Fix Homebrew source build inactivity timeouts

README.md

@@ -527,6 +527,13 @@ On GitHub Actions you can assign the `setup-php` step an `id`, you can use the s
 - By default, it is set to `false`.
 - See [force update setup](#force-update-setup) for more info.
 
+#### `verbose` (optional)
+
+- Specify to enable verbose output.
+- Accepts `true`, `false`, `v`, `vv` and `vvv`.
+- By default, it is set to `false`.
+- See [verbose setup](#verbose-setup) for more info.
+
 See below for more info.
 
 ### Basic Setup
@@ -655,13 +662,19 @@ jobs:
 
 > Debug your workflow
 
-To debug any issues, you can use the `verbose` tag instead of `v2`.
+- Set the `verbose` environment variable to `true` or `v` to show command output.
+- Set `verbose` to `vv` or `vvv` to also enable `set -x` on Linux and macOS.
+- On Windows, `vv` enables `Set-PSDebug -Trace 1` and `vvv` enables `Set-PSDebug -Trace 2`.
+- Enabling [GitHub Actions debug logging](https://docs.github.com/en/actions/how-tos/monitor-workflows/enable-debug-logging) (`RUNNER_DEBUG=1`) also enables verbose mode.
+- The `verbose` and `more-verbose` tags have been deprecated and will be discontinued in the next major release.
 
 ```yaml
 - name: Setup PHP with logs
-  uses: shivammathur/setup-php@verbose
+  uses: shivammathur/setup-php@v2
   with:
     php-version: '8.5'
+  env:
+    verbose: true
 ```
 
 ### Multi-Arch Setup
@@ -995,7 +1008,7 @@ Examples of using `setup-php` with various PHP frameworks and packages.
 - Semantic release versions can also be used. It is recommended to [use dependabot](https://docs.github.com/en/github/administering-a-repository/keeping-your-actions-up-to-date-with-github-dependabot "Setup Dependabot with GitHub Actions") with semantic versioning to keep the actions in your workflows up to date.
 - Commit SHA can also be used, but is not recommended unless you set up tooling to update them with each release of the action.
 - A new major version of the action will only be tagged when there are breaking changes in the setup-php API i.e. - inputs, outputs, and environment flags.
-- For debugging any issues `verbose` tag can be used temporarily. It outputs all the logs and is also synced with the latest releases.
+- For debugging any issues, use the [`verbose` environment variable](#verbose-setup).
 - It is highly discouraged to use the `main` branch as the version, it might break your workflow after major releases as they have breaking changes.
 - If you are using the `v1` tag or a `1.x.y` version, you should [switch to v2](https://github.com/shivammathur/setup-php/wiki/Switch-to-v2 "Guide for switching from setup-php v1 to v2") as `v1` is not supported anymore.
 

__tests__/brew.test.ts

@@ -0,0 +1,317 @@
+import {spawn, spawnSync} from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+
+const brew = fs.readFileSync(
+  path.join(__dirname, '../src/scripts/tools/brew.sh'),
+  'utf8'
+);
+const describeUnix = process.platform === 'win32' ? describe.skip : describe;
+
+describeUnix('Homebrew inactivity watchdog', () => {
+  let root: string;
+  let fixture: string;
+  let buildScript: string;
+
+  const pids = () =>
+    fs.existsSync(path.join(root, 'pids'))
+      ? fs
+          .readFileSync(path.join(root, 'pids'), 'utf8')
+          .trim()
+          .split('\n')
+          .map(Number)
+      : [];
+
+  const running = (pid: number) => {
+    const result = spawnSync('ps', ['-p', String(pid), '-o', 'stat='], {
+      encoding: 'utf8'
+    });
+    return result.status === 0 && !result.stdout.trim().startsWith('Z');
+  };
+
+  const cleanup = () => {
+    for (const pid of pids().reverse()) {
+      try {
+        process.kill(pid, 'SIGKILL');
+      } catch {
+        // The watchdog may have already terminated this process.
+      }
+    }
+  };
+
+  beforeEach(() => {
+    root = fs.mkdtempSync(path.join(os.tmpdir(), 'setup-php-brew-test-'));
+    fixture = path.join(root, 'source.cjs');
+    buildScript = path.join(root, 'Homebrew', 'build.rb');
+    fs.mkdirSync(path.dirname(buildScript));
+    fs.symlinkSync(fixture, buildScript);
+    fs.writeFileSync(
+      fixture,
+      `const fs = require('fs');
+const {spawn, spawnSync} = require('child_process');
+const role = process.argv[2] || 'brew';
+const pidFile = process.env.TEST_ROOT + '/pids';
+if (role === 'brew') {
+  if (fs.existsSync(pidFile)) {
+    for (const pid of fs.readFileSync(pidFile, 'utf8').trim().split('\\n')) {
+      const state = spawnSync('ps', ['-p', pid, '-o', 'stat='], {encoding: 'utf8'});
+      if (state.status === 0 && !state.stdout.trim().startsWith('Z')) {
+        fs.appendFileSync(process.env.TEST_ROOT + '/overlap', pid + '\\n');
+      }
+    }
+  }
+  fs.appendFileSync(process.env.TEST_ROOT + '/attempts', 'attempt\\n');
+  process.stdout.write('==> make\\n');
+}
+fs.appendFileSync(pidFile, process.pid + '\\n');
+if (role === 'compiler') {
+  process.on('SIGTERM', () => {});
+  if (process.env.TEST_BUILD_DURATION) {
+    setTimeout(() => process.exit(0), Number(process.env.TEST_BUILD_DURATION));
+  }
+} else {
+  const script = role === 'brew' ? process.env.TEST_BUILD_SCRIPT : __filename;
+  const child = spawn(process.execPath, [script, role === 'brew' ? 'builder' : 'compiler'], {
+    detached: true,
+    stdio: process.env.TEST_BUILD_STDIO
+  });
+  child.on('exit', status => {
+    if (process.env.TEST_BUILD_DURATION) {
+      if (role === 'brew') fs.writeFileSync(process.env.TEST_ROOT + '/built', 'done');
+      const delay = role === 'brew' ? Number(process.env.TEST_AFTER_BUILD_DELAY || 0) : 0;
+      setTimeout(() => process.exit(status || 0), delay);
+    }
+  });
+  child.unref();
+}
+setInterval(() => {}, 1000);
+`
+    );
+  });
+
+  afterEach(() => {
+    cleanup();
+    fs.rmSync(root, {recursive: true, force: true});
+  });
+
+  const run = (script: string, env: NodeJS.ProcessEnv = {}) =>
+    new Promise<{status: number | null; stdout: string; stderr: string}>(
+      (resolve, reject) => {
+        const child = spawn('bash', ['-c', brew + '\n' + script], {
+          detached: true,
+          env: {
+            ...process.env,
+            TEST_NODE: process.execPath,
+            TEST_ROOT: root,
+            TEST_FIXTURE: fixture,
+            TEST_BUILD_SCRIPT: buildScript,
+            TEST_BUILD_STDIO: 'ignore',
+            SETUP_PHP_BREW_WATCHDOG: 'true',
+            SETUP_PHP_BREW_INACTIVITY_TIMEOUT: '1',
+            SETUP_PHP_BREW_SOURCE_INACTIVITY_TIMEOUT: '1',
+            SETUP_PHP_BREW_WATCHDOG_POLL: '0.05',
+            SETUP_PHP_BREW_RETRY_ATTEMPTS: '3',
+            ...env
+          }
+        });
+        let stdout = '';
+        let stderr = '';
+        child.stdout.on('data', data => (stdout += data));
+        child.stderr.on('data', data => (stderr += data));
+        const timer = setTimeout(() => {
+          cleanup();
+          if (child.pid) {
+            try {
+              process.kill(-child.pid, 'SIGKILL');
+            } catch {
+              // The shell may have just exited.
+            }
+          }
+          reject(new Error('Watchdog did not finish: ' + stderr));
+        }, 20000);
+        child.on('error', error => {
+          clearTimeout(timer);
+          reject(error);
+        });
+        child.on('close', status => {
+          clearTimeout(timer);
+          resolve({status, stdout, stderr});
+        });
+      }
+    );
+
+  it.each(['ignore', 'inherit'])(
+    'kills the complete source-build tree with %s stdio before returning',
+    async stdio => {
+      const result = await run(
+        'run_with_inactivity_watchdog "$TEST_NODE" "$TEST_FIXTURE"',
+        {TEST_BUILD_STDIO: stdio}
+      );
+      expect(result.status).toBe(124);
+      expect(pids()).toHaveLength(3);
+      expect(pids().filter(running)).toEqual([]);
+      expect(result.stderr).toContain('brew produced no output');
+      expect(result.stderr).not.toContain('retrying');
+    },
+    25000
+  );
+
+  it('cleans up each timed-out build before retrying, then stops at the limit', async () => {
+    const result = await run(`
+brew() { "$TEST_NODE" "$TEST_FIXTURE"; }
+sleep() { case "$1" in 5|10) return 0;; *) command sleep "$@";; esac; }
+safe_brew install php@8.4
+`);
+    expect(result.status).toBe(124);
+    expect(fs.readFileSync(path.join(root, 'attempts'), 'utf8')).toBe(
+      'attempt\nattempt\nattempt\n'
+    );
+    expect(fs.existsSync(path.join(root, 'overlap'))).toBe(false);
+    expect(pids().filter(running)).toEqual([]);
+    expect(result.stderr.match(/retrying brew command/g)).toHaveLength(2);
+    expect(result.stderr).not.toContain('attempt 4');
+  }, 25000);
+
+  it('recovers on the next attempt after cleaning up a timed-out source build', async () => {
+    const result = await run(`
+brew() {
+  if [ ! -e "$TEST_ROOT/attempts" ]; then
+    "$TEST_NODE" "$TEST_FIXTURE"
+  else
+    echo recovered
+  fi
+}
+sleep() { case "$1" in 5) return 0;; *) command sleep "$@";; esac; }
+safe_brew install php@8.4
+`);
+    expect(result.status).toBe(0);
+    expect(result.stdout).toContain('recovered\n');
+    expect(result.stderr.match(/retrying brew command/g)).toHaveLength(1);
+    expect(result.stderr).toContain('attempt 2/3, exit 124');
+    expect(pids().filter(running)).toEqual([]);
+  }, 10000);
+
+  it('retries an ordinary failure and stops after success', async () => {
+    const result = await run(`
+brew() {
+  if [ ! -e "$TEST_ROOT/failed" ]; then
+    touch "$TEST_ROOT/failed"
+    return 37
+  fi
+  printf recovered
+}
+sleep() { case "$1" in 5) return 0;; *) command sleep "$@";; esac; }
+safe_brew install php@8.4
+`);
+    expect(result.status).toBe(0);
+    expect(result.stdout).toBe('recovered');
+    expect(result.stderr.match(/retrying brew command/g)).toHaveLength(1);
+    expect(result.stderr).toContain('attempt 2/3, exit 37');
+  });
+
+  it('preserves the opt-out from the watchdog and retries', async () => {
+    const result = await run(
+      'brew() { printf disabled; return 37; }; safe_brew install php@8.4',
+      {SETUP_PHP_BREW_WATCHDOG: 'false'}
+    );
+    expect(result).toEqual({status: 37, stdout: 'disabled', stderr: ''});
+  });
+
+  it.each([0, 37])('preserves output and exit status %s', async status => {
+    const result = await run(
+      `run_with_inactivity_watchdog bash -c 'printf out; printf err >&2; exit ${status}'`
+    );
+    expect(result).toEqual({status, stdout: 'out', stderr: 'err'});
+  });
+
+  it('keeps the bottle timeout when no source build is running', async () => {
+    const result = await run(
+      'run_with_inactivity_watchdog "$TEST_NODE" -e "setTimeout(() => {}, 6000)"',
+      {SETUP_PHP_BREW_SOURCE_INACTIVITY_TIMEOUT: '4'}
+    );
+    expect(result.status).toBe(124);
+    expect(result.stderr).toContain('no output for 1s; terminating');
+  }, 10000);
+
+  it('ignores source builds outside the watched process tree', async () => {
+    const otherBuild = spawn(
+      process.execPath,
+      ['-e', 'setTimeout(() => {}, 10000)', buildScript],
+      {stdio: 'ignore'}
+    );
+    try {
+      const result = await run(
+        'run_with_inactivity_watchdog "$TEST_NODE" -e "setTimeout(() => {}, 6000)"',
+        {SETUP_PHP_BREW_SOURCE_INACTIVITY_TIMEOUT: '4'}
+      );
+      expect(result.status).toBe(124);
+      expect(result.stderr).toContain('no output for 1s; terminating');
+    } finally {
+      otherBuild.kill('SIGKILL');
+    }
+  }, 10000);
+
+  it.each(['', '4'])(
+    'allows quiet source builds past the bottle timeout with source timeout=%s',
+    async sourceTimeout => {
+      const result = await run(
+        'run_with_inactivity_watchdog "$TEST_NODE" "$TEST_FIXTURE"',
+        {
+          SETUP_PHP_BREW_SOURCE_INACTIVITY_TIMEOUT: sourceTimeout,
+          TEST_BUILD_DURATION: '2500'
+        }
+      );
+      expect(result.status).toBe(0);
+      expect(fs.existsSync(path.join(root, 'built'))).toBe(true);
+      expect(pids().filter(running)).toEqual([]);
+      expect(result.stderr).not.toContain('terminating');
+    },
+    10000
+  );
+
+  it('terminates a stalled source build at its longer timeout', async () => {
+    const result = await run(
+      'run_with_inactivity_watchdog "$TEST_NODE" "$TEST_FIXTURE"',
+      {SETUP_PHP_BREW_SOURCE_INACTIVITY_TIMEOUT: '3'}
+    );
+    expect(result.status).toBe(124);
+    expect(result.stderr).toContain('no output for 3s; terminating');
+    expect(pids().filter(running)).toEqual([]);
+  }, 10000);
+
+  it('restores the bottle timeout after the source build finishes', async () => {
+    const result = await run(
+      'run_with_inactivity_watchdog "$TEST_NODE" "$TEST_FIXTURE"',
+      {
+        SETUP_PHP_BREW_SOURCE_INACTIVITY_TIMEOUT: '4',
+        TEST_BUILD_DURATION: '2500',
+        TEST_AFTER_BUILD_DELAY: '6000'
+      }
+    );
+    expect(result.status).toBe(124);
+    expect(fs.existsSync(path.join(root, 'built'))).toBe(true);
+    expect(result.stderr).toContain('no output for 1s; terminating');
+    expect(pids().filter(running)).toEqual([]);
+  }, 10000);
+
+  it.each(['stdout', 'stderr'] as const)(
+    'counts partial output on %s as activity',
+    async stream => {
+      const result = await run(
+        `run_with_inactivity_watchdog "$TEST_NODE" -e '
+let count = 0;
+const timer = setInterval(() => {
+  process.${stream}.write(".");
+  if (++count === 25) clearInterval(timer);
+}, 100);
+'`,
+        {SETUP_PHP_BREW_INACTIVITY_TIMEOUT: '2'}
+      );
+      expect(result.status).toBe(0);
+      expect(result[stream]).toBe('.'.repeat(25));
+      expect(result.stderr).not.toContain('terminating');
+    },
+    10000
+  );
+});

__tests__/darwin.test.ts

@@ -0,0 +1,151 @@
+import {spawnSync} from 'child_process';
+import fs from 'fs';
+import path from 'path';
+
+const darwin = fs
+  .readFileSync(path.join(__dirname, '../src/scripts/darwin.sh'), 'utf8')
+  .split('\n# Variables\n')[0];
+const describeUnix = process.platform === 'win32' ? describe.skip : describe;
+
+describeUnix('macOS PHP installation', () => {
+  const run = (env: NodeJS.ProcessEnv) =>
+    spawnSync(
+      'bash',
+      [
+        '-c',
+        `${darwin}
+uname() { echo "$TEST_ARCH"; }
+setup_cached_versions() { echo cache; return "$TEST_CACHE_STATUS"; }
+update_dependencies() { echo update; }
+add_brew_tap() { echo tap; }
+safe_brew() {
+  echo "brew $*"
+  case "$*" in
+    *--only-dependencies*) return "$TEST_DEPENDENCY_STATUS";;
+    install*) return "$TEST_INSTALL_STATUS";;
+    upgrade*) return "$TEST_UPGRADE_STATUS";;
+  esac
+}
+brew() { echo "brew $*"; }
+add_php "$TEST_ACTION" "$TEST_EXISTING_VERSION"
+`
+      ],
+      {
+        encoding: 'utf8',
+        timeout: 5000,
+        env: {
+          ...process.env,
+          TEST_ARCH: 'arm64',
+          TEST_ACTION: 'install',
+          TEST_EXISTING_VERSION: 'false',
+          TEST_CACHE_STATUS: '0',
+          TEST_DEPENDENCY_STATUS: '0',
+          TEST_INSTALL_STATUS: '0',
+          TEST_UPGRADE_STATUS: '0',
+          version: '8.4',
+          debug: 'none',
+          ts: 'nts',
+          runner: 'github',
+          use_package_cache: 'true',
+          php_tap: 'shivammathur/homebrew-php',
+          ...env
+        }
+      }
+    );
+
+  it.each([
+    ['arm64', '0', false, 0],
+    ['arm64', '37', true, 0],
+    ['x86_64', '0', false, 0],
+    ['x86_64', '37', false, 1]
+  ])(
+    'preserves the cache fallback on %s with cache status %s',
+    (arch, cacheStatus, fallback, status) => {
+      const result = run({TEST_ARCH: arch, TEST_CACHE_STATUS: cacheStatus});
+      expect(result.error).toBeUndefined();
+      expect(result.stderr).toBe('');
+      expect(result.status).toBe(status);
+      expect(result.stdout).toContain('cache\n');
+      expect(result.stdout.includes('brew install')).toBe(fallback);
+    }
+  );
+
+  it.each([
+    ['install', '124', '0', '0', 124, 1],
+    ['install', '37', '0', '0', 37, 1],
+    ['install', '0', '124', '0', 124, 2],
+    ['install', '0', '37', '124', 124, 3],
+    ['install', '0', '37', '37', 37, 3],
+    ['upgrade', '124', '0', '0', 124, 1],
+    ['upgrade', '0', '0', '124', 124, 2],
+    ['upgrade', '0', '0', '37', 37, 2]
+  ])(
+    'stops %s after failures (dependencies=%s, install=%s, upgrade=%s)',
+    (action, dependencyStatus, installStatus, upgradeStatus, status, calls) => {
+      const result = run({
+        TEST_ACTION: action,
+        TEST_EXISTING_VERSION: action === 'upgrade' ? '8.4.10' : 'false',
+        TEST_CACHE_STATUS: '37',
+        TEST_DEPENDENCY_STATUS: dependencyStatus,
+        TEST_INSTALL_STATUS: installStatus,
+        TEST_UPGRADE_STATUS: upgradeStatus
+      });
+      expect(result.error).toBeUndefined();
+      expect(result.stderr).toBe('');
+      expect(result.status).toBe(status);
+      expect(result.stdout.match(/^brew /gm)).toHaveLength(calls);
+      expect(result.stdout).not.toContain('brew link');
+    }
+  );
+
+  it('retains the upgrade fallback for an install failure other than a timeout', () => {
+    const result = run({TEST_CACHE_STATUS: '37', TEST_INSTALL_STATUS: '1'});
+    expect(result.error).toBeUndefined();
+    expect(result.status).toBe(0);
+    expect(result.stdout).toContain(
+      'brew upgrade -f --overwrite shivammathur/php/php@8.4\n'
+    );
+    expect(result.stdout).toContain('brew link --force --overwrite php@8.4\n');
+  });
+
+  it('reuses an existing installation without invoking the cache or Homebrew install', () => {
+    const result = run({TEST_EXISTING_VERSION: '8.4.10'});
+    expect(result.status).toBe(0);
+    expect(result.stdout).toBe(
+      'brew unlink php@8.4\nbrew link --force --overwrite php@8.4\n'
+    );
+  });
+
+  it.each([
+    ['debug', 'nts', '-debug'],
+    ['none', 'zts', '-zts'],
+    ['debug', 'zts', '-debug-zts']
+  ])('keeps cache fallback for debug=%s, ts=%s', (debug, ts, suffix) => {
+    const result = run({
+      TEST_EXISTING_VERSION: '8.4.10',
+      TEST_CACHE_STATUS: '37',
+      debug,
+      ts
+    });
+    expect(result.status).toBe(0);
+    expect(result.stdout).toContain('cache\n');
+    expect(result.stdout).toContain(
+      `brew install --skip-link -f --overwrite shivammathur/php/php@8.4${suffix}\n`
+    );
+  });
+
+  it.each([
+    ['self-hosted', 'true'],
+    ['github', 'false']
+  ])('uses Homebrew for runner=%s, cache=%s', (runner, use_package_cache) => {
+    const result = run({runner, use_package_cache, TEST_CACHE_STATUS: '37'});
+    expect(result.error).toBeUndefined();
+    expect(result.stderr).toBe('');
+    expect(result.status).toBe(0);
+    expect(result.stdout).not.toContain('cache\n');
+    expect(result.stdout).toContain(
+      'brew install --skip-link -f --overwrite shivammathur/php/php@8.4\n'
+    );
+    expect(result.stdout).toContain('brew link --force --overwrite php@8.4\n');
+  });
+});

__tests__/utils.test.ts

@@ -1,4 +1,6 @@
 import fs from 'fs';
+import os from 'os';
+import {spawnSync} from 'child_process';
 import * as path from 'path';
 import * as utils from '../src/utils';
 import * as fetchModule from '../src/fetch';
@@ -395,3 +397,437 @@ describe('Utils tests', () => {
     expect(script).toEqual('\n$var = command\n');
   });
 });
+
+const hasPwsh =
+  spawnSync('pwsh', ['-NoProfile', '-Command', 'exit 0']).status === 0;
+const scripts = path.join(__dirname, '../src/scripts');
+const unixInit = fs.readFileSync(path.join(scripts, 'unix.sh'), 'utf8');
+const windowsSource = fs.readFileSync(path.join(scripts, 'win32.ps1'), 'utf8');
+const windowsInit = [
+  windowsSource.match(/Function Invoke-WithoutTrace[\s\S]*?\n}/)![0],
+  windowsSource.match(
+    /\$setup_php_trace = 0\r?\nif \(\$env:SETUP_PHP_TRACE[\s\S]*?\n}/
+  )![0]
+].join('\n');
+
+describe.each(['linux', 'darwin', 'win32'])(
+  'Verbose scripts on %s',
+  platform => {
+    let root: string;
+    let run: string;
+    let helper: string;
+    const env = {...process.env};
+
+    beforeEach(() => {
+      jest.restoreAllMocks();
+      root = fs.mkdtempSync(path.join(os.tmpdir(), 'setup-php-verbose-'));
+      const scripts = path.join(root, 'src', 'scripts');
+      const extension = platform === 'win32' ? '.ps1' : '.sh';
+      fs.mkdirSync(path.join(scripts, 'tools'), {recursive: true});
+      const init = path.join(scripts, 'init' + extension);
+      fs.writeFileSync(
+        init,
+        platform === 'win32'
+          ? windowsInit
+          : unixInit + '\nrunner=self-hosted read_env\n'
+      );
+      helper = path.join(scripts, 'tools', 'helper' + extension);
+      run = path.join(scripts, 'run' + extension);
+      fs.writeFileSync(helper, 'echo helper-output\n');
+      fs.writeFileSync(
+        run,
+        `. '${init}'\n. '${helper}' ${platform === 'win32' ? '>$null' : '>/dev/null'} 2>&1\n`
+      );
+      delete process.env.verbose;
+      delete process.env.VERBOSE;
+      delete process.env.RUNNER_DEBUG;
+    });
+
+    afterEach(() => {
+      process.env = {...env};
+      fs.rmSync(root, {recursive: true, force: true});
+    });
+
+    it.each([undefined, '', 'false', 'true', 'v', 'vv', 'vvv', 'invalid'])(
+      'prepares scripts for verbose=%s',
+      async verbose => {
+        if (verbose !== undefined) process.env.verbose = verbose;
+        const original = fs.readFileSync(run, 'utf8');
+        const enabled = /^(true|v{1,3})$/.test(verbose || '');
+        const tracing = /^v{2,3}$/.test(verbose || '');
+        const prepared = await utils.addVerbose(run, platform);
+        const script = fs.readFileSync(prepared, 'utf8');
+        expect(prepared !== run).toBe(enabled);
+        expect(script.includes('2>&1')).toBe(!enabled);
+        expect(script.includes('src-verbose')).toBe(enabled);
+        expect(script.startsWith('. ')).toBe(true);
+        expect(process.env.SETUP_PHP_TRACE).toBe(
+          tracing ? String(verbose!.length - 1) : '0'
+        );
+        expect(fs.readFileSync(run, 'utf8')).toBe(original);
+        if (platform === 'win32' ? hasPwsh : process.platform !== 'win32') {
+          const result = spawnSync(
+            platform === 'win32' ? 'pwsh' : 'bash',
+            platform === 'win32'
+              ? ['-NoProfile', '-File', prepared]
+              : [prepared],
+            {encoding: 'utf8', env: process.env}
+          );
+          expect(result.status).toBe(0);
+          expect(/helper-output\r?\n/.test(result.stdout)).toBe(enabled);
+          expect(
+            platform === 'win32'
+              ? result.stdout.includes('DEBUG:')
+              : result.stderr.includes('+ ')
+          ).toBe(tracing);
+        }
+      }
+    );
+
+    it.each(['', ' ', '\t'])(
+      'handles pipe spacing %j and subsequent quiet runs',
+      async space => {
+        const target = platform === 'win32' ? '$null' : '/dev/null';
+        const pipe = `>${space}${target} 2>&1`;
+        const probe =
+          platform === 'win32'
+            ? 'echo probe 2>$null'
+            : 'command -v sh >/dev/null';
+        fs.writeFileSync(helper, `echo nested-output ${pipe}\n${probe}\n`);
+        process.env.VERBOSE = 'true';
+        const prepared = await utils.addVerbose(run, platform);
+        expect(
+          fs.readFileSync(
+            path.join(path.dirname(prepared), 'tools', path.basename(helper)),
+            'utf8'
+          )
+        ).toBe(`echo nested-output \n${probe}\n`);
+        expect(fs.readFileSync(helper, 'utf8')).toContain(pipe);
+        const shell = platform === 'win32' ? 'pwsh' : 'bash';
+        if (platform === 'win32' ? hasPwsh : process.platform !== 'win32') {
+          const result = spawnSync(
+            shell,
+            platform === 'win32'
+              ? ['-NoProfile', '-File', prepared]
+              : [prepared],
+            {encoding: 'utf8', env: process.env}
+          );
+          expect(result.status).toBe(0);
+          expect(result.stdout).toMatch(/nested-output\r?\n/);
+        }
+        process.env.verbose = 'false';
+        expect(await utils.addVerbose(run, platform)).toBe(run);
+        expect(process.env.SETUP_PHP_TRACE).toBe('0');
+        expect(fs.readFileSync(helper, 'utf8')).toContain(pipe);
+      }
+    );
+
+    it.each([undefined, 'false', 'true', 'v', 'vv', 'vvv'])(
+      'enables output for runner debug with verbose=%s',
+      async verbose => {
+        process.env.RUNNER_DEBUG = '1';
+        if (verbose !== undefined) process.env.verbose = verbose;
+        const prepared = await utils.addVerbose(run, platform);
+        expect(prepared).not.toBe(run);
+        expect(fs.readFileSync(prepared, 'utf8')).not.toContain('2>&1');
+        expect(process.env.SETUP_PHP_TRACE).toBe(
+          /^v{2,3}$/.test(verbose || '') ? String(verbose!.length - 1) : '0'
+        );
+      }
+    );
+
+    it.each(['true', 'vv', 'vvv'])(
+      'protects nested sensitive calls and restores tracing for verbose=%s',
+      async verbose => {
+        const windows = platform === 'win32';
+        if (windows ? !hasPwsh : process.platform === 'win32') return;
+        process.env.verbose = verbose;
+        process.env.GITHUB_TOKEN = 'example-github-token';
+        process.env.TRACE_TEST_OUTPUT = path.join(root, 'tokens');
+        fs.writeFileSync(
+          helper,
+          windows
+            ? `$result = 0
+try {
+  Invoke-WithoutTrace {
+    Invoke-WithoutTrace {
+      $token = $env:GITHUB_TOKEN
+      Set-Content $env:TRACE_TEST_OUTPUT $token
+    }
+    $token = $env:GITHUB_TOKEN
+    Add-Content $env:TRACE_TEST_OUTPUT $token
+    if ($env:TRACE_TEST_STATUS -ne '0') { throw 'example-failure' }
+  }
+} catch {
+  if ($_.Exception.Message -ne 'example-failure') { throw }
+  $result = [int]$env:TRACE_TEST_STATUS
+}
+$after_wrapper = 'after-wrapper'
+Write-Output $after_wrapper
+Write-Output "status=$result"
+`
+            : `inner_sensitive() {
+  token="$GITHUB_TOKEN"
+  printf '%s\\n' "$token" > "$TRACE_TEST_OUTPUT"
+  return "$TRACE_TEST_STATUS"
+}
+outer_sensitive() {
+  without_trace inner_sensitive
+  local result=$?
+  token="$GITHUB_TOKEN"
+  printf '%s\\n' "$token" >> "$TRACE_TEST_OUTPUT"
+  return "$result"
+}
+without_trace outer_sensitive
+result=$?
+echo "\${token:+state-preserved}"
+echo after-wrapper
+exit "$result"
+`
+        );
+        const prepared = await utils.addVerbose(run, platform);
+        for (const status of [0, 37]) {
+          const result = spawnSync(
+            windows ? 'pwsh' : 'bash',
+            windows ? ['-NoProfile', '-File', prepared] : [prepared],
+            {
+              encoding: 'utf8',
+              env: {...process.env, TRACE_TEST_STATUS: String(status)}
+            }
+          );
+          expect(result.status).toBe(windows ? 0 : status);
+          expect(result.stdout + result.stderr).not.toContain(
+            'example-github-token'
+          );
+          expect(result.stdout).toContain('after-wrapper');
+          expect(
+            windows
+              ? /DEBUG:.*Write-Output \$after_wrapper/.test(result.stdout)
+              : result.stderr.includes('+ echo after-wrapper')
+          ).toBe(verbose !== 'true');
+          if (windows) {
+            expect(result.stdout).toContain('status=' + status);
+            expect(/DEBUG:\s+!\s+SET \$after_wrapper/.test(result.stdout)).toBe(
+              verbose === 'vvv'
+            );
+          } else {
+            expect(result.stdout).toContain('state-preserved');
+          }
+          expect(
+            fs
+              .readFileSync(process.env.TRACE_TEST_OUTPUT!, 'utf8')
+              .trim()
+              .split(/\r?\n/)
+          ).toEqual(['example-github-token', 'example-github-token']);
+        }
+      }
+    );
+
+    it.each(['true', 'vv', 'vvv'])(
+      'keeps Blackfire credentials out of traces for verbose=%s',
+      async verbose => {
+        const windows = platform === 'win32';
+        if (windows ? !hasPwsh : process.platform === 'win32') return;
+        process.env.verbose = verbose;
+        process.env.TRACE_TEST_OUTPUT = path.join(root, 'blackfire-config');
+        process.env.BLACKFIRE_SERVER_ID = 'example-blackfire-server-id';
+        process.env.BLACKFIRE_SERVER_TOKEN = 'example-blackfire-server-token';
+        process.env.BLACKFIRE_CLIENT_ID = 'example-blackfire-client-id';
+        process.env.BLACKFIRE_CLIENT_TOKEN = 'example-blackfire-client-token';
+        fs.writeFileSync(
+          helper,
+          fs.readFileSync(
+            path.join(
+              scripts,
+              'tools',
+              'blackfire' + (windows ? '.ps1' : '.sh')
+            ),
+            'utf8'
+          ) +
+            (windows
+              ? `
+function Invoke-RestMethod { @{cli='1.2.3'} }
+function Get-File {}
+function Expand-Archive {}
+function Add-ToProfile {}
+function Add-Log {}
+function blackfire { Add-Content $env:TRACE_TEST_OUTPUT ($args -join ' ') }
+$version = '8.4'
+$bin_dir = 'unused'
+Add-Blackfire
+Write-Output after-blackfire
+`
+              : `
+blackfire() { printf '%s\\n' "$@" >> "$TRACE_TEST_OUTPUT"; }
+os=Test
+blackfire_config
+echo after-blackfire
+`)
+        );
+        const prepared = await utils.addVerbose(run, platform);
+        const result = spawnSync(
+          windows ? 'pwsh' : 'bash',
+          windows ? ['-NoProfile', '-File', prepared] : [prepared],
+          {encoding: 'utf8', env: process.env}
+        );
+        expect(result.status).toBe(0);
+        expect(result.stdout + result.stderr).not.toContain(
+          'example-blackfire-'
+        );
+        expect(result.stdout).toContain('after-blackfire');
+        expect(
+          windows
+            ? /DEBUG:.*Write-Output after-blackfire/.test(result.stdout)
+            : result.stderr.includes('+ echo after-blackfire')
+        ).toBe(verbose !== 'true');
+        const config = fs.readFileSync(process.env.TRACE_TEST_OUTPUT!, 'utf8');
+        for (const value of [
+          'server-id',
+          'server-token',
+          'client-id',
+          'client-token'
+        ]) {
+          expect(config).toContain('example-blackfire-' + value);
+        }
+      }
+    );
+
+    it('keeps Composer credentials out of traces and resumes tracing', async () => {
+      if (platform === 'win32' ? !hasPwsh : process.platform === 'win32')
+        return;
+      process.env.verbose = 'vvv';
+      process.env.GITHUB_TOKEN = 'example-github-token';
+      process.env.COMPOSER_TOKEN = 'example-composer-token';
+      process.env.PACKAGIST_TOKEN = 'example-packagist-token';
+      process.env.COMPOSER_AUTH_JSON =
+        '{"bearer":{"example.org":"example-json-token"}}';
+      process.env.GITHUB_SERVER_URL = 'https://github.com';
+      const windows = platform === 'win32';
+      const source = fs.readFileSync(
+        path.join(scripts, 'tools', 'add_tools' + (windows ? '.ps1' : '.sh')),
+        'utf8'
+      );
+      fs.writeFileSync(
+        helper,
+        source +
+          (windows
+            ? `\n$composer_home='${root}'\nSet-ComposerAuth\nWrite-Output after-auth\n`
+            : `\ncomposer_home='${root}'\nset_composer_auth\necho after-auth\n`)
+      );
+      const prepared = await utils.addVerbose(run, platform);
+      const result = spawnSync(
+        windows ? 'pwsh' : 'bash',
+        windows ? ['-NoProfile', '-File', prepared] : [prepared],
+        {encoding: 'utf8', env: process.env}
+      );
+      expect(result.status).toBe(0);
+      expect(result.stdout + result.stderr).not.toMatch(
+        /example-(github|composer|packagist|json)-token/
+      );
+      expect(windows ? result.stdout : result.stderr).toMatch(
+        windows ? /DEBUG:.*Write-Output after-auth/ : /\+ echo after-auth/
+      );
+      const auth = JSON.parse(
+        fs.readFileSync(path.join(root, 'auth.json'), 'utf8')
+      );
+      expect(auth['github-oauth']['github.com']).toBe('example-composer-token');
+      expect(auth['http-basic']['repo.packagist.com'].password).toBe(
+        'example-packagist-token'
+      );
+      expect(auth.bearer['example.org']).toBe('example-json-token');
+    });
+
+    if (platform !== 'win32') {
+      (process.platform === 'win32' ? it.skip : it).each([
+        ['exit 37', 37],
+        ['set -e\nfalse', 1]
+      ])('preserves shell termination for %s', async (failure, status) => {
+        process.env.verbose = 'vvv';
+        process.env.GITHUB_TOKEN = 'example-github-token';
+        fs.writeFileSync(
+          helper,
+          `
+sensitive_failure() {
+  token="$GITHUB_TOKEN"
+  ${failure}
+  echo should-not-run
+}
+trap 'echo cleanup' EXIT
+without_trace sensitive_failure
+echo should-not-run
+`
+        );
+        const prepared = await utils.addVerbose(run, platform);
+        const result = spawnSync('bash', [prepared], {
+          encoding: 'utf8',
+          env: process.env
+        });
+        expect(result.status).toBe(status);
+        expect(result.stdout).toBe('cleanup\n');
+        expect(result.stdout + result.stderr).not.toContain(
+          'example-github-token'
+        );
+      });
+
+      (process.platform === 'win32' ? it.skip : it).each(['true', 'vv', 'vvv'])(
+        'protects Relay credentials and preserves tracing and status for verbose=%s',
+        async verbose => {
+          process.env.verbose = verbose;
+          const ini = path.join(root, 'relay.ini');
+          fs.writeFileSync(
+            helper,
+            fs.readFileSync(path.join(scripts, 'extensions/relay.sh'), 'utf8') +
+              '\nsudo() { if [ "$1" = rm ]; then return "$RELAY_TEST_STATUS"; fi; "$@"; }\n' +
+              `init_relay_ini '${ini}'\nrelay_status=$?\necho after-relay\nexit "$relay_status"\n`
+          );
+          const prepared = await utils.addVerbose(run, platform);
+          for (const status of [0, 37]) {
+            fs.writeFileSync(ini, '; relay.key =\n');
+            const result = spawnSync('bash', [prepared], {
+              encoding: 'utf8',
+              env: {
+                ...process.env,
+                RELAY_KEY: 'example-relay-key',
+                RELAY_TEST_STATUS: String(status)
+              }
+            });
+            expect(result.status).toBe(status);
+            expect(result.stdout + result.stderr).not.toContain(
+              'example-relay-key'
+            );
+            expect(result.stdout).toContain('after-relay');
+            expect(result.stderr.includes('+ echo after-relay')).toBe(
+              verbose !== 'true'
+            );
+            expect(fs.readFileSync(ini, 'utf8')).toBe(
+              'relay.key = example-relay-key\n'
+            );
+          }
+        }
+      );
+    }
+
+    (process.platform === 'win32' ? it.skip : it)(
+      'uses fresh copies without writing through source symlinks',
+      async () => {
+        const outside = path.join(root, path.basename(helper));
+        const original = 'echo original >/dev/null 2>&1\n';
+        fs.writeFileSync(outside, original);
+        fs.unlinkSync(helper);
+        fs.symlinkSync(outside, helper);
+        process.env.verbose = 'true';
+        const first = await utils.addVerbose(run, platform);
+        const second = await utils.addVerbose(run, platform);
+        expect(first).not.toBe(second);
+        expect(fs.readFileSync(outside, 'utf8')).toBe(original);
+        expect(fs.readFileSync(helper, 'utf8')).toBe(original);
+        expect(
+          fs.readFileSync(
+            path.join(path.dirname(first), 'tools', path.basename(helper)),
+            'utf8'
+          )
+        ).toBe('echo original \n');
+      }
+    );
+  }
+);

src/install.ts

@@ -47,7 +47,7 @@ export async function getScript(os: string): Promise<string> {
 
   fs.writeFileSync(run_path, script, {mode: 0o755});
 
-  return run_path;
+  return await utils.addVerbose(run_path, os);
 }
 
 /**

src/scripts/darwin.sh

@@ -183,29 +183,34 @@ setup_cached_versions() {
 
 # Function to setup PHP 5.6 and newer using Homebrew.
 add_php() {
+  local exit_code
   action=$1
   existing_version=$2
   suffix="$(get_php_formula_suffix)"
   php_keg="php@$version$suffix"
   php_formula="shivammathur/php/$php_keg"
   if [[ "$existing_version" = "false" || -n "$suffix" || "$action" = "upgrade" ]]; then
-    if [ "$(uname -m)" = "arm64" ] && [ "${runner:?}" != "self-hosted" ] && \
-      [ "${use_package_cache:-true}" != "false" ] && setup_cached_versions; then
-      return 0
+    if [ "${runner:?}" != "self-hosted" ] && [ "${use_package_cache:-true}" != "false" ]; then
+      setup_cached_versions && return 0
+      [ "$(uname -m)" != "x86_64" ] || return 1
     fi
     update_dependencies
     add_brew_tap "$php_tap"
   fi
   if [[ "$existing_version" != "false" && -z "$suffix" ]]; then
     if [ "$action" = "upgrade" ]; then
-      safe_brew install --only-dependencies "$php_formula"
-      safe_brew upgrade -f --overwrite "$php_formula"
+      safe_brew install --only-dependencies "$php_formula" || return $?
+      safe_brew upgrade -f --overwrite "$php_formula" || return $?
     else
       brew unlink "$php_keg"
     fi
   else
-    safe_brew install --only-dependencies "$php_formula"
-    safe_brew install --skip-link -f --overwrite "$php_formula" 2>/dev/null || safe_brew upgrade -f --overwrite "$php_formula"
+    safe_brew install --only-dependencies "$php_formula" || return $?
+    safe_brew install --skip-link -f --overwrite "$php_formula" 2>/dev/null || {
+      exit_code=$?
+      [ "$exit_code" -ne 124 ] || return "$exit_code"
+      safe_brew upgrade -f --overwrite "$php_formula" || return $?
+    }
   fi
   brew link --force --overwrite "$php_keg" || (sudo chown -R "$(id -un)":"$(id -gn)" "$brew_prefix" && brew link --force --overwrite "$php_keg")
 }
@@ -264,12 +269,18 @@ setup_php() {
     run_script "php5-darwin" "${version/./}" >/dev/null 2>&1
     status="Installed"
   elif [[ "${existing_version:0:3}" != "$version" || -n "$(get_php_formula_suffix)" ]]; then
-    add_php "install" "$existing_version" >/dev/null 2>&1
+    add_php "install" "$existing_version" >/dev/null 2>&1 || {
+      add_log "${cross:?}" "PHP" "Could not install PHP $version"
+      exit 1
+    }
     status="Installed"
   elif [[ "${existing_version:0:3}" = "$version" && "${update:?}" = "true" ]]; then
     brew_php_version="$(brew info --json "php@$version" 2>/dev/null | jq -r '.[].versions.stable')"
     if [ "$brew_php_version" != "$existing_version" ]; then
-      add_php "upgrade" "$existing_version" >/dev/null 2>&1
+      add_php "upgrade" "$existing_version" >/dev/null 2>&1 || {
+        add_log "${cross:?}" "PHP" "Could not upgrade PHP $version"
+        exit 1
+      }
       status="Upgraded"
     fi
   fi

src/scripts/extensions/relay.sh

@@ -63,6 +63,10 @@ add_relay_dependencies() {
 
 # Initialize relay extension ini configuration
 init_relay_ini() {
+  without_trace init_relay_ini_helper "$@"
+}
+
+init_relay_ini_helper() {
   relay_ini=$1
   if [ -e "$relay_ini" ]; then
     if [[ -n "$RELAY_KEY" ]]; then

src/scripts/tools/add_tools.ps1

@@ -87,35 +87,37 @@ Function Write-ComposerGhAuthNoOpWarning() {
 
 # Function to setup authentication in composer.
 Function Set-ComposerAuth() {
-  $token = if ($env:COMPOSER_TOKEN) { $env:COMPOSER_TOKEN } else { $env:GITHUB_TOKEN }
-  if(Test-Path env:COMPOSER_AUTH_JSON) {
-    if(Test-Json -JSON $env:COMPOSER_AUTH_JSON) {
-      Set-Content -Path $composer_home\auth.json -Value $env:COMPOSER_AUTH_JSON
-    } else {
-      Add-Log "$cross" "composer" "Could not parse COMPOSER_AUTH_JSON as valid JSON"
+  Invoke-WithoutTrace {
+    $token = if ($env:COMPOSER_TOKEN) { $env:COMPOSER_TOKEN } else { $env:GITHUB_TOKEN }
+    if(Test-Path env:COMPOSER_AUTH_JSON) {
+      if(Test-Json -JSON $env:COMPOSER_AUTH_JSON) {
+        Set-Content -Path $composer_home\auth.json -Value $env:COMPOSER_AUTH_JSON
+      } else {
+        Add-Log "$cross" "composer" "Could not parse COMPOSER_AUTH_JSON as valid JSON"
+      }
     }
-  }
-  if($skip_composer_github_auth) {
-    Write-ComposerGhAuthNoOpWarning
-  }
-  $composer_auth = @()
-  if(Test-Path env:PACKAGIST_TOKEN) {
-    $composer_auth += '"http-basic": {"repo.packagist.com": { "username": "token", "password": "' + $env:PACKAGIST_TOKEN + '"}}'
-  }
-  $write_token = $true
-  if ($token) {
-    if ($skip_composer_github_auth) {
-      $write_token = $false
+    if($skip_composer_github_auth) {
+      Write-ComposerGhAuthNoOpWarning
     }
-    if ($env:GITHUB_SERVER_URL -ne "https://github.com" -and -not(Test-GitHubPublicAccess $token)) {
-      $write_token = $false
+    $composer_auth = @()
+    if(Test-Path env:PACKAGIST_TOKEN) {
+      $composer_auth += '"http-basic": {"repo.packagist.com": { "username": "token", "password": "' + $env:PACKAGIST_TOKEN + '"}}'
     }
-    if($write_token) {
-      $composer_auth += '"github-oauth": {"github.com": "' + $token + '"}'
+    $write_token = $true
+    if ($token) {
+      if ($skip_composer_github_auth) {
+        $write_token = $false
+      }
+      if ($env:GITHUB_SERVER_URL -ne "https://github.com" -and -not(Test-GitHubPublicAccess $token)) {
+        $write_token = $false
+      }
+      if($write_token) {
+        $composer_auth += '"github-oauth": {"github.com": "' + $token + '"}'
+      }
+    }
+    if($composer_auth.length) {
+      Update-AuthJson $composer_auth
     }
-  }
-  if($composer_auth.length) {
-    Update-AuthJson $composer_auth
   }
 }
 

src/scripts/tools/add_tools.sh

@@ -85,6 +85,10 @@ composer_gh_auth_no_op() {
 
 # Function to setup authentication in composer.
 set_composer_auth() {
+  without_trace set_composer_auth_helper
+}
+
+set_composer_auth_helper() {
   token="${COMPOSER_TOKEN:-$GITHUB_TOKEN}"
   if [ -n "${COMPOSER_AUTH_JSON:-}" ]; then
     if printf '%s' "$COMPOSER_AUTH_JSON" | jq -e . >/dev/null; then

src/scripts/tools/blackfire.ps1

@@ -9,11 +9,13 @@ Function Add-Blackfire() {
   Get-File -Url $url -OutFile $bin_dir\blackfire.zip >$null 2>&1
   Expand-Archive -Path $bin_dir\blackfire.zip -DestinationPath $bin_dir -Force >$null 2>&1
   Add-ToProfile $current_profile 'blackfire' "New-Alias blackfire $bin_dir\blackfire.exe"
-  if ((Test-Path env:BLACKFIRE_SERVER_ID) -and (Test-Path env:BLACKFIRE_SERVER_TOKEN)) {
-    blackfire agent:config --server-id=$env:BLACKFIRE_SERVER_ID --server-token=$env:BLACKFIRE_SERVER_TOKEN >$null 2>&1
-  }
-  if ((Test-Path env:BLACKFIRE_CLIENT_ID) -and (Test-Path env:BLACKFIRE_CLIENT_TOKEN)) {
-    blackfire client:config --client-id=$env:BLACKFIRE_CLIENT_ID --client-token=$env:BLACKFIRE_CLIENT_TOKEN --ca-cert=$php_dir\ssl\cacert.pem >$null 2>&1
+  Invoke-WithoutTrace {
+    if ((Test-Path env:BLACKFIRE_SERVER_ID) -and (Test-Path env:BLACKFIRE_SERVER_TOKEN)) {
+      blackfire agent:config --server-id=$env:BLACKFIRE_SERVER_ID --server-token=$env:BLACKFIRE_SERVER_TOKEN >$null 2>&1
+    }
+    if ((Test-Path env:BLACKFIRE_CLIENT_ID) -and (Test-Path env:BLACKFIRE_CLIENT_TOKEN)) {
+      blackfire client:config --client-id=$env:BLACKFIRE_CLIENT_ID --client-token=$env:BLACKFIRE_CLIENT_TOKEN --ca-cert=$php_dir\ssl\cacert.pem >$null 2>&1
+    }
   }
   Add-Log $tick "blackfire" "Added blackfire $cli_version"
 }

src/scripts/tools/blackfire.sh

@@ -12,6 +12,10 @@ add_blackfire_darwin() {
 }
 
 blackfire_config() {
+  without_trace blackfire_config_helper
+}
+
+blackfire_config_helper() {
   if [[ -n $BLACKFIRE_SERVER_ID ]] && [[ -n $BLACKFIRE_SERVER_TOKEN ]]; then
     blackfire agent:config --server-id="$BLACKFIRE_SERVER_ID" --server-token="$BLACKFIRE_SERVER_TOKEN"
     if [ "$os" = "Linux" ]; then

src/scripts/tools/brew.sh

@@ -55,25 +55,45 @@ get_file_mtime() {
   fi
 }
 
-# Function to terminate a process and its direct children.
-terminate_process_tree() {
+# Function to list descendants before their parents, including separate sessions.
+get_process_tree() {
   local pid=$1
   local children child
   children=$(pgrep -P "$pid" 2>/dev/null || true)
-  kill -TERM "$pid" >/dev/null 2>&1 || true
   for child in $children; do
-    terminate_process_tree "$child"
+    get_process_tree "$child"
+  done
+  echo "$pid"
+}
+
+# Function to detect Homebrew's source-build worker, even with buffered output.
+is_brew_building_from_source() {
+  local pid
+  for pid in $(get_process_tree "$1"); do
+    if ps -ww -p "$pid" -o command= 2>/dev/null | grep -qE '/Homebrew/build[.]rb([[:space:]]|$)'; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+# Function to terminate the entire tree captured before any parents can exit.
+terminate_process_tree() {
+  local pids pid
+  pids=$(get_process_tree "$1")
+  for pid in $pids; do
+    kill -TERM "$pid" >/dev/null 2>&1 || true
   done
   sleep 2
-  kill -KILL "$pid" >/dev/null 2>&1 || true
-  for child in $children; do
-    terminate_process_tree "$child"
+  for pid in $pids; do
+    kill -KILL "$pid" >/dev/null 2>&1 || true
   done
 }
 
 # Function to run a command with an inactivity watchdog.
 run_with_inactivity_watchdog() {
   local timeout_secs="${SETUP_PHP_BREW_INACTIVITY_TIMEOUT:-180}"
+  local source_timeout_secs="${SETUP_PHP_BREW_SOURCE_INACTIVITY_TIMEOUT:-1800}"
   local poll_secs="${SETUP_PHP_BREW_WATCHDOG_POLL:-5}"
   local tmp_dir stdout_fifo stderr_fifo stdout_log stderr_log timeout_file
   local command_pid stdout_reader_pid stderr_reader_pid monitor_pid exit_code
@@ -93,36 +113,39 @@ run_with_inactivity_watchdog() {
   ("$@" >"$stdout_fifo" 2>"$stderr_fifo") &
   command_pid=$!
 
-  (
-    while IFS= read -r line || [ -n "$line" ]; do
-      printf '%s\n' "$line"
-      printf '%s\n' "$line" >>"$stdout_log"
-    done <"$stdout_fifo"
-  ) &
+  tee "$stdout_log" <"$stdout_fifo" &
   stdout_reader_pid=$!
 
-  (
-    while IFS= read -r line || [ -n "$line" ]; do
-      printf '%s\n' "$line" >&2
-      printf '%s\n' "$line" >>"$stderr_log"
-    done <"$stderr_fifo"
-  ) &
+  tee "$stderr_log" <"$stderr_fifo" >&2 &
   stderr_reader_pid=$!
 
   (
     local last_activity current_activity current_err_activity now
+    local building_from_source=false was_building_from_source=false active_timeout_secs
     last_activity=$(get_file_mtime "$stdout_log")
     current_err_activity=$(get_file_mtime "$stderr_log")
     [ "$current_err_activity" -gt "$last_activity" ] && last_activity="$current_err_activity"
     while kill -0 "$command_pid" >/dev/null 2>&1; do
       sleep "$poll_secs"
+      kill -0 "$command_pid" >/dev/null 2>&1 || break
+      now=$(date +%s)
+      active_timeout_secs="$timeout_secs"
+      building_from_source=false
+      if is_brew_building_from_source "$command_pid"; then
+        building_from_source=true
+        active_timeout_secs="$source_timeout_secs"
+      fi
+      if [ "$building_from_source" != "$was_building_from_source" ]; then
+        last_activity="$now"
+        was_building_from_source="$building_from_source"
+      fi
       current_activity=$(get_file_mtime "$stdout_log")
       [ "$current_activity" -gt "$last_activity" ] && last_activity="$current_activity"
       current_err_activity=$(get_file_mtime "$stderr_log")
       [ "$current_err_activity" -gt "$last_activity" ] && last_activity="$current_err_activity"
       now=$(date +%s)
-      if [ $((now - last_activity)) -ge "$timeout_secs" ]; then
-        printf "\nsetup-php: brew produced no output for %ss; terminating and retrying...\n" "$timeout_secs" >&2
+      if [ $((now - last_activity)) -ge "$active_timeout_secs" ]; then
+        printf "\nsetup-php: brew produced no output for %ss; terminating...\n" "$active_timeout_secs" >&2
         : >"$timeout_file"
         terminate_process_tree "$command_pid"
         break
@@ -131,12 +154,15 @@ run_with_inactivity_watchdog() {
   ) &
   monitor_pid=$!
 
-  wait "$command_pid"
-  exit_code=$?
+  exit_code=0
+  wait "$command_pid" || exit_code=$?
+  # Let timeout cleanup finish killing source-build descendants before retrying.
+  if [ ! -e "$timeout_file" ]; then
+    kill "$monitor_pid" >/dev/null 2>&1 || true
+  fi
+  wait "$monitor_pid" 2>/dev/null || true
   wait "$stdout_reader_pid" 2>/dev/null || true
   wait "$stderr_reader_pid" 2>/dev/null || true
-  kill "$monitor_pid" >/dev/null 2>&1 || true
-  wait "$monitor_pid" 2>/dev/null || true
 
   if [ -e "$timeout_file" ]; then
     rm -rf "$tmp_dir"

src/scripts/unix.sh

@@ -48,8 +48,21 @@ set_output() {
   fi
 }
 
+# Function to run sensitive code without tracing. Expand tokens inside the function, not its arguments.
+without_trace() {
+  local setup_php_trace_flags=$-
+  set +x
+  "$@"
+  local setup_php_trace_status=$?
+  [[ "$setup_php_trace_flags" == *x* ]] && set -x
+  return "$setup_php_trace_status"
+}
+
 # Function to read env inputs.
 read_env() {
+  if [[ "${SETUP_PHP_TRACE:-0}" =~ ^[12]$ ]]; then
+    set -x
+  fi
   update="${update:-${UPDATE:-false}}"
   [ "${debug:-${DEBUG:-false}}" = "true" ] && debug=debug && update=true || debug=release
   [[ "${phpts:-${PHPTS:-nts}}" = "ts" || "${phpts:-${PHPTS:-nts}}" = "zts" ]] && ts=zts && update=true || ts=nts

src/scripts/win32.ps1

@@ -28,6 +28,18 @@ Function Add-Log($mark, $subject, $message) {
   }
 }
 
+# Function to run sensitive code without tracing. Expand tokens inside the script block.
+Function Invoke-WithoutTrace([scriptblock]$Script) {
+  Set-PSDebug -Off
+  $previous_trace = $setup_php_trace
+  $setup_php_trace = 0
+  try {
+    & $Script
+  } finally {
+    Set-PSDebug -Trace $previous_trace
+  }
+}
+
 # Function to set output on GitHub Actions.
 Function Set-Output() {
   param(
@@ -333,6 +345,12 @@ $nightly_versions = '8.[6-9]'
 $xdebug3_versions = "7.[2-4]|8.[0-9]"
 $enable_extensions = ('openssl', 'curl', 'mbstring')
 
+$setup_php_trace = 0
+if ($env:SETUP_PHP_TRACE -match '^[12]$') {
+  $setup_php_trace = [int]$env:SETUP_PHP_TRACE
+  Set-PSDebug -Trace $setup_php_trace
+}
+
 $arch = 'x64'
 if(-not([Environment]::Is64BitOperatingSystem) -or $version -lt '7.0') {
   $arch = 'x86'

src/utils.ts

@@ -332,6 +332,43 @@ export async function suppressOutput(os: string): Promise<string> {
   }
 }
 
+/**
+ * Prepare verbose runtime scripts without changing the original sources.
+ */
+export async function addVerbose(
+  run_path: string,
+  os: string
+): Promise<string> {
+  const verbose = await readEnv('verbose');
+  process.env['SETUP_PHP_TRACE'] = /^v{2,3}$/.test(verbose)
+    ? String(verbose.length - 1)
+    : '0';
+  if (!/^(true|v{1,3})$/.test(verbose) && process.env['RUNNER_DEBUG'] !== '1') {
+    return run_path;
+  }
+  const extension = await scriptExtension(os);
+  const src = path.dirname(path.dirname(run_path));
+  const dest = fs.mkdtempSync(src + '-verbose-');
+  await fs.promises.cp(src, dest, {recursive: true, dereference: true});
+  const scripts = path.join(dest, 'scripts');
+  const verbose_run = path.join(scripts, path.basename(run_path));
+  const pipe = />[ \t]*(?:\/dev\/null|\$null)[ \t]+2>&1/g;
+  for (const file of fs.readdirSync(scripts, {
+    recursive: true,
+    encoding: 'utf8'
+  })) {
+    if (!file.endsWith(extension)) continue;
+    const filename = path.join(scripts, file);
+    const original = fs.readFileSync(filename, 'utf8');
+    let script = original.replace(pipe, '');
+    if (filename === verbose_run) {
+      script = script.replaceAll(src, dest);
+    }
+    if (script !== original) fs.writeFileSync(filename, script);
+  }
+  return verbose_run;
+}
+
 /**
  * Function to get script to log unsupported extensions.
  *