Bump to 0.19.1-sudo.5 and teach the release helper the sudo serial #5
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "PHP extension" | |
| # Builds the secretspec-php-native PHP extension (ext-php-rs) as a prebuilt | |
| # shared object for each supported PHP minor x platform, smoke tests that it | |
| # loads and registers its functions, and on a version tag attaches the binaries | |
| # to the GitHub Release. | |
| # | |
| # DISTRIBUTION STATUS (see RELEASE.md): this builds and publishes prebuilt | |
| # extension binaries. Installing them is documented in the PHP SDK docs | |
| # (download + `extension=`, or `docker-php-ext-enable`, or build from source with | |
| # cargo). A one-command PIE install is a follow-up: PIE builds non-Windows | |
| # extensions from source via phpize, which does not apply to a Cargo/ext-php-rs | |
| # extension, so the prebuilt-binary path here is what is validated. | |
| # | |
| # The SDK itself is exercised on every PR by the devenv-based sdks.yml (both the | |
| # extension and the ext-ffi fallback); this workflow only builds the | |
| # distributable extension binaries. | |
| on: | |
| workflow_call: | |
| inputs: | |
| release_tag: | |
| description: Existing GitHub Release tag to upload artifacts to | |
| required: false | |
| type: string | |
| default: "" | |
| workflow_dispatch: | |
| inputs: | |
| release_tag: | |
| description: Existing GitHub Release tag to upload artifacts to | |
| required: false | |
| type: string | |
| default: "" | |
| push: | |
| tags: | |
| - v** | |
| pull_request: | |
| paths: | |
| - "secretspec-php/**" | |
| - ".github/workflows/php-ext.yml" | |
| jobs: | |
| build: | |
| name: php-${{ matrix.php }}-${{ matrix.target }} | |
| runs-on: ${{ matrix.runner }} | |
| permissions: | |
| contents: write # attach binaries to the release (tag runs only) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # Full php x target cross-product: the `include` entries share the | |
| # `target` key with the axis, so they merge in the runner (rather than | |
| # creating standalone combinations). Non-thread-safe (NTS) is the default | |
| # CLI/FPM build. 8.1 is omitted (end of life). ZTS builds are a | |
| # follow-up. On Windows, ext-php-rs's build script downloads the PHP | |
| # devel pack matching the installed php.exe (setup-php installs the | |
| # official windows.php.net build) and links its php8.lib, so no manual | |
| # dev-pack step is needed. | |
| php: ["8.2", "8.3", "8.4"] | |
| target: | |
| - x86_64-unknown-linux-gnu | |
| - aarch64-unknown-linux-gnu | |
| - aarch64-apple-darwin | |
| - x86_64-pc-windows-msvc | |
| include: | |
| - { target: x86_64-unknown-linux-gnu, runner: ubuntu-latest, libext: so } | |
| - { target: aarch64-unknown-linux-gnu, runner: ubuntu-24.04-arm, libext: so } | |
| - { target: aarch64-apple-darwin, runner: macos-latest, libext: so } | |
| - { target: x86_64-pc-windows-msvc, runner: windows-latest, libext: dll } | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up PHP ${{ matrix.php }} | |
| uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 | |
| with: | |
| php-version: ${{ matrix.php }} | |
| # php-config + headers, needed by ext-php-rs's build. | |
| tools: none | |
| env: | |
| # Ensure the dev headers are available for the build. | |
| phpts: nts | |
| - name: Install Linux build dependencies (clang for bindgen) | |
| if: runner.os == 'Linux' | |
| run: sudo apt-get update && sudo apt-get install -y llvm-dev libclang-dev clang | |
| - name: Install Rust (pinned by rust-toolchain.toml) | |
| run: rustup toolchain install | |
| # PHP's Windows ABI uses the vectorcall calling convention, which stable | |
| # Rust does not expose; ext-php-rs therefore requires nightly on Windows | |
| # (its own CI builds Windows on nightly, all other platforms on stable). | |
| - name: Install Rust nightly (vectorcall ABI, Windows only) | |
| if: runner.os == 'Windows' | |
| run: rustup toolchain install nightly --profile minimal | |
| # Keyed per target and PHP minor: ext-php-rs's build script generates | |
| # per-PHP-version bindings into the build dir. (The Windows rows build | |
| # on nightly, whose daily version bump naturally expires their cache.) | |
| - name: Cache Rust builds | |
| uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 | |
| with: | |
| key: ${{ matrix.target }}-php${{ matrix.php }} | |
| - name: Build and stage the extension under its distribution name | |
| id: stage | |
| shell: bash | |
| # Each runner is the target's native arch, so a plain release build emits | |
| # the target's binary (no cross-compilation). build-ext.sh owns the | |
| # platform-to-library-name mapping and stages lib/secretspec.<ext>. | |
| run: | | |
| set -euo pipefail | |
| # RUSTUP_TOOLCHAIN outranks rust-toolchain.toml; see the nightly note. | |
| if [ "${{ runner.os }}" = "Windows" ]; then | |
| export RUSTUP_TOOLCHAIN=nightly | |
| # PHP's Windows loader refuses modules linked with a newer MSVC | |
| # linker than the php.exe core (the official 8.x builds are | |
| # VS16/VS17; the runner's link.exe is newer). rust-lld stamps a | |
| # compatible PE linker version -- the setup ext-php-rs recommends. | |
| export RUSTFLAGS="-C linker=rust-lld" | |
| fi | |
| bash secretspec-php/scripts/build-ext.sh | |
| asset="secretspec-php-native-${{ matrix.php }}-nts-${{ matrix.target }}.${{ matrix.libext }}" | |
| cp "secretspec-php/lib/secretspec.${{ matrix.libext }}" "$asset" | |
| echo "asset=$asset" >> "$GITHUB_OUTPUT" | |
| - name: Smoke test (load the extension, check it registers) | |
| # Every row builds natively, so the runner can load what it built. | |
| shell: bash | |
| run: | | |
| # php.exe needs a Windows path, not Git Bash's /d/a/... form. | |
| dir="$PWD" | |
| case "$(uname -s)" in MINGW*|MSYS*) dir="$(pwd -W)" ;; esac | |
| php -d extension="$dir/${{ steps.stage.outputs.asset }}" -r ' | |
| assert(function_exists("secretspec_native_resolve")); | |
| assert(function_exists("secretspec_native_abi_version")); | |
| echo secretspec_native_abi_version(), PHP_EOL; | |
| ' | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: php-ext-${{ matrix.php }}-${{ matrix.target }} | |
| path: ${{ steps.stage.outputs.asset }} | |
| - name: Publish extension to the release | |
| if: (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) || inputs.release_tag != '' | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASE_ASSET: ${{ steps.stage.outputs.asset }} | |
| RELEASE_TAG: ${{ inputs.release_tag || github.ref_name }} | |
| run: bash scripts/upload-release-asset.sh "$RELEASE_TAG" "$RELEASE_ASSET" |