Use homebrew-extensions for lua on PHP 8.0 and above [skip ci]

Bumps the github-actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [shivammathur/cache-extensions](https://github.com/shivammathur/cache-extensions).


Updates `github/codeql-action/init` from 4.37.6 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd)

Updates `github/codeql-action/autobuild` from 4.37.6 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd)

Updates `github/codeql-action/analyze` from 4.37.6 to 4.37.7
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd)

Updates `shivammathur/cache-extensions` from 1.14.6 to 1.15.0
- [Release notes](https://github.com/shivammathur/cache-extensions/releases)
- [Commits](https://github.com/shivammathur/cache-extensions/compare/9b476298b44f2e4d4268dd103ff4c3e216314e27...50000e7030dd3fa176964a8fbbbd9e4b560fe4d4)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: shivammathur/cache-extensions
  dependency-version: 1.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @shivammathur

.github/FUNDING.yml

@@ -1,3 +1,4 @@
 # These are supported funding model platforms
 
 github: shivammathur
+open_collective: setup-php

.github/SECURITY.md

@@ -10,10 +10,10 @@ This security policy only applies to the latest patch releases of the following
 
 | Version | Supported          |
 |---------|--------------------|
-| 8.1     | :white_check_mark: |
 | 8.2     | :white_check_mark: |
 | 8.3     | :white_check_mark: |
 | 8.4     | :white_check_mark: |
+| 8.5     | :white_check_mark: |
 
 ## Reporting a Vulnerability
 

.github/dependabot.yml

@@ -1,7 +1,13 @@
 version: 2
 updates:
-- package-ecosystem: "github-actions"
-  directory: "/"
-  target-branch: "develop"
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    target-branch: 'develop'
     schedule:
-      interval: "weekly"
+      interval: 'weekly'
+    groups:
+      github-actions:
+        patterns:
+          - '*'
+    cooldown:
+      default-days: 7

.github/workflows/codeql.yml

@@ -5,9 +5,13 @@ on:
     - cron: '0 15 * * 6'
 permissions:
   contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   codeql:
+    name: CodeQL Analysis
     if: github.event.repository.fork == false
     permissions:
       actions: read  # for github/codeql-action/init to get workflow details
@@ -16,18 +20,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2
+          persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
         with:
           config-file: ./.github/codeql/codeql-configuration.yml
           languages: javascript
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4

.github/workflows/docs.yml

@@ -5,12 +5,15 @@ on:
     - cron: '0 15 * * 6'
 permissions:
   contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   create:
     if: github.event.repository.fork == false
     permissions:
-      contents: none
+      contents: none # this job only prepares artifacts and uploads them, no repository writes
     name: Create
     runs-on: ${{ matrix.operating-system }}
     strategy:
@@ -20,7 +23,7 @@ jobs:
         php-versions: ['5.3', '5.4', '5.5', '5.6', '7.0', '7.1', '7.2', '7.3', '7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5', '8.6']
     steps:
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: ${{ matrix.php-versions }}
           tools: none
@@ -39,7 +42,7 @@ jobs:
         run: |
           php -m | Out-File -FilePath "$env:file.all" -Append
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: ${{ matrix.php-versions }}
           extensions: none
@@ -72,7 +75,7 @@ jobs:
           version: ${{ matrix.php-versions }}
         if: matrix.operating-system == 'windows-2022'
         run: |
-          Write-Output "## PHP ${{ matrix.php-versions }}`n" | Out-File -FilePath "$env:file"
+          Write-Output "## PHP $env:version`n" | Out-File -FilePath "$env:file"
           Write-Output "``````" | Out-File -FilePath "$env:file" -Append
           php -m | Out-File -FilePath "$env:file.builtin" -Append
           Get-Content "$env:file.all" | ForEach-Object {
@@ -88,7 +91,7 @@ jobs:
           Remove-Item "$env:file.all" -Force
           Remove-Item "$env:file.builtin" -Force
       - name: Upload artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: lists-php${{ matrix.php-versions }}-${{ matrix.operating-system }}.md
           path: php${{ matrix.php-versions }}-${{ matrix.operating-system }}.md
@@ -101,19 +104,23 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ github.repository }}.wiki
+          persist-credentials: false
       - name: Download artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           path: ${{ github.workspace }}/lists
           pattern: lists-*
           merge-multiple: true
       - name: Configure Git
+        env:
+          GIT_USER_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
+          GIT_USER_NAME: github-actions[bot]
         run : |
-          git config --local user.email "${{ secrets.email }}"
-          git config --local user.name "${{ github.repository_owner }}"
+          git config --local user.email "$GIT_USER_EMAIL"
+          git config --local user.name "$GIT_USER_NAME"
       - name: Combine
         run: |
           for os in ubuntu-24.04 ubuntu-22.04 windows-2025 windows-2022 windows-2019 macos-13 macos-14 macos-15 macos-26; do
@@ -130,9 +137,12 @@ jobs:
           done
           rm -rf ./lists
       - name: Update
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          WIKI_REPOSITORY: ${{ github.repository }}
         run: |
           if [ "$(git status --porcelain=v1 2>/dev/null | wc -l)" != "0" ]; then
             git add .
             git commit -m "Update PHP extensions on wiki - $(date +'%d-%m-%y')"
-            git push -f https://${{ github.repository_owner }}:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.wiki.git master || true
+            git push -f https://x-access-token:${GITHUB_TOKEN}@github.com/${WIKI_REPOSITORY}.wiki.git master || true
           fi

.github/workflows/node.yml

@@ -18,10 +18,14 @@ on:
       - 'examples/**'
 permissions:
   contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   run:
     name: Run
+    environment: codecov
     runs-on: ${{ matrix.operating-system }}
     strategy:
       fail-fast: false
@@ -29,12 +33,13 @@ jobs:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2
+          persist-credentials: false
 
       - name: Setup Node.js 24.x
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version: 24.x
 
@@ -54,7 +59,7 @@ jobs:
         run: npm audit
 
       - name: Send Coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage/lcov.info

.github/workflows/php.yml

@@ -19,8 +19,11 @@ on:
       - 'examples/**'
 permissions:
   contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 env:
-  default-php-version: '8.2'
+  default-php-version: '8.5'
 jobs:
   run:
     name: Run
@@ -39,18 +42,20 @@ jobs:
       key: cache-v5
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup cache environment
         id: cache-env
-        uses: shivammathur/cache-extensions@develop
+        uses: shivammathur/cache-extensions@50000e7030dd3fa176964a8fbbbd9e4b560fe4d4 # v1
         with:
           php-version: ${{ matrix.php-versions || env.default-php-version }}
           extensions: ${{ env.extensions }}
           key: ${{ env.key }}
 
       - name: Cache extensions
-        uses: actions/cache@v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
         with:
           path: ${{ steps.cache-env.outputs.dir }}
           key: ${{ steps.cache-env.outputs.key }}
@@ -58,8 +63,10 @@ jobs:
 
       - name: Stage php-version-file
         if: ${{ matrix.php-version-file == 'php-version-file' }}
+        env:
+          DEFAULT_PHP_VERSION: ${{ env.default-php-version }}
         run: |
-          echo ${{ env.default-php-version }} > php-version-file
+          echo "$DEFAULT_PHP_VERSION" > php-version-file
 
       - name: Setup PHP with extensions and custom config
         run: node dist/index.js
@@ -70,9 +77,11 @@ jobs:
           ini-values: post_max_size=256M, short_open_tag=On, date.timezone=Asia/Kolkata
 
       - name: Testing PHP version
+        env:
+          EXPECTED_PHP_VERSION: ${{ matrix.php-versions || env.default-php-version }}
         run: |
           php -v
-          php -r "if(strpos(phpversion(), '${{ matrix.php-versions || env.default-php-version }}') === false) {throw new Exception('Wrong PHP version Installed');}"
+          php -r '$expected = getenv("EXPECTED_PHP_VERSION"); if(strpos(phpversion(), $expected) === false) {throw new Exception("Wrong PHP version Installed");}'
 
       - name: Testing Composer version
         run: |

.github/workflows/publish.yml

@@ -10,28 +10,39 @@ on:
       tag:
         description: Tag name
         required: true
-jobs:
-  build:
-    runs-on: ubuntu-latest
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
 permissions:
   contents: read
-      packages: write
+jobs:
+  build:
+    name: Build and Publish
+    permissions:
+      contents: read # for actions/checkout
+      packages: write # For publishing to GitHub Packages
+      id-token: write # For authentication with npm registry
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout release
         if: github.event_name != 'workflow_dispatch'
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Checkout tag
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         if: github.event_name == 'workflow_dispatch'
         with:
           ref: ${{ github.event.inputs.tag }}
+          persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
-          node-version: '20.x'
+          node-version: '24.x'
           registry-url: https://registry.npmjs.org
+          package-manager-cache: false
 
       - name: Install dependencies and add lib
         run: |
@@ -42,13 +53,12 @@ jobs:
       - name: Publish to NPM
         if: "!contains(github.event.inputs.skip, 'skip-npm')"
         run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Change to GitHub Packages registry
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           registry-url: https://npm.pkg.github.com
+          package-manager-cache: false
           scope: '@shivammathur'
 
       - name: Patch package.json

README.md

@@ -18,7 +18,7 @@
   <a href="https://status.setup-php.com" title="setup-php status"><img alt="setup-php status" src="https://img.shields.io/badge/status-subscribe-28A745?logo=statuspage&logoColor=28A745&labelColor=555555"></a>
 </p>
 
-Setup PHP with required extensions, php.ini configuration, code-coverage support and various tools like composer in [GitHub Actions](https://github.com/features/actions "GitHub Actions"). This action gives you a cross-platform interface to set up the PHP environment you need to test your application. Refer to [Usage](#memo-usage "How to use this") section and [examples](#examples "Examples of use") to see how to use this.
+Setup PHP with required extensions, php.ini configuration, code-coverage support, and various tools like composer in [GitHub Actions](https://github.com/features/actions "GitHub Actions"). This action gives you a cross-platform interface to set up the PHP environment you need to test your application. Refer to the [Usage](#memo-usage "How to use this") section and [examples](#examples "Examples of use") to see how to use this.
 
 ## Contents
 
@@ -70,8 +70,10 @@ Both `GitHub-hosted` and `self-hosted` runners are supported by `setup-php` on t
 
 | Virtual environment | Arch    | YAML workflow label                | Pre-installed PHP |
 |---------------------|---------|------------------------------------|-------------------|
+| Ubuntu 26.04        | x86_64  | `ubuntu-26.04`                     | `PHP 8.5`         |
 | Ubuntu 24.04        | x86_64  | `ubuntu-latest` or `ubuntu-24.04`  | `PHP 8.3`         |
 | Ubuntu 22.04        | x86_64  | `ubuntu-22.04`                     | `PHP 8.1`         |
+| Ubuntu 26.04        | aarch64 | `ubuntu-26.04-arm`                 | `PHP 8.5`         |
 | Ubuntu 24.04        | aarch64 | `ubuntu-24.04-arm`                 | `PHP 8.3`         |
 | Ubuntu 22.04        | aarch64 | `ubuntu-22.04-arm`                 | `PHP 8.1`         |
 | Windows Server 2025 | x64     | `windows-2025`                     | `PHP 8.5`         |
@@ -86,6 +88,7 @@ Both `GitHub-hosted` and `self-hosted` runners are supported by `setup-php` on t
 
 | Host OS/Virtual environment      | YAML workflow label        |
 |----------------------------------|----------------------------|
+| Ubuntu 26.04                     | `self-hosted` or `Linux`   |
 | Ubuntu 24.04                     | `self-hosted` or `Linux`   |
 | Ubuntu 22.04                     | `self-hosted` or `Linux`   |
 | Debian 13                        | `self-hosted` or `Linux`   |
@@ -98,7 +101,7 @@ Both `GitHub-hosted` and `self-hosted` runners are supported by `setup-php` on t
 | macOS Sonoma 14.x x86_64/arm64   | `self-hosted` or `macOS`   |
 
 - Refer to the [self-hosted setup](#self-hosted-setup) to use the action on self-hosted runners.
-- Operating systems based on the above Ubuntu and Debian versions are also supported on best effort basis.
+- Operating systems based on the above Ubuntu and Debian versions are also supported on a best effort basis.
 - If the requested PHP version is pre-installed, `setup-php` switches to it, otherwise it installs the PHP version.
 
 ## :tada: PHP Support
@@ -155,7 +158,7 @@ PHP extensions can be set up using the `extensions` input. It accepts a `string`
 
 - Extensions installed along with PHP if specified are enabled.
 
-- Specific versions of extensions available on `PECL` can be set up by suffixing the extension's name with the version. This is useful for installing old versions of extensions which support end of life PHP versions.
+- Specific versions of extensions available on `PECL` can be set up by suffixing the extension's name with the version. This is useful for installing old versions of extensions which support end-of-life PHP versions.
 
 ```yaml
 - name: Setup PHP with specific version of PECL extension
@@ -180,14 +183,14 @@ PHP extensions can be set up using the `extensions` input. It accepts a `string`
 - Shared extensions can be disabled by prefixing them with a `:`. All extensions depending on the specified extension will also be disabled.
 
 ```yaml
-- name: Setup PHP and disable opcache
+- name: Setup PHP and disable mbstring
   uses: shivammathur/setup-php@v2
   with:
     php-version: '8.5'
     extensions: :mbstring
 ```
 
-- All shared extensions can be disabled by specifying `none`. When `none` is specified along with other extensions, it is hoisted to the start of the input. So, all the shared extensions will be disabled first, then rest of the extensions in the input will be processed.
+- All shared extensions can be disabled by specifying `none`. When `none` is specified along with other extensions, it is hoisted to the start of the input. So, all the shared extensions will be disabled first, then the rest of the extensions in the input will be processed.
 
 This disables all core and third-party shared extensions and thus, can break some tools that need them. Required extensions are enabled again when the tools are set up on a best-effort basis. So it is recommended to add the extensions required for your tools after `none` in the `extensions` input to avoid any issues.
 
@@ -216,7 +219,7 @@ This disables all core and third-party shared extensions and thus, can break som
   - `event`, `gearman`, `geos` and `relay` on `Ubuntu` and `macOS`.
   - `blackfire`, `couchbase`, `ibm_db2`, `ioncube`, `oci8`, `pdo_firebird`, `pdo_ibm`, `pdo_oci`, `pecl_http`, `phalcon3`, `phalcon4`, `phalcon5`, and `zephir_parser` on all supported OS.
 
-- By default, extensions which cannot be added or disabled gracefully leave an error message in the logs, the execution is not interrupted. To change this behaviour you can set `fail-fast` flag to `true`.
+- By default, extensions which cannot be added or disabled gracefully leave an error message in the logs. The execution is not interrupted. To change this behaviour you can set `fail-fast` flag to `true`.
 
 ```yaml
 - name: Setup PHP with fail-fast
@@ -232,7 +235,7 @@ This disables all core and third-party shared extensions and thus, can break som
 
 These tools can be set up globally using the `tools` input. It accepts a string in csv-format.
 
-[`backward-compatibility-check`], [`behat`], [`blackfire`], [`blackfire-player`], [`box`], [`castor`], [`churn`], [`codeception`], [`composer`], [`composer-dependency-analyser`], [`composer-normalize`], [`composer-prefetcher`], [`composer-require-checker`], [`composer-unused`], [`cs2pr`], [`deployer`], [`ecs`], [`flex`], [`grpc_php_plugin`], [`infection`], [`mago`], [`name-collision-detector`], [`parallel-lint`], [`pecl`], [`phan`], [`phing`], [`phinx`], [`phive`], [`php-config`], [`php-cs-fixer`], [`php-scoper`], [`phpcbf`], [`phpcpd`], [`phpcs`], [`phpdoc`] or [`phpDocumentor`], [`phpize`], [`phplint`], [`phpmd`], [`phpspec`], [`phpstan`], [`phpunit`], [`phpunit-bridge`], [`phpunit-polyfills`], [`pie`], [`pint`], [`prestissimo`], [`protoc`], [`psalm`], [`rector`], [`symfony`] or [`symfony-cli`], [`vapor`] or [`vapor-cli`], [`wp`] or [`wp-cli`]
+[`backward-compatibility-check`], [`behat`], [`blackfire`], [`blackfire-player`], [`box`], [`castor`], [`churn`], [`codeception`], [`composer`], [`composer-dependency-analyser`], [`composer-normalize`], [`composer-prefetcher`], [`composer-require-checker`], [`composer-unused`], [`cpx`], [`cs2pr`], [`deployer`], [`ecs`], [`flex`], [`grpc_php_plugin`], [`infection`], [`laravel-cloud`] or [`cloud-cli`], [`mago`], [`name-collision-detector`], [`parallel-lint`], [`pecl`], [`phan`], [`phing`], [`phinx`], [`phive`], [`php-config`], [`php-cs-fixer`], [`php-scoper`], [`phpcbf`], [`phpcpd`], [`phpcs`], [`phpdoc`] or [`phpDocumentor`], [`phpize`], [`phplint`], [`phpmd`], [`phpspec`], [`phpstan`], [`phpunit`], [`phpunit-bridge`], [`phpunit-polyfills`], [`pie`], [`pint`], [`prestissimo`], [`protoc`], [`psalm`], [`rector`], [`symfony`] or [`symfony-cli`], [`vapor`] or [`vapor-cli`], [`wp`] or [`wp-cli`]
 
 ```yaml
 - name: Setup PHP with tools
@@ -242,7 +245,7 @@ These tools can be set up globally using the `tools` input. It accepts a string
     tools: php-cs-fixer, phpunit
 ```
 
-- In addition to above tools any composer tool or package can also be set up globally by specifying it as `vendor/package` matching the listing on Packagist. This format accepts the same [version constraints](https://getcomposer.org/doc/articles/versions.md#writing-version-constraints "Composer version constraints") as `composer`.
+- In addition to the above tools, any composer tool or package can also be set up globally by specifying it as `vendor/package` matching the listing on Packagist. This format accepts the same [version constraints](https://getcomposer.org/doc/articles/versions.md#writing-version-constraints "Composer version constraints") as `composer`.
 
 ```yaml
 - name: Setup PHP with tools
@@ -261,6 +264,18 @@ These tools can be set up globally using the `tools` input. It accepts a string
 
   When you specify just the major version or the version in `major.minor` format, the latest patch version matching the input will be set up.
 
+- To harden your workflow against supply chain attacks, you can pin a tool to a checksum in the form `tool:version@sha256:<hash>` or `tool:version@sha512:<hash>`. The downloaded tool is verified against the checksum and it is not set up if the verification fails, even if the tool is served from the tools cache.
+
+```yaml
+- name: Setup PHP with tools pinned to a checksum
+  uses: shivammathur/setup-php@v2
+  with:
+    php-version: '8.5'
+    tools: composer:2.9.8@sha256:59b2c50e10cafa0d8efc19ede9a326d782f096c674a26baf98cf042ce23de890
+```
+
+  Checksum verification is supported for tools which are downloaded as phar archives. It is not supported for tools set up using `composer` packages or custom package scripts, specifying a checksum for these tools will result in an error. For checksum pinning to be effective, pin the tool to an exact version, as mutable versions like `latest` or `major.minor` can resolve to a different release with a different checksum.
+
 - The latest stable version of `composer` is set up by default. You can set up the required `composer` version by specifying the major version `v1` or `v2`, or the version in `major.minor` or `semver` format. Additionally, for composer `snapshot` and `preview` can also be specified to set up the respective releases.
 
 ```yaml
@@ -268,7 +283,7 @@ These tools can be set up globally using the `tools` input. It accepts a string
   uses: shivammathur/setup-php@v2
   with:
     php-version: '8.5'
-    tools: composer:v1
+    tools: composer:v2
 ```
 
 - If you do not use composer in your workflow, you can specify `tools: none` to skip it.
@@ -302,7 +317,7 @@ These tools can be set up globally using the `tools` input. It accepts a string
 - By default, `composer` blocks all its plugins. If you are using the `tools` input to install a composer plugin it will be added to the allowlist, alternatively if your dependencies have composer plugins, you can allow them by setting `COMPOSER_ALLOW_PLUGINS` that accepts a csv string of plugin names.
 
 ```yaml
-- name: Setup PHP with fail-fast
+- name: Setup PHP with allow composer plugins
   uses: shivammathur/setup-php@v2
   with:
     php-version: '8.5'
@@ -342,7 +357,7 @@ Runs on all [PHP versions supported](#tada-php-support "List of PHP versions sup
 ```
 
 - When you specify `coverage: xdebug`, the latest version of Xdebug compatible with the PHP version is set up by default.
-- If you need Xdebug 2.x on PHP 7.2, 7.3 or 7.4, you can specify `coverage: xdebug2`.
+- If you need Xdebug 2.x on PHP 7.2, 7.3, or 7.4, you can specify `coverage: xdebug2`.
 
 ```yaml
 - name: Setup PHP with Xdebug 2.x
@@ -353,7 +368,7 @@ Runs on all [PHP versions supported](#tada-php-support "List of PHP versions sup
 ```
 
 > [!NOTE]
-> Xdebug is enabled by default on Ubuntu GitHub Actions images, so if you are not using it in your workflow it is recommended to disable it as that will have a positive impact on your PHP performance. Please refer to the [disable coverage](#disable-coverage) section for details.
+> Xdebug is enabled by default on Ubuntu GitHub Actions images, so if you are not using it in your workflows, it is recommended to disable it as that will have a positive impact on your PHP performance. Please refer to the [disable coverage](#disable-coverage) section for details.
 
 ### PCOV
 
@@ -372,7 +387,7 @@ Runs on PHP 7.1 and newer PHP versions.
 ```
 
 - PHPUnit 8.x and above support PCOV out of the box.
-- If you are using PHPUnit 5.x, 6.x or 7.x, you need to set up `pcov/clobber` before executing your tests.
+- If you are using PHPUnit 5.x, 6.x, or 7.x, you need to set up `pcov/clobber` before executing your tests.
 
 ```yaml
 - name: Setup PCOV
@@ -390,7 +405,7 @@ Disable coverage for these reasons:
 - You are not generating coverage reports while testing.
 - You are using `phpdbg` for running your tests.
 - You are profiling your code using `blackfire`.
-- You are using PHP in JIT mode. Please refer to [JIT configuration](#jit-configuration) section for more details.
+- You are using PHP in JIT mode. Please refer to the [JIT configuration](#jit-configuration) section for more details.
 
 ```yaml
 - name: Setup PHP with no coverage driver
@@ -653,7 +668,7 @@ To debug any issues, you can use the `verbose` tag instead of `v2`.
 
 ### Multi-Arch Setup
 
-> Set up PHP on multiple architecture on Ubuntu GitHub Runners.
+> Set up PHP on multiple architectures on Ubuntu GitHub Runners.
 
 - `PHP 5.6` to `PHP 8.5` are supported by `setup-php` on multiple architecture on `Ubuntu` and `Debian`.
 - For this, you can use `shivammathur/node` images as containers. These have compatible `Nodejs` and `PHP` installed for `setup-php`.
@@ -683,7 +698,7 @@ jobs:
 
 > Set up PHP on a self-hosted runner.
 
-- To set up a containerised self-hosted runner, refer to the following guides as per your base operating system.
+- To set up a containerized self-hosted runner, refer to the following guides as per your base operating system.
   - [Linux](https://github.com/shivammathur/setup-php/wiki/Dockerized-self-hosted-runner-on-Linux)
   - [Windows](https://github.com/shivammathur/setup-php/wiki/Dockerized-self-hosted-runner-on-Windows)
 
@@ -710,7 +725,7 @@ jobs:
 ```
 
 > [!NOTE]
-> - Do not set up multiple self-hosted runners on a single server instance as parallel workflow will conflict with each other.
+> - Do not set up multiple self-hosted runners on a single server instance as parallel workflows will conflict with each other.
 > - Do not set up self-hosted runners on the side of your development environment or your production server.
 > - Avoid using the same labels for your `self-hosted` runners which are used by `GitHub-hosted` runners.
 
@@ -753,7 +768,7 @@ act -P ubuntu-22.04=shivammathur/node:22.04
 - By default, `opcache.jit=1235` and `opcache.jit_buffer_size=256M` (`opcache.jit_buffer_size=128M` on ARM-based environments) are set which can be changed using `ini-values` input.
 - For detailed information about JIT related directives refer to the [`official PHP documentation`](https://www.php.net/manual/en/opcache.configuration.php#ini.opcache.jit "opcache.jit documentation").
 
-For example to enable JIT in `tracing` mode with buffer size of `64 MB`.
+For example, to enable JIT in `tracing` mode with buffer size of `64 MB`.
 
 ```yaml
 - name: Setup PHP with JIT in tracing mode
@@ -833,7 +848,7 @@ If you use Private Packagist for your private composer dependencies, you can set
 
 ### Manual Composer Authentication
 
-In addition to GitHub or Private Packagist, if you want to authenticate private repositories hosted elsewhere, you can set the `COMPOSER_AUTH_JSON` environment variable with the authentication methods and the credentials in json format.
+In addition to GitHub or Private Packagist, if you want to authenticate private repositories hosted elsewhere, you can set the `COMPOSER_AUTH_JSON` environment variable with the authentication methods and the credentials in JSON format.
 Please refer to the authentication section in [`composer documentation`](https://getcomposer.org/doc/articles/authentication-for-private-packages.md "composer documentation") for more details.
 
 ```yaml
@@ -950,11 +965,12 @@ Examples of using `setup-php` with various PHP frameworks and packages.
 | Framework/Package                      | Runs on                         | Workflow                                                                                                      |
 |----------------------------------------|---------------------------------|---------------------------------------------------------------------------------------------------------------|
 | Blackfire                              | `macOS`, `ubuntu` and `windows` | [blackfire.yml](./examples/blackfire.yml "GitHub Action using Blackfire")                                     |
-| Blackfire Player                       | `macOS`, `ubuntu` and `windows` | [blackfire-player.yml](./examples/blackfire-player.yml "GitHub Action using Blackfire Player")                |
+| Blackfire Player                       | `macOS` and `ubuntu`            | [blackfire-player.yml](./examples/blackfire-player.yml "GitHub Action using Blackfire Player")                |
 | CakePHP with `MySQL` and `Redis`       | `ubuntu`                        | [cakephp-mysql.yml](./examples/cakephp-mysql.yml "GitHub Action for CakePHP with MySQL and Redis")            |
 | CakePHP with `PostgreSQL` and `Redis`  | `ubuntu`                        | [cakephp-postgres.yml](./examples/cakephp-postgres.yml "GitHub Action for CakePHP with Postgres and Redis")   |
 | CakePHP without services               | `macOS`, `ubuntu` and `windows` | [cakephp.yml](./examples/cakephp.yml "GitHub Action for CakePHP without services")                            |
 | CodeIgniter                            | `macOS`, `ubuntu` and `windows` | [codeigniter.yml](./examples/codeigniter.yml "GitHub Action for CodeIgniter")                                 |
+| Drupal 11 (Composer-managed)           | `ubuntu`                        | [drupal.yml](./examples/drupal.yml "GitHub Action for Drupal 11 composer-managed projects")                   |
 | Laminas MVC                            | `macOS`, `ubuntu` and `windows` | [laminas-mvc.yml](./examples/laminas-mvc.yml "GitHub Action for Laminas Framework MVC Projects")              |
 | Laravel with `MySQL` and `Redis`       | `ubuntu`                        | [laravel-mysql.yml](./examples/laravel-mysql.yml "GitHub Action for Laravel with MySQL and Redis")            |
 | Laravel with `PostgreSQL` and `Redis`  | `ubuntu`                        | [laravel-postgres.yml](./examples/laravel-postgres.yml "GitHub Action for Laravel with PostgreSQL and Redis") |
@@ -964,23 +980,25 @@ Examples of using `setup-php` with various PHP frameworks and packages.
 | Lumen without services                 | `macOS`, `ubuntu` and `windows` | [lumen.yml](./examples/lumen.yml "GitHub Action for Lumen without services")                                  |
 | Phalcon with `MySQL`                   | `ubuntu`                        | [phalcon-mysql.yml](./examples/phalcon-mysql.yml "GitHub Action for Phalcon with MySQL")                      |
 | Phalcon with `PostgreSQL`              | `ubuntu`                        | [phalcon-postgres.yml](./examples/phalcon-postgres.yml "GitHub Action for Phalcon with PostgreSQL")           |
-| Roots/bedrock                          | `ubuntu`                        | [bedrock.yml](./examples/bedrock.yml "GitHub Action for Wordpress Development using @roots/bedrock")          |
-| Roots/sage                             | `ubuntu`                        | [sage.yml](./examples/sage.yml "GitHub Action for Wordpress Development using @roots/sage")                   |
 | Slim Framework                         | `macOS`, `ubuntu` and `windows` | [slim-framework.yml](./examples/slim-framework.yml "GitHub Action for Slim Framework")                        |
 | Symfony with `MySQL`                   | `ubuntu`                        | [symfony-mysql.yml](./examples/symfony-mysql.yml "GitHub Action for Symfony with MySQL")                      |
 | Symfony with `PostgreSQL`              | `ubuntu`                        | [symfony-postgres.yml](./examples/symfony-postgres.yml "GitHub Action for Symfony with PostgreSQL")           |
 | Symfony without services               | `macOS`, `ubuntu` and `windows` | [symfony.yml](./examples/symfony.yml "GitHub Action for Symfony without services")                            |
-| Yii2 Starter Kit with `MySQL`          | `ubuntu`                        | [yii2-mysql.yml](./examples/yii2-mysql.yml "GitHub Action for Yii2 Starter Kit with MySQL")                   |
-| Yii2 Starter Kit with `PostgreSQL`     | `ubuntu`                        | [yii2-postgres.yml](./examples/yii2-postgres.yml "GitHub Action for Yii2 Starter Kit with PostgreSQL")        |
+| WordPress plugin                       | `ubuntu`                        | [wordpress.yml](./examples/wordpress.yml "GitHub Action for WordPress plugins")                               |
+| WordPress with Roots/Bedrock           | `ubuntu`                        | [bedrock.yml](./examples/bedrock.yml "GitHub Action for WordPress development using @roots/bedrock")          |
+| WordPress with Roots/Sage              | `ubuntu`                        | [sage.yml](./examples/sage.yml "GitHub Action for WordPress development using @roots/sage")                   |
+| Yii3 web application with `MySQL`      | `ubuntu`                        | [yii3-mysql.yml](./examples/yii3-mysql.yml "GitHub Action for Yii3 web application with MySQL")               |
+| Yii3 web application with `PostgreSQL` | `ubuntu`                        | [yii3-postgres.yml](./examples/yii3-postgres.yml "GitHub Action for Yii3 web application with PostgreSQL")    |
+| Yii3 web application                   | `ubuntu` and `windows`          | [yii3.yml](./examples/yii3.yml "GitHub Action for Yii3 web application")                                      |
 
 ## :bookmark: Versioning
 
-- Use the `v2` tag as `setup-php` version. It is a rolling tag and is synced with the latest minor and patch releases. With `v2` you automatically get the bug fixes, security patches, new features and support for latest PHP releases.
+- Use the `v2` tag as `setup-php` version. It is a rolling tag and is synced with the latest minor and patch releases. With `v2` you automatically get the bug fixes, security patches, new features, and support for latest PHP releases.
 - Semantic release versions can also be used. It is recommended to [use dependabot](https://docs.github.com/en/github/administering-a-repository/keeping-your-actions-up-to-date-with-github-dependabot "Setup Dependabot with GitHub Actions") with semantic versioning to keep the actions in your workflows up to date.
-- Commit SHA can also be used, but are not recommended unless you set up tooling to update them with each release of the action.
-- A new major version of the action will only be tagged when there are breaking changes in the setup-php API i.e. inputs, outputs, and environment flags.
+- Commit SHA can also be used, but is not recommended unless you set up tooling to update them with each release of the action.
+- A new major version of the action will only be tagged when there are breaking changes in the setup-php API i.e. - inputs, outputs, and environment flags.
 - For debugging any issues `verbose` tag can be used temporarily. It outputs all the logs and is also synced with the latest releases.
-- It is highly discouraged to use the `main` branch as version, it might break your workflow after major releases as they have breaking changes.
+- It is highly discouraged to use the `main` branch as the version, it might break your workflow after major releases as they have breaking changes.
 - If you are using the `v1` tag or a `1.x.y` version, you should [switch to v2](https://github.com/shivammathur/setup-php/wiki/Switch-to-v2 "Guide for switching from setup-php v1 to v2") as `v1` is not supported anymore.
 
 ## :scroll: License
@@ -1042,7 +1060,7 @@ Many users and organizations support setup-php via [GitHub Sponsors](https://git
 
 <a href="https://github.com/sponsors/shivammathur"><img src="https://setup-php.com/sponsors.svg?" alt="Sponsor shivammathur"></a>
 
-- If you use setup-php, please consider starring the project and share it. 
+- If you use setup-php, please consider starring the project and sharing it. 
 - If you blog, please share your experience of using `setup-php`.
 - Please [reach out](mailto:contact@setup-php.com) if you have any questions about sponsoring setup-php.
 
@@ -1078,6 +1096,7 @@ Many users and organizations support setup-php via [GitHub Sponsors](https://git
 [`box`]:                      https://github.com/humbug/box
 [`castor`]:                   https://github.com/jolicode/castor
 [`churn`]:                    https://github.com/bmitch/churn-php
+[`cloud-cli`]:                https://cloud.laravel.com/docs/api/cli
 [`codeception`]:              https://codeception.com/
 [`composer`]:                 https://getcomposer.org/
 [`composer-dependency-analyser`]: https://github.com/shipmonk-rnd/composer-dependency-analyser
@@ -1085,12 +1104,14 @@ Many users and organizations support setup-php via [GitHub Sponsors](https://git
 [`composer-prefetcher`]:      https://github.com/narrowspark/automatic-composer-prefetcher
 [`composer-require-checker`]: https://github.com/maglnet/ComposerRequireChecker
 [`composer-unused`]:          https://github.com/composer-unused/composer-unused
+[`cpx`]:                      https://github.com/laravel/cpx
 [`cs2pr`]:                    https://github.com/staabm/annotate-pull-request-from-checkstyle
 [`deployer`]:                 https://deployer.org/
 [`ecs`]:                      https://github.com/easy-coding-standard/easy-coding-standard
 [`flex`]:                     https://github.com/symfony/flex
 [`grpc_php_plugin`]:          https://grpc.io/
 [`infection`]:                https://infection.github.io/
+[`laravel-cloud`]:            https://cloud.laravel.com/docs/api/cli
 [`mago`]:                     https://github.com/carthage-software/mago
 [`name-collision-detector`]:  https://github.com/shipmonk/name-collision-detector
 [`parallel-lint`]:            https://github.com/php-parallel-lint/PHP-Parallel-Lint

__tests__/config.test.ts

@@ -9,6 +9,10 @@ describe('Config tests', () => {
     ${'a=b & ~c'}                        | ${'win32'}   | ${'Add-Content "$php_dir\\php.ini" "a=\'b & ~c\'"'}
     ${'a="~(b)"'}                        | ${'win32'}   | ${'Add-Content "$php_dir\\php.ini" "a=\'~(b)\'"'}
     ${'a="b, c"'}                        | ${'win32'}   | ${'Add-Content "$php_dir\\php.ini" "a=b, c"'}
+    ${'disable_functions="exec,system"'} | ${'linux'}   | ${'echo "disable_functions=exec,system" | sudo tee -a'}
+    ${'disable_functions="exec,system"'} | ${'win32'}   | ${'Add-Content "$php_dir\\php.ini" "disable_functions=exec,system"'}
+    ${'a=$(id)'}                         | ${'linux'}   | ${'echo "a=\'\\$(id)\'"'}
+    ${'a=$(id)'}                         | ${'win32'}   | ${'Add-Content "$php_dir\\php.ini" "a=\'`$(id)\'"'}
     ${'a=b, c=d'}                        | ${'openbsd'} | ${'Platform openbsd is not supported'}
   `('checking addINIValues on $os', async ({ini_values, os, output}) => {
     expect(await config.addINIValues(ini_values, os)).toContain(output);

__tests__/tools.test.ts

@@ -31,6 +31,12 @@ function getData(data: Partial<ToolData>): ToolData {
   };
 }
 
+function unsetComposerAuthEnv(): void {
+  delete process.env['GITHUB_TOKEN'];
+  delete process.env['COMPOSER_TOKEN'];
+  delete process.env['COMPOSER_AUTH_JSON'];
+}
+
 /**
  * Mock fetch.ts
  */
@@ -181,6 +187,7 @@ describe('Tools tests', () => {
     ${'1.2.3-dev'}     | ${'tool'}     | ${'phar'}     | ${'1.2.3-dev'}
     ${'1.2.3-alpha1'}  | ${'tool'}     | ${'phar'}     | ${'1.2.3-alpha1'}
     ${'1.2.3-alpha.1'} | ${'tool'}     | ${'phar'}     | ${'1.2.3-alpha.1'}
+    ${'1.>=0'}         | ${'tool'}     | ${'phar'}     | ${'1.0'}
   `(
     'checking getVersion: $version, $tool, $type',
     async ({version, tool, type, expected}) => {
@@ -214,6 +221,32 @@ describe('Tools tests', () => {
     ).toBe(expected);
   });
 
+  it.each`
+    release                                      | expected_release    | checksum                       | error
+    ${'tool:1.2.3'}                              | ${'tool:1.2.3'}     | ${undefined}                   | ${undefined}
+    ${'tool:1.2.3@sha256:' + 'a'.repeat(64)}     | ${'tool:1.2.3'}     | ${'sha256:' + 'a'.repeat(64)}  | ${undefined}
+    ${'tool:1.2.3@sha256:' + 'A'.repeat(64)}     | ${'tool:1.2.3'}     | ${'sha256:' + 'a'.repeat(64)}  | ${undefined}
+    ${'tool:1.2.3@SHA256:' + 'a'.repeat(64)}     | ${'tool:1.2.3'}     | ${'sha256:' + 'a'.repeat(64)}  | ${undefined}
+    ${'tool:1.2.3@sha512:' + 'b'.repeat(128)}    | ${'tool:1.2.3'}     | ${'sha512:' + 'b'.repeat(128)} | ${undefined}
+    ${'composer:2.9.8@sha256:' + 'c'.repeat(64)} | ${'composer:2.9.8'} | ${'sha256:' + 'c'.repeat(64)}  | ${undefined}
+    ${'tool:1.2.3@sha256:xyz'}                   | ${'tool:1.2.3'}     | ${undefined}                   | ${'Invalid sha256 checksum, expected 64 hexadecimal characters'}
+    ${'tool:1.2.3@sha256:' + 'a'.repeat(63)}     | ${'tool:1.2.3'}     | ${undefined}                   | ${'Invalid sha256 checksum, expected 64 hexadecimal characters'}
+    ${'tool:1.2.3@sha512:' + 'b'.repeat(64)}     | ${'tool:1.2.3'}     | ${undefined}                   | ${'Invalid sha512 checksum, expected 128 hexadecimal characters'}
+    ${'tool:1.2.3@sha384:' + 'b'.repeat(96)}     | ${'tool:1.2.3'}     | ${undefined}                   | ${'Unsupported checksum algorithm sha384, expected sha256 or sha512'}
+    ${'tool:1.2.3@md5:' + 'b'.repeat(32)}        | ${'tool:1.2.3'}     | ${undefined}                   | ${'Unsupported checksum algorithm md5, expected sha256 or sha512'}
+    ${'tool:1.2.3@sha256' + 'a'.repeat(64)}      | ${'tool:1.2.3'}     | ${undefined}                   | ${'Invalid checksum syntax, expected @sha256:<hash> or @sha512:<hash>'}
+    ${'tool:1.0@dev'}                            | ${'tool:1.0@dev'}   | ${undefined}                   | ${undefined}
+  `(
+    'checking extractChecksum: $release',
+    ({release, expected_release, checksum, error}) => {
+      expect(tools.extractChecksum(release)).toStrictEqual({
+        release: expected_release,
+        ...(checksum !== undefined && {checksum}),
+        ...(error !== undefined && {error})
+      });
+    }
+  );
+
   it.each`
     input_list                                          | filtered_list
     ${'a, b'}                                           | ${'composer, a, b'}
@@ -226,6 +259,13 @@ describe('Tools tests', () => {
     ${'a, b, composer:2'}                               | ${'composer:2, a, b'}
     ${'a, b, composer:v1'}                              | ${'composer:1, a, b'}
     ${'a, b, composer:v2'}                              | ${'composer:2, a, b'}
+    ${'a, b, composer:2.7.1@sha256:' + 'a'.repeat(64)}  | ${'composer:2.7.1@sha256:' + 'a'.repeat(64) + ', a, b'}
+    ${'a, b, composer:v2.7.1@sha256:' + 'a'.repeat(64)} | ${'composer:2.7.1@sha256:' + 'a'.repeat(64) + ', a, b'}
+    ${'a, b, composer:2.7.1@SHA256:' + 'a'.repeat(64)}  | ${'composer:2.7.1@SHA256:' + 'a'.repeat(64) + ', a, b'}
+    ${'a, b, composer:2.7.1@sha384:' + 'a'.repeat(96)}  | ${'composer:2.7.1@sha384:' + 'a'.repeat(96) + ', a, b'}
+    ${'a, b, composer:2.7.1@md5:' + 'a'.repeat(32)}     | ${'composer:2.7.1@md5:' + 'a'.repeat(32) + ', a, b'}
+    ${'a, b, composer:2.7.1@sha256' + 'a'.repeat(64)}   | ${'composer:2.7.1@sha256' + 'a'.repeat(64) + ', a, b'}
+    ${'a, b, composer@sha256:' + 'a'.repeat(64)}        | ${'composer@sha256:' + 'a'.repeat(64) + ', a, b'}
   `('checking filterList $input_list', async ({input_list, filtered_list}) => {
     expect(await tools.filterList(input_list.split(', '))).toStrictEqual(
       filtered_list.split(', ')
@@ -298,22 +338,47 @@ describe('Tools tests', () => {
   });
 
   it.each`
-    os           | script                                              | scope
-    ${'linux'}   | ${'add_composer_tool tool tool:1.2.3 user/ global'} | ${'global'}
-    ${'darwin'}  | ${'add_composer_tool tool tool:1.2.3 user/ scoped'} | ${'scoped'}
-    ${'win32'}   | ${'Add-ComposerTool tool tool:1.2.3 user/ scoped'}  | ${'scoped'}
-    ${'openbsd'} | ${'Platform openbsd is not supported'}              | ${'global'}
-  `('checking addPackage: $os, $scope', async ({os, script, scope}) => {
+    os          | script
+    ${'linux'}  | ${'add_tool https://example.com/tool.phar tool "-v" sha256:' + 'a'.repeat(64)}
+    ${'darwin'} | ${'add_tool https://example.com/tool.phar tool "-v" sha256:' + 'a'.repeat(64)}
+    ${'win32'}  | ${'Add-Tool https://example.com/tool.phar tool "-v" sha256:' + 'a'.repeat(64)}
+  `('checking addArchive with checksum: $os', async ({os, script}) => {
+    const data = getData({
+      tool: 'tool',
+      version: '1.2.3',
+      version_parameter: JSON.stringify('-v'),
+      os: os,
+      url: 'https://example.com/tool.phar'
+    });
+    data.checksum = 'sha256:' + 'a'.repeat(64);
+    expect(await tools.addArchive(data)).toContain(script);
+  });
+
+  it.each`
+    os           | release           | scope       | script
+    ${'linux'}   | ${'tool:1.2.3'}   | ${'global'} | ${'add_composer_tool tool tool:1.2.3 user/ global'}
+    ${'darwin'}  | ${'tool:1.2.3'}   | ${'scoped'} | ${'add_composer_tool tool tool:1.2.3 user/ scoped'}
+    ${'win32'}   | ${'tool:1.2.3'}   | ${'scoped'} | ${'Add-ComposerTool tool tool:1.2.3 user/ scoped'}
+    ${'linux'}   | ${'tool:>=1.2'}   | ${'global'} | ${'add_composer_tool tool "tool:>=1.2" user/ global'}
+    ${'win32'}   | ${'tool:>=1.2'}   | ${'global'} | ${'Add-ComposerTool tool "tool:>=1.2" user/ global'}
+    ${'linux'}   | ${'tool:1.*'}     | ${'global'} | ${'add_composer_tool tool "tool:1.*" user/ global'}
+    ${'linux'}   | ${'psalm:^5||^6'} | ${'global'} | ${'add_composer_tool tool "psalm:^5||^6" user/ global'}
+    ${'linux'}   | ${'psalm:>=5,<6'} | ${'global'} | ${'add_composer_tool tool "psalm:>=5,<6" user/ global'}
+    ${'openbsd'} | ${'tool:1.2.3'}   | ${'global'} | ${'Platform openbsd is not supported'}
+  `(
+    'checking addPackage: $os, $release',
+    async ({os, release, scope, script}) => {
       const data = getData({
         tool: 'tool',
         version: '1.2.3',
         repository: 'user/tool',
-      os: os,
-      scope: scope
+        os,
+        scope
       });
-    data['release'] = [data['tool'], data['version']].join(':');
+      data['release'] = release;
       expect(await tools.addPackage(data)).toContain(script);
-  });
+    }
+  );
 
   it.each`
     version     | php_version | os          | script
@@ -423,6 +488,118 @@ describe('Tools tests', () => {
     }
   );
 
+  it.each`
+    version            | affected
+    ${'1'}             | ${false}
+    ${'1.0.0-alpha1'}  | ${true}
+    ${'1.0.0-alpha2'}  | ${true}
+    ${'1.0.0-alpha3'}  | ${true}
+    ${'1.0.0-alpha4'}  | ${true}
+    ${'1.0.0-alpha5'}  | ${true}
+    ${'1.0.0-alpha6'}  | ${true}
+    ${'1.0.0-alpha7'}  | ${true}
+    ${'1.0.0-alpha8'}  | ${true}
+    ${'1.0.0-alpha9'}  | ${true}
+    ${'1.0.0-alpha10'} | ${true}
+    ${'1.0.0-alpha11'} | ${true}
+    ${'1.0.0-beta1'}   | ${true}
+    ${'1.0.0-beta2'}   | ${true}
+    ${'1.0.0'}         | ${true}
+    ${'1.10.27'}       | ${true}
+    ${'1.10.28'}       | ${false}
+    ${'2.0.0-alpha1'}  | ${true}
+    ${'2.0.0-alpha2'}  | ${true}
+    ${'2.0.0-alpha3'}  | ${true}
+    ${'2.0.0-RC1'}     | ${true}
+    ${'2.0.0-RC2'}     | ${true}
+    ${'2.2.27'}        | ${true}
+    ${'2.2.28'}        | ${false}
+    ${'2.3.0-RC1'}     | ${true}
+    ${'2.3.0-RC2'}     | ${true}
+    ${'2.9.7'}         | ${true}
+    ${'2.9.7-RC1'}     | ${true}
+    ${'2.9.8'}         | ${false}
+    ${'2.9.0RC1'}      | ${false}
+    ${'2.9.x-dev'}     | ${false}
+  `('checking affected composer version: $version', ({version, affected}) => {
+    expect(tools.skipGitHubAuthForComposerVersion(version)).toBe(affected);
+  });
+
+  it('checking affected composer version with CRLF ranges', async () => {
+    let affected = false;
+    let fixed = true;
+    await jest.isolateModulesAsync(async () => {
+      jest.doMock('fs', () => ({
+        ...jest.requireActual('fs'),
+        readFileSync: (
+          filePath: fs.PathOrFileDescriptor,
+          options?: unknown
+        ) => {
+          if (String(filePath).includes('composer-gh-auth-no-op')) {
+            return '1.0.0-0 1.10.28\r\n2.0.0-0 2.2.28\r\n2.3.0-0 2.9.8';
+          }
+          return (jest.requireActual('fs') as typeof fs).readFileSync(
+            filePath,
+            options as fs.ObjectEncodingOptions & {flag?: string}
+          );
+        }
+      }));
+      const isolatedTools = jest.requireActual<typeof tools>('../src/tools');
+      affected = isolatedTools.skipGitHubAuthForComposerVersion('2.9.7');
+      fixed = isolatedTools.skipGitHubAuthForComposerVersion('2.9.8');
+    });
+    expect(affected).toBe(true);
+    expect(fixed).toBe(false);
+  });
+
+  it.each`
+    auth_json                                                                                                          | expected
+    ${'{"github-oauth":{"github.com":"ghs_new-token"},"http-basic":{"repo.example":{"username":"u","password":"p"}}}'} | ${'{"http-basic":{"repo.example":{"username":"u","password":"p"}}}'}
+    ${'{"github-oauth":{"github.com":"ghs_new-token"}}'}                                                               | ${undefined}
+    ${'{"http-basic":{"repo.example":{"username":"u","password":"p"}}}'}                                               | ${'{"http-basic":{"repo.example":{"username":"u","password":"p"}}}'}
+    ${'{"nested":{"github-oauth":{"github.com":"ghs_new-token"}}}'}                                                    | ${'{"nested":{"github-oauth":{"github.com":"ghs_new-token"}}}'}
+    ${'{"github-oauth":'}                                                                                              | ${'{"github-oauth":'}
+  `('cleaning composer auth json', ({auth_json, expected}) => {
+    unsetComposerAuthEnv();
+    process.env['COMPOSER_AUTH_JSON'] = auth_json;
+    tools.cleanComposerAuthJson();
+    expect(process.env['COMPOSER_AUTH_JSON']).toBe(expected);
+    unsetComposerAuthEnv();
+  });
+
+  it.each`
+    version     | os         | envs                                                                                       | skip_github_auth
+    ${'latest'} | ${'linux'} | ${{GITHUB_TOKEN: 'ghs_token'}}                                                             | ${false}
+    ${'1'}      | ${'linux'} | ${{GITHUB_TOKEN: 'ghs_token'}}                                                             | ${false}
+    ${'2'}      | ${'linux'} | ${{GITHUB_TOKEN: 'ghs_token'}}                                                             | ${false}
+    ${'2.9.7'}  | ${'linux'} | ${{}}                                                                                      | ${true}
+    ${'2.9.7'}  | ${'linux'} | ${{GITHUB_TOKEN: 'ghs_token'}}                                                             | ${true}
+    ${'2.9.7'}  | ${'linux'} | ${{COMPOSER_TOKEN: 'ghs_token'}}                                                           | ${true}
+    ${'2.9.7'}  | ${'linux'} | ${{COMPOSER_AUTH_JSON: '{"github-oauth":{"github.com":"ghs_new-token"}}'}}                 | ${true}
+    ${'2.9.7'}  | ${'linux'} | ${{COMPOSER_AUTH_JSON: '{"http-basic":{"repo.example":{"username":"u","password":"p"}}}'}} | ${true}
+    ${'2.9.8'}  | ${'linux'} | ${{GITHUB_TOKEN: 'ghs_token'}}                                                             | ${false}
+    ${'2.9.7'}  | ${'win32'} | ${{GITHUB_TOKEN: 'ghs_token'}}                                                             | ${true}
+  `(
+    'checking composer github auth skip flag: $version, $os',
+    async ({version, os, envs, skip_github_auth}) => {
+      unsetComposerAuthEnv();
+      Object.assign(process.env, envs);
+      const data = getData({
+        tool: 'composer',
+        os: os,
+        php_version: '7.4',
+        domain: 'https://getcomposer.org',
+        repository: 'composer/composer',
+        version: version
+      });
+      const script = await tools.addComposer(data);
+      expect(script).toContain(
+        `composer ${version}${skip_github_auth ? ' true' : ''}`
+      );
+      unsetComposerAuthEnv();
+    }
+  );
+
   it.each`
     version     | uri
     ${'latest'} | ${'wp-cli/builds/blob/gh-pages/phar/wp-cli.phar?raw=true'}
@@ -458,13 +635,15 @@ describe('Tools tests', () => {
 
   it.each([
     [
-      'blackfire, blackfire-player, box, churn, cs2pr, flex, grpc_php_plugin, mago, name-collision-detector, parallel-lint, php-cs-fixer, php-scoper, phpDocumentor, phplint, phpstan, phpunit, pecl, phing, phinx, phinx:1.2.3, phive, phpunit-bridge, phpunit-polyfills, pint, php-config, phpize, protoc, symfony, vapor, wp, pie',
+      'blackfire, blackfire-player, box, churn, cloud-cli, cpx, cs2pr, flex, grpc_php_plugin, mago, name-collision-detector, parallel-lint, php-cs-fixer, php-scoper, phpDocumentor, phplint, phpstan, phpunit, pecl, phing, phinx, phinx:1.2.3, phive, phpunit-bridge, phpunit-polyfills, pint, php-config, phpize, protoc, symfony, vapor, wp, pie',
       [
         'add_tool https://github.com/shivammathur/composer-cache/releases/latest/download/composer-7.4-stable.phar,https://artifacts.setup-php.com/composer/composer-7.4-stable.phar,https://dl.cloudsmith.io/public/shivammathur/composer-cache/raw/files/composer-7.4-stable.phar,https://getcomposer.org/composer-stable.phar composer',
         'add_blackfire',
         'add_tool https://get.blackfire.io/blackfire-player-v1.22.0.phar blackfire-player "-V"',
         'add_tool https://github.com/box-project/box/releases/latest/download/box.phar box "--version"',
         'add_tool https://github.com/bmitch/churn-php/releases/latest/download/churn.phar churn "-V"',
+        'add_composer_tool cloud-cli cloud-cli laravel/ scoped',
+        'add_tool https://github.com/laravel/cpx/releases/latest/download/cpx cpx "--version"',
         'add_tool https://github.com/staabm/annotate-pull-request-from-checkstyle/releases/latest/download/cs2pr cs2pr "-V"',
         'add_composer_tool flex flex symfony/ global',
         'add_grpc_php_plugin latest',
@@ -503,7 +682,7 @@ describe('Tools tests', () => {
 
   it.each([
     [
-      'backward-compatibility-check, behat, blackfire, blackfire-player, churn, composer-dependency-analyser, composer-normalize, composer-require-checker, composer-unused, cs2pr:1.2.3, ecs, flex, grpc_php_plugin:1.2.3, infection, mago:0.26.1, name-collision-detector, phan, phan:1.2.3, phing:1.2.3, phinx, phive:1.2.3, php-config, phpcbf, phpcpd, phpcs, phpdoc, phpize, phpmd, phpspec, phpunit-bridge:5.6, phpunit-polyfills:1.0.1, protoc:v1.2.3, psalm, rector, symfony-cli, vapor-cli, wp-cli, pie',
+      'backward-compatibility-check, behat, blackfire, blackfire-player, churn, composer-dependency-analyser, composer-normalize, composer-require-checker, composer-unused, cpx:2.0.0, cs2pr:1.2.3, ecs, flex, grpc_php_plugin:1.2.3, infection, laravel-cloud, mago:0.26.1, name-collision-detector, phan, phan:1.2.3, phing:1.2.3, phinx, phive:1.2.3, php-config, phpcbf, phpcpd, phpcs, phpdoc, phpize, phpmd, phpspec, phpunit-bridge:5.6, phpunit-polyfills:1.0.1, protoc:v1.2.3, psalm, rector, symfony-cli, vapor-cli, wp-cli, pie',
       [
         'add_tool https://github.com/shivammathur/composer-cache/releases/latest/download/composer-7.4-stable.phar,https://artifacts.setup-php.com/composer/composer-7.4-stable.phar,https://dl.cloudsmith.io/public/shivammathur/composer-cache/raw/files/composer-7.4-stable.phar,https://getcomposer.org/composer-stable.phar composer',
         'add_composer_tool behat behat behat/ scoped',
@@ -514,10 +693,12 @@ describe('Tools tests', () => {
         'add_composer_tool composer-dependency-analyser composer-dependency-analyser shipmonk/ scoped',
         'add_composer_tool composer-require-checker composer-require-checker maglnet/ scoped',
         'add_tool https://github.com/composer-unused/composer-unused/releases/latest/download/composer-unused.phar composer-unused "-V"',
+        'add_tool https://github.com/laravel/cpx/releases/download/v2.0.0/cpx cpx "--version"',
         'add_tool https://github.com/staabm/annotate-pull-request-from-checkstyle/releases/download/1.2.3/cs2pr cs2pr "-V"',
         'add_composer_tool flex flex symfony/ global',
         'add_grpc_php_plugin 1.2.3',
         'add_tool https://github.com/infection/infection/releases/latest/download/infection.phar infection "-V"',
+        'add_composer_tool cloud-cli cloud-cli laravel/ scoped',
         'add_mago 0.26.1',
         'add_composer_tool name-collision-detector name-collision-detector shipmonk/ scoped',
         'add_tool https://github.com/phan/phan/releases/latest/download/phan.phar phan "-v"',
@@ -533,7 +714,7 @@ describe('Tools tests', () => {
         'add_devtools phpize',
         'add_tool https://github.com/phpmd/phpmd/releases/latest/download/phpmd.phar phpmd "--version"',
         'add_tool https://github.com/phpspec/phpspec/releases/latest/download/phpspec.phar phpspec "-V"',
-        'add_composer_tool phpunit-bridge phpunit-bridge:5.6.* symfony/ global',
+        'add_composer_tool phpunit-bridge "phpunit-bridge:5.6.*" symfony/ global',
         'add_composer_tool phpunit-polyfills phpunit-polyfills:1.0.1 yoast/ global',
         'add_protoc 1.2.3',
         'add_tool https://github.com/vimeo/psalm/releases/latest/download/psalm.phar psalm "-v"',
@@ -593,7 +774,7 @@ describe('Tools tests', () => {
         'Add-ComposerTool codeception codeception codeception/ global',
         'Add-ComposerTool prestissimo prestissimo hirak/ global',
         'Add-ComposerTool automatic-composer-prefetcher automatic-composer-prefetcher narrowspark/ global',
-        'Add-ComposerTool phinx phinx:1.2.* robmorgan/ scoped',
+        'Add-ComposerTool phinx "phinx:1.2.*" robmorgan/ scoped',
         'Add-ComposerTool phinx phinx:^1.2 robmorgan/ global',
         'Add-ComposerTool tool tool:1.2.3 user/ global',
         'Add-ComposerTool tool tool:~1.2 user/ global'
@@ -642,10 +823,50 @@ describe('Tools tests', () => {
     ${'composer:preview'}                                 | ${'add_tool https://github.com/shivammathur/composer-cache/releases/latest/download/composer-7.4-preview.phar,https://artifacts.setup-php.com/composer/composer-7.4-preview.phar,https://dl.cloudsmith.io/public/shivammathur/composer-cache/raw/files/composer-7.4-preview.phar,https://getcomposer.org/composer-preview.phar composer preview'}
     ${'composer, composer:v1'}                            | ${'add_tool https://github.com/shivammathur/composer-cache/releases/latest/download/composer-7.4-1.phar,https://artifacts.setup-php.com/composer/composer-7.4-1.phar,https://dl.cloudsmith.io/public/shivammathur/composer-cache/raw/files/composer-7.4-1.phar,https://getcomposer.org/composer-1.phar composer'}
     ${'composer:v1, composer:preview, composer:snapshot'} | ${'add_tool https://github.com/shivammathur/composer-cache/releases/latest/download/composer-7.4-snapshot.phar,https://artifacts.setup-php.com/composer/composer-7.4-snapshot.phar,https://dl.cloudsmith.io/public/shivammathur/composer-cache/raw/files/composer-7.4-snapshot.phar,https://getcomposer.org/composer.phar composer snapshot'}
+    ${'composer:2.9.7'}                                   | ${'add_tool https://github.com/composer/composer/releases/download/2.9.7/composer.phar,https://getcomposer.org/download/2.9.7/composer.phar composer 2.9.7 true'}
   `('checking composer setup: $tools_csv', async ({tools_csv, script}) => {
     expect(await tools.addTools(tools_csv, '7.4', 'linux')).toContain(script);
   });
 
+  it.each`
+    tools_csv                                    | os          | script
+    ${'phpunit:9.5.0@sha256:' + 'a'.repeat(64)}  | ${'linux'}  | ${'add_tool https://phar.phpunit.de/phpunit-9.5.0.phar,https://phar.phpunit.de/phpunit-9.phar phpunit "--version" sha256:' + 'a'.repeat(64)}
+    ${'phpunit:9.5.0@sha256:' + 'a'.repeat(64)}  | ${'win32'}  | ${'Add-Tool https://phar.phpunit.de/phpunit-9.5.0.phar,https://phar.phpunit.de/phpunit-9.phar phpunit "--version" sha256:' + 'a'.repeat(64)}
+    ${'composer:2.9.8@sha256:' + 'b'.repeat(64)} | ${'linux'}  | ${'composer 2.9.8 sha256:' + 'b'.repeat(64)}
+    ${'cs2pr:1.2.3@sha256:' + 'd'.repeat(64)}    | ${'linux'}  | ${'add_tool https://github.com/staabm/annotate-pull-request-from-checkstyle/releases/download/1.2.3/cs2pr cs2pr "-V" sha256:' + 'd'.repeat(64)}
+    ${'phive:0.15.3@sha512:' + 'c'.repeat(128)}  | ${'darwin'} | ${'add_tool https://github.com/phar-io/phive/releases/download/0.15.3/phive-0.15.3.phar phive "status" sha512:' + 'c'.repeat(128)}
+    ${'phinx:1.2.3@sha256:' + 'a'.repeat(64)}    | ${'linux'}  | ${'add_log "$cross" "phinx" "Checksum verification is not supported for phinx"'}
+    ${'pecl@sha256:' + 'a'.repeat(64)}           | ${'linux'}  | ${'add_log "$cross" "pecl" "Checksum verification is not supported for pecl"'}
+    ${'phpunit:9.5.0@sha256:invalid'}            | ${'linux'}  | ${'add_log "$cross" "phpunit" "Invalid sha256 checksum, expected 64 hexadecimal characters"'}
+    ${'composer:2.9.8@SHA256:' + 'b'.repeat(64)} | ${'linux'}  | ${'composer 2.9.8 sha256:' + 'b'.repeat(64)}
+    ${'composer:2.9.8@sha384:' + 'b'.repeat(96)} | ${'linux'}  | ${'add_log "$cross" "composer" "Unsupported checksum algorithm sha384, expected sha256 or sha512"'}
+    ${'composer:2.9.8@md5:' + 'b'.repeat(32)}    | ${'linux'}  | ${'add_log "$cross" "composer" "Unsupported checksum algorithm md5, expected sha256 or sha512"'}
+    ${'composer:2.9.8@sha256' + 'b'.repeat(64)}  | ${'linux'}  | ${'add_log "$cross" "composer" "Invalid checksum syntax, expected @sha256:<hash> or @sha512:<hash>"'}
+  `(
+    'checking addTools with checksum: $tools_csv, $os',
+    async ({tools_csv, os, script}) => {
+      expect(await tools.addTools(tools_csv, '7.4', os)).toContain(script);
+    }
+  );
+
+  it.each`
+    type                 | tool_function  | supported
+    ${'phar'}            | ${undefined}   | ${true}
+    ${'custom-function'} | ${undefined}   | ${true}
+    ${'custom-function'} | ${'composer'}  | ${true}
+    ${'custom-function'} | ${'pecl'}      | ${false}
+    ${'custom-function'} | ${'dev_tools'} | ${false}
+    ${'composer'}        | ${undefined}   | ${false}
+    ${'custom-package'}  | ${undefined}   | ${false}
+  `(
+    'checking supportsChecksum: $type, $tool_function',
+    async ({type, tool_function, supported}) => {
+      const data = getData({tool: 'tool', type: type});
+      data.function = tool_function;
+      expect(await tools.supportsChecksum(data)).toBe(supported);
+    }
+  );
+
   it.each`
     tools_csv        | token              | script
     ${'cs2pr:1.2'}   | ${'invalid_token'} | ${'add_log "$cross" "cs2pr" "Invalid token"'}
@@ -686,7 +907,7 @@ describe('Tools tests', () => {
           );
         }
       }));
-      const isolatedTools = await import('../src/tools');
+      const isolatedTools = jest.requireActual<typeof tools>('../src/tools');
       result = await isolatedTools.addTools('broken-tool', '7.4', 'linux');
     });
 

__tests__/utils.test.ts

@@ -11,6 +11,12 @@ describe('Utils tests', () => {
     expect(await utils.readEnv('TEST')).toBe('setup-php');
     expect(await utils.readEnv('test_hyphen')).toBe('setup-php');
     expect(await utils.readEnv('TEST_HYPHEN')).toBe('setup-php');
+    expect(await utils.readEnv('test invalid')).toBe('');
+    process.env['conflict_hyphen'] = 'setup-php';
+    process.env['conflict-hyphen'] = 'wrong';
+    expect(await utils.readEnv('conflict_hyphen')).toBe('setup-php');
+    delete process.env['conflict_hyphen'];
+    delete process.env['conflict-hyphen'];
     expect(await utils.readEnv('undefined')).toBe('');
   });
 
@@ -40,7 +46,19 @@ describe('Utils tests', () => {
     expect(await utils.parseVersion('7')).toBe('7.0');
     expect(await utils.parseVersion('7.4')).toBe('7.4');
     expect(await utils.parseVersion('5.x')).toBe('5.6');
-    expect(await utils.parseVersion('4.x')).toBe(undefined);
+    expect(await utils.parseVersion('pre')).toBe('pre');
+    expect(await utils.parseVersion('pre-installed')).toBe('pre');
+    await expect(utils.parseVersion('4.x')).rejects.toThrow(
+      'Invalid PHP version: 4.x'
+    );
+    await expect(utils.parseVersion('foo')).rejects.toThrow(
+      'Invalid PHP version:'
+    );
+
+    fetchSpy.mockResolvedValue({data: '{ "latest": "8.1.0" }'});
+    await expect(utils.parseVersion('latest')).rejects.toThrow(
+      'Invalid PHP version in manifest:'
+    );
 
     fetchSpy.mockReset();
     fetchSpy.mockResolvedValueOnce({}).mockResolvedValueOnce({});
@@ -56,6 +74,12 @@ describe('Utils tests', () => {
     expect(await utils.parseIniFile('none')).toBe('none');
     expect(await utils.parseIniFile('php.ini-production')).toBe('production');
     expect(await utils.parseIniFile('php.ini-development')).toBe('development');
+    expect(await utils.parseIniFile('/etc/php.ini-production')).toBe(
+      'production'
+    );
+    expect(await utils.parseIniFile('/a-b/php.ini-development')).toBe(
+      'development'
+    );
     expect(await utils.parseIniFile('invalid')).toBe('production');
   });
 
@@ -85,6 +109,26 @@ describe('Utils tests', () => {
 
     expect(await utils.extensionArray('')).toEqual([]);
     expect(await utils.extensionArray(' ')).toEqual([]);
+
+    expect(
+      await utils.extensionArray('apcu, mbstring, \\ pdo_pgsql, posix, session')
+    ).toEqual(['apcu', 'mbstring', 'pdo_pgsql', 'posix', 'session']);
+  });
+
+  it('checking shell helpers', () => {
+    expect(utils.escapeForShell('a$b`c\\d"e', 'linux')).toBe(
+      'a\\$b\\`c\\\\d\\"e'
+    );
+    expect(utils.escapeForShell('a$b`c"d', 'win32')).toBe('a`$b``c`"d');
+    expect(utils.safeArg('vendor-pkg/repo@v1.0.0', 'linux')).toBe(
+      'vendor-pkg/repo@v1.0.0'
+    );
+    expect(utils.safeArg('phpcs:>=3.0', 'linux')).toBe('"phpcs:>=3.0"');
+    expect(utils.safeArg('foo$bar', 'win32')).toBe('"foo`$bar"');
+    expect(utils.sanitizeShellInput('foo;$(`ls`)bar')).toBe('foolsbar');
+    expect(utils.sanitizeShellInput('vendor/foo:1.*', true)).toBe(
+      'vendor/foo:1.'
+    );
   });
 
   it('checking INIArray', async () => {
@@ -278,6 +322,9 @@ describe('Utils tests', () => {
     process.env['php-version'] = '8.2';
     expect(await utils.readPHPVersion()).toBe('8.2');
 
+    process.env['php-version'] = 'pre-installed';
+    expect(await utils.readPHPVersion()).toBe('pre-installed');
+
     delete process.env['php-version-file'];
     delete process.env['php-version'];
 
@@ -287,7 +334,7 @@ describe('Utils tests', () => {
 
     existsSync.mockReturnValue(true);
     readFileSync.mockReturnValue('setup-php');
-    expect(await utils.readPHPVersion()).toBe('setup-php');
+    await expect(utils.readPHPVersion()).rejects.toThrow('Invalid PHP version');
 
     existsSync.mockReturnValueOnce(false).mockReturnValueOnce(true);
     readFileSync.mockReturnValue(
@@ -308,6 +355,37 @@ describe('Utils tests', () => {
     readFileSync.mockClear();
   });
 
+  it('readPHPVersion rejects unsupported values from each source', async () => {
+    const existsSync = jest.spyOn(fs, 'existsSync').mockImplementation();
+    const readFileSync = jest.spyOn(fs, 'readFileSync').mockImplementation();
+
+    process.env['php-version'] = 'bogus';
+    await expect(utils.readPHPVersion()).rejects.toThrow('php-version input');
+    delete process.env['php-version'];
+
+    existsSync.mockReturnValue(true);
+    readFileSync.mockReturnValue('bogus');
+    await expect(utils.readPHPVersion()).rejects.toThrow('.php-version');
+
+    existsSync.mockReturnValueOnce(false).mockReturnValueOnce(true);
+    readFileSync.mockReturnValue('{"platform-overrides":{"php":"bogus"}}');
+    await expect(utils.readPHPVersion()).rejects.toThrow(
+      'composer.lock platform-overrides.php'
+    );
+
+    existsSync
+      .mockReturnValueOnce(false)
+      .mockReturnValueOnce(false)
+      .mockReturnValueOnce(true);
+    readFileSync.mockReturnValue('{"config":{"platform":{"php":"bogus"}}}');
+    await expect(utils.readPHPVersion()).rejects.toThrow(
+      'composer.json config.platform.php'
+    );
+
+    existsSync.mockClear();
+    readFileSync.mockClear();
+  });
+
   it('checking setVariable', async () => {
     let script: string = await utils.setVariable('var', 'command', 'linux');
     expect(script).toEqual('\nvar="$(command)"\n');

examples/bedrock.yml

@@ -8,7 +8,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
     steps:
       - name: Checkout
         uses: actions/checkout@v6

examples/blackfire-player.yml

@@ -4,6 +4,9 @@ on: [push, pull_request]
 jobs:
   blackfire-player:
     name: Blackfire (PHP ${{ matrix.php-versions }})
+    defaults:
+      run:
+        shell: bash
     # Add your Blackfire credentials securely using GitHub Secrets
     env:
       BLACKFIRE_SERVER_ID: ${{ secrets.BLACKFIRE_SERVER_ID }}
@@ -14,9 +17,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
-        # blackfire-player supports PHP >= 5.5
+        operating-system: [ubuntu-latest, macos-latest]
+        php-versions: ['8.3', '8.4', '8.5']
+        # Blackfire Player supports PHP 8.5 and is available on Ubuntu and macOS.
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -31,6 +34,14 @@ jobs:
           tools: blackfire, blackfire-player
           coverage: none
 
-      # Refer to https://blackfire.io/docs/player/index#usage
+      - name: Start local endpoint
+        run: |
+          php -S 127.0.0.1:8080 > "$RUNNER_TEMP/blackfire-player.log" 2>&1 &
+          sleep 5
+
+      - name: Validate scenario
+        run: blackfire-player validate scenario.bkf
+
+      # Refer to https://docs.blackfire.io/builds-cookbooks/player
       - name: Play the scenario
-        run: blackfire-player run scenario.bkf
+        run: blackfire-player run scenario.bkf --endpoint=http://127.0.0.1:8080

examples/blackfire.yml

@@ -15,8 +15,8 @@ jobs:
       fail-fast: false
       matrix:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
-        # Blackfire supports PHP >= 5.3 on Ubuntu and macOS, and PHP >= 5.4 on Windows
+        php-versions: ['8.3', '8.4', '8.5']
+        # Blackfire supports the current PHP releases on Ubuntu, macOS, and Windows.
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -26,12 +26,24 @@ jobs:
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php-versions }}
-          # Setup Blackfire extension and CLI
-          extensions: blackfire
+          # Setup Blackfire extension and CLI.
+          extensions: blackfire, :xdebug
           tools: blackfire
           # Disable Xdebug and PCOV coverage drivers
           coverage: none
 
       # Refer to https://blackfire.io/docs/cookbooks/profiling-cli
       - name: Profile
-        run: blackfire run php my-script.php
+        shell: bash
+        run: |
+          set +e
+          output=$(blackfire run php my-script.php 2>&1)
+          exit_code=$?
+          printf '%s\n' "$output"
+          if [ "$exit_code" -ne 0 ]; then
+            if printf '%s' "$output" | grep -q "upgrade your subscription"; then
+              echo "Blackfire profiling reached the repository quota limit; treating this as a known non-fatal condition."
+              exit 0
+            fi
+            exit "$exit_code"
+          fi

examples/cakephp-mysql.yml

@@ -6,7 +6,8 @@ jobs:
   tests:
     strategy:
       matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.4', '8.5']
+        # The latest cakephp/app release resolves dev dependencies that require PHP 8.4+.
     runs-on: ubuntu-latest
 
     # Docs: https://docs.github.com/en/actions/using-containerized-services
@@ -37,7 +38,7 @@ jobs:
           php-version: ${{ matrix.php-versions }}
           # You can also use ext-apcu or ext-memcached instead of ext-redis
           # Install memcached if using ext-memcached
-          extensions: mbstring, intl, redis, pdo_mysql
+          extensions: mbstring, intl, redis, apcu, pdo_mysql
           coverage: pcov
 
       # Local MySQL service in GitHub hosted environments is disabled by default.
@@ -61,14 +62,15 @@ jobs:
       - name: Install dependencies
         run: |
           composer install --no-progress --prefer-dist --optimize-autoloader
-          composer run-script post-install-cmd
+          composer run-script post-install-cmd --no-interaction
 
       # Add a step to run migrations if required
       - name: Test with phpunit
         run: vendor/bin/phpunit --coverage-text
         env:
           REDIS_PORT: ${{ job.services.redis.ports['6379'] }}
-          DB_DSN: "mysql://root:password@127.0.0.1:${{ job.services.mysql.ports['3306'] }}/cakephp?init[]=SET sql_mode = \"STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION\""
+          DATABASE_URL: "mysql://root:password@127.0.0.1:${{ job.services.mysql.ports['3306'] }}/cakephp?init[]=SET sql_mode = \"STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION\""
+          DATABASE_TEST_URL: "mysql://root:password@127.0.0.1:${{ job.services.mysql.ports['3306'] }}/cakephp?init[]=SET sql_mode = \"STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION\""
 
   coding-standard:
     name: Coding Standard
@@ -81,7 +83,7 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.1'
+          php-version: '8.5'
           extensions: mbstring, intl
 
       - name: Get composer cache directory
@@ -114,7 +116,7 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.1'
+          php-version: '8.5'
           extensions: mbstring, intl
           tools: phpstan
 
@@ -132,7 +134,9 @@ jobs:
           restore-keys: ${{ runner.os }}-composer-
 
       - name: Install dependencies
-        run: composer install --no-progress --prefer-dist --optimize-autoloader
+        run: |
+          composer install --no-progress --prefer-dist --optimize-autoloader
+          composer run-script post-install-cmd --no-interaction
 
       - name: Static Analysis using PHPStan
         run: phpstan analyse --no-progress src/

examples/cakephp-postgres.yml

@@ -5,8 +5,10 @@ on: [push, pull_request]
 jobs:
   tests:
     strategy:
+      fail-fast: false
       matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.4', '8.5']
+        # The latest cakephp/app release resolves dev dependencies that require PHP 8.4+.
     runs-on: ubuntu-latest
 
     # Docs: https://docs.github.com/en/actions/using-containerized-services
@@ -37,7 +39,7 @@ jobs:
           php-version: ${{ matrix.php-versions }}
           # You can also use ext-apcu or ext-memcached instead of ext-redis
           # Install memcached if using ext-memcached
-          extensions: mbstring, intl, redis, pdo_pgsql
+          extensions: mbstring, intl, redis, apcu, pdo_pgsql
           coverage: pcov
 
       # Local PostgreSQL service in GitHub hosted environments is disabled by default.
@@ -61,14 +63,15 @@ jobs:
       - name: Install dependencies
         run: |
           composer install --no-progress --prefer-dist --optimize-autoloader
-          composer run-script post-install-cmd
+          composer run-script post-install-cmd --no-interaction
 
       # Add a step to run migrations if required
       - name: Test with phpunit
         run: vendor/bin/phpunit --coverage-text
         env:
           REDIS_PORT: ${{ job.services.redis.ports['6379'] }}
-          DB_DSN: postgres://postgres@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/postgres
+          DATABASE_URL: postgres://postgres:postgres@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/postgres?encoding=UTF8
+          DATABASE_TEST_URL: postgres://postgres:postgres@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/postgres?encoding=UTF8
 
   coding-standard:
     name: Coding Standard
@@ -81,8 +84,8 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.1'
-          extensions: mbstring, intl
+          php-version: '8.5'
+          extensions: mbstring, intl, apcu
 
       - name: Get composer cache directory
         id: composer-cache
@@ -114,8 +117,8 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.1'
-          extensions: mbstring, intl
+          php-version: '8.5'
+          extensions: mbstring, intl, apcu
           tools: phpstan
 
       - name: Get composer cache directory
@@ -132,7 +135,9 @@ jobs:
           restore-keys: ${{ runner.os }}-composer-
 
       - name: Install dependencies
-        run: composer install --no-progress --prefer-dist --optimize-autoloader
+        run: |
+          composer install --no-progress --prefer-dist --optimize-autoloader
+          composer run-script post-install-cmd --no-interaction
 
       - name: Static Analysis using PHPStan
         run: phpstan analyse --no-progress src/

examples/cakephp.yml

@@ -7,7 +7,8 @@ jobs:
     strategy:
       matrix:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.4', '8.5']
+        # The latest cakephp/app release resolves dev dependencies that require PHP 8.4+.
     runs-on: ${{ matrix.operating-system }}
     steps:
       - name: Checkout
@@ -23,6 +24,7 @@ jobs:
 
       - name: Get composer cache directory
         id: composer-cache
+        shell: bash
         run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Cache composer dependencies
@@ -37,7 +39,7 @@ jobs:
       - name: Install dependencies
         run: |
           composer install --no-progress --prefer-dist --optimize-autoloader
-          composer run-script post-install-cmd
+          composer run-script post-install-cmd --no-interaction
 
       - name: Test with phpunit
         run: vendor/bin/phpunit --coverage-text
@@ -53,10 +55,11 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.1'
+          php-version: '8.5'
           extensions: mbstring, intl
       - name: Get composer cache directory
         id: composer-cache
+        shell: bash
         run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Cache composer dependencies
@@ -85,12 +88,13 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.1'
+          php-version: '8.5'
           extensions: mbstring, intl
           tools: phpstan
 
       - name: Get composer cache directory
         id: composer-cache
+        shell: bash
         run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Cache composer dependencies
@@ -103,7 +107,9 @@ jobs:
           restore-keys: ${{ runner.os }}-composer-
 
       - name: Install dependencies
-        run: composer install --no-progress --prefer-dist --optimize-autoloader
+        run: |
+          composer install --no-progress --prefer-dist --optimize-autoloader
+          composer run-script post-install-cmd --no-interaction
 
       - name: Static Analysis using PHPStan
         run: phpstan analyse --no-progress src/

examples/codeigniter.yml

@@ -6,7 +6,7 @@ jobs:
     strategy:
       matrix:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
     runs-on: ${{ matrix.operating-system }}
     steps:
       - name: Checkout
@@ -17,12 +17,13 @@ jobs:
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php-versions }}
-          extensions: mbstring, intl, curl, dom
+          extensions: mbstring, intl, curl, dom, sqlite3, pdo_sqlite
           coverage: xdebug
 
       - name: Get composer cache directory
         id: composer-cache
-        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+        shell: bash
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
 
       - name: Cache composer dependencies
         uses: actions/cache@v5

examples/drupal.yml

@@ -0,0 +1,59 @@
+# GitHub Action for Drupal 11 composer-managed projects
+# Requires drupal/core-dev in require-dev for vendor/bin/phpunit
+name: Testing Drupal
+on: [push, pull_request]
+jobs:
+  drupal:
+    name: Drupal (PHP ${{ matrix.php-versions }})
+    runs-on: ubuntu-latest
+    env:
+      SIMPLETEST_BASE_URL: http://127.0.0.1:8080
+      SIMPLETEST_DB: sqlite://localhost/sites/default/files/.ht.sqlite
+      BROWSERTEST_OUTPUT_DIRECTORY: /tmp/browser_output
+    strategy:
+      fail-fast: false
+      matrix:
+        php-versions: ['8.3', '8.4', '8.5']
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      # Docs: https://github.com/shivammathur/setup-php
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-versions }}
+          extensions: apcu, ctype, curl, dom, gd, iconv, intl, mbstring, pdo_sqlite, simplexml, xml, zip
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache composer dependencies
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          # Use composer.json for key, if composer.lock is not committed.
+          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install Composer dependencies
+        run: |
+          if [ "${{ matrix.php-versions }}" = "8.3" ]; then
+            composer require --dev drupal/core-dev:11.2.10 doctrine/instantiator:^2.0.0 --no-interaction --no-update
+            composer update drupal/core-dev doctrine/instantiator --with-all-dependencies --no-interaction --no-progress --prefer-dist --optimize-autoloader
+          else
+            composer install --no-interaction --no-progress --prefer-dist --optimize-autoloader
+          fi
+
+      - name: Prepare Drupal test directories
+        run: mkdir -p web/sites/default/files "$BROWSERTEST_OUTPUT_DIRECTORY"
+
+      - name: Start Drupal web server
+        run: php -S 127.0.0.1:8080 -t web >/tmp/php-server.log 2>&1 &
+
+      - name: Test with phpunit
+        # Adjust the test path to match your custom modules or themes.
+        run: vendor/bin/phpunit -c web/core web/modules/custom

examples/laminas-mvc.yml

@@ -1,12 +1,12 @@
 # GitHub Action for Laminas framework MVC projects
-name: Testing Zend Framework
+name: Testing Laminas MVC
 on: [push, pull_request]
 jobs:
   build:
     strategy:
       matrix:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.1', '8.2', '8.3']
     runs-on: ${{ matrix.operating-system }}
     steps:
       - name: Checkout
@@ -21,6 +21,7 @@ jobs:
 
       - name: Get composer cache directory
         id: composer-cache
+        shell: bash
         run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Cache composer dependencies

examples/laravel-mysql.yml

@@ -6,11 +6,13 @@ jobs:
     name: Laravel (PHP ${{ matrix.php-versions }})
     runs-on: ubuntu-latest
     env:
+      DB_CONNECTION: mysql
+      DB_HOST: 127.0.0.1
       DB_DATABASE: laravel
       DB_USERNAME: root
       DB_PASSWORD: password
-      BROADCAST_DRIVER: log
-      CACHE_DRIVER: redis
+      BROADCAST_CONNECTION: log
+      CACHE_STORE: redis
       QUEUE_CONNECTION: redis
       SESSION_DRIVER: redis
 
@@ -34,7 +36,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
     steps:
       - name: Checkout
         uses: actions/checkout@v6

examples/laravel-postgres.yml

@@ -11,7 +11,7 @@ jobs:
       QUEUE_CONNECTION: redis
       SESSION_DRIVER: redis
       DB_CONNECTION: pgsql
-      DB_HOST: localhost
+      DB_HOST: 127.0.0.1
       DB_PASSWORD: postgres
       DB_USERNAME: postgres
       DB_DATABASE: postgres
@@ -36,7 +36,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -81,11 +81,11 @@ jobs:
       - name: Run Migration
         run: php artisan migrate -v
         env:
-          DB_PORT: ${{ job.services.postgres.ports[5432] }}
+          DB_PORT: ${{ job.services.postgres.ports['5432'] }}
           REDIS_PORT: ${{ job.services.redis.ports['6379'] }}
 
       - name: Test with phpunit
         run: vendor/bin/phpunit --coverage-text
         env:
-          DB_PORT: ${{ job.services.postgres.ports[5432] }}
+          DB_PORT: ${{ job.services.postgres.ports['5432'] }}
           REDIS_PORT: ${{ job.services.redis.ports['6379'] }}

examples/laravel.yml

@@ -9,7 +9,7 @@ jobs:
       fail-fast: false
       matrix:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -24,6 +24,7 @@ jobs:
 
       - name: Get composer cache directory
         id: composer-cache
+        shell: bash
         run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Cache composer dependencies

examples/lumen-mysql.yml

@@ -34,7 +34,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -83,7 +83,7 @@ jobs:
           REDIS_PORT: ${{ job.services.redis.ports['6379'] }}
 
       - name: Test with phpunit
-        run: vendor/bin/phpunit --coverage-text
+        run: vendor/bin/phpunit --coverage-text --coverage-filter app
         env:
           DB_PORT: ${{ job.services.mysql.ports['3306'] }}
           REDIS_PORT: ${{ job.services.redis.ports['6379'] }}

examples/lumen-postgres.yml

@@ -11,7 +11,7 @@ jobs:
       QUEUE_CONNECTION: redis
       SESSION_DRIVER: redis
       DB_CONNECTION: pgsql
-      DB_HOST: localhost
+      DB_HOST: 127.0.0.1
       DB_PASSWORD: postgres
       DB_USERNAME: postgres
       DB_DATABASE: postgres
@@ -36,7 +36,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -47,7 +47,7 @@ jobs:
         with:
           php-version: ${{ matrix.php-versions }}
           extensions: mbstring, dom, fileinfo, pgsql
-          coverage: xdebug
+          coverage: none
 
       # Local PostgreSQL service in GitHub hosted environments is disabled by default.
       # If you are using it instead of service containers, make sure you start it.
@@ -81,11 +81,11 @@ jobs:
       - name: Run Migration
         run: php artisan migrate -v
         env:
-          DB_PORT: ${{ job.services.postgres.ports[5432] }}
+          DB_PORT: ${{ job.services.postgres.ports['5432'] }}
           REDIS_PORT: ${{ job.services.redis.ports['6379'] }}
 
       - name: Test with phpunit
-        run: vendor/bin/phpunit --coverage-text
+        run: vendor/bin/phpunit
         env:
-          DB_PORT: ${{ job.services.postgres.ports[5432] }}
+          DB_PORT: ${{ job.services.postgres.ports['5432'] }}
           REDIS_PORT: ${{ job.services.redis.ports['6379'] }}

examples/lumen.yml

@@ -9,7 +9,7 @@ jobs:
       fail-fast: false
       matrix:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -24,6 +24,7 @@ jobs:
 
       - name: Get composer cache directory
         id: composer-cache
+        shell: bash
         run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Cache composer dependencies
@@ -42,4 +43,4 @@ jobs:
         run: php -r "file_exists('.env') || copy('.env.example', '.env');"
 
       - name: Test with phpunit
-        run: vendor/bin/phpunit --coverage-text
+        run: vendor/bin/phpunit --coverage-text --coverage-filter app

examples/phalcon-mysql.yml

@@ -11,7 +11,7 @@ jobs:
     env:
       DB_ADAPTER: mysql
       DB_HOST: 127.0.0.1
-      DB_NAME: phalcon
+      DB_NAME: vokuro
       DB_USERNAME: root
       DB_PASSWORD: password
       CODECEPTION_URL: 127.0.0.1
@@ -20,11 +20,11 @@ jobs:
     # Docs: https://docs.github.com/en/actions/using-containerized-services
     services:
       mysql:
-        image: mysql:latest
+        image: mysql:5.7
         env:
           MYSQL_ALLOW_EMPTY_PASSWORD: false
           MYSQL_ROOT_PASSWORD: password
-          MYSQL_DATABASE: phalcon
+          MYSQL_DATABASE: vokuro
         ports:
           - 3306/tcp
         options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
@@ -32,8 +32,6 @@ jobs:
       fail-fast: false
       matrix:
         php-versions: ['7.2', '7.3', '7.4']
-        # For phalcon 3.x, use
-        # php-versions: ['7.0', '7.1', '7.2', '7.3']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -43,7 +41,7 @@ jobs:
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php-versions }}
-          # Use phalcon3 for the phalcon 3.x.
+          # Use phalcon4 for the latest compatible Vokuro sample release.
           extensions: mbstring, dom, zip, phalcon4, mysql
           coverage: xdebug
 
@@ -73,7 +71,6 @@ jobs:
 
       - name: Run Migration
         run: |
-          if [ ! -e phinx.yml ]; then vendor/bin/phinx init; fi
           vendor/bin/phinx migrate
           vendor/bin/phinx seed:run
         env:

examples/phalcon-postgres.yml

@@ -11,21 +11,18 @@ jobs:
     env:
       DB_ADAPTER: pgsql
       DB_HOST: 127.0.0.1
-      DB_NAME: postgres
+      DB_NAME: vokuro
       DB_USERNAME: postgres
       DB_PASSWORD: postgres
       CODECEPTION_URL: 127.0.0.1
       CODECEPTION_PORT: 8888
-      DB_CONNECTION: pgsql
-
-    # Docs: https://docs.github.com/en/actions/using-containerized-services
     services:
       postgres:
         image: postgres:latest
         env:
           POSTGRES_USER: postgres
           POSTGRES_PASSWORD: postgres
-          POSTGRES_DB: postgres
+          POSTGRES_DB: vokuro
         ports:
           - 5432/tcp
         options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 3
@@ -33,8 +30,6 @@ jobs:
       fail-fast: false
       matrix:
         php-versions: ['7.2', '7.3', '7.4']
-        # For phalcon 3.x, use
-        # php-versions: ['7.0', '7.1', '7.2', '7.3']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -44,40 +39,39 @@ jobs:
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php-versions }}
-          # Use phalcon3 for the phalcon 3.x
           extensions: mbstring, dom, zip, phalcon4, pgsql
           coverage: xdebug
 
-      # Local PostgreSQL service in GitHub hosted environments is disabled by default.
-      # If you are using it instead of service containers, make sure you start it.
-      # - name: Start postgresql service
-      #   run: sudo systemctl start postgresql.service
-
       - name: Get composer cache directory
         id: composer-cache
         run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
       - name: Cache composer dependencies
         uses: actions/cache@v5
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
-          # Use composer.json for key, if composer.lock is not committed.
-          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
           restore-keys: ${{ runner.os }}-composer-
+
       - name: Install Composer dependencies
-        run: composer install --no-progress --prefer-dist --optimize-autoloader
+        run: composer install --no-progress --prefer-dist --optimize-autoloader --no-security-blocking
+
       - name: Prepare the application
-        run: php -r "file_exists('.env') || copy('.env.example', '.env');"
+        run: |
+          php -r "file_exists('.env') || copy('.env.example', '.env');"
+          mkdir -p var/cache/acl var/cache/metaData var/cache/session var/cache/volt var/logs
+          chmod -R 777 var/cache var/logs
+
       - name: Run Migration
         run: |
-          if [ ! -e phinx.yml ]; then vendor/bin/phinx init; fi
           vendor/bin/phinx migrate
           vendor/bin/phinx seed:run
         env:
           DB_PORT: ${{ job.services.postgres.ports['5432'] }}
+
       - name: Run Tests
         run: |
-          (cd public && nohup php -S $CODECEPTION_URL:$CODECEPTION_PORT > phalcon.log 2>&1 &)
+          (cd public && nohup php -S $CODECEPTION_URL:$CODECEPTION_PORT > vokuro.log 2>&1 &)
           vendor/bin/codecept build
           vendor/bin/codecept run
         env:

examples/sage.yml

@@ -8,8 +8,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php-versions: ['7.4', '8.0', '8.1']
-        node-versions: ['16']
+        php-versions: ['8.3', '8.4', '8.5']
+        node-versions: ['20']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -53,17 +53,10 @@ jobs:
           restore-keys: ${{ runner.os }}-composer-
 
       - name: Install yarn dependencies
-        run: yarn -V
+        run: yarn install --frozen-lockfile --non-interactive
 
       - name: Install Composer dependencies
         run: composer install --no-progress --prefer-dist --optimize-autoloader
 
-      - name: Yarn test and build
-        run: |
-          yarn run test
-          yarn run build
-          yarn run rmdist
-          yarn run "build:production"
-
-      - name: PHP test
-        run: composer test
+      - name: Yarn build
+        run: yarn build

examples/slim-framework.yml

@@ -6,7 +6,7 @@ jobs:
     strategy:
       matrix:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
     runs-on: ${{ matrix.operating-system }}
     steps:
       - name: Checkout
@@ -22,6 +22,7 @@ jobs:
 
       - name: Get composer cache directory
         id: composer-cache
+        shell: bash
         run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Cache composer dependencies

examples/symfony-mysql.yml

@@ -5,11 +5,13 @@ jobs:
   symfony:
     name: Symfony (PHP ${{ matrix.php-versions }})
     runs-on: ubuntu-latest
+    env:
+      APP_ENV: test
 
     # Docs: https://docs.github.com/en/actions/using-containerized-services
     services:
       mysql:
-        image: mysql:latest
+        image: mysql:8.4
         env:
           MYSQL_ALLOW_EMPTY_PASSWORD: false
           MYSQL_ROOT_PASSWORD: symfony
@@ -20,7 +22,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.4', '8.5', '8.6']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -30,7 +32,6 @@ jobs:
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php-versions }}
-          tools: phpunit-bridge
           extensions: mbstring, xml, ctype, iconv, intl, pdo_sqlite, mysql
           coverage: xdebug
 
@@ -53,18 +54,17 @@ jobs:
           restore-keys: ${{ runner.os }}-composer-
 
       - name: Install Composer dependencies
-        run: composer install --no-progress --prefer-dist --optimize-autoloader
+        run: composer install --no-interaction --no-progress --prefer-dist --optimize-autoloader
 
-      - name: Run Migration
+      - name: Prepare database
         run: |
-          composer require --dev symfony/orm-pack
-          php bin/console doctrine:schema:update --force || echo "No migrations found or schema update failed"
-          php bin/console doctrine:migrations:migrate || echo "No migrations found or migration failed"
+          php bin/console doctrine:database:create --if-not-exists --no-interaction
+          php bin/console doctrine:schema:create --no-interaction
+          php bin/console doctrine:fixtures:load --no-interaction
         env:
-          DATABASE_URL: mysql://root:symfony@127.0.0.1:${{ job.services.mysql.ports['3306'] }}/symfony
-
-      - name: Install PHPUnit
-        run: simple-phpunit install
+          DATABASE_URL: mysql://root:symfony@127.0.0.1:${{ job.services.mysql.ports['3306'] }}/symfony?serverVersion=8.4&charset=utf8mb4
 
       - name: Run tests
-        run: simple-phpunit --coverage-text
+        run: php bin/phpunit --coverage-text
+        env:
+          DATABASE_URL: mysql://root:symfony@127.0.0.1:${{ job.services.mysql.ports['3306'] }}/symfony?serverVersion=8.4&charset=utf8mb4

examples/symfony-postgres.yml

@@ -5,11 +5,13 @@ jobs:
   symfony:
     name: Symfony (PHP ${{ matrix.php-versions }})
     runs-on: ubuntu-latest
+    env:
+      APP_ENV: test
 
     # Docs: https://docs.github.com/en/actions/using-containerized-services
     services:
       postgres:
-        image: postgres:latest
+        image: postgres:16
         env:
           POSTGRES_USER: postgres
           POSTGRES_PASSWORD: postgres
@@ -20,7 +22,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.4', '8.5', '8.6']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -30,8 +32,7 @@ jobs:
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php-versions }}
-          tools: phpunit-bridge
-          extensions: mbstring, xml, ctype, iconv, intl, pdo_sqlite, pgsql
+          extensions: mbstring, xml, ctype, iconv, intl, pdo_pgsql, pgsql
           coverage: xdebug
 
       # Local PostgreSQL service in GitHub hosted environments is disabled by default.
@@ -55,16 +56,15 @@ jobs:
       - name: Install Composer dependencies
         run: composer install --no-progress --prefer-dist --optimize-autoloader
 
-      - name: Run Migration
+      - name: Prepare database
         run: |
-          composer require --dev symfony/orm-pack
-          php bin/console doctrine:schema:update --force || echo "No migrations found or schema update failed"
-          php bin/console doctrine:migrations:migrate || echo "No migrations found or migration failed"
+          php bin/console doctrine:database:create --if-not-exists --no-interaction
+          php bin/console doctrine:schema:create --no-interaction
+          php bin/console doctrine:fixtures:load --no-interaction
         env:
-          DATABASE_URL: postgres://postgres:postgres@127.0.0.1:${{ job.services.postgres.ports[5432] }}/postgres?charset=UTF-8
-
-      - name: Install PHPUnit
-        run: simple-phpunit install
+          DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:${{ job.services.postgres.ports[5432] }}/postgres?serverVersion=16.0.0&charset=utf8
 
       - name: Run tests
-        run: simple-phpunit --coverage-text
+        run: php bin/phpunit --coverage-text
+        env:
+          DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:${{ job.services.postgres.ports[5432] }}/postgres?serverVersion=16.0.0&charset=utf8

examples/symfony.yml

@@ -9,7 +9,7 @@ jobs:
       fail-fast: false
       matrix:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.4', '8.5', '8.6']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -19,12 +19,12 @@ jobs:
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php-versions }}
-          tools: phpunit-bridge
-          extensions: mbstring, xml, ctype, iconv, intl, pdo_sqlite
+          extensions: mbstring, xml, ctype, iconv, intl, pdo_sqlite, zip
           coverage: xdebug
 
       - name: Get composer cache directory
         id: composer-cache
+        shell: bash
         run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Cache composer dependencies
@@ -39,8 +39,5 @@ jobs:
       - name: Install Composer dependencies
         run: composer install --no-progress --prefer-dist --optimize-autoloader
 
-      - name: Install PHPUnit
-        run: simple-phpunit install
-
       - name: Run tests
-        run: simple-phpunit --coverage-text
+        run: ./bin/phpunit --coverage-text

examples/wordpress.yml

@@ -0,0 +1,68 @@
+# GitHub Action for WordPress plugins
+# Tested with files scaffolded by wp scaffold plugin-tests --ci=github
+# Requires phpunit/phpunit and yoast/phpunit-polyfills in require-dev for vendor/bin/phpunit
+name: Testing WordPress
+on: [push, pull_request]
+jobs:
+  wordpress:
+    name: WordPress (PHP ${{ matrix.php-versions }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php-versions: ['8.3', '8.4', '8.5']
+
+    # Docs: https://docs.github.com/en/actions/using-containerized-services
+    services:
+      mysql:
+        image: mysql:latest
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: false
+          MYSQL_ROOT_PASSWORD: root
+          MYSQL_DATABASE: wordpress_test
+        ports:
+          - 3306/tcp
+        options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      # Docs: https://github.com/shivammathur/setup-php
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-versions }}
+          extensions: mbstring, xml, zip, intl, mysql
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache composer dependencies
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          # Use composer.json for key, if composer.lock is not committed.
+          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y subversion default-mysql-client
+
+      - name: Install Composer dependencies
+        run: |
+          if [ "${{ matrix.php-versions }}" = "8.3" ]; then
+            composer require --dev doctrine/instantiator:^2.0.0 --no-interaction --no-update
+            composer update doctrine/instantiator --with-all-dependencies --no-interaction --no-progress --prefer-dist --optimize-autoloader
+          else
+            composer install --no-interaction --no-progress --prefer-dist --optimize-autoloader
+          fi
+
+      - name: Install WordPress test environment
+        run: bash bin/install-wp-tests.sh wordpress_test root root 127.0.0.1:${{ job.services.mysql.ports['3306'] }} latest true
+
+      - name: Test with phpunit
+        run: vendor/bin/phpunit

examples/yii2-mysql.yml

@@ -1,86 +0,0 @@
-# GitHub Action for Yii Framework with MySQL
-name: Testing Yii2 with MySQL
-on: [push, pull_request]
-jobs:
-  yii:
-    name: Yii2 (PHP ${{ matrix.php-versions }})
-    runs-on: ubuntu-latest
-    env:
-      DB_USERNAME: root
-      DB_PASSWORD: yii
-      TEST_DB_USERNAME: root
-      TEST_DB_PASSWORD: yii
-      DB_CHARSET: utf8
-
-    # Docs: https://docs.github.com/en/actions/using-containerized-services
-    services:
-      mysql:
-        image: mysql:latest
-        env:
-          MYSQL_ALLOW_EMPTY_PASSWORD: false
-          MYSQL_ROOT_PASSWORD: yii
-          MYSQL_DATABASE: yii
-        ports:
-          - 3306/tcp
-        options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
-    strategy:
-      fail-fast: false
-      matrix:
-        php-versions: ['7.4', '8.0']
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Set Node.js 10.x
-        uses: actions/setup-node@v5
-        with:
-          node-version: 10.x
-
-      # Docs: https://github.com/shivammathur/setup-php
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php-versions }}
-          extensions: mbstring, intl, gd, imagick, zip, dom, mysql
-          coverage: xdebug
-
-      # Local MySQL service in GitHub hosted environments is disabled by default.
-      # If you are using it instead of service containers, make sure you start it.
-      # - name: Start mysql service
-      #   run: sudo systemctl start mysql.service
-
-      - name: Get composer cache directory
-        id: composer-cache
-        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
-
-      - name: Cache composer dependencies
-        uses: actions/cache@v5
-        with:
-          path: ${{ steps.composer-cache.outputs.dir }}
-          # Use composer.json for key, if composer.lock is not committed.
-          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
-          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
-          restore-keys: ${{ runner.os }}-composer-
-
-      - name: Install Composer dependencies
-        run: composer install --no-progress --prefer-dist --optimize-autoloader
-
-      - name: Prepare the application
-        run: |
-          php -r "file_exists('.env') || copy('.env.dist', '.env');"
-          php console/yii app/setup
-          npm install --development
-          npm run build
-        env:
-          DB_DSN: mysql:host=127.0.0.1;port=${{ job.services.mysql.ports['3306'] }};dbname=yii
-          TEST_DB_DSN: mysql:host=127.0.0.1;port=${{ job.services.mysql.ports['3306'] }};dbname=yii
-
-      - name: Run Tests
-        run: |
-          vendor/bin/codecept build
-          php tests/bin/yii app/setup --interactive=0
-          nohup php -S localhost:8080 > yii.log 2>&1 &
-          vendor/bin/codecept run
-        env:
-          DB_DSN: mysql:host=127.0.0.1;port=${{ job.services.mysql.ports['3306'] }};dbname=yii
-          TEST_DB_DSN: mysql:host=127.0.0.1;port=${{ job.services.mysql.ports['3306'] }};dbname=yii

examples/yii2-postgres.yml

@@ -1,86 +0,0 @@
-# GitHub Action for Yii Framework with PostgreSQL
-name: Testing Yii2 with PostgreSQL
-on: [push, pull_request]
-jobs:
-  yii:
-    name: Yii2 (PHP ${{ matrix.php-versions }})
-    runs-on: ubuntu-latest
-    env:
-      DB_USERNAME: postgres
-      DB_PASSWORD: postgres
-      TEST_DB_USERNAME: postgres
-      TEST_DB_PASSWORD: postgres
-      DB_CHARSET: utf8
-
-    # Docs: https://docs.github.com/en/actions/using-containerized-services
-    services:
-      postgres:
-        image: postgres:latest
-        env:
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: postgres
-          POSTGRES_DB: postgres
-        ports:
-          - 5432/tcp
-        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 3
-    strategy:
-      fail-fast: false
-      matrix:
-        php-versions: ['7.4', '8.0']
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Set Node.js 10.x
-        uses: actions/setup-node@v5
-        with:
-          node-version: 10.x
-
-      # Docs: https://github.com/shivammathur/setup-php
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php-versions }}
-          extensions: mbstring, intl, gd, imagick, zip, dom, pgsql
-          coverage: xdebug
-
-      # Local PostgreSQL service in GitHub hosted environments is disabled by default.
-      # If you are using it instead of service containers, make sure you start it.
-      # - name: Start postgresql service
-      #   run: sudo systemctl start postgresql.service
-
-      - name: Get composer cache directory
-        id: composer-cache
-        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
-
-      - name: Cache composer dependencies
-        uses: actions/cache@v5
-        with:
-          path: ${{ steps.composer-cache.outputs.dir }}
-          # Use composer.json for key, if composer.lock is not committed.
-          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
-          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
-          restore-keys: ${{ runner.os }}-composer-
-
-      - name: Install Composer dependencies
-        run: composer install --no-progress --prefer-dist --optimize-autoloader
-
-      - name: Prepare the application
-        run: |
-          php -r "file_exists('.env') || copy('.env.dist', '.env');"
-          php console/yii app/setup
-          npm install --development
-          npm run build
-        env:
-          DB_DSN: pgsql:host=127.0.0.1;port=${{ job.services.postgres.ports['5432'] }};dbname=postgres
-          TEST_DB_DSN: pgsql:host=127.0.0.1;port=${{ job.services.postgres.ports['5432'] }};dbname=postgres
-
-      - name: Run Tests
-        run: |
-          vendor/bin/codecept build
-          php tests/bin/yii app/setup --interactive=0
-          nohup php -S localhost:8080 > yii.log 2>&1 &
-          vendor/bin/codecept run
-        env:
-          DB_DSN: pgsql:host=127.0.0.1;port=${{ job.services.postgres.ports['5432'] }};dbname=postgres
-          TEST_DB_DSN: pgsql:host=127.0.0.1;port=${{ job.services.postgres.ports['5432'] }};dbname=postgres

examples/yii3-mysql.yml

@@ -0,0 +1,78 @@
+# GitHub Action for Yii3 web application with MySQL
+# Tested with https://github.com/yiisoft/app
+name: Testing Yii3 with MySQL
+on: [push, pull_request]
+jobs:
+  yii:
+    name: Yii3 (PHP ${{ matrix.php-versions }})
+    runs-on: ubuntu-latest
+    env:
+      APP_C3: true
+      APP_ENV: test
+      APP_DEBUG: false
+
+    # Docs: https://docs.github.com/en/actions/using-containerized-services
+    services:
+      mysql:
+        image: mysql:8.4
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: false
+          MYSQL_ROOT_PASSWORD: password
+          MYSQL_DATABASE: app
+        ports:
+          - 3306/tcp
+        options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
+    strategy:
+      fail-fast: false
+      matrix:
+        php-versions: ['8.4', '8.5']
+        # The latest yiisoft/app release resolves Symfony 8.0 packages that require PHP 8.4+.
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      # Docs: https://github.com/shivammathur/setup-php
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-versions }}
+          extensions: fileinfo, intl, pdo_mysql
+          ini-values: date.timezone='UTC', register_argc_argv=On
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache composer dependencies
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          # Use composer.json for key, if composer.lock is not committed.
+          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install Composer dependencies
+        run: composer install --no-progress --prefer-dist --optimize-autoloader
+
+      - name: Run migrations
+        run: php yii migrate:up --no-interaction
+        env:
+          DB_HOST: 127.0.0.1
+          DB_PORT: ${{ job.services.mysql.ports['3306'] }}
+          DB_NAME: app
+          DB_USERNAME: root
+          DB_PASSWORD: password
+
+      - name: Run codeception build
+        run: vendor/bin/codecept build
+
+      - name: Run tests with Codeception
+        run: vendor/bin/codecept run
+        env:
+          DB_HOST: 127.0.0.1
+          DB_PORT: ${{ job.services.mysql.ports['3306'] }}
+          DB_NAME: app
+          DB_USERNAME: root
+          DB_PASSWORD: password

examples/yii3-postgres.yml

@@ -0,0 +1,78 @@
+# GitHub Action for Yii3 web application with PostgreSQL
+# Tested with https://github.com/yiisoft/app
+name: Testing Yii3 with PostgreSQL
+on: [push, pull_request]
+jobs:
+  yii:
+    name: Yii3 (PHP ${{ matrix.php-versions }})
+    runs-on: ubuntu-latest
+    env:
+      APP_C3: true
+      APP_ENV: test
+      APP_DEBUG: false
+
+    # Docs: https://docs.github.com/en/actions/using-containerized-services
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: app
+        ports:
+          - 5432/tcp
+        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 3
+    strategy:
+      fail-fast: false
+      matrix:
+        php-versions: ['8.4', '8.5']
+        # The latest yiisoft/app release resolves Symfony 8.0 packages that require PHP 8.4+.
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      # Docs: https://github.com/shivammathur/setup-php
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-versions }}
+          extensions: fileinfo, intl, pdo_pgsql
+          ini-values: date.timezone='UTC', register_argc_argv=On
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache composer dependencies
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          # Use composer.json for key, if composer.lock is not committed.
+          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install Composer dependencies
+        run: composer install --no-progress --prefer-dist --optimize-autoloader
+
+      - name: Run migrations
+        run: php yii migrate:up --no-interaction
+        env:
+          DB_HOST: 127.0.0.1
+          DB_PORT: ${{ job.services.postgres.ports['5432'] }}
+          DB_NAME: app
+          DB_USERNAME: postgres
+          DB_PASSWORD: postgres
+
+      - name: Run codeception build
+        run: vendor/bin/codecept build
+
+      - name: Run tests with Codeception
+        run: vendor/bin/codecept run
+        env:
+          DB_HOST: 127.0.0.1
+          DB_PORT: ${{ job.services.postgres.ports['5432'] }}
+          DB_NAME: app
+          DB_USERNAME: postgres
+          DB_PASSWORD: postgres

examples/yii3.yml

@@ -0,0 +1,53 @@
+# GitHub Action for Yii3 web application
+# Tested with https://github.com/yiisoft/app
+name: Testing Yii3
+on: [push, pull_request]
+jobs:
+  yii:
+    name: Yii3 (PHP ${{ matrix.php-versions }} on ${{ matrix.operating-system }})
+    runs-on: ${{ matrix.operating-system }}
+    env:
+      APP_C3: true
+      APP_ENV: test
+      APP_DEBUG: false
+    strategy:
+      fail-fast: false
+      matrix:
+        operating-system: [ubuntu-latest, windows-latest]
+        php-versions: ['8.4', '8.5']
+        # The latest yiisoft/app release resolves Symfony 8.0 packages that require PHP 8.4+.
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      # Docs: https://github.com/shivammathur/setup-php
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-versions }}
+          extensions: fileinfo, intl
+          ini-values: date.timezone='UTC', register_argc_argv=On
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        shell: bash
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache composer dependencies
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          # Use composer.json for key, if composer.lock is not committed.
+          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install Composer dependencies
+        run: composer install --no-progress --prefer-dist --optimize-autoloader
+
+      - name: Run codeception build
+        run: vendor/bin/codecept build
+
+      - name: Run tests with Codeception
+        run: vendor/bin/codecept run

jest.config.js

@@ -5,7 +5,7 @@ module.exports = {
   testMatch: ['**/*.test.ts'],
   testRunner: 'jest-circus/runner',
   transform: {
-    '^.+\\.ts$': 'ts-jest'
+    '^.+\\.ts$': ['ts-jest', {tsconfig: 'tsconfig.test.json'}]
   },
   verbose: true,
   collectCoverage: true

package.json

@@ -1,6 +1,6 @@
 {
   "name": "setup-php",
-  "version": "2.37.0",
+  "version": "2.37.2",
   "private": false,
   "description": "Setup PHP for use with GitHub Actions",
   "main": "lib/install.js",
@@ -38,29 +38,32 @@
     "compare-versions": "^6.1.1"
   },
   "devDependencies": {
-    "@eslint/compat": "^2.0.3",
+    "@eslint/compat": "^2.1.0",
     "@eslint/js": "^10.0.1",
     "@types/jest": "^30.0.0",
-    "@types/node": "^25.5.0",
-    "@typescript-eslint/eslint-plugin": "^8.57.0",
-    "@typescript-eslint/parser": "^8.57.0",
-    "@vercel/ncc": "^0.38.4",
-    "eslint": "^10.0.3",
+    "@types/node": "^26.1.1",
+    "@typescript-eslint/eslint-plugin": "^8.65.0",
+    "@typescript-eslint/parser": "^8.65.0",
+    "@typescript/native": "npm:typescript@^7.0.2",
+    "@vercel/ncc": "^0.44.1",
+    "eslint": "^10.7.0",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-import-resolver-typescript": "^4.4.4",
-    "eslint-plugin-import-x": "^4.16.2",
-    "eslint-plugin-jest": "^29.15.0",
-    "eslint-plugin-prettier": "^5.5.5",
-    "globals": "^17.4.0",
-    "jest": "^30.3.0",
-    "jest-circus": "^30.3.0",
-    "nock": "^14.0.11",
-    "prettier": "^3.8.1",
+    "eslint-import-resolver-typescript": "^4.4.5",
+    "eslint-plugin-import-x": "^4.17.1",
+    "eslint-plugin-jest": "^29.15.5",
+    "eslint-plugin-prettier": "^5.5.6",
+    "globals": "^17.7.0",
+    "jest": "^30.4.2",
+    "jest-circus": "^30.4.2",
+    "nock": "^14.0.16",
+    "prettier": "^3.9.6",
     "simple-git-hooks": "^2.13.1",
-    "ts-jest": "^29.4.6",
-    "typescript": "^5.9.3"
+    "ts-jest": "^29.4.11",
+    "typescript": "npm:@typescript/typescript6@^6.0.2"
   },
   "overrides": {
+    "@babel/core": "^7.29.7",
+    "js-yaml": "^4.2.0",
     "test-exclude": "^7.0.1",
     "glob": "^13.0.6",
     "minimatch": "^10.2.1"
@@ -70,5 +73,10 @@
   },
   "simple-git-hooks": {
     "pre-commit": "npm run format && npm run lint && npm run test && npm run build && npm run release"
+  },
+  "allowScripts": {
+    "fsevents@2.3.3": true,
+    "simple-git-hooks@2.13.1": true,
+    "unrs-resolver@1.11.1": true
   }
 }

src/config.ts

@@ -16,7 +16,7 @@ export async function addINIValuesUnix(
   });
   return (
     'echo "' +
-    ini_values.join('\n') +
+    ini_values.map(v => utils.escapeForShell(v, 'linux')).join('\n') +
     '" | sudo tee -a "${pecl_file:-${ini_file[@]}}" >/dev/null 2>&1' +
     script
   );
@@ -37,7 +37,10 @@ export async function addINIValuesWindows(
       (await utils.addLog('$tick', line, 'Added to php.ini', 'win32')) + '\n';
   });
   return (