2.11.0@sha256:278dfc7bd35169965d03f87194816f43bf4e6b6ea61707c2114e52ad12fe24ce
+FROM node:24-bookworm-slim@sha256:01d566e8d94d8c619591d78652babfccd3c6992a3dffa9ed5ab39e11cf6c70e9
 
-COPY composer.json composer.lock /opt/php-versions/
-RUN composer --working-dir=/opt/php-versions install --no-dev --no-interaction --no-plugins --no-scripts --prefer-dist --no-progress
-COPY src/ /opt/php-versions/src/
+COPY dist/ /opt/php-versions/dist/
 
-USER 65534:65534
+USER 1000:1000
 
-HEALTHCHECK --interval=5m --timeout=10s --retries=3 CMD ["php", "--version"]
+HEALTHCHECK --interval=5m --timeout=10s --retries=3 CMD ["node", "--version"]
 
-ENTRYPOINT ["php", "/opt/php-versions/src/cli.php"]
+ENTRYPOINT ["node", "/opt/php-versions/dist/index.js"]
 CMD ["/project", "--latest"]

actions/get-php-versions/README.md

@@ -13,7 +13,7 @@
 
 ## Overview
 
-Discover stable PHP releases matching composer.json require.php using Composer constraints. Runs in Docker on Linux without changing the runner's PHP installation.
+Discover stable PHP releases matching composer.json require.php using Composer constraints. Runs on the native Node.js runtime without installing PHP or project dependencies.
 
 ### PHP version selection
 
@@ -33,17 +33,16 @@ checks and publishes coverage. A new stable minor is included when the constrain
 already allows it. Explicitly restricted ranges require a deliberate Composer change
 before CI adds another minor. End-of-life versions remain tested when still allowed.
 
-Discovery uses PHP.net release metadata and Composer's constraint parser. It handles
+Discovery uses PHP.net release metadata and composer-semver's Composer constraint parser. It handles
 patch bounds and disjoint ranges without approximating them as npm SemVer.
 Prereleases are excluded. A missing or invalid `require.php`, an unavailable release
 catalog, or a constraint with no matching stable release causes an error. Dependency
 installation still validates the project and tooling against the selected runtime.
 
-The discovery action builds and runs its Docker image on Linux runners with Docker,
-using the runner's UID/GID and a read-only checkout mount.
-CI and local builds use the same container runtime and locked dependencies. Discovery
-does not change PHP on the runner. The setup action then installs the selected PHP
-version when the job needs it.
+The discovery action uses GitHub's native Node.js runtime with bundled dependencies.
+It needs no PHP, Composer, Docker or dependency installation on the runner. Discovery
+leaves the runner's PHP installation unchanged. Local Docker builds use the same
+bundled resolver. The setup action installs the selected PHP version when needed.
 
 ### Overrides
 
@@ -87,7 +86,7 @@ Automatic selection requires workflow files with one consistent commit pin for
 `ci-github-php`. Missing or conflicting pins stop the build before fetching the
 resolver. Explicit `PHP_VERSION` overrides in the consumer Makefiles skip discovery.
 
-Docker caches the resolver image's dependencies. Each invocation consults the release
+Docker caches the resolver image and its bundled dependencies. Each invocation consults the release
 catalog, so newly available compatible releases need no Makefile version edit. The
 resolver prints the highest matching patch by default. Pass `/project` as its only
 argument to print the complete JSON result instead.