Preserve IBM client include flags on Ubuntu 26.04

Upgrade Node.js dependencies

.github/workflows/codeql.yml

@@ -26,13 +26,13 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
         with:
           config-file: ./.github/codeql/codeql-configuration.yml
           languages: javascript
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4

.github/workflows/node.yml

@@ -52,6 +52,9 @@ jobs:
       - name: ESLint Check
         run: npm run lint
 
+      - name: TypeScript Check
+        run: npm run typecheck
+
       - name: Run tests
         run: npm test
 

.github/workflows/publish.yml

@@ -50,9 +50,14 @@ jobs:
           npm run build
           sed -i -e '/lib\//d' .gitignore
 
+      - name: Select npm distribution tag
+        id: publish-tag
+        run: |
+          jq -r '.version | if test("alpha|beta|rc"; "i") then "tag=next" else "tag=latest" end' package.json >> "$GITHUB_OUTPUT"
+
       - name: Publish to NPM
         if: "!contains(github.event.inputs.skip, 'skip-npm')"
-        run: npm publish --access public
+        run: npm publish --access public --tag "${{ steps.publish-tag.outputs.tag }}"
 
       - name: Change to GitHub Packages registry
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
@@ -67,6 +72,6 @@ jobs:
 
       - name: Publish to GitHub Packages
         if: "!contains(github.event.inputs.skip, 'skip-github-packages')"
-        run: npm publish
+        run: npm publish --tag "${{ steps.publish-tag.outputs.tag }}"
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

README.md

@@ -68,19 +68,26 @@ Both `GitHub-hosted` and `self-hosted` runners are supported by `setup-php` on t
 
 ### GitHub-Hosted Runners
 
-| Virtual environment | Arch    | YAML workflow label                | Pre-installed PHP |
-|---------------------|---------|------------------------------------|-------------------|
-| Ubuntu 26.04        | x86_64  | `ubuntu-26.04`                     | `PHP 8.5`         |
-| Ubuntu 24.04        | x86_64  | `ubuntu-latest` or `ubuntu-24.04`  | `PHP 8.3`         |
-| Ubuntu 22.04        | x86_64  | `ubuntu-22.04`                     | `PHP 8.1`         |
-| Ubuntu 26.04        | aarch64 | `ubuntu-26.04-arm`                 | `PHP 8.5`         |
-| Ubuntu 24.04        | aarch64 | `ubuntu-24.04-arm`                 | `PHP 8.3`         |
-| Ubuntu 22.04        | aarch64 | `ubuntu-22.04-arm`                 | `PHP 8.1`         |
-| Windows Server 2025 | x64     | `windows-2025`                     | `PHP 8.5`         |
-| Windows Server 2022 | x64     | `windows-latest` or `windows-2022` | `PHP 8.5`         |
-| macOS Tahoe 26.x    | arm64   | `macos-26`                         | -                 |
-| macOS Sequoia 15.x  | arm64   | `macos-latest` or `macos-15`       | -                 |
-| macOS Sonoma 14.x   | arm64   | `macos-14`                         | -                 |
+| Virtual environment    | Arch    | YAML workflow label                                       | Pre-installed PHP |
+|------------------------|---------|-----------------------------------------------------------|-------------------|
+| Ubuntu 26.04           | x86_64  | `ubuntu-26.04`                                            | `PHP 8.5`         |
+| Ubuntu 24.04           | x86_64  | `ubuntu-latest` or `ubuntu-24.04`                         | `PHP 8.3`         |
+| Ubuntu 22.04           | x86_64  | `ubuntu-22.04`                                            | `PHP 8.1`         |
+| Ubuntu 26.04           | aarch64 | `ubuntu-26.04-arm`                                        | `PHP 8.5`         |
+| Ubuntu 24.04           | aarch64 | `ubuntu-24.04-arm`                                        | `PHP 8.3`         |
+| Ubuntu 22.04           | aarch64 | `ubuntu-22.04-arm`                                        | `PHP 8.1`         |
+| Windows Server 2025    | x64     | `windows-latest`, `windows-2025` or `windows-2025-vs2026` | `PHP 8.5`         |
+| Windows Server 2022    | x64     | `windows-2022`                                            | `PHP 8.5`         |
+| Windows 11 ARM         | arm64   | `windows-11-arm` or `windows-11-vs2026-arm`               | `PHP 8.4`         |
+| macOS Golden Gate 27.x | arm64   | `xcode-27`                                                | -                 |
+| macOS Tahoe 26.x       | arm64   | `macos-latest` or `macos-26`                              | -                 |
+| macOS Sequoia 15.x     | arm64   | `macos-15`                                                | -                 |
+| macOS Sonoma 14.x      | arm64   | `macos-14`                                                | -                 |
+| macOS Tahoe 26.x       | x86_64  | `macos-26-intel`                                          | `PHP 8.5`         |
+| macOS Sequoia 15.x     | x86_64  | `macos-15-intel`                                          | `PHP 8.5`         |
+
+> [!NOTE]
+> Support for Intel (`x86_64`) macOS runners and macOS Sonoma 14.x (`macos-14`) arm64 runners is deprecated and will be removed completely in a future release of `setup-php`. We recommend migrating to arm64-based macOS runners running macOS 15 or newer, such as `macos-26` or `macos-15`.
 
 ### Self-Hosted Runners
 
@@ -91,12 +98,11 @@ Both `GitHub-hosted` and `self-hosted` runners are supported by `setup-php` on t
 | Ubuntu 22.04                     | `self-hosted` or `Linux`   |
 | Debian 13                        | `self-hosted` or `Linux`   |
 | Debian 12                        | `self-hosted` or `Linux`   |
-| Debian 11                        | `self-hosted` or `Linux`   |
 | Windows 7 and newer              | `self-hosted` or `Windows` |
 | Windows Server 2012 R2 and newer | `self-hosted` or `Windows` |
-| macOS Tahoe 26.x x86_64/arm64    | `self-hosted` or `macOS`   |
-| macOS Sequoia 15.x x86_64/arm64  | `self-hosted` or `macOS`   |
-| macOS Sonoma 14.x x86_64/arm64   | `self-hosted` or `macOS`   |
+| macOS Golden Gate 27.x arm64     | `self-hosted` or `macOS`   |
+| macOS Tahoe 26.x arm64           | `self-hosted` or `macOS`   |
+| macOS Sequoia 15.x arm64         | `self-hosted` or `macOS`   |
 
 - Refer to the [self-hosted setup](#self-hosted-setup) to use the action on self-hosted runners.
 - Operating systems based on the above Ubuntu and Debian versions are also supported on a best effort basis.
@@ -272,7 +278,7 @@ These tools can be set up globally using the `tools` input. It accepts a string
     tools: composer:2.9.8@sha256:59b2c50e10cafa0d8efc19ede9a326d782f096c674a26baf98cf042ce23de890
 ```
 
-  Checksum verification is supported for tools which are downloaded as phar archives. It is not supported for tools set up using `composer` packages or custom package scripts, specifying a checksum for these tools will result in an error. For checksum pinning to be effective, pin the tool to an exact version, as mutable versions like `latest` or `major.minor` can resolve to a different release with a different checksum.
+  Checksum verification is supported only for tools downloaded as phar archives with a full version, such as `tool:1.2.3` or `tool:1.2.3-beta1`. Specifying a checksum with an omitted version, a variable tag such as `latest`, `stable`, `preview` or `snapshot`, or a partial version such as `2`, `2.x`, `2.9` or `2.9.x` results in an error. These versions can resolve to different releases with different checksums. Checksum verification is not supported for tools set up using `composer` packages or custom package scripts; specifying a checksum for these tools also results in an error.
 
 - The latest stable version of `composer` is set up by default. You can set up the required `composer` version by specifying the major version `v1` or `v2`, or the version in `major.minor` or `semver` format. Additionally, for composer `snapshot` and `preview` can also be specified to set up the respective releases.
 
@@ -1071,7 +1077,7 @@ Many users and organizations support setup-php via [GitHub Sponsors](https://git
 
 <a href="https://github.com/sponsors/shivammathur"><img src="https://setup-php.com/sponsors.svg?" alt="Sponsor shivammathur"></a>
 
-- If you use setup-php, please consider starring the project and sharing it. 
+- If you use setup-php, please consider starring the project and sharing it.
 - If you blog, please share your experience of using `setup-php`.
 - Please [reach out](mailto:contact@setup-php.com) if you have any questions about sponsoring setup-php.
 

__tests__/tools.test.ts

@@ -222,20 +222,21 @@ describe('Tools tests', () => {
   });
 
   it.each`
-    release                                      | expected_release    | checksum                       | error
-    ${'tool:1.2.3'}                              | ${'tool:1.2.3'}     | ${undefined}                   | ${undefined}
-    ${'tool:1.2.3@sha256:' + 'a'.repeat(64)}     | ${'tool:1.2.3'}     | ${'sha256:' + 'a'.repeat(64)}  | ${undefined}
-    ${'tool:1.2.3@sha256:' + 'A'.repeat(64)}     | ${'tool:1.2.3'}     | ${'sha256:' + 'a'.repeat(64)}  | ${undefined}
-    ${'tool:1.2.3@SHA256:' + 'a'.repeat(64)}     | ${'tool:1.2.3'}     | ${'sha256:' + 'a'.repeat(64)}  | ${undefined}
-    ${'tool:1.2.3@sha512:' + 'b'.repeat(128)}    | ${'tool:1.2.3'}     | ${'sha512:' + 'b'.repeat(128)} | ${undefined}
-    ${'composer:2.9.8@sha256:' + 'c'.repeat(64)} | ${'composer:2.9.8'} | ${'sha256:' + 'c'.repeat(64)}  | ${undefined}
-    ${'tool:1.2.3@sha256:xyz'}                   | ${'tool:1.2.3'}     | ${undefined}                   | ${'Invalid sha256 checksum, expected 64 hexadecimal characters'}
-    ${'tool:1.2.3@sha256:' + 'a'.repeat(63)}     | ${'tool:1.2.3'}     | ${undefined}                   | ${'Invalid sha256 checksum, expected 64 hexadecimal characters'}
-    ${'tool:1.2.3@sha512:' + 'b'.repeat(64)}     | ${'tool:1.2.3'}     | ${undefined}                   | ${'Invalid sha512 checksum, expected 128 hexadecimal characters'}
-    ${'tool:1.2.3@sha384:' + 'b'.repeat(96)}     | ${'tool:1.2.3'}     | ${undefined}                   | ${'Unsupported checksum algorithm sha384, expected sha256 or sha512'}
-    ${'tool:1.2.3@md5:' + 'b'.repeat(32)}        | ${'tool:1.2.3'}     | ${undefined}                   | ${'Unsupported checksum algorithm md5, expected sha256 or sha512'}
-    ${'tool:1.2.3@sha256' + 'a'.repeat(64)}      | ${'tool:1.2.3'}     | ${undefined}                   | ${'Invalid checksum syntax, expected @sha256:<hash> or @sha512:<hash>'}
-    ${'tool:1.0@dev'}                            | ${'tool:1.0@dev'}   | ${undefined}                   | ${undefined}
+    release                                                  | expected_release                | checksum                       | error
+    ${'tool:1.2.3'}                                          | ${'tool:1.2.3'}                 | ${undefined}                   | ${undefined}
+    ${'tool:1.2.3@sha256:' + 'a'.repeat(64)}                 | ${'tool:1.2.3'}                 | ${'sha256:' + 'a'.repeat(64)}  | ${undefined}
+    ${'tool:1.2.3@sha256:' + 'A'.repeat(64)}                 | ${'tool:1.2.3'}                 | ${'sha256:' + 'a'.repeat(64)}  | ${undefined}
+    ${'tool:1.2.3@SHA256:' + 'a'.repeat(64)}                 | ${'tool:1.2.3'}                 | ${'sha256:' + 'a'.repeat(64)}  | ${undefined}
+    ${'tool:1.2.3@sha512:' + 'b'.repeat(128)}                | ${'tool:1.2.3'}                 | ${'sha512:' + 'b'.repeat(128)} | ${undefined}
+    ${'tool:v1.2.3-beta.1+build.2@sha256:' + 'a'.repeat(64)} | ${'tool:v1.2.3-beta.1+build.2'} | ${'sha256:' + 'a'.repeat(64)}  | ${undefined}
+    ${'composer:2.9.8@sha256:' + 'c'.repeat(64)}             | ${'composer:2.9.8'}             | ${'sha256:' + 'c'.repeat(64)}  | ${undefined}
+    ${'tool:1.2.3@sha256:xyz'}                               | ${'tool:1.2.3'}                 | ${undefined}                   | ${'Invalid sha256 checksum, expected 64 hexadecimal characters'}
+    ${'tool:1.2.3@sha256:' + 'a'.repeat(63)}                 | ${'tool:1.2.3'}                 | ${undefined}                   | ${'Invalid sha256 checksum, expected 64 hexadecimal characters'}
+    ${'tool:1.2.3@sha512:' + 'b'.repeat(64)}                 | ${'tool:1.2.3'}                 | ${undefined}                   | ${'Invalid sha512 checksum, expected 128 hexadecimal characters'}
+    ${'tool:1.2.3@sha384:' + 'b'.repeat(96)}                 | ${'tool:1.2.3'}                 | ${undefined}                   | ${'Unsupported checksum algorithm sha384, expected sha256 or sha512'}
+    ${'tool:1.2.3@md5:' + 'b'.repeat(32)}                    | ${'tool:1.2.3'}                 | ${undefined}                   | ${'Unsupported checksum algorithm md5, expected sha256 or sha512'}
+    ${'tool:1.2.3@sha256' + 'a'.repeat(64)}                  | ${'tool:1.2.3'}                 | ${undefined}                   | ${'Invalid checksum syntax, expected @sha256:<hash> or @sha512:<hash>'}
+    ${'tool:1.0@dev'}                                        | ${'tool:1.0@dev'}               | ${undefined}                   | ${undefined}
   `(
     'checking extractChecksum: $release',
     ({release, expected_release, checksum, error}) => {
@@ -836,7 +837,7 @@ describe('Tools tests', () => {
     ${'cs2pr:1.2.3@sha256:' + 'd'.repeat(64)}    | ${'linux'}  | ${'add_tool https://github.com/staabm/annotate-pull-request-from-checkstyle/releases/download/1.2.3/cs2pr cs2pr "-V" sha256:' + 'd'.repeat(64)}
     ${'phive:0.15.3@sha512:' + 'c'.repeat(128)}  | ${'darwin'} | ${'add_tool https://github.com/phar-io/phive/releases/download/0.15.3/phive-0.15.3.phar phive "status" sha512:' + 'c'.repeat(128)}
     ${'phinx:1.2.3@sha256:' + 'a'.repeat(64)}    | ${'linux'}  | ${'add_log "$cross" "phinx" "Checksum verification is not supported for phinx"'}
-    ${'pecl@sha256:' + 'a'.repeat(64)}           | ${'linux'}  | ${'add_log "$cross" "pecl" "Checksum verification is not supported for pecl"'}
+    ${'pecl:1.2.3@sha256:' + 'a'.repeat(64)}     | ${'linux'}  | ${'add_log "$cross" "pecl" "Checksum verification is not supported for pecl"'}
     ${'phpunit:9.5.0@sha256:invalid'}            | ${'linux'}  | ${'add_log "$cross" "phpunit" "Invalid sha256 checksum, expected 64 hexadecimal characters"'}
     ${'composer:2.9.8@SHA256:' + 'b'.repeat(64)} | ${'linux'}  | ${'composer 2.9.8 sha256:' + 'b'.repeat(64)}
     ${'composer:2.9.8@sha384:' + 'b'.repeat(96)} | ${'linux'}  | ${'add_log "$cross" "composer" "Unsupported checksum algorithm sha384, expected sha256 or sha512"'}
@@ -849,6 +850,63 @@ describe('Tools tests', () => {
     }
   );
 
+  describe.each(['linux', 'darwin', 'win32'])(
+    'Checksum version requirements on %s',
+    os => {
+      it.each(['2.9.8+build.1', '2.9.8-rc.1', '2.9.8-rc.1+build.2'])(
+        'preserves the exact Composer version and checksum for %s',
+        async version => {
+          const checksum = 'sha256:' + 'a'.repeat(64);
+          const release = `composer:${version}@${checksum}`;
+          expect(await tools.filterList([release])).toEqual([release]);
+          const script = await tools.addTools(release, '8.4', os);
+          expect(script).toContain(
+            `https://github.com/composer/composer/releases/download/${version}/composer.phar`
+          );
+          expect(script).toContain(
+            `https://getcomposer.org/download/${version}/composer.phar`
+          );
+          expect(script).toContain(`composer ${version} ${checksum}`);
+          expect(script).not.toContain('latest');
+          expect(script).not.toContain('composer-stable.phar');
+        }
+      );
+
+      it.each([
+        '',
+        ':latest',
+        ':stable',
+        ':preview',
+        ':snapshot',
+        ':2',
+        ':2.x',
+        ':2.9',
+        ':2.9.x',
+        ':^2.9.8'
+      ])(
+        'rejects a checksum on a non-full version %s without an unpinned install',
+        async version => {
+          for (const tool of ['composer', 'phpunit']) {
+            const release = `${tool}${version}@sha256:${'a'.repeat(64)}`;
+            const data = await tools.getData(release, '8.4', os);
+            expect(data.error).toBe(
+              'Checksum pinning requires a full version, for example tool:1.2.3'
+            );
+            expect(data.url).toBe('');
+            const script = await tools.addTools(release, '8.4', os);
+            expect(script).toContain(data.error);
+            const installations = script
+              .split('\n')
+              .filter(line => /^add[-_]tool /i.test(line));
+            expect(
+              installations.some(line => new RegExp(` ${tool}( |$)`).test(line))
+            ).toBe(false);
+          }
+        }
+      );
+    }
+  );
+
   it.each`
     type                 | tool_function  | supported
     ${'phar'}            | ${undefined}   | ${true}

__tests__/utils.test.ts

@@ -56,12 +56,17 @@ describe('Utils tests', () => {
     await expect(utils.parseVersion('foo')).rejects.toThrow(
       'Invalid PHP version:'
     );
-
-    fetchSpy.mockResolvedValue({data: '{ "latest": "8.1.0" }'});
-    await expect(utils.parseVersion('latest')).rejects.toThrow(
-      'Invalid PHP version in manifest:'
+    await expect(utils.parseVersion('8.4\n$(id)')).rejects.toThrow(
+      'Invalid PHP version:'
     );
 
+    for (const latest of ['8.1.0', 'pre', 8.4, ['8.4']]) {
+      fetchSpy.mockResolvedValue({data: JSON.stringify({latest})});
+      await expect(utils.parseVersion('latest')).rejects.toThrow(
+        'Invalid PHP version in manifest:'
+      );
+    }
+
     fetchSpy.mockReset();
     fetchSpy.mockResolvedValueOnce({}).mockResolvedValueOnce({});
     await expect(utils.parseVersion('latest')).rejects.toThrow(
@@ -334,8 +339,30 @@ describe('Utils tests', () => {
     readFileSync.mockReturnValue('ruby 1.2.3\nphp 8.4.2\nnode 20.1.2');
     expect(await utils.readPHPVersion()).toBe('8.4.2');
 
+    readFileSync.mockReturnValue('ruby 1.2.3\nphp 8.4\nnode 20.1.2');
+    expect(await utils.readPHPVersion()).toBe('8.4');
+
+    readFileSync.mockReturnValue('ruby 1.2.3\nphp latest\nnode 20.1.2');
+    expect(await utils.readPHPVersion()).toBe('latest');
+
+    readFileSync.mockReturnValue(' \t8.4 \t\n');
+    expect(await utils.readPHPVersion()).toBe('8.4');
+
+    readFileSync.mockReturnValue(
+      '#PHP\r\n\r\nruby 1.2.3\r\n \tphp \t latest \t# version\r\nnode 20.1.2'
+    );
+    expect(await utils.readPHPVersion()).toBe('latest');
+
+    readFileSync.mockReturnValue('php\n8.4');
+    await expect(utils.readPHPVersion()).rejects.toThrow('Invalid PHP version');
+
+    process.env['php-version-file'] = '.tool-versions';
+    readFileSync.mockReturnValue("ruby 1.2.3\nphp 8.4';id;#\nnode 20.1.2");
+    await expect(utils.readPHPVersion()).rejects.toThrow('.tool-versions');
+    delete process.env['php-version-file'];
+
     existsSync.mockReturnValue(true);
-    readFileSync.mockReturnValue('setup-php');
+    readFileSync.mockReturnValue('php 8.4 8.5');
     await expect(utils.readPHPVersion()).rejects.toThrow('Invalid PHP version');
 
     existsSync.mockReturnValueOnce(false).mockReturnValueOnce(true);
@@ -361,29 +388,44 @@ describe('Utils tests', () => {
     const existsSync = jest.spyOn(fs, 'existsSync').mockImplementation();
     const readFileSync = jest.spyOn(fs, 'readFileSync').mockImplementation();
 
-    process.env['php-version'] = 'bogus';
+    process.env['php-version'] = '$0';
     await expect(utils.readPHPVersion()).rejects.toThrow('php-version input');
     delete process.env['php-version'];
 
     existsSync.mockReturnValue(true);
-    readFileSync.mockReturnValue('bogus');
+    readFileSync.mockReturnValue(';id');
     await expect(utils.readPHPVersion()).rejects.toThrow('.php-version');
 
     existsSync.mockReturnValueOnce(false).mockReturnValueOnce(true);
-    readFileSync.mockReturnValue('{"platform-overrides":{"php":"bogus"}}');
+    readFileSync.mockReturnValue('{"platform-overrides":{"php":"`w`"}}');
     await expect(utils.readPHPVersion()).rejects.toThrow(
       'composer.lock platform-overrides.php'
     );
 
+    existsSync.mockReturnValueOnce(false).mockReturnValueOnce(true);
+    readFileSync.mockReturnValue('{"platform-overrides":{"php":8.4}}');
+    await expect(utils.readPHPVersion()).rejects.toThrow(
+      'composer.lock platform-overrides.php: number'
+    );
+
     existsSync
       .mockReturnValueOnce(false)
       .mockReturnValueOnce(false)
       .mockReturnValueOnce(true);
-    readFileSync.mockReturnValue('{"config":{"platform":{"php":"bogus"}}}');
+    readFileSync.mockReturnValue('{"config":{"platform":{"php":"8.4$(id)"}}}');
     await expect(utils.readPHPVersion()).rejects.toThrow(
       'composer.json config.platform.php'
     );
 
+    existsSync
+      .mockReturnValueOnce(false)
+      .mockReturnValueOnce(false)
+      .mockReturnValueOnce(true);
+    readFileSync.mockReturnValue('{"config":{"platform":{"php":["8.4"]}}}');
+    await expect(utils.readPHPVersion()).rejects.toThrow(
+      'composer.json config.platform.php: object'
+    );
+
     existsSync.mockClear();
     readFileSync.mockClear();
   });
@@ -458,7 +500,9 @@ describe.each(['linux', 'darwin', 'win32'])(
         const prepared = await utils.addVerbose(run, platform);
         const script = fs.readFileSync(prepared, 'utf8');
         expect(prepared !== run).toBe(enabled);
-        expect(script.includes('2>&1')).toBe(!enabled);
+        expect(
+          script.includes(platform === 'win32' ? '>$null' : '>/dev/null')
+        ).toBe(!enabled);
         expect(script.includes('src-verbose')).toBe(enabled);
         expect(script.startsWith('. ')).toBe(true);
         expect(process.env.SETUP_PHP_TRACE).toBe(
@@ -501,7 +545,9 @@ describe.each(['linux', 'darwin', 'win32'])(
             path.join(path.dirname(prepared), 'tools', path.basename(helper)),
             'utf8'
           )
-        ).toBe(`echo nested-output \n${probe}\n`);
+        ).toBe(
+          `echo nested-output ${platform === 'win32' ? '2>&1 | Out-Host' : ''}\n${probe}\n`
+        );
         expect(fs.readFileSync(helper, 'utf8')).toContain(pipe);
         const shell = platform === 'win32' ? 'pwsh' : 'bash';
         if (platform === 'win32' ? hasPwsh : process.platform !== 'win32') {
@@ -529,7 +575,9 @@ describe.each(['linux', 'darwin', 'win32'])(
         if (verbose !== undefined) process.env.verbose = verbose;
         const prepared = await utils.addVerbose(run, platform);
         expect(prepared).not.toBe(run);
-        expect(fs.readFileSync(prepared, 'utf8')).not.toContain('2>&1');
+        expect(fs.readFileSync(prepared, 'utf8')).not.toMatch(
+          />\s*(?:\/dev\/null|\$null)\s+2>&1/
+        );
         expect(process.env.SETUP_PHP_TRACE).toBe(
           /^v{2,3}$/.test(verbose || '') ? String(verbose!.length - 1) : '0'
         );
@@ -826,7 +874,9 @@ echo should-not-run
             path.join(path.dirname(first), 'tools', path.basename(helper)),
             'utf8'
           )
-        ).toBe('echo original \n');
+        ).toBe(
+          `echo original ${platform === 'win32' ? '2>&1 | Out-Host' : ''}\n`
+        );
       }
     );
   }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "setup-php",
-  "version": "2.37.2",
+  "version": "2.40.0-beta",
   "private": false,
   "description": "Setup PHP for use with GitHub Actions",
   "main": "lib/install.js",
@@ -20,6 +20,7 @@
     "format": "prettier --write **/src/*.ts **/__tests__/*.ts && git add -f __tests__/ ",
     "format-check": "prettier --check **/src/*.ts **/__tests__/*.ts",
     "release": "ncc build -m -o dist && git add -f dist/",
+    "typecheck": "tsc --project tsconfig.test.json --noEmit",
     "test": "jest"
   },
   "repository": {
@@ -38,25 +39,25 @@
     "compare-versions": "^6.1.1"
   },
   "devDependencies": {
-    "@eslint/compat": "^2.1.0",
+    "@eslint/compat": "^2.1.1",
     "@eslint/js": "^10.0.1",
     "@types/jest": "^30.0.0",
-    "@types/node": "^26.4.1",
-    "@typescript-eslint/eslint-plugin": "^8.69.0",
-    "@typescript-eslint/parser": "^8.69.0",
+    "@types/node": "^26.6.2",
+    "@typescript-eslint/eslint-plugin": "^8.70.0",
+    "@typescript-eslint/parser": "^8.70.0",
     "@typescript/native": "npm:typescript@^7.0.2",
     "@vercel/ncc": "^0.45.0",
-    "eslint": "^10.9.1",
+    "eslint": "^10.11.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-import-resolver-typescript": "^4.4.5",
     "eslint-plugin-import-x": "^4.17.1",
     "eslint-plugin-jest": "^29.16.6",
     "eslint-plugin-prettier": "^5.5.6",
     "globals": "^17.12.0",
-    "jest": "^30.5.1",
-    "jest-circus": "^30.5.1",
+    "jest": "^30.5.2",
+    "jest-circus": "^30.5.2",
     "nock": "^14.0.17",
-    "prettier": "^3.9.6",
+    "prettier": "^3.9.8",
     "simple-git-hooks": "^2.14.0",
     "ts-jest": "^29.4.12",
     "typescript": "npm:@typescript/typescript6@^6.0.2"

src/configs/mod_priority

@@ -11,6 +11,7 @@ grpc=30
 http=25
 pecl_http=25
 pecl-http=25
+ibm_db2=40
 inotify=30
 libvirt-php=40
 mailparse=25

src/scripts/darwin.sh

@@ -90,7 +90,13 @@ add_brew_extension() {
       safe_brew install --skip-link "${brew_opts[@]}" "$ext_tap/$formula@$version" >/dev/null 2>&1 &&
       brew link --overwrite --force "$formula@$version" >/dev/null 2>&1 &&
       copy_brew_extensions "$formula"
-    ) || pecl_install "$extension" >/dev/null 2>&1
+    ) || {
+      if [ -n "$expected_version" ]; then
+        pecl_install "$extension-$expected_version" || pecl_install "$extension"
+      else
+        pecl_install "$extension"
+      fi
+    } >/dev/null 2>&1
     add_extension_log "$extension" "Installed and enabled"
   fi
 }
@@ -183,6 +189,7 @@ setup_cached_versions() {
 
 # Function to setup PHP 5.6 and newer using Homebrew.
 add_php() {
+  local exit_code
   action=$1
   existing_version=$2
   suffix="$(get_php_formula_suffix)"
@@ -198,14 +205,19 @@ add_php() {
   fi
   if [[ "$existing_version" != "false" && -z "$suffix" ]]; then
     if [ "$action" = "upgrade" ]; then
-      safe_brew install --only-dependencies "$php_formula"
-      safe_brew upgrade -f --overwrite "$php_formula"
+      safe_brew install --only-dependencies "$php_formula" || return $?
+      safe_brew upgrade -f --overwrite "$php_formula" || return $?
     else
       brew unlink "$php_keg"
     fi
   else
-    safe_brew install --only-dependencies "$php_formula"
-    safe_brew install --skip-link -f --overwrite "$php_formula" 2>/dev/null || safe_brew upgrade -f --overwrite "$php_formula"
+    safe_brew install --only-dependencies "$php_formula" || return $?
+    safe_brew install --skip-link -f --overwrite "$php_formula" 2>/dev/null || {
+      exit_code=$?
+      # A timeout has exhausted its retries; do not start another build via upgrade.
+      [ "$exit_code" -ne 124 ] || return "$exit_code"
+      safe_brew upgrade -f --overwrite "$php_formula" || return $?
+    }
   fi
   brew link --force --overwrite "$php_keg" || (sudo chown -R "$(id -un)":"$(id -gn)" "$brew_prefix" && brew link --force --overwrite "$php_keg")
 }

src/scripts/extensions/add_extensions.ps1

@@ -104,16 +104,50 @@ Function Add-Extension {
     [string]
     $extension_version = ''
   )
+  $extension_backup = ''
+  $restore_startup_errors = $false
   try {
     $deps_dir = "$ext_dir\$extension-vc$($installed.VCVersion)-$arch"
     New-Item $deps_dir -Type Directory -Force > $null 2>&1
-    if($extension_version -ne '' -and (Test-Path "$ext_dir\$extension-$extension_version")) {
-      Copy-Item "$ext_dir\$extension-$extension_version" "$ext_dir\php_$extension.dll" -Force
-      Enable-Extension $extension
-      return
+    $cached = $extension_version -ne '' -and (Test-Path "$ext_dir\$extension-$extension_version")
+    $extension_info = $null
+    if(-not $cached) {
+      $extension_info = Get-PhpExtension -Path $php_dir | Where-Object { $_.Name -eq $extension -or $_.Handle -eq $extension }
     }
-    $extension_info = Get-PhpExtension -Path $php_dir | Where-Object { $_.Name -eq $extension -or $_.Handle -eq $extension }
-    if ($null -ne $extension_info -and ($extension_version -eq '' -or $extension_info.Version[0] -eq $extension_version)) {
+    # Only suppress startup errors while probing a cached DLL or replacing an installed DLL.
+    if($cached -or ($extension_version -ne '' -and $extension_info.Version -ne $extension_version -and (Test-Path "$ext_dir\php_$extension.dll"))) {
+      $startup_errors = Get-PhpIniKey -Key display_startup_errors -Path "$php_dir\php.ini"
+      if($startup_errors -notmatch '^(0|off|false|no)$') {
+        $restore_startup_errors = $true
+        Set-PhpIniKey -Key display_startup_errors -Value Off -Path "$php_dir\php.ini"
+      }
+    }
+    if($cached) {
+      # Preserve the active DLL before probing a cache entry for another PHP build.
+      if(Test-Path "$ext_dir\php_$extension.dll") {
+        $extension_info = Get-PhpExtension -Path "$ext_dir\php_$extension.dll"
+        $backup_name = if($extension_info.Version) { "$extension-$($extension_info.Version)" } else { "$extension.bak" }
+        Copy-Item "$ext_dir\php_$extension.dll" "$ext_dir\$backup_name" -Force -ErrorAction Stop
+        $extension_backup = "$ext_dir\$backup_name"
+      }
+      Copy-Item "$ext_dir\$extension-$extension_version" "$ext_dir\php_$extension.dll" -Force
+      try {
+        Enable-ExtensionDependencies $extension
+        Enable-PhpExtension -Extension $extension -Path $php_dir
+        Set-ExtensionPrerequisites $extension
+        $cached_extension = Get-PhpExtension -Path $php_dir | Where-Object { ($_.Name -eq $extension -or $_.Handle -eq $extension) -and $_.State -eq 'Enabled' }
+        if($null -ne $cached_extension) {
+          Add-Log $tick $extension "Enabled"
+          return
+        }
+      } catch {
+        Write-Verbose "Could not enable cached ${extension}: $_"
+      }
+      # A cached DLL may target another PHP build; install it again if it did not load.
+      Remove-Item "$ext_dir\php_$extension.dll" -Force
+      $extension_info = $null
+    }
+    if ($null -ne $extension_info -and ($extension_version -eq '' -or $extension_info.Version -eq $extension_version)) {
       switch ($extension_info.State) {
         'Builtin' {
           Add-Log $tick $extension "Enabled"
@@ -143,7 +177,10 @@ Function Add-Extension {
         }
         # If extension for a different version exists
         if(Test-Path $ext_dir\php_$extension.dll) {
-          Move-Item $ext_dir\php_$extension.dll $ext_dir\php_$extension.bak.dll -Force
+          # Keep backups outside PhpManager's DLL scan and reuse known versions as cache entries.
+          $backup_name = if($extension_info.Version) { "$extension-$($extension_info.Version)" } else { "$extension.bak" }
+          Move-Item $ext_dir\php_$extension.dll "$ext_dir\$backup_name" -Force -ErrorAction Stop
+          $extension_backup = "$ext_dir\$backup_name"
         }
         Install-PhpExtension @params
         Set-ExtensionPrerequisites $extension
@@ -154,7 +191,18 @@ Function Add-Extension {
       Copy-Item "$ext_dir\php_$extension.dll" "$ext_dir\$extension-$extension_version" -Force
     }
   } catch {
+    if($extension_backup -ne '') {
+      Copy-Item $extension_backup "$ext_dir\php_$extension.dll" -Force
+    }
     Add-Log $cross $extension "Could not install $extension on PHP $( $installed.FullVersion )"
+  } finally {
+    if($restore_startup_errors) {
+      if($null -eq $startup_errors) {
+        Set-PhpIniKey -Key display_startup_errors -Delete -Path "$php_dir\php.ini"
+      } else {
+        Set-PhpIniKey -Key display_startup_errors -Value $startup_errors -Path "$php_dir\php.ini"
+      }
+    }
   }
 }
 

src/scripts/extensions/add_extensions.sh

@@ -195,14 +195,15 @@ pecl_install() {
     check_extension "${extension%-*}" && return 0 || return 1;
   else
     cpu_count="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo '1')"
-    prefix_opts="$(parse_args "$extension" CONFIGURE_PREFIX_OPTS) MAKEFLAGS='-j $cpu_count'"
+    local prefix_opts=()
+    IFS=' ' read -r -a prefix_opts <<<"$(parse_args "$extension" CONFIGURE_PREFIX_OPTS)"
     suffix_opts="$(parse_args "$extension" CONFIGURE_OPTS) $(parse_args "$extension" CONFIGURE_SUFFIX_OPTS)"
     IFS=' ' read -r -a libraries <<<"$(parse_args "$extension" LIBS) $(parse_args "$extension" "$(uname -s)"_LIBS)"
     (( ${#libraries[@]} )) && add_libs "${libraries[@]}" >/dev/null 2>&1
     if [ "$version" = "5.3" ]; then
-      yes '' 2>/dev/null | sudo "$prefix_opts" pecl install -f "$extension" >/dev/null 2>&1
+      yes '' 2>/dev/null | sudo env "${prefix_opts[@]}" MAKEFLAGS="-j $cpu_count" pecl install -f "$extension" >/dev/null 2>&1
     else
-      yes '' 2>/dev/null | sudo "$prefix_opts" pecl install -f -D "$(parse_pecl_configure_options "$suffix_opts")" "$extension" >/dev/null 2>&1
+      yes '' 2>/dev/null | sudo env "${prefix_opts[@]}" MAKEFLAGS="-j $cpu_count" pecl install -f -D "$(parse_pecl_configure_options "$suffix_opts")" "$extension" >/dev/null 2>&1
     fi
     local exit_code=$?
     sudo pecl info "$extension" 2>/dev/null | grep -iq 'zend extension' && prefix=zend_extension
@@ -222,16 +223,15 @@ add_pecl_extension() {
   # Cache versioned extensions using suffixless copies in extension_dir.
   if [ -n "$pecl_version" ] && [ -e "${ext_dir:?}/$extension-$pecl_version" ]; then
     sudo cp "${ext_dir:?}/$extension-$pecl_version" "${ext_dir:?}/$extension.so"
-    enable_extension "$extension" "$prefix"
-    add_log "${tick:?}" "$extension" "Enabled"
-    return
+    sudo rm -f /tmp/php"${version:?}"_extensions
   fi
   enable_extension "$extension" "$prefix"
-  ext_version=$(php -r "echo phpversion('$extension');")
+  ext_version=$(php -d display_errors=0 -r "echo phpversion('$extension');" 2>/dev/null)
   if check_extension "$extension" && [[ -z "$pecl_version" || (-n "$pecl_version" && "${ext_version/-/}" == "$pecl_version") ]]; then
     [ -n "$pecl_version" ] && sudo cp "${ext_dir:?}/$extension.so" "${ext_dir:?}/$extension-$pecl_version" 2>/dev/null || true
     add_log "${tick:?}" "$extension" "Enabled"
   else
+    [ -n "$pecl_version" ] && sudo rm -f "${ext_dir:?}/$extension-$pecl_version"
     [ -n "$pecl_version" ] && pecl_version="-$pecl_version"
     pecl_install "$extension$pecl_version" || ( [ "${fail_fast:?}" = "false" ] && add_extension "$extension" "$(get_extension_prefix "$extension")" >/dev/null 2>&1)
     extension_version="$(php -r "echo phpversion('$extension');")"

src/scripts/extensions/couchbase.sh

@@ -7,8 +7,8 @@ add_couchbase_clibs() {
   else
     release=$(get -s -n "" "$trunk"/latest | grep -Eo -m 1 "[0-9]+\.[0-9]+\.[0-9]+" | head -n 1)
   fi
-  [ "$VERSION_ID" = "24.04" ] && vid=22.04 || vid="$VERSION_ID"
-  [ "$VERSION_CODENAME" = "noble" ] && vcn=jammy || vcn="$VERSION_CODENAME"
+  [[ "$VERSION_ID" = "24.04" || "$VERSION_ID" = "26.04" ]] && vid=22.04 || vid="$VERSION_ID"
+  [[ "$VERSION_CODENAME" = "noble" || "$VERSION_CODENAME" = "resolute" ]] && vcn=jammy || vcn="$VERSION_CODENAME"
   deb_url="$trunk/download/$release/libcouchbase-${release}_ubuntu${vid/./}_${vcn}_amd64.tar"
   get -q -n /tmp/libcouchbase.tar "$deb_url"
   if ! [ -e /tmp/libcouchbase.tar ] || ! file /tmp/libcouchbase.tar | grep -q 'tar archive'; then
@@ -22,9 +22,9 @@ add_couchbase_clibs() {
 }
 
 add_old_libssl() {
-  if [[ "$VERSION_ID" = "24.04" ]]; then
+  if [[ "$VERSION_ID" = "24.04" || "$VERSION_ID" = "26.04" ]]; then
     get -q -n /tmp/libssl.deb http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.1f-1ubuntu2_amd64.deb
-    [ -e /tmp/libssl.deb ] && sudo dpkg -i /tmp/libssl.deb || add_extension_log "couchbase" "Could not install libssl1.1"
+    ([ -e /tmp/libssl.deb ] && sudo dpkg -i /tmp/libssl.deb) || add_extension_log "couchbase" "Could not install libssl1.1"
   fi
 }
 
@@ -59,22 +59,32 @@ add_couchbase() {
       ext=$(get_couchbase_version)
     fi
     if [[ "$ext" =~ couchbase-[2-3].+ ]]; then
+      export COUCHBASE_CONFIGURE_PREFIX_OPTS="${COUCHBASE_CONFIGURE_PREFIX_OPTS:-} SED=sed CFLAGS=-Wno-error=incompatible-pointer-types"
       add_couchbase_clibs "$ext" >/dev/null 2>&1
     else
       add_couchbase_cxxlibs >/dev/null 2>&1
+      if [[ "$ext" =~ ^couchbase-4\.1\. ]]; then
+        export COUCHBASE_CONFIGURE_PREFIX_OPTS="${COUCHBASE_CONFIGURE_PREFIX_OPTS:-} COUCHBASE_CMAKE_EXTRA=-DCMAKE_POLICY_VERSION_MINIMUM=3.5"
+      fi
     fi
     enable_extension "couchbase" "extension"
     if check_extension "couchbase"; then
       add_log "${tick:?}" "couchbase" "Enabled"
     else
+      local install_method=pecl_install
       if [ "$ext" = "couchbase" ]; then
         ext="couchbase-$(get_pecl_version "couchbase" "stable")"
         n_proc="$(nproc)"
         export COUCHBASE_SUFFIX_OPTS="CMAKE_BUILD_TYPE=Release"
         export CMAKE_BUILD_PARALLEL_LEVEL="$n_proc"
+        install_method=add_extension_from_source
+      elif [[ "$ext" =~ ^couchbase-4\.1\. ]]; then
+        install_method=add_extension_from_source
+      fi
+      if [ "$install_method" = add_extension_from_source ]; then
         add_extension_from_source couchbase https://pecl.php.net couchbase couchbase "${ext##*-}" extension pecl >/dev/null 2>&1
       else
-        pecl_install "${ext}" >/dev/null 2>&1
+        "$install_method" "${ext}" >/dev/null 2>&1
       fi
       add_extension_log "couchbase" "Installed and enabled"
     fi

src/scripts/extensions/ibm.sh

@@ -35,6 +35,15 @@ get_cli_archive() {
   esac
 }
 
+# Function to add the libxml2 ABI name expected by the IBM Db2 CLI driver.
+add_ibm_libxml2_link() {
+  local libxml2
+  if ! ldconfig -p 2>/dev/null | grep -q 'libxml2\.so\.2 '; then
+    libxml2=$(ldconfig -p 2>/dev/null | awk '$1 == "libxml2.so.16" {print $NF; exit}')
+    [ -n "$libxml2" ] && sudo ln -sfn "$libxml2" "$(dirname "$libxml2")/libxml2.so.2"
+  fi
+}
+
 # Function to install IBM Db2 CLI driver.
 add_cli_driver() {
   local os arch archive url tmp libs
@@ -58,6 +67,7 @@ add_cli_driver() {
   if [ "$os" = "Linux" ]; then
     echo "$ibm_cli/lib" | sudo tee /etc/ld.so.conf.d/ibm_db2.conf >/dev/null
     sudo ldconfig
+    add_ibm_libxml2_link
   else
     libs='/usr/local/lib'
     sudo mkdir -p "$libs"
@@ -78,6 +88,7 @@ add_ibm_helper() {
     else
       configure_flag="--with-pdo-ibm=$IBM_DB_HOME"
     fi
+    read -r "${ext}_CONFIGURE_PREFIX_OPTS" <<< "SED=sed"
     read -r "${ext}_CONFIGURE_OPTS" <<< "--with-php-config=$(command -v php-config) $configure_flag"
     patch_phpize
     add_extension_from_source "$ext" https://github.com php "pecl-database-$ext" master extension get

src/scripts/extensions/oci.sh

@@ -37,6 +37,10 @@ add_client() {
     for icdir in /opt/oracle/instantclient_*; do
       sudo mv "$icdir"/* "$oracle_client"/
     done
+    if [ "$os" = "Linux" ]; then
+      client_library=$(find "$oracle_client" -maxdepth 1 -type f -name 'libclntsh.so.*.1' | sort -V | tail -n1)
+      [ -n "$client_library" ] && sudo ln -sfn "${client_library##*/}" "$oracle_client/libclntsh.so"
+    fi
     sudo mkdir -p "$libs"
     sudo ln -sf /opt/oracle/instantclient/*."$lib_ext"* "$libs"
     if [ "$os" = "Linux" ]; then
@@ -49,7 +53,13 @@ add_client() {
 add_oci_helper() {
   if ! shared_extension "$ext"; then
     status='Installed and enabled'
-    read -r "${ext}_CONFIGURE_PREFIX_OPTS" <<< "CFLAGS=-Wno-incompatible-function-pointer-types"
+    local compatibility_flag
+    if [ "$os" = "Linux" ]; then
+      compatibility_flag='-Wno-error=incompatible-pointer-types'
+    else
+      compatibility_flag='-Wno-incompatible-function-pointer-types'
+    fi
+    read -r "${ext}_CONFIGURE_PREFIX_OPTS" <<< "SED=sed CFLAGS=$compatibility_flag"
     read -r "${ext}_LINUX_LIBS" <<< "libaio-dev"
     read -r "${ext}_CONFIGURE_OPTS" <<< "--with-php-config=$(command -v php-config) --with-${ext/_/-}=instantclient,$oracle_client"
     patch_phpize

src/scripts/extensions/patches/couchbase.sh

@@ -0,0 +1,12 @@
+patch_couchbase() {
+  local operation_queue query_index_manager
+  operation_queue=src/deps/couchbase-cxx-client/core/mcbp/operation_queue.cxx
+  query_index_manager=src/deps/couchbase-cxx-client/core/impl/query_index_manager.cxx
+  if [ -e "$operation_queue" ] && ! grep -q '^#include <algorithm>' "$operation_queue"; then
+    sed -i.bak '/^#include <memory>/i#include <algorithm>' "$operation_queue"
+  fi
+  if [ -e "$query_index_manager" ] && ! grep -q '^#include <algorithm>' "$query_index_manager"; then
+    sed -i.bak '/^#include <utility>/i#include <algorithm>' "$query_index_manager"
+  fi
+  rm -f "$operation_queue.bak" "$query_index_manager.bak"
+}

src/scripts/extensions/relay.sh

@@ -35,7 +35,7 @@ get_openssl_suffix() {
 # Change library paths in relay binary.
 change_library_paths() {
   if [ "$os" = "Darwin" ]; then
-    otool -L "${ext_dir:?}"/relay.so | grep -q 'ssl.1' && openssl_version='1.1' || openssl_version='3'
+    otool -L "${ext_dir:?}"/relay.so | grep -q 'ssl.3.' && openssl_version='3' || openssl_version='1.1'
     [ -e "${brew_prefix:?}"/opt/openssl@"$openssl_version" ] || {
       safe_brew install --skip-link openssl@"$openssl_version" &&
       brew link --overwrite --force openssl@"$openssl_version"

src/scripts/tools/add_tools.ps1

@@ -224,7 +224,7 @@ Function Add-ToolsHelper() {
   } elseif($tool -eq "phpunit-bridge") {
     $extensions += @('dom', 'pdo', 'tokenizer', 'xmlwriter')
   } elseif($tool -eq "cloud-cli") {
-    $extensions += @('sockets')
+    $extensions += @('fileinfo', 'sockets')
     Copy-Item $env:cloud_cli_bin\cloud.bat -Destination $env:cloud_cli_bin\cloud-cli.bat
   } elseif($tool -eq "vapor-cli") {
     $extensions += @('fileinfo', 'json', 'mbstring', 'zip', 'simplexml')

src/scripts/tools/add_tools.sh

@@ -190,7 +190,7 @@ add_tools_helper() {
       sudo cp "$tool_path_dir"/phpunit "$composer_bin"
     fi
   elif [ "$tool" = "cloud-cli" ]; then
-    extensions+=(dom iconv sockets tokenizer)
+    extensions+=(dom fileinfo iconv sockets tokenizer)
     sudo ln -s "$scoped_dir"/vendor/bin/cloud "$scoped_dir"/vendor/bin/cloud-cli 2>/dev/null || true
   elif [ "$tool" = "vapor-cli" ]; then
     extensions+=(fileinfo json mbstring zip simplexml)

src/scripts/tools/brew.sh

@@ -55,25 +55,45 @@ get_file_mtime() {
   fi
 }
 
-# Function to terminate a process and its direct children.
-terminate_process_tree() {
+# Function to list descendants before their parents, including separate sessions.
+get_process_tree() {
   local pid=$1
   local children child
   children=$(pgrep -P "$pid" 2>/dev/null || true)
-  kill -TERM "$pid" >/dev/null 2>&1 || true
   for child in $children; do
-    terminate_process_tree "$child"
+    get_process_tree "$child"
+  done
+  echo "$pid"
+}
+
+# Function to detect Homebrew's source-build worker, even with buffered output.
+is_brew_building_from_source() {
+  local pid
+  for pid in $(get_process_tree "$1"); do
+    if ps -ww -p "$pid" -o command= 2>/dev/null | grep -qE '/Homebrew/build[.]rb([[:space:]]|$)'; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+# Function to terminate the entire tree captured before any parents can exit.
+terminate_process_tree() {
+  local pids pid
+  pids=$(get_process_tree "$1")
+  for pid in $pids; do
+    kill -TERM "$pid" >/dev/null 2>&1 || true
   done
   sleep 2
-  kill -KILL "$pid" >/dev/null 2>&1 || true
-  for child in $children; do
-    terminate_process_tree "$child"
+  for pid in $pids; do
+    kill -KILL "$pid" >/dev/null 2>&1 || true
   done
 }
 
 # Function to run a command with an inactivity watchdog.
 run_with_inactivity_watchdog() {
   local timeout_secs="${SETUP_PHP_BREW_INACTIVITY_TIMEOUT:-180}"
+  local source_timeout_secs="${SETUP_PHP_BREW_SOURCE_INACTIVITY_TIMEOUT:-1800}"
   local poll_secs="${SETUP_PHP_BREW_WATCHDOG_POLL:-5}"
   local tmp_dir stdout_fifo stderr_fifo stdout_log stderr_log timeout_file
   local command_pid stdout_reader_pid stderr_reader_pid monitor_pid exit_code
@@ -93,36 +113,39 @@ run_with_inactivity_watchdog() {
   ("$@" >"$stdout_fifo" 2>"$stderr_fifo") &
   command_pid=$!
 
-  (
-    while IFS= read -r line || [ -n "$line" ]; do
-      printf '%s\n' "$line"
-      printf '%s\n' "$line" >>"$stdout_log"
-    done <"$stdout_fifo"
-  ) &
+  tee "$stdout_log" <"$stdout_fifo" &
   stdout_reader_pid=$!
 
-  (
-    while IFS= read -r line || [ -n "$line" ]; do
-      printf '%s\n' "$line" >&2
-      printf '%s\n' "$line" >>"$stderr_log"
-    done <"$stderr_fifo"
-  ) &
+  tee "$stderr_log" <"$stderr_fifo" >&2 &
   stderr_reader_pid=$!
 
   (
     local last_activity current_activity current_err_activity now
+    local building_from_source=false was_building_from_source=false active_timeout_secs
     last_activity=$(get_file_mtime "$stdout_log")
     current_err_activity=$(get_file_mtime "$stderr_log")
     [ "$current_err_activity" -gt "$last_activity" ] && last_activity="$current_err_activity"
     while kill -0 "$command_pid" >/dev/null 2>&1; do
       sleep "$poll_secs"
+      kill -0 "$command_pid" >/dev/null 2>&1 || break
+      now=$(date +%s)
+      active_timeout_secs="$timeout_secs"
+      building_from_source=false
+      if is_brew_building_from_source "$command_pid"; then
+        building_from_source=true
+        active_timeout_secs="$source_timeout_secs"
+      fi
+      if [ "$building_from_source" != "$was_building_from_source" ]; then
+        last_activity="$now"
+        was_building_from_source="$building_from_source"
+      fi
       current_activity=$(get_file_mtime "$stdout_log")
       [ "$current_activity" -gt "$last_activity" ] && last_activity="$current_activity"
       current_err_activity=$(get_file_mtime "$stderr_log")
       [ "$current_err_activity" -gt "$last_activity" ] && last_activity="$current_err_activity"
       now=$(date +%s)
-      if [ $((now - last_activity)) -ge "$timeout_secs" ]; then
-        printf "\nsetup-php: brew produced no output for %ss; terminating and retrying...\n" "$timeout_secs" >&2
+      if [ $((now - last_activity)) -ge "$active_timeout_secs" ]; then
+        printf "\nsetup-php: brew produced no output for %ss; terminating...\n" "$active_timeout_secs" >&2
         : >"$timeout_file"
         terminate_process_tree "$command_pid"
         break
@@ -131,12 +154,15 @@ run_with_inactivity_watchdog() {
   ) &
   monitor_pid=$!
 
-  wait "$command_pid"
-  exit_code=$?
+  exit_code=0
+  wait "$command_pid" || exit_code=$?
+  # Let timeout cleanup finish killing source-build descendants before retrying.
+  if [ ! -e "$timeout_file" ]; then
+    kill "$monitor_pid" >/dev/null 2>&1 || true
+  fi
+  wait "$monitor_pid" 2>/dev/null || true
   wait "$stdout_reader_pid" 2>/dev/null || true
   wait "$stderr_reader_pid" 2>/dev/null || true
-  kill "$monitor_pid" >/dev/null 2>&1 || true
-  wait "$monitor_pid" 2>/dev/null || true
 
   if [ -e "$timeout_file" ]; then
     rm -rf "$tmp_dir"

src/tools.ts

@@ -118,6 +118,12 @@ export function extractChecksum(release: string): {
       error: `Invalid ${algo} checksum, expected ${hash_length} hexadecimal characters`
     };
   }
+  if (!/^[^:]+:v?\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?$/.test(release)) {
+    return {
+      release,
+      error: 'Checksum pinning requires a full version, for example tool:1.2.3'
+    };
+  }
   return {release, checksum: `${algo}:${hash}`};
 }
 
@@ -308,9 +314,14 @@ export async function filterList(tools_list: string[]): Promise<string[]> {
   const regex_any = /^composer($|:.*)/;
   const regex_valid =
     /^composer:?($|preview$|snapshot$|v?\d+(\.\d+)?$|v?\d+\.\d+\.\d+[\w-]*$)/;
-  const matches: string[] = tools_list.filter(tool =>
-    regex_valid.test(extractChecksum(tool).release)
-  );
+  const matches: string[] = tools_list.filter(tool => {
+    const parsed = extractChecksum(tool);
+    return (
+      regex_valid.test(parsed.release) ||
+      (regex_any.test(parsed.release) &&
+        (parsed.checksum !== undefined || parsed.error !== undefined))
+    );
+  });
   let composer = 'composer';
   tools_list = tools_list.filter(
     tool => !regex_any.test(extractChecksum(tool).release)
@@ -480,7 +491,7 @@ export async function addComposer(data: ToolData): Promise<string> {
     case /^1$/.test(channel):
       source_url = channel_source_url;
       break;
-    case /^\d+\.\d+\.\d+(?:-[\w-]+)?$/.test(data.version):
+    case /^\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?$/.test(data.version):
       if (skipGitHubAuthForComposerVersion(data.version)) {
         cleanComposerAuthJson();
         skip_composer_github_auth = ' true';
@@ -721,6 +732,7 @@ export async function getData(
   data.checksum = checksum_data.checksum;
   data.error = checksum_data.error;
   data.release = await getRelease(release, data);
+  if (data.error !== undefined) return data;
   data.version = version
     ? await getVersion(version, data)
     : await getLatestVersion(data);

src/utils.ts

@@ -71,15 +71,13 @@ export async function parseVersion(version: string): Promise<string> {
       for (const manifestURL of await getManifestURLS()) {
         const fetchResult = await fetch.fetch(manifestURL);
         if (fetchResult['data'] ?? false) {
-          const resolved: string | undefined = JSON.parse(fetchResult['data'])[
-            version
-          ];
+          const resolved: unknown = JSON.parse(fetchResult['data'])[version];
           if (resolved === undefined) {
             throw new Error(`Invalid PHP version: ${version.slice(0, 20)}`);
           }
-          if (!/^\d+\.\d+$/.test(resolved)) {
+          if (typeof resolved !== 'string' || !/^\d+\.\d+$/.test(resolved)) {
             throw new Error(
-              `Invalid PHP version in manifest: ${resolved.slice(0, 10)}`
+              `Invalid PHP version in manifest: ${typeof resolved === 'string' ? resolved.slice(0, 10) : typeof resolved}`
             );
           }
           return resolved;
@@ -360,7 +358,11 @@ export async function addVerbose(
     if (!file.endsWith(extension)) continue;
     const filename = path.join(scripts, file);
     const original = fs.readFileSync(filename, 'utf8');
-    let script = original.replace(pipe, '');
+    // PowerShell's success stream also carries function return values.
+    let script = original.replace(
+      pipe,
+      os === 'win32' ? '2>&1 | Out-Host' : ''
+    );
     if (filename === verbose_run) {
       script = script.replaceAll(src, dest);
     }
@@ -510,10 +512,10 @@ export async function parseExtensionSource(
 const VERSION_INPUT_REGEX =
   /^(latest|lowest|highest|nightly|master|pre|pre-installed|\d+\.x|\d+(\.\d+){0,2})$/;
 
-function validatePHPVersionInput(version: string, source: string): string {
-  if (!VERSION_INPUT_REGEX.test(version)) {
+function validatePHPVersionInput(version: unknown, source: string): string {
+  if (typeof version !== 'string' || !VERSION_INPUT_REGEX.test(version)) {
     throw new Error(
-      `Invalid PHP version in ${source}: ${version.slice(0, 20)}`
+      `Invalid PHP version in ${source}: ${typeof version === 'string' ? version.slice(0, 20) : typeof version}`
     );
   }
   return version;
@@ -531,7 +533,9 @@ export async function readPHPVersion(): Promise<string> {
     (await getInput('php-version-file', false)) || '.php-version';
   if (fs.existsSync(versionFile)) {
     const contents: string = fs.readFileSync(versionFile, 'utf8');
-    const match = contents.match(/^(?:php\s)?(\d+\.\d+\.\d+)$/m);
+    const match = contents.match(
+      /^[ \t]*(?:php[ \t]+)?([^\s#]+)[ \t]*(?:#.*)?$/m
+    );
     return validatePHPVersionInput(
       match ? match[1] : contents.trim(),
       versionFile