* fix: honor a cache-restored build when a versioned extension mismatches
When a PHP package install bundles its own default build of a versioned
extension (e.g. redis ships with its own recent version pre-enabled),
add_pecl_extension correctly detects the version mismatch against the
pinned version and falls back to pecl_install - but it does this even
when a matching build has already been restored from a CI cache into a
separate directory, since shared_extension only checks that *some* file
exists at ext_dir, not which version it is.
This adds an opt-in CACHED_EXTENSIONS_DIR: when set and a mismatch is
detected, look for extension.so there, and if found, copy it into
ext_dir and re-check before falling back to a full pecl_install. When
CACHED_EXTENSIONS_DIR is unset, behavior is unchanged.
Related to shivammathur/cache-extensions#21 and #37, where a cached
build of a versioned PECL extension is silently ignored and
recompiled on every run regardless of caching.
* fix: preserve versioned builds in ext_dir instead of a separate cache dir
Per @shivammathur's review on the PR: drop the opt-in
CACHED_EXTENSIONS_DIR env var. Instead, after installing a versioned
extension, keep a second copy of the built .so in ext_dir itself under
a name with no .so suffix (e.g. redis-5.3.7), so it can't be mistaken
for the active extension and rides along in the same ext_dir that
cache-extensions already caches wholesale - no separate cache
directory, key, or workflow step required. On a version mismatch,
restore that preserved build over the active binary and re-check
before falling back to a full pecl_install.
Tools in the tools input can now be pinned to a checksum using the
tool:version@sha256:<hash> or tool:version@sha512:<hash> syntax.
The downloaded tool is verified against the checksum on all platforms,
including when it is served from the tools cache, and it is removed
along with its cache entry if the verification fails.
Checksum verification is supported for tools downloaded as phar
archives. Specifying a checksum for tools set up using composer
packages or custom package scripts results in an error.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Shivam Mathur