Add configurable verbosity and guarded shell tracing

src/install.ts

@@ -47,7 +47,7 @@ export async function getScript(os: string): Promise<string> {
 
   fs.writeFileSync(run_path, script, {mode: 0o755});
 
-  return run_path;
+  return await utils.addVerbose(run_path, os);
 }
 
 /**

src/scripts/extensions/relay.sh

@@ -63,6 +63,10 @@ add_relay_dependencies() {
 
 # Initialize relay extension ini configuration
 init_relay_ini() {
+  without_trace init_relay_ini_helper "$@"
+}
+
+init_relay_ini_helper() {
   relay_ini=$1
   if [ -e "$relay_ini" ]; then
     if [[ -n "$RELAY_KEY" ]]; then

src/scripts/tools/add_tools.ps1

@@ -87,35 +87,37 @@ Function Write-ComposerGhAuthNoOpWarning() {
 
 # Function to setup authentication in composer.
 Function Set-ComposerAuth() {
-  $token = if ($env:COMPOSER_TOKEN) { $env:COMPOSER_TOKEN } else { $env:GITHUB_TOKEN }
-  if(Test-Path env:COMPOSER_AUTH_JSON) {
-    if(Test-Json -JSON $env:COMPOSER_AUTH_JSON) {
-      Set-Content -Path $composer_home\auth.json -Value $env:COMPOSER_AUTH_JSON
-    } else {
-      Add-Log "$cross" "composer" "Could not parse COMPOSER_AUTH_JSON as valid JSON"
+  Invoke-WithoutTrace {
+    $token = if ($env:COMPOSER_TOKEN) { $env:COMPOSER_TOKEN } else { $env:GITHUB_TOKEN }
+    if(Test-Path env:COMPOSER_AUTH_JSON) {
+      if(Test-Json -JSON $env:COMPOSER_AUTH_JSON) {
+        Set-Content -Path $composer_home\auth.json -Value $env:COMPOSER_AUTH_JSON
+      } else {
+        Add-Log "$cross" "composer" "Could not parse COMPOSER_AUTH_JSON as valid JSON"
+      }
     }
-  }
-  if($skip_composer_github_auth) {
-    Write-ComposerGhAuthNoOpWarning
-  }
-  $composer_auth = @()
-  if(Test-Path env:PACKAGIST_TOKEN) {
-    $composer_auth += '"http-basic": {"repo.packagist.com": { "username": "token", "password": "' + $env:PACKAGIST_TOKEN + '"}}'
-  }
-  $write_token = $true
-  if ($token) {
-    if ($skip_composer_github_auth) {
-      $write_token = $false
+    if($skip_composer_github_auth) {
+      Write-ComposerGhAuthNoOpWarning
     }
-    if ($env:GITHUB_SERVER_URL -ne "https://github.com" -and -not(Test-GitHubPublicAccess $token)) {
-      $write_token = $false
+    $composer_auth = @()
+    if(Test-Path env:PACKAGIST_TOKEN) {
+      $composer_auth += '"http-basic": {"repo.packagist.com": { "username": "token", "password": "' + $env:PACKAGIST_TOKEN + '"}}'
     }
-    if($write_token) {
-      $composer_auth += '"github-oauth": {"github.com": "' + $token + '"}'
+    $write_token = $true
+    if ($token) {
+      if ($skip_composer_github_auth) {
+        $write_token = $false
+      }
+      if ($env:GITHUB_SERVER_URL -ne "https://github.com" -and -not(Test-GitHubPublicAccess $token)) {
+        $write_token = $false
+      }
+      if($write_token) {
+        $composer_auth += '"github-oauth": {"github.com": "' + $token + '"}'
+      }
+    }
+    if($composer_auth.length) {
+      Update-AuthJson $composer_auth
     }
-  }
-  if($composer_auth.length) {
-    Update-AuthJson $composer_auth
   }
 }
 

src/scripts/tools/add_tools.sh

@@ -85,6 +85,10 @@ composer_gh_auth_no_op() {
 
 # Function to setup authentication in composer.
 set_composer_auth() {
+  without_trace set_composer_auth_helper
+}
+
+set_composer_auth_helper() {
   token="${COMPOSER_TOKEN:-$GITHUB_TOKEN}"
   if [ -n "${COMPOSER_AUTH_JSON:-}" ]; then
     if printf '%s' "$COMPOSER_AUTH_JSON" | jq -e . >/dev/null; then

src/scripts/tools/blackfire.ps1

@@ -9,11 +9,13 @@ Function Add-Blackfire() {
   Get-File -Url $url -OutFile $bin_dir\blackfire.zip >$null 2>&1
   Expand-Archive -Path $bin_dir\blackfire.zip -DestinationPath $bin_dir -Force >$null 2>&1
   Add-ToProfile $current_profile 'blackfire' "New-Alias blackfire $bin_dir\blackfire.exe"
-  if ((Test-Path env:BLACKFIRE_SERVER_ID) -and (Test-Path env:BLACKFIRE_SERVER_TOKEN)) {
-    blackfire agent:config --server-id=$env:BLACKFIRE_SERVER_ID --server-token=$env:BLACKFIRE_SERVER_TOKEN >$null 2>&1
-  }
-  if ((Test-Path env:BLACKFIRE_CLIENT_ID) -and (Test-Path env:BLACKFIRE_CLIENT_TOKEN)) {
-    blackfire client:config --client-id=$env:BLACKFIRE_CLIENT_ID --client-token=$env:BLACKFIRE_CLIENT_TOKEN --ca-cert=$php_dir\ssl\cacert.pem >$null 2>&1
+  Invoke-WithoutTrace {
+    if ((Test-Path env:BLACKFIRE_SERVER_ID) -and (Test-Path env:BLACKFIRE_SERVER_TOKEN)) {
+      blackfire agent:config --server-id=$env:BLACKFIRE_SERVER_ID --server-token=$env:BLACKFIRE_SERVER_TOKEN >$null 2>&1
+    }
+    if ((Test-Path env:BLACKFIRE_CLIENT_ID) -and (Test-Path env:BLACKFIRE_CLIENT_TOKEN)) {
+      blackfire client:config --client-id=$env:BLACKFIRE_CLIENT_ID --client-token=$env:BLACKFIRE_CLIENT_TOKEN --ca-cert=$php_dir\ssl\cacert.pem >$null 2>&1
+    }
   }
   Add-Log $tick "blackfire" "Added blackfire $cli_version"
 }

src/scripts/tools/blackfire.sh

@@ -12,6 +12,10 @@ add_blackfire_darwin() {
 }
 
 blackfire_config() {
+  without_trace blackfire_config_helper
+}
+
+blackfire_config_helper() {
   if [[ -n $BLACKFIRE_SERVER_ID ]] && [[ -n $BLACKFIRE_SERVER_TOKEN ]]; then
     blackfire agent:config --server-id="$BLACKFIRE_SERVER_ID" --server-token="$BLACKFIRE_SERVER_TOKEN"
     if [ "$os" = "Linux" ]; then

src/scripts/unix.sh

@@ -48,8 +48,21 @@ set_output() {
   fi
 }
 
+# Function to run sensitive code without tracing. Expand tokens inside the function, not its arguments.
+without_trace() {
+  local setup_php_trace_flags=$-
+  set +x
+  "$@"
+  local setup_php_trace_status=$?
+  [[ "$setup_php_trace_flags" == *x* ]] && set -x
+  return "$setup_php_trace_status"
+}
+
 # Function to read env inputs.
 read_env() {
+  if [[ "${SETUP_PHP_TRACE:-0}" =~ ^[12]$ ]]; then
+    set -x
+  fi
   update="${update:-${UPDATE:-false}}"
   [ "${debug:-${DEBUG:-false}}" = "true" ] && debug=debug && update=true || debug=release
   [[ "${phpts:-${PHPTS:-nts}}" = "ts" || "${phpts:-${PHPTS:-nts}}" = "zts" ]] && ts=zts && update=true || ts=nts

src/scripts/win32.ps1

@@ -28,6 +28,18 @@ Function Add-Log($mark, $subject, $message) {
   }
 }
 
+# Function to run sensitive code without tracing. Expand tokens inside the script block.
+Function Invoke-WithoutTrace([scriptblock]$Script) {
+  Set-PSDebug -Off
+  $previous_trace = $setup_php_trace
+  $setup_php_trace = 0
+  try {
+    & $Script
+  } finally {
+    Set-PSDebug -Trace $previous_trace
+  }
+}
+
 # Function to set output on GitHub Actions.
 Function Set-Output() {
   param(
@@ -333,6 +345,12 @@ $nightly_versions = '8.[6-9]'
 $xdebug3_versions = "7.[2-4]|8.[0-9]"
 $enable_extensions = ('openssl', 'curl', 'mbstring')
 
+$setup_php_trace = 0
+if ($env:SETUP_PHP_TRACE -match '^[12]$') {
+  $setup_php_trace = [int]$env:SETUP_PHP_TRACE
+  Set-PSDebug -Trace $setup_php_trace
+}
+
 $arch = 'x64'
 if(-not([Environment]::Is64BitOperatingSystem) -or $version -lt '7.0') {
   $arch = 'x86'

src/utils.ts

@@ -332,6 +332,43 @@ export async function suppressOutput(os: string): Promise<string> {
   }
 }
 
+/**
+ * Prepare verbose runtime scripts without changing the original sources.
+ */
+export async function addVerbose(
+  run_path: string,
+  os: string
+): Promise<string> {
+  const verbose = await readEnv('verbose');
+  process.env['SETUP_PHP_TRACE'] = /^v{2,3}$/.test(verbose)
+    ? String(verbose.length - 1)
+    : '0';
+  if (!/^(true|v{1,3})$/.test(verbose) && process.env['RUNNER_DEBUG'] !== '1') {
+    return run_path;
+  }
+  const extension = await scriptExtension(os);
+  const src = path.dirname(path.dirname(run_path));
+  const dest = fs.mkdtempSync(src + '-verbose-');
+  await fs.promises.cp(src, dest, {recursive: true, dereference: true});
+  const scripts = path.join(dest, 'scripts');
+  const verbose_run = path.join(scripts, path.basename(run_path));
+  const pipe = />[ \t]*(?:\/dev\/null|\$null)[ \t]+2>&1/g;
+  for (const file of fs.readdirSync(scripts, {
+    recursive: true,
+    encoding: 'utf8'
+  })) {
+    if (!file.endsWith(extension)) continue;
+    const filename = path.join(scripts, file);
+    const original = fs.readFileSync(filename, 'utf8');
+    let script = original.replace(pipe, '');
+    if (filename === verbose_run) {
+      script = script.replaceAll(src, dest);
+    }
+    if (script !== original) fs.writeFileSync(filename, script);
+  }
+  return verbose_run;
+}
+
 /**
  * Function to get script to log unsupported extensions.
  *