GHSA-pqwm-q9pv-ph8r - Fix CWE-78 [skip ci]

Co-Authored-By: maki <amarrec@quarkslab.com>

.github/workflows/node.yml

@@ -54,7 +54,7 @@ jobs:
         run: npm audit
 
       - name: Send Coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v6
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage/lcov.info

.github/workflows/publish.yml

@@ -16,6 +16,7 @@ jobs:
     permissions:
       contents: read
       packages: write
+      id-token: write
     steps:
       - name: Checkout release
         if: github.event_name != 'workflow_dispatch'
@@ -30,7 +31,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: '20.x'
+          node-version: '24.x'
           registry-url: https://registry.npmjs.org
 
       - name: Install dependencies and add lib
@@ -42,8 +43,6 @@ jobs:
       - name: Publish to NPM
         if: "!contains(github.event.inputs.skip, 'skip-npm')"
         run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Change to GitHub Packages registry
         uses: actions/setup-node@v6

README.md

@@ -268,7 +268,7 @@ These tools can be set up globally using the `tools` input. It accepts a string
   uses: shivammathur/setup-php@v2
   with:
     php-version: '8.5'
-    tools: composer:v1
+    tools: composer:v2
 ```
 
 - If you do not use composer in your workflow, you can specify `tools: none` to skip it.
@@ -950,11 +950,12 @@ Examples of using `setup-php` with various PHP frameworks and packages.
 | Framework/Package                      | Runs on                         | Workflow                                                                                                      |
 |----------------------------------------|---------------------------------|---------------------------------------------------------------------------------------------------------------|
 | Blackfire                              | `macOS`, `ubuntu` and `windows` | [blackfire.yml](./examples/blackfire.yml "GitHub Action using Blackfire")                                     |
-| Blackfire Player                       | `macOS`, `ubuntu` and `windows` | [blackfire-player.yml](./examples/blackfire-player.yml "GitHub Action using Blackfire Player")                |
+| Blackfire Player                       | `macOS` and `ubuntu`            | [blackfire-player.yml](./examples/blackfire-player.yml "GitHub Action using Blackfire Player")                |
 | CakePHP with `MySQL` and `Redis`       | `ubuntu`                        | [cakephp-mysql.yml](./examples/cakephp-mysql.yml "GitHub Action for CakePHP with MySQL and Redis")            |
 | CakePHP with `PostgreSQL` and `Redis`  | `ubuntu`                        | [cakephp-postgres.yml](./examples/cakephp-postgres.yml "GitHub Action for CakePHP with Postgres and Redis")   |
 | CakePHP without services               | `macOS`, `ubuntu` and `windows` | [cakephp.yml](./examples/cakephp.yml "GitHub Action for CakePHP without services")                            |
 | CodeIgniter                            | `macOS`, `ubuntu` and `windows` | [codeigniter.yml](./examples/codeigniter.yml "GitHub Action for CodeIgniter")                                 |
+| Drupal 11 (Composer-managed)           | `ubuntu`                        | [drupal.yml](./examples/drupal.yml "GitHub Action for Drupal 11 composer-managed projects")                   |
 | Laminas MVC                            | `macOS`, `ubuntu` and `windows` | [laminas-mvc.yml](./examples/laminas-mvc.yml "GitHub Action for Laminas Framework MVC Projects")              |
 | Laravel with `MySQL` and `Redis`       | `ubuntu`                        | [laravel-mysql.yml](./examples/laravel-mysql.yml "GitHub Action for Laravel with MySQL and Redis")            |
 | Laravel with `PostgreSQL` and `Redis`  | `ubuntu`                        | [laravel-postgres.yml](./examples/laravel-postgres.yml "GitHub Action for Laravel with PostgreSQL and Redis") |
@@ -964,14 +965,16 @@ Examples of using `setup-php` with various PHP frameworks and packages.
 | Lumen without services                 | `macOS`, `ubuntu` and `windows` | [lumen.yml](./examples/lumen.yml "GitHub Action for Lumen without services")                                  |
 | Phalcon with `MySQL`                   | `ubuntu`                        | [phalcon-mysql.yml](./examples/phalcon-mysql.yml "GitHub Action for Phalcon with MySQL")                      |
 | Phalcon with `PostgreSQL`              | `ubuntu`                        | [phalcon-postgres.yml](./examples/phalcon-postgres.yml "GitHub Action for Phalcon with PostgreSQL")           |
-| Roots/bedrock                          | `ubuntu`                        | [bedrock.yml](./examples/bedrock.yml "GitHub Action for Wordpress Development using @roots/bedrock")          |
-| Roots/sage                             | `ubuntu`                        | [sage.yml](./examples/sage.yml "GitHub Action for Wordpress Development using @roots/sage")                   |
 | Slim Framework                         | `macOS`, `ubuntu` and `windows` | [slim-framework.yml](./examples/slim-framework.yml "GitHub Action for Slim Framework")                        |
 | Symfony with `MySQL`                   | `ubuntu`                        | [symfony-mysql.yml](./examples/symfony-mysql.yml "GitHub Action for Symfony with MySQL")                      |
 | Symfony with `PostgreSQL`              | `ubuntu`                        | [symfony-postgres.yml](./examples/symfony-postgres.yml "GitHub Action for Symfony with PostgreSQL")           |
 | Symfony without services               | `macOS`, `ubuntu` and `windows` | [symfony.yml](./examples/symfony.yml "GitHub Action for Symfony without services")                            |
-| Yii2 Starter Kit with `MySQL`          | `ubuntu`                        | [yii2-mysql.yml](./examples/yii2-mysql.yml "GitHub Action for Yii2 Starter Kit with MySQL")                   |
+| WordPress plugin                       | `ubuntu`                        | [wordpress.yml](./examples/wordpress.yml "GitHub Action for WordPress plugins")                               |
-| Yii2 Starter Kit with `PostgreSQL`     | `ubuntu`                        | [yii2-postgres.yml](./examples/yii2-postgres.yml "GitHub Action for Yii2 Starter Kit with PostgreSQL")        |
+| WordPress with Roots/Bedrock           | `ubuntu`                        | [bedrock.yml](./examples/bedrock.yml "GitHub Action for WordPress development using @roots/bedrock")         |
+| WordPress with Roots/Sage              | `ubuntu`                        | [sage.yml](./examples/sage.yml "GitHub Action for WordPress development using @roots/sage")                   |
+| Yii3 web application with `MySQL`      | `ubuntu`                        | [yii3-mysql.yml](./examples/yii3-mysql.yml "GitHub Action for Yii3 web application with MySQL")               |
+| Yii3 web application with `PostgreSQL` | `ubuntu`                        | [yii3-postgres.yml](./examples/yii3-postgres.yml "GitHub Action for Yii3 web application with PostgreSQL")    |
+| Yii3 web application                   | `ubuntu` and `windows`          | [yii3.yml](./examples/yii3.yml "GitHub Action for Yii3 web application")                                      |
 
 ## :bookmark: Versioning
 

__tests__/config.test.ts

@@ -13,4 +13,17 @@ describe('Config tests', () => {
   `('checking addINIValues on $os', async ({ini_values, os, output}) => {
     expect(await config.addINIValues(ini_values, os)).toContain(output);
   });
+
+  it.each`
+    ini_values                           | os         | output
+    ${'disable_functions="exec,system"'} | ${'linux'} | ${'echo "disable_functions=exec,system" | sudo tee -a "${pecl_file:-${ini_file[@]}}"'}
+    ${'disable_functions="exec,system"'} | ${'win32'} | ${'Add-Content "$php_dir\\php.ini" "disable_functions=exec,system"'}
+    ${'a=$(id)'}                         | ${'linux'} | ${'echo "a=\'\\$(id)\'"'}
+    ${'a=$(id)'}                         | ${'win32'} | ${'Add-Content "$php_dir\\php.ini" "a=\'`$(id)\'"'}
+  `(
+    'addINIValues survives quoted values and escapes shell metas: $ini_values, $os',
+    async ({ini_values, os, output}) => {
+      expect(await config.addINIValues(ini_values, os)).toContain(output);
+    }
+  );
 });

__tests__/tools.test.ts

@@ -31,6 +31,12 @@ function getData(data: Partial<ToolData>): ToolData {
   };
 }
 
+function unsetComposerAuthEnv(): void {
+  delete process.env['GITHUB_TOKEN'];
+  delete process.env['COMPOSER_TOKEN'];
+  delete process.env['COMPOSER_AUTH_JSON'];
+}
+
 /**
  * Mock fetch.ts
  */
@@ -181,6 +187,7 @@ describe('Tools tests', () => {
     ${'1.2.3-dev'}     | ${'tool'}     | ${'phar'}     | ${'1.2.3-dev'}
     ${'1.2.3-alpha1'}  | ${'tool'}     | ${'phar'}     | ${'1.2.3-alpha1'}
     ${'1.2.3-alpha.1'} | ${'tool'}     | ${'phar'}     | ${'1.2.3-alpha.1'}
+    ${'1.>=0'}         | ${'tool'}     | ${'phar'}     | ${'1.0'}
   `(
     'checking getVersion: $version, $tool, $type',
     async ({version, tool, type, expected}) => {
@@ -315,6 +322,28 @@ describe('Tools tests', () => {
     expect(await tools.addPackage(data)).toContain(script);
   });
 
+  it.each`
+    release           | os         | expected
+    ${'tool:>=1.2'}   | ${'linux'} | ${'add_composer_tool tool "tool:>=1.2" user/ global'}
+    ${'tool:1.*'}     | ${'linux'} | ${'add_composer_tool tool "tool:1.*" user/ global'}
+    ${'tool:>=1.2'}   | ${'win32'} | ${'Add-ComposerTool tool "tool:>=1.2" user/ global'}
+    ${'psalm:^5||^6'} | ${'linux'} | ${'add_composer_tool tool "psalm:^5||^6" user/ global'}
+    ${'psalm:>=5,<6'} | ${'linux'} | ${'add_composer_tool tool "psalm:>=5,<6" user/ global'}
+  `(
+    'addPackage quotes constraint operators: $release, $os',
+    async ({release, os, expected}) => {
+      const data = getData({
+        tool: 'tool',
+        version: '>=1.2',
+        repository: 'user/tool',
+        os: os,
+        scope: 'global'
+      });
+      data['release'] = release;
+      expect(await tools.addPackage(data)).toContain(expected);
+    }
+  );
+
   it.each`
     version     | php_version | os          | script
     ${'latest'} | ${'8.0'}    | ${'linux'}  | ${'add_tool https://github.com/phar-io/phive/releases/download/3.2.1/phive-3.2.1.phar phive'}
@@ -423,6 +452,118 @@ describe('Tools tests', () => {
     }
   );
 
+  it.each`
+    version            | affected
+    ${'1'}             | ${false}
+    ${'1.0.0-alpha1'}  | ${true}
+    ${'1.0.0-alpha2'}  | ${true}
+    ${'1.0.0-alpha3'}  | ${true}
+    ${'1.0.0-alpha4'}  | ${true}
+    ${'1.0.0-alpha5'}  | ${true}
+    ${'1.0.0-alpha6'}  | ${true}
+    ${'1.0.0-alpha7'}  | ${true}
+    ${'1.0.0-alpha8'}  | ${true}
+    ${'1.0.0-alpha9'}  | ${true}
+    ${'1.0.0-alpha10'} | ${true}
+    ${'1.0.0-alpha11'} | ${true}
+    ${'1.0.0-beta1'}   | ${true}
+    ${'1.0.0-beta2'}   | ${true}
+    ${'1.0.0'}         | ${true}
+    ${'1.10.27'}       | ${true}
+    ${'1.10.28'}       | ${false}
+    ${'2.0.0-alpha1'}  | ${true}
+    ${'2.0.0-alpha2'}  | ${true}
+    ${'2.0.0-alpha3'}  | ${true}
+    ${'2.0.0-RC1'}     | ${true}
+    ${'2.0.0-RC2'}     | ${true}
+    ${'2.2.27'}        | ${true}
+    ${'2.2.28'}        | ${false}
+    ${'2.3.0-RC1'}     | ${true}
+    ${'2.3.0-RC2'}     | ${true}
+    ${'2.9.7'}         | ${true}
+    ${'2.9.7-RC1'}     | ${true}
+    ${'2.9.8'}         | ${false}
+    ${'2.9.0RC1'}      | ${false}
+    ${'2.9.x-dev'}     | ${false}
+  `('checking affected composer version: $version', ({version, affected}) => {
+    expect(tools.skipGitHubAuthForComposerVersion(version)).toBe(affected);
+  });
+
+  it('checking affected composer version with CRLF ranges', async () => {
+    let affected = false;
+    let fixed = true;
+    await jest.isolateModulesAsync(async () => {
+      jest.doMock('fs', () => ({
+        ...jest.requireActual('fs'),
+        readFileSync: (
+          filePath: fs.PathOrFileDescriptor,
+          options?: unknown
+        ) => {
+          if (String(filePath).includes('composer-gh-auth-no-op')) {
+            return '1.0.0-0 1.10.28\r\n2.0.0-0 2.2.28\r\n2.3.0-0 2.9.8';
+          }
+          return (jest.requireActual('fs') as typeof fs).readFileSync(
+            filePath,
+            options as fs.ObjectEncodingOptions & {flag?: string}
+          );
+        }
+      }));
+      const isolatedTools = await import('../src/tools');
+      affected = isolatedTools.skipGitHubAuthForComposerVersion('2.9.7');
+      fixed = isolatedTools.skipGitHubAuthForComposerVersion('2.9.8');
+    });
+    expect(affected).toBe(true);
+    expect(fixed).toBe(false);
+  });
+
+  it.each`
+    auth_json                                                                                                          | expected
+    ${'{"github-oauth":{"github.com":"ghs_new-token"},"http-basic":{"repo.example":{"username":"u","password":"p"}}}'} | ${'{"http-basic":{"repo.example":{"username":"u","password":"p"}}}'}
+    ${'{"github-oauth":{"github.com":"ghs_new-token"}}'}                                                               | ${undefined}
+    ${'{"http-basic":{"repo.example":{"username":"u","password":"p"}}}'}                                               | ${'{"http-basic":{"repo.example":{"username":"u","password":"p"}}}'}
+    ${'{"nested":{"github-oauth":{"github.com":"ghs_new-token"}}}'}                                                    | ${'{"nested":{"github-oauth":{"github.com":"ghs_new-token"}}}'}
+    ${'{"github-oauth":'}                                                                                              | ${'{"github-oauth":'}
+  `('cleaning composer auth json', ({auth_json, expected}) => {
+    unsetComposerAuthEnv();
+    process.env['COMPOSER_AUTH_JSON'] = auth_json;
+    tools.cleanComposerAuthJson();
+    expect(process.env['COMPOSER_AUTH_JSON']).toBe(expected);
+    unsetComposerAuthEnv();
+  });
+
+  it.each`
+    version     | os         | envs                                                                                       | skip_github_auth
+    ${'latest'} | ${'linux'} | ${{GITHUB_TOKEN: 'ghs_token'}}                                                             | ${false}
+    ${'1'}      | ${'linux'} | ${{GITHUB_TOKEN: 'ghs_token'}}                                                             | ${false}
+    ${'2'}      | ${'linux'} | ${{GITHUB_TOKEN: 'ghs_token'}}                                                             | ${false}
+    ${'2.9.7'}  | ${'linux'} | ${{}}                                                                                      | ${true}
+    ${'2.9.7'}  | ${'linux'} | ${{GITHUB_TOKEN: 'ghs_token'}}                                                             | ${true}
+    ${'2.9.7'}  | ${'linux'} | ${{COMPOSER_TOKEN: 'ghs_token'}}                                                           | ${true}
+    ${'2.9.7'}  | ${'linux'} | ${{COMPOSER_AUTH_JSON: '{"github-oauth":{"github.com":"ghs_new-token"}}'}}                 | ${true}
+    ${'2.9.7'}  | ${'linux'} | ${{COMPOSER_AUTH_JSON: '{"http-basic":{"repo.example":{"username":"u","password":"p"}}}'}} | ${true}
+    ${'2.9.8'}  | ${'linux'} | ${{GITHUB_TOKEN: 'ghs_token'}}                                                             | ${false}
+    ${'2.9.7'}  | ${'win32'} | ${{GITHUB_TOKEN: 'ghs_token'}}                                                             | ${true}
+  `(
+    'checking composer github auth skip flag: $version, $os',
+    async ({version, os, envs, skip_github_auth}) => {
+      unsetComposerAuthEnv();
+      Object.assign(process.env, envs);
+      const data = getData({
+        tool: 'composer',
+        os: os,
+        php_version: '7.4',
+        domain: 'https://getcomposer.org',
+        repository: 'composer/composer',
+        version: version
+      });
+      const script = await tools.addComposer(data);
+      expect(script).toContain(
+        `composer ${version}${skip_github_auth ? ' true' : ''}`
+      );
+      unsetComposerAuthEnv();
+    }
+  );
+
   it.each`
     version     | uri
     ${'latest'} | ${'wp-cli/builds/blob/gh-pages/phar/wp-cli.phar?raw=true'}
@@ -533,7 +674,7 @@ describe('Tools tests', () => {
         'add_devtools phpize',
         'add_tool https://github.com/phpmd/phpmd/releases/latest/download/phpmd.phar phpmd "--version"',
         'add_tool https://github.com/phpspec/phpspec/releases/latest/download/phpspec.phar phpspec "-V"',
-        'add_composer_tool phpunit-bridge phpunit-bridge:5.6.* symfony/ global',
+        'add_composer_tool phpunit-bridge "phpunit-bridge:5.6.*" symfony/ global',
         'add_composer_tool phpunit-polyfills phpunit-polyfills:1.0.1 yoast/ global',
         'add_protoc 1.2.3',
         'add_tool https://github.com/vimeo/psalm/releases/latest/download/psalm.phar psalm "-v"',
@@ -593,7 +734,7 @@ describe('Tools tests', () => {
         'Add-ComposerTool codeception codeception codeception/ global',
         'Add-ComposerTool prestissimo prestissimo hirak/ global',
         'Add-ComposerTool automatic-composer-prefetcher automatic-composer-prefetcher narrowspark/ global',
-        'Add-ComposerTool phinx phinx:1.2.* robmorgan/ scoped',
+        'Add-ComposerTool phinx "phinx:1.2.*" robmorgan/ scoped',
         'Add-ComposerTool phinx phinx:^1.2 robmorgan/ global',
         'Add-ComposerTool tool tool:1.2.3 user/ global',
         'Add-ComposerTool tool tool:~1.2 user/ global'
@@ -642,6 +783,7 @@ describe('Tools tests', () => {
     ${'composer:preview'}                                 | ${'add_tool https://github.com/shivammathur/composer-cache/releases/latest/download/composer-7.4-preview.phar,https://artifacts.setup-php.com/composer/composer-7.4-preview.phar,https://dl.cloudsmith.io/public/shivammathur/composer-cache/raw/files/composer-7.4-preview.phar,https://getcomposer.org/composer-preview.phar composer preview'}
     ${'composer, composer:v1'}                            | ${'add_tool https://github.com/shivammathur/composer-cache/releases/latest/download/composer-7.4-1.phar,https://artifacts.setup-php.com/composer/composer-7.4-1.phar,https://dl.cloudsmith.io/public/shivammathur/composer-cache/raw/files/composer-7.4-1.phar,https://getcomposer.org/composer-1.phar composer'}
     ${'composer:v1, composer:preview, composer:snapshot'} | ${'add_tool https://github.com/shivammathur/composer-cache/releases/latest/download/composer-7.4-snapshot.phar,https://artifacts.setup-php.com/composer/composer-7.4-snapshot.phar,https://dl.cloudsmith.io/public/shivammathur/composer-cache/raw/files/composer-7.4-snapshot.phar,https://getcomposer.org/composer.phar composer snapshot'}
+    ${'composer:2.9.7'}                                   | ${'add_tool https://github.com/composer/composer/releases/download/2.9.7/composer.phar,https://getcomposer.org/download/2.9.7/composer.phar composer 2.9.7 true'}
   `('checking composer setup: $tools_csv', async ({tools_csv, script}) => {
     expect(await tools.addTools(tools_csv, '7.4', 'linux')).toContain(script);
   });

__tests__/utils.test.ts

@@ -50,12 +50,37 @@ describe('Utils tests', () => {
     expect(fetchSpy).toHaveBeenCalledTimes(2);
   });
 
+  it('parseVersion rejects unsupported inputs', async () => {
+    await expect(utils.parseVersion('foo')).rejects.toThrow(
+      'Invalid PHP version:'
+    );
+    await expect(utils.parseVersion('8.x.1')).rejects.toThrow(
+      'Invalid PHP version:'
+    );
+  });
+
+  it('parseVersion rejects unexpected manifest values', async () => {
+    const fetchSpy = jest
+      .spyOn(fetchModule, 'fetch')
+      .mockResolvedValue({data: '{ "latest": "8.1.0" }'});
+    await expect(utils.parseVersion('latest')).rejects.toThrow(
+      'Invalid PHP version in manifest:'
+    );
+    fetchSpy.mockRestore();
+  });
+
   it('checking parseIniFile', async () => {
     expect(await utils.parseIniFile('production')).toBe('production');
     expect(await utils.parseIniFile('development')).toBe('development');
     expect(await utils.parseIniFile('none')).toBe('none');
     expect(await utils.parseIniFile('php.ini-production')).toBe('production');
     expect(await utils.parseIniFile('php.ini-development')).toBe('development');
+    expect(await utils.parseIniFile('/etc/php.ini-production')).toBe(
+      'production'
+    );
+    expect(await utils.parseIniFile('/a-b/php.ini-development')).toBe(
+      'development'
+    );
     expect(await utils.parseIniFile('invalid')).toBe('production');
   });
 
@@ -85,6 +110,44 @@ describe('Utils tests', () => {
 
     expect(await utils.extensionArray('')).toEqual([]);
     expect(await utils.extensionArray(' ')).toEqual([]);
+
+    expect(
+      await utils.extensionArray('apcu, mbstring, \\ pdo_pgsql, posix, session')
+    ).toEqual(['apcu', 'mbstring', 'pdo_pgsql', 'posix', 'session']);
+  });
+
+  it('checking escapeForShell', () => {
+    expect(utils.escapeForShell('plain', 'linux')).toBe('plain');
+    expect(utils.escapeForShell('a"b', 'linux')).toBe('a\\"b');
+    expect(utils.escapeForShell('a$b`c\\d"e', 'linux')).toBe(
+      'a\\$b\\`c\\\\d\\"e'
+    );
+    expect(utils.escapeForShell('a$b`c"d', 'win32')).toBe('a`$b``c`"d');
+  });
+
+  it('checking safeArg', () => {
+    expect(utils.safeArg('plain', 'linux')).toBe('plain');
+    expect(utils.safeArg('vendor-pkg/repo@v1.0.0', 'linux')).toBe(
+      'vendor-pkg/repo@v1.0.0'
+    );
+    expect(utils.safeArg('phpcs:>=3.0', 'linux')).toBe('"phpcs:>=3.0"');
+    expect(utils.safeArg('vendor/foo:1.*', 'linux')).toBe('"vendor/foo:1.*"');
+    expect(utils.safeArg('foo$bar', 'linux')).toBe('"foo\\$bar"');
+    expect(utils.safeArg('foo$bar', 'win32')).toBe('"foo`$bar"');
+    expect(utils.safeArg('', 'linux')).toBe('');
+  });
+
+  it('checking sanitizeShellInput', () => {
+    expect(utils.sanitizeShellInput('mbstring, intl')).toBe('mbstring, intl');
+    expect(utils.sanitizeShellInput('foo;ls;bar')).toBe('foolsbar');
+    expect(utils.sanitizeShellInput('foo$(id)bar')).toBe('fooidbar');
+    expect(utils.sanitizeShellInput('a`b`c\\d"e\'f')).toBe('abcdef');
+    expect(utils.sanitizeShellInput('vendor/foo:1.*', true)).toBe(
+      'vendor/foo:1.'
+    );
+    expect(utils.sanitizeShellInput('vendor/foo@feat?ure', true)).toBe(
+      'vendor/foo@feature'
+    );
   });
 
   it('checking INIArray', async () => {
@@ -287,7 +350,7 @@ describe('Utils tests', () => {
 
     existsSync.mockReturnValue(true);
     readFileSync.mockReturnValue('setup-php');
-    expect(await utils.readPHPVersion()).toBe('setup-php');
+    await expect(utils.readPHPVersion()).rejects.toThrow('Invalid PHP version');
 
     existsSync.mockReturnValueOnce(false).mockReturnValueOnce(true);
     readFileSync.mockReturnValue(
@@ -308,6 +371,45 @@ describe('Utils tests', () => {
     readFileSync.mockClear();
   });
 
+  it('readPHPVersion rejects unsupported values from each source', async () => {
+    const existsSync = jest.spyOn(fs, 'existsSync').mockImplementation();
+    const readFileSync = jest.spyOn(fs, 'readFileSync').mockImplementation();
+
+    process.env['php-version'] = 'bogus';
+    await expect(utils.readPHPVersion()).rejects.toThrow(
+      'Invalid PHP version in php-version input'
+    );
+    delete process.env['php-version'];
+
+    existsSync.mockReturnValue(true);
+    readFileSync.mockReturnValue('bogus');
+    await expect(utils.readPHPVersion()).rejects.toThrow(
+      'Invalid PHP version in .php-version'
+    );
+
+    existsSync.mockReturnValueOnce(false).mockReturnValueOnce(true);
+    readFileSync.mockReturnValue(
+      JSON.stringify({'platform-overrides': {php: 'bogus'}})
+    );
+    await expect(utils.readPHPVersion()).rejects.toThrow(
+      'Invalid PHP version in composer.lock platform-overrides.php'
+    );
+
+    existsSync
+      .mockReturnValueOnce(false)
+      .mockReturnValueOnce(false)
+      .mockReturnValueOnce(true);
+    readFileSync.mockReturnValue(
+      JSON.stringify({config: {platform: {php: 'bogus'}}})
+    );
+    await expect(utils.readPHPVersion()).rejects.toThrow(
+      'Invalid PHP version in composer.json config.platform.php'
+    );
+
+    existsSync.mockClear();
+    readFileSync.mockClear();
+  });
+
   it('checking setVariable', async () => {
     let script: string = await utils.setVariable('var', 'command', 'linux');
     expect(script).toEqual('\nvar="$(command)"\n');

examples/bedrock.yml

@@ -8,7 +8,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
     steps:
       - name: Checkout
         uses: actions/checkout@v6

examples/blackfire-player.yml

@@ -4,6 +4,9 @@ on: [push, pull_request]
 jobs:
   blackfire-player:
     name: Blackfire (PHP ${{ matrix.php-versions }})
+    defaults:
+      run:
+        shell: bash
     # Add your Blackfire credentials securely using GitHub Secrets
     env:
       BLACKFIRE_SERVER_ID: ${{ secrets.BLACKFIRE_SERVER_ID }}
@@ -14,9 +17,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        operating-system: [ubuntu-latest, windows-latest, macos-latest]
+        operating-system: [ubuntu-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
-        # blackfire-player supports PHP >= 5.5
+        # Blackfire Player supports PHP 8.5 and is available on Ubuntu and macOS.
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -31,6 +34,14 @@ jobs:
           tools: blackfire, blackfire-player
           coverage: none
 
-      # Refer to https://blackfire.io/docs/player/index#usage
+      - name: Start local endpoint
+        run: |
+          php -S 127.0.0.1:8080 > "$RUNNER_TEMP/blackfire-player.log" 2>&1 &
+          sleep 5
+
+      - name: Validate scenario
+        run: blackfire-player validate scenario.bkf
+
+      # Refer to https://docs.blackfire.io/builds-cookbooks/player
       - name: Play the scenario
-        run: blackfire-player run scenario.bkf
+        run: blackfire-player run scenario.bkf --endpoint=http://127.0.0.1:8080

examples/blackfire.yml

@@ -15,8 +15,8 @@ jobs:
       fail-fast: false
       matrix:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
-        # Blackfire supports PHP >= 5.3 on Ubuntu and macOS, and PHP >= 5.4 on Windows
+        # Blackfire supports the current PHP releases on Ubuntu, macOS, and Windows.
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -26,12 +26,24 @@ jobs:
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php-versions }}
-          # Setup Blackfire extension and CLI
+          # Setup Blackfire extension and CLI.
-          extensions: blackfire
+          extensions: blackfire, :xdebug
           tools: blackfire
           # Disable Xdebug and PCOV coverage drivers
           coverage: none
 
       # Refer to https://blackfire.io/docs/cookbooks/profiling-cli
       - name: Profile
-        run: blackfire run php my-script.php
+        shell: bash
+        run: |
+          set +e
+          output=$(blackfire run php my-script.php 2>&1)
+          exit_code=$?
+          printf '%s\n' "$output"
+          if [ "$exit_code" -ne 0 ]; then
+            if printf '%s' "$output" | grep -q "upgrade your subscription"; then
+              echo "Blackfire profiling reached the repository quota limit; treating this as a known non-fatal condition."
+              exit 0
+            fi
+            exit "$exit_code"
+          fi

examples/cakephp-mysql.yml

@@ -6,7 +6,8 @@ jobs:
   tests:
     strategy:
       matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.4', '8.5']
+        # The latest cakephp/app release resolves dev dependencies that require PHP 8.4+.
     runs-on: ubuntu-latest
 
     # Docs: https://docs.github.com/en/actions/using-containerized-services
@@ -37,7 +38,7 @@ jobs:
           php-version: ${{ matrix.php-versions }}
           # You can also use ext-apcu or ext-memcached instead of ext-redis
           # Install memcached if using ext-memcached
-          extensions: mbstring, intl, redis, pdo_mysql
+          extensions: mbstring, intl, redis, apcu, pdo_mysql
           coverage: pcov
 
       # Local MySQL service in GitHub hosted environments is disabled by default.
@@ -61,14 +62,15 @@ jobs:
       - name: Install dependencies
         run: |
           composer install --no-progress --prefer-dist --optimize-autoloader
-          composer run-script post-install-cmd
+          composer run-script post-install-cmd --no-interaction
 
       # Add a step to run migrations if required
       - name: Test with phpunit
         run: vendor/bin/phpunit --coverage-text
         env:
           REDIS_PORT: ${{ job.services.redis.ports['6379'] }}
-          DB_DSN: "mysql://root:password@127.0.0.1:${{ job.services.mysql.ports['3306'] }}/cakephp?init[]=SET sql_mode = \"STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION\""
+          DATABASE_URL: "mysql://root:password@127.0.0.1:${{ job.services.mysql.ports['3306'] }}/cakephp?init[]=SET sql_mode = \"STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION\""
+          DATABASE_TEST_URL: "mysql://root:password@127.0.0.1:${{ job.services.mysql.ports['3306'] }}/cakephp?init[]=SET sql_mode = \"STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION\""
 
   coding-standard:
     name: Coding Standard
@@ -81,7 +83,7 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.1'
+          php-version: '8.5'
           extensions: mbstring, intl
 
       - name: Get composer cache directory
@@ -114,7 +116,7 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.1'
+          php-version: '8.5'
           extensions: mbstring, intl
           tools: phpstan
 
@@ -132,7 +134,9 @@ jobs:
           restore-keys: ${{ runner.os }}-composer-
 
       - name: Install dependencies
-        run: composer install --no-progress --prefer-dist --optimize-autoloader
+        run: |
+          composer install --no-progress --prefer-dist --optimize-autoloader
+          composer run-script post-install-cmd --no-interaction
 
       - name: Static Analysis using PHPStan
         run: phpstan analyse --no-progress src/

examples/cakephp-postgres.yml

@@ -5,8 +5,10 @@ on: [push, pull_request]
 jobs:
   tests:
     strategy:
+      fail-fast: false
       matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.4', '8.5']
+        # The latest cakephp/app release resolves dev dependencies that require PHP 8.4+.
     runs-on: ubuntu-latest
 
     # Docs: https://docs.github.com/en/actions/using-containerized-services
@@ -37,7 +39,7 @@ jobs:
           php-version: ${{ matrix.php-versions }}
           # You can also use ext-apcu or ext-memcached instead of ext-redis
           # Install memcached if using ext-memcached
-          extensions: mbstring, intl, redis, pdo_pgsql
+          extensions: mbstring, intl, redis, apcu, pdo_pgsql
           coverage: pcov
 
       # Local PostgreSQL service in GitHub hosted environments is disabled by default.
@@ -61,14 +63,15 @@ jobs:
       - name: Install dependencies
         run: |
           composer install --no-progress --prefer-dist --optimize-autoloader
-          composer run-script post-install-cmd
+          composer run-script post-install-cmd --no-interaction
 
       # Add a step to run migrations if required
       - name: Test with phpunit
         run: vendor/bin/phpunit --coverage-text
         env:
           REDIS_PORT: ${{ job.services.redis.ports['6379'] }}
-          DB_DSN: postgres://postgres@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/postgres
+          DATABASE_URL: postgres://postgres:postgres@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/postgres?encoding=UTF8
+          DATABASE_TEST_URL: postgres://postgres:postgres@127.0.0.1:${{ job.services.postgres.ports['5432'] }}/postgres?encoding=UTF8
 
   coding-standard:
     name: Coding Standard
@@ -81,8 +84,8 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.1'
+          php-version: '8.5'
-          extensions: mbstring, intl
+          extensions: mbstring, intl, apcu
 
       - name: Get composer cache directory
         id: composer-cache
@@ -114,8 +117,8 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.1'
+          php-version: '8.5'
-          extensions: mbstring, intl
+          extensions: mbstring, intl, apcu
           tools: phpstan
 
       - name: Get composer cache directory
@@ -132,7 +135,9 @@ jobs:
           restore-keys: ${{ runner.os }}-composer-
 
       - name: Install dependencies
-        run: composer install --no-progress --prefer-dist --optimize-autoloader
+        run: |
+          composer install --no-progress --prefer-dist --optimize-autoloader
+          composer run-script post-install-cmd --no-interaction
 
       - name: Static Analysis using PHPStan
         run: phpstan analyse --no-progress src/

examples/cakephp.yml

@@ -7,7 +7,8 @@ jobs:
     strategy:
       matrix:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.4', '8.5']
+        # The latest cakephp/app release resolves dev dependencies that require PHP 8.4+.
     runs-on: ${{ matrix.operating-system }}
     steps:
       - name: Checkout
@@ -23,6 +24,7 @@ jobs:
 
       - name: Get composer cache directory
         id: composer-cache
+        shell: bash
         run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Cache composer dependencies
@@ -37,7 +39,7 @@ jobs:
       - name: Install dependencies
         run: |
           composer install --no-progress --prefer-dist --optimize-autoloader
-          composer run-script post-install-cmd
+          composer run-script post-install-cmd --no-interaction
 
       - name: Test with phpunit
         run: vendor/bin/phpunit --coverage-text
@@ -53,10 +55,11 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.1'
+          php-version: '8.5'
           extensions: mbstring, intl
       - name: Get composer cache directory
         id: composer-cache
+        shell: bash
         run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Cache composer dependencies
@@ -85,12 +88,13 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.1'
+          php-version: '8.5'
           extensions: mbstring, intl
           tools: phpstan
 
       - name: Get composer cache directory
         id: composer-cache
+        shell: bash
         run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Cache composer dependencies
@@ -103,7 +107,9 @@ jobs:
           restore-keys: ${{ runner.os }}-composer-
 
       - name: Install dependencies
-        run: composer install --no-progress --prefer-dist --optimize-autoloader
+        run: |
+          composer install --no-progress --prefer-dist --optimize-autoloader
+          composer run-script post-install-cmd --no-interaction
 
       - name: Static Analysis using PHPStan
         run: phpstan analyse --no-progress src/

examples/codeigniter.yml

@@ -6,7 +6,7 @@ jobs:
     strategy:
       matrix:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
     runs-on: ${{ matrix.operating-system }}
     steps:
       - name: Checkout
@@ -17,12 +17,13 @@ jobs:
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php-versions }}
-          extensions: mbstring, intl, curl, dom
+          extensions: mbstring, intl, curl, dom, sqlite3, pdo_sqlite
           coverage: xdebug
 
       - name: Get composer cache directory
         id: composer-cache
-        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+        shell: bash
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
 
       - name: Cache composer dependencies
         uses: actions/cache@v5

examples/drupal.yml

@@ -0,0 +1,59 @@
+# GitHub Action for Drupal 11 composer-managed projects
+# Requires drupal/core-dev in require-dev for vendor/bin/phpunit
+name: Testing Drupal
+on: [push, pull_request]
+jobs:
+  drupal:
+    name: Drupal (PHP ${{ matrix.php-versions }})
+    runs-on: ubuntu-latest
+    env:
+      SIMPLETEST_BASE_URL: http://127.0.0.1:8080
+      SIMPLETEST_DB: sqlite://localhost/sites/default/files/.ht.sqlite
+      BROWSERTEST_OUTPUT_DIRECTORY: /tmp/browser_output
+    strategy:
+      fail-fast: false
+      matrix:
+        php-versions: ['8.3', '8.4', '8.5']
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      # Docs: https://github.com/shivammathur/setup-php
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-versions }}
+          extensions: apcu, ctype, curl, dom, gd, iconv, intl, mbstring, pdo_sqlite, simplexml, xml, zip
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache composer dependencies
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          # Use composer.json for key, if composer.lock is not committed.
+          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install Composer dependencies
+        run: |
+          if [ "${{ matrix.php-versions }}" = "8.3" ]; then
+            composer require --dev drupal/core-dev:11.2.10 doctrine/instantiator:^2.0.0 --no-interaction --no-update
+            composer update drupal/core-dev doctrine/instantiator --with-all-dependencies --no-interaction --no-progress --prefer-dist --optimize-autoloader
+          else
+            composer install --no-interaction --no-progress --prefer-dist --optimize-autoloader
+          fi
+
+      - name: Prepare Drupal test directories
+        run: mkdir -p web/sites/default/files "$BROWSERTEST_OUTPUT_DIRECTORY"
+
+      - name: Start Drupal web server
+        run: php -S 127.0.0.1:8080 -t web >/tmp/php-server.log 2>&1 &
+
+      - name: Test with phpunit
+        # Adjust the test path to match your custom modules or themes.
+        run: vendor/bin/phpunit -c web/core web/modules/custom

examples/laminas-mvc.yml

@@ -1,12 +1,12 @@
 # GitHub Action for Laminas framework MVC projects
-name: Testing Zend Framework
+name: Testing Laminas MVC
 on: [push, pull_request]
 jobs:
   build:
     strategy:
       matrix:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.1', '8.2', '8.3']
     runs-on: ${{ matrix.operating-system }}
     steps:
       - name: Checkout
@@ -21,6 +21,7 @@ jobs:
 
       - name: Get composer cache directory
         id: composer-cache
+        shell: bash
         run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Cache composer dependencies

examples/laravel-mysql.yml

@@ -6,11 +6,13 @@ jobs:
     name: Laravel (PHP ${{ matrix.php-versions }})
     runs-on: ubuntu-latest
     env:
+      DB_CONNECTION: mysql
+      DB_HOST: 127.0.0.1
       DB_DATABASE: laravel
       DB_USERNAME: root
       DB_PASSWORD: password
-      BROADCAST_DRIVER: log
+      BROADCAST_CONNECTION: log
-      CACHE_DRIVER: redis
+      CACHE_STORE: redis
       QUEUE_CONNECTION: redis
       SESSION_DRIVER: redis
 
@@ -34,7 +36,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
     steps:
       - name: Checkout
         uses: actions/checkout@v6

examples/laravel-postgres.yml

@@ -11,7 +11,7 @@ jobs:
       QUEUE_CONNECTION: redis
       SESSION_DRIVER: redis
       DB_CONNECTION: pgsql
-      DB_HOST: localhost
+      DB_HOST: 127.0.0.1
       DB_PASSWORD: postgres
       DB_USERNAME: postgres
       DB_DATABASE: postgres
@@ -36,7 +36,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -81,11 +81,11 @@ jobs:
       - name: Run Migration
         run: php artisan migrate -v
         env:
-          DB_PORT: ${{ job.services.postgres.ports[5432] }}
+          DB_PORT: ${{ job.services.postgres.ports['5432'] }}
           REDIS_PORT: ${{ job.services.redis.ports['6379'] }}
 
       - name: Test with phpunit
         run: vendor/bin/phpunit --coverage-text
         env:
-          DB_PORT: ${{ job.services.postgres.ports[5432] }}
+          DB_PORT: ${{ job.services.postgres.ports['5432'] }}
           REDIS_PORT: ${{ job.services.redis.ports['6379'] }}

examples/laravel.yml

@@ -9,7 +9,7 @@ jobs:
       fail-fast: false
       matrix:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -24,6 +24,7 @@ jobs:
 
       - name: Get composer cache directory
         id: composer-cache
+        shell: bash
         run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Cache composer dependencies

examples/lumen-mysql.yml

@@ -34,7 +34,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -83,7 +83,7 @@ jobs:
           REDIS_PORT: ${{ job.services.redis.ports['6379'] }}
 
       - name: Test with phpunit
-        run: vendor/bin/phpunit --coverage-text
+        run: vendor/bin/phpunit --coverage-text --coverage-filter app
         env:
           DB_PORT: ${{ job.services.mysql.ports['3306'] }}
           REDIS_PORT: ${{ job.services.redis.ports['6379'] }}

examples/lumen-postgres.yml

@@ -11,7 +11,7 @@ jobs:
       QUEUE_CONNECTION: redis
       SESSION_DRIVER: redis
       DB_CONNECTION: pgsql
-      DB_HOST: localhost
+      DB_HOST: 127.0.0.1
       DB_PASSWORD: postgres
       DB_USERNAME: postgres
       DB_DATABASE: postgres
@@ -36,7 +36,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -47,7 +47,7 @@ jobs:
         with:
           php-version: ${{ matrix.php-versions }}
           extensions: mbstring, dom, fileinfo, pgsql
-          coverage: xdebug
+          coverage: none
 
       # Local PostgreSQL service in GitHub hosted environments is disabled by default.
       # If you are using it instead of service containers, make sure you start it.
@@ -81,11 +81,11 @@ jobs:
       - name: Run Migration
         run: php artisan migrate -v
         env:
-          DB_PORT: ${{ job.services.postgres.ports[5432] }}
+          DB_PORT: ${{ job.services.postgres.ports['5432'] }}
           REDIS_PORT: ${{ job.services.redis.ports['6379'] }}
 
       - name: Test with phpunit
-        run: vendor/bin/phpunit --coverage-text
+        run: vendor/bin/phpunit
         env:
-          DB_PORT: ${{ job.services.postgres.ports[5432] }}
+          DB_PORT: ${{ job.services.postgres.ports['5432'] }}
           REDIS_PORT: ${{ job.services.redis.ports['6379'] }}

examples/lumen.yml

@@ -9,7 +9,7 @@ jobs:
       fail-fast: false
       matrix:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -24,6 +24,7 @@ jobs:
 
       - name: Get composer cache directory
         id: composer-cache
+        shell: bash
         run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Cache composer dependencies
@@ -42,4 +43,4 @@ jobs:
         run: php -r "file_exists('.env') || copy('.env.example', '.env');"
 
       - name: Test with phpunit
-        run: vendor/bin/phpunit --coverage-text
+        run: vendor/bin/phpunit --coverage-text --coverage-filter app

examples/phalcon-mysql.yml

@@ -11,7 +11,7 @@ jobs:
     env:
       DB_ADAPTER: mysql
       DB_HOST: 127.0.0.1
-      DB_NAME: phalcon
+      DB_NAME: vokuro
       DB_USERNAME: root
       DB_PASSWORD: password
       CODECEPTION_URL: 127.0.0.1
@@ -20,11 +20,11 @@ jobs:
     # Docs: https://docs.github.com/en/actions/using-containerized-services
     services:
       mysql:
-        image: mysql:latest
+        image: mysql:5.7
         env:
           MYSQL_ALLOW_EMPTY_PASSWORD: false
           MYSQL_ROOT_PASSWORD: password
-          MYSQL_DATABASE: phalcon
+          MYSQL_DATABASE: vokuro
         ports:
           - 3306/tcp
         options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
@@ -32,8 +32,6 @@ jobs:
       fail-fast: false
       matrix:
         php-versions: ['7.2', '7.3', '7.4']
-        # For phalcon 3.x, use
-        # php-versions: ['7.0', '7.1', '7.2', '7.3']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -43,7 +41,7 @@ jobs:
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php-versions }}
-          # Use phalcon3 for the phalcon 3.x.
+          # Use phalcon4 for the latest compatible Vokuro sample release.
           extensions: mbstring, dom, zip, phalcon4, mysql
           coverage: xdebug
 
@@ -73,7 +71,6 @@ jobs:
 
       - name: Run Migration
         run: |
-          if [ ! -e phinx.yml ]; then vendor/bin/phinx init; fi
           vendor/bin/phinx migrate
           vendor/bin/phinx seed:run
         env:

examples/phalcon-postgres.yml

@@ -11,21 +11,18 @@ jobs:
     env:
       DB_ADAPTER: pgsql
       DB_HOST: 127.0.0.1
-      DB_NAME: postgres
+      DB_NAME: vokuro
       DB_USERNAME: postgres
       DB_PASSWORD: postgres
       CODECEPTION_URL: 127.0.0.1
       CODECEPTION_PORT: 8888
-      DB_CONNECTION: pgsql
-
-    # Docs: https://docs.github.com/en/actions/using-containerized-services
     services:
       postgres:
         image: postgres:latest
         env:
           POSTGRES_USER: postgres
           POSTGRES_PASSWORD: postgres
-          POSTGRES_DB: postgres
+          POSTGRES_DB: vokuro
         ports:
           - 5432/tcp
         options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 3
@@ -33,8 +30,6 @@ jobs:
       fail-fast: false
       matrix:
         php-versions: ['7.2', '7.3', '7.4']
-        # For phalcon 3.x, use
-        # php-versions: ['7.0', '7.1', '7.2', '7.3']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -44,40 +39,39 @@ jobs:
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php-versions }}
-          # Use phalcon3 for the phalcon 3.x
           extensions: mbstring, dom, zip, phalcon4, pgsql
           coverage: xdebug
 
-      # Local PostgreSQL service in GitHub hosted environments is disabled by default.
-      # If you are using it instead of service containers, make sure you start it.
-      # - name: Start postgresql service
-      #   run: sudo systemctl start postgresql.service
-
       - name: Get composer cache directory
         id: composer-cache
         run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
       - name: Cache composer dependencies
         uses: actions/cache@v5
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
-          # Use composer.json for key, if composer.lock is not committed.
-          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
           restore-keys: ${{ runner.os }}-composer-
+
       - name: Install Composer dependencies
-        run: composer install --no-progress --prefer-dist --optimize-autoloader
+        run: composer install --no-progress --prefer-dist --optimize-autoloader --no-security-blocking
+
       - name: Prepare the application
-        run: php -r "file_exists('.env') || copy('.env.example', '.env');"
+        run: |
+          php -r "file_exists('.env') || copy('.env.example', '.env');"
+          mkdir -p var/cache/acl var/cache/metaData var/cache/session var/cache/volt var/logs
+          chmod -R 777 var/cache var/logs
+
       - name: Run Migration
         run: |
-          if [ ! -e phinx.yml ]; then vendor/bin/phinx init; fi
           vendor/bin/phinx migrate
           vendor/bin/phinx seed:run
         env:
           DB_PORT: ${{ job.services.postgres.ports['5432'] }}
+
       - name: Run Tests
         run: |
-          (cd public && nohup php -S $CODECEPTION_URL:$CODECEPTION_PORT > phalcon.log 2>&1 &)
+          (cd public && nohup php -S $CODECEPTION_URL:$CODECEPTION_PORT > vokuro.log 2>&1 &)
           vendor/bin/codecept build
           vendor/bin/codecept run
         env:

examples/sage.yml

@@ -8,8 +8,8 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
-        node-versions: ['16']
+        node-versions: ['20']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -53,17 +53,10 @@ jobs:
           restore-keys: ${{ runner.os }}-composer-
 
       - name: Install yarn dependencies
-        run: yarn -V
+        run: yarn install --frozen-lockfile --non-interactive
 
       - name: Install Composer dependencies
         run: composer install --no-progress --prefer-dist --optimize-autoloader
 
-      - name: Yarn test and build
+      - name: Yarn build
-        run: |
+        run: yarn build
-          yarn run test
-          yarn run build
-          yarn run rmdist
-          yarn run "build:production"
-
-      - name: PHP test
-        run: composer test

examples/slim-framework.yml

@@ -6,7 +6,7 @@ jobs:
     strategy:
       matrix:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.3', '8.4', '8.5']
     runs-on: ${{ matrix.operating-system }}
     steps:
       - name: Checkout
@@ -22,6 +22,7 @@ jobs:
 
       - name: Get composer cache directory
         id: composer-cache
+        shell: bash
         run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Cache composer dependencies

examples/symfony-mysql.yml

@@ -5,11 +5,13 @@ jobs:
   symfony:
     name: Symfony (PHP ${{ matrix.php-versions }})
     runs-on: ubuntu-latest
+    env:
+      APP_ENV: test
 
     # Docs: https://docs.github.com/en/actions/using-containerized-services
     services:
       mysql:
-        image: mysql:latest
+        image: mysql:8.4
         env:
           MYSQL_ALLOW_EMPTY_PASSWORD: false
           MYSQL_ROOT_PASSWORD: symfony
@@ -20,7 +22,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.4', '8.5', '8.6']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -30,7 +32,6 @@ jobs:
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php-versions }}
-          tools: phpunit-bridge
           extensions: mbstring, xml, ctype, iconv, intl, pdo_sqlite, mysql
           coverage: xdebug
 
@@ -53,18 +54,17 @@ jobs:
           restore-keys: ${{ runner.os }}-composer-
 
       - name: Install Composer dependencies
-        run: composer install --no-progress --prefer-dist --optimize-autoloader
+        run: composer install --no-interaction --no-progress --prefer-dist --optimize-autoloader
 
-      - name: Run Migration
+      - name: Prepare database
         run: |
-          composer require --dev symfony/orm-pack
+          php bin/console doctrine:database:create --if-not-exists --no-interaction
-          php bin/console doctrine:schema:update --force || echo "No migrations found or schema update failed"
+          php bin/console doctrine:schema:create --no-interaction
-          php bin/console doctrine:migrations:migrate || echo "No migrations found or migration failed"
+          php bin/console doctrine:fixtures:load --no-interaction
         env:
-          DATABASE_URL: mysql://root:symfony@127.0.0.1:${{ job.services.mysql.ports['3306'] }}/symfony
+          DATABASE_URL: mysql://root:symfony@127.0.0.1:${{ job.services.mysql.ports['3306'] }}/symfony?serverVersion=8.4&charset=utf8mb4
-
-      - name: Install PHPUnit
-        run: simple-phpunit install
 
       - name: Run tests
-        run: simple-phpunit --coverage-text
+        run: php bin/phpunit --coverage-text
+        env:
+          DATABASE_URL: mysql://root:symfony@127.0.0.1:${{ job.services.mysql.ports['3306'] }}/symfony?serverVersion=8.4&charset=utf8mb4

examples/symfony-postgres.yml

@@ -5,11 +5,13 @@ jobs:
   symfony:
     name: Symfony (PHP ${{ matrix.php-versions }})
     runs-on: ubuntu-latest
+    env:
+      APP_ENV: test
 
     # Docs: https://docs.github.com/en/actions/using-containerized-services
     services:
       postgres:
-        image: postgres:latest
+        image: postgres:16
         env:
           POSTGRES_USER: postgres
           POSTGRES_PASSWORD: postgres
@@ -20,7 +22,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.4', '8.5', '8.6']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -30,8 +32,7 @@ jobs:
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php-versions }}
-          tools: phpunit-bridge
+          extensions: mbstring, xml, ctype, iconv, intl, pdo_pgsql, pgsql
-          extensions: mbstring, xml, ctype, iconv, intl, pdo_sqlite, pgsql
           coverage: xdebug
 
       # Local PostgreSQL service in GitHub hosted environments is disabled by default.
@@ -55,16 +56,15 @@ jobs:
       - name: Install Composer dependencies
         run: composer install --no-progress --prefer-dist --optimize-autoloader
 
-      - name: Run Migration
+      - name: Prepare database
         run: |
-          composer require --dev symfony/orm-pack
+          php bin/console doctrine:database:create --if-not-exists --no-interaction
-          php bin/console doctrine:schema:update --force || echo "No migrations found or schema update failed"
+          php bin/console doctrine:schema:create --no-interaction
-          php bin/console doctrine:migrations:migrate || echo "No migrations found or migration failed"
+          php bin/console doctrine:fixtures:load --no-interaction
         env:
-          DATABASE_URL: postgres://postgres:postgres@127.0.0.1:${{ job.services.postgres.ports[5432] }}/postgres?charset=UTF-8
+          DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:${{ job.services.postgres.ports[5432] }}/postgres?serverVersion=16.0.0&charset=utf8
-
-      - name: Install PHPUnit
-        run: simple-phpunit install
 
       - name: Run tests
-        run: simple-phpunit --coverage-text
+        run: php bin/phpunit --coverage-text
+        env:
+          DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:${{ job.services.postgres.ports[5432] }}/postgres?serverVersion=16.0.0&charset=utf8

examples/symfony.yml

@@ -9,7 +9,7 @@ jobs:
       fail-fast: false
       matrix:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
-        php-versions: ['7.4', '8.0', '8.1']
+        php-versions: ['8.4', '8.5', '8.6']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -19,12 +19,12 @@ jobs:
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php-versions }}
-          tools: phpunit-bridge
+          extensions: mbstring, xml, ctype, iconv, intl, pdo_sqlite, zip
-          extensions: mbstring, xml, ctype, iconv, intl, pdo_sqlite
           coverage: xdebug
 
       - name: Get composer cache directory
         id: composer-cache
+        shell: bash
         run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Cache composer dependencies
@@ -39,8 +39,5 @@ jobs:
       - name: Install Composer dependencies
         run: composer install --no-progress --prefer-dist --optimize-autoloader
 
-      - name: Install PHPUnit
-        run: simple-phpunit install
-
       - name: Run tests
-        run: simple-phpunit --coverage-text
+        run: ./bin/phpunit --coverage-text

examples/wordpress.yml

@@ -0,0 +1,68 @@
+# GitHub Action for WordPress plugins
+# Tested with files scaffolded by wp scaffold plugin-tests --ci=github
+# Requires phpunit/phpunit and yoast/phpunit-polyfills in require-dev for vendor/bin/phpunit
+name: Testing WordPress
+on: [push, pull_request]
+jobs:
+  wordpress:
+    name: WordPress (PHP ${{ matrix.php-versions }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php-versions: ['8.3', '8.4', '8.5']
+
+    # Docs: https://docs.github.com/en/actions/using-containerized-services
+    services:
+      mysql:
+        image: mysql:latest
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: false
+          MYSQL_ROOT_PASSWORD: root
+          MYSQL_DATABASE: wordpress_test
+        ports:
+          - 3306/tcp
+        options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      # Docs: https://github.com/shivammathur/setup-php
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-versions }}
+          extensions: mbstring, xml, zip, intl, mysql
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache composer dependencies
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          # Use composer.json for key, if composer.lock is not committed.
+          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y subversion default-mysql-client
+
+      - name: Install Composer dependencies
+        run: |
+          if [ "${{ matrix.php-versions }}" = "8.3" ]; then
+            composer require --dev doctrine/instantiator:^2.0.0 --no-interaction --no-update
+            composer update doctrine/instantiator --with-all-dependencies --no-interaction --no-progress --prefer-dist --optimize-autoloader
+          else
+            composer install --no-interaction --no-progress --prefer-dist --optimize-autoloader
+          fi
+
+      - name: Install WordPress test environment
+        run: bash bin/install-wp-tests.sh wordpress_test root root 127.0.0.1:${{ job.services.mysql.ports['3306'] }} latest true
+
+      - name: Test with phpunit
+        run: vendor/bin/phpunit

examples/yii2-mysql.yml

@@ -1,86 +0,0 @@
-# GitHub Action for Yii Framework with MySQL
-name: Testing Yii2 with MySQL
-on: [push, pull_request]
-jobs:
-  yii:
-    name: Yii2 (PHP ${{ matrix.php-versions }})
-    runs-on: ubuntu-latest
-    env:
-      DB_USERNAME: root
-      DB_PASSWORD: yii
-      TEST_DB_USERNAME: root
-      TEST_DB_PASSWORD: yii
-      DB_CHARSET: utf8
-
-    # Docs: https://docs.github.com/en/actions/using-containerized-services
-    services:
-      mysql:
-        image: mysql:latest
-        env:
-          MYSQL_ALLOW_EMPTY_PASSWORD: false
-          MYSQL_ROOT_PASSWORD: yii
-          MYSQL_DATABASE: yii
-        ports:
-          - 3306/tcp
-        options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
-    strategy:
-      fail-fast: false
-      matrix:
-        php-versions: ['7.4', '8.0']
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Set Node.js 10.x
-        uses: actions/setup-node@v5
-        with:
-          node-version: 10.x
-
-      # Docs: https://github.com/shivammathur/setup-php
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php-versions }}
-          extensions: mbstring, intl, gd, imagick, zip, dom, mysql
-          coverage: xdebug
-
-      # Local MySQL service in GitHub hosted environments is disabled by default.
-      # If you are using it instead of service containers, make sure you start it.
-      # - name: Start mysql service
-      #   run: sudo systemctl start mysql.service
-
-      - name: Get composer cache directory
-        id: composer-cache
-        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
-
-      - name: Cache composer dependencies
-        uses: actions/cache@v5
-        with:
-          path: ${{ steps.composer-cache.outputs.dir }}
-          # Use composer.json for key, if composer.lock is not committed.
-          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
-          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
-          restore-keys: ${{ runner.os }}-composer-
-
-      - name: Install Composer dependencies
-        run: composer install --no-progress --prefer-dist --optimize-autoloader
-
-      - name: Prepare the application
-        run: |
-          php -r "file_exists('.env') || copy('.env.dist', '.env');"
-          php console/yii app/setup
-          npm install --development
-          npm run build
-        env:
-          DB_DSN: mysql:host=127.0.0.1;port=${{ job.services.mysql.ports['3306'] }};dbname=yii
-          TEST_DB_DSN: mysql:host=127.0.0.1;port=${{ job.services.mysql.ports['3306'] }};dbname=yii
-
-      - name: Run Tests
-        run: |
-          vendor/bin/codecept build
-          php tests/bin/yii app/setup --interactive=0
-          nohup php -S localhost:8080 > yii.log 2>&1 &
-          vendor/bin/codecept run
-        env:
-          DB_DSN: mysql:host=127.0.0.1;port=${{ job.services.mysql.ports['3306'] }};dbname=yii
-          TEST_DB_DSN: mysql:host=127.0.0.1;port=${{ job.services.mysql.ports['3306'] }};dbname=yii

examples/yii2-postgres.yml

@@ -1,86 +0,0 @@
-# GitHub Action for Yii Framework with PostgreSQL
-name: Testing Yii2 with PostgreSQL
-on: [push, pull_request]
-jobs:
-  yii:
-    name: Yii2 (PHP ${{ matrix.php-versions }})
-    runs-on: ubuntu-latest
-    env:
-      DB_USERNAME: postgres
-      DB_PASSWORD: postgres
-      TEST_DB_USERNAME: postgres
-      TEST_DB_PASSWORD: postgres
-      DB_CHARSET: utf8
-
-    # Docs: https://docs.github.com/en/actions/using-containerized-services
-    services:
-      postgres:
-        image: postgres:latest
-        env:
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: postgres
-          POSTGRES_DB: postgres
-        ports:
-          - 5432/tcp
-        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 3
-    strategy:
-      fail-fast: false
-      matrix:
-        php-versions: ['7.4', '8.0']
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Set Node.js 10.x
-        uses: actions/setup-node@v5
-        with:
-          node-version: 10.x
-
-      # Docs: https://github.com/shivammathur/setup-php
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php-versions }}
-          extensions: mbstring, intl, gd, imagick, zip, dom, pgsql
-          coverage: xdebug
-
-      # Local PostgreSQL service in GitHub hosted environments is disabled by default.
-      # If you are using it instead of service containers, make sure you start it.
-      # - name: Start postgresql service
-      #   run: sudo systemctl start postgresql.service
-
-      - name: Get composer cache directory
-        id: composer-cache
-        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
-
-      - name: Cache composer dependencies
-        uses: actions/cache@v5
-        with:
-          path: ${{ steps.composer-cache.outputs.dir }}
-          # Use composer.json for key, if composer.lock is not committed.
-          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
-          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
-          restore-keys: ${{ runner.os }}-composer-
-
-      - name: Install Composer dependencies
-        run: composer install --no-progress --prefer-dist --optimize-autoloader
-
-      - name: Prepare the application
-        run: |
-          php -r "file_exists('.env') || copy('.env.dist', '.env');"
-          php console/yii app/setup
-          npm install --development
-          npm run build
-        env:
-          DB_DSN: pgsql:host=127.0.0.1;port=${{ job.services.postgres.ports['5432'] }};dbname=postgres
-          TEST_DB_DSN: pgsql:host=127.0.0.1;port=${{ job.services.postgres.ports['5432'] }};dbname=postgres
-
-      - name: Run Tests
-        run: |
-          vendor/bin/codecept build
-          php tests/bin/yii app/setup --interactive=0
-          nohup php -S localhost:8080 > yii.log 2>&1 &
-          vendor/bin/codecept run
-        env:
-          DB_DSN: pgsql:host=127.0.0.1;port=${{ job.services.postgres.ports['5432'] }};dbname=postgres
-          TEST_DB_DSN: pgsql:host=127.0.0.1;port=${{ job.services.postgres.ports['5432'] }};dbname=postgres

examples/yii3-mysql.yml

@@ -0,0 +1,78 @@
+# GitHub Action for Yii3 web application with MySQL
+# Tested with https://github.com/yiisoft/app
+name: Testing Yii3 with MySQL
+on: [push, pull_request]
+jobs:
+  yii:
+    name: Yii3 (PHP ${{ matrix.php-versions }})
+    runs-on: ubuntu-latest
+    env:
+      APP_C3: true
+      APP_ENV: test
+      APP_DEBUG: false
+
+    # Docs: https://docs.github.com/en/actions/using-containerized-services
+    services:
+      mysql:
+        image: mysql:8.4
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: false
+          MYSQL_ROOT_PASSWORD: password
+          MYSQL_DATABASE: app
+        ports:
+          - 3306/tcp
+        options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
+    strategy:
+      fail-fast: false
+      matrix:
+        php-versions: ['8.4', '8.5']
+        # The latest yiisoft/app release resolves Symfony 8.0 packages that require PHP 8.4+.
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      # Docs: https://github.com/shivammathur/setup-php
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-versions }}
+          extensions: fileinfo, intl, pdo_mysql
+          ini-values: date.timezone='UTC', register_argc_argv=On
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache composer dependencies
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          # Use composer.json for key, if composer.lock is not committed.
+          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install Composer dependencies
+        run: composer install --no-progress --prefer-dist --optimize-autoloader
+
+      - name: Run migrations
+        run: php yii migrate:up --no-interaction
+        env:
+          DB_HOST: 127.0.0.1
+          DB_PORT: ${{ job.services.mysql.ports['3306'] }}
+          DB_NAME: app
+          DB_USERNAME: root
+          DB_PASSWORD: password
+
+      - name: Run codeception build
+        run: vendor/bin/codecept build
+
+      - name: Run tests with Codeception
+        run: vendor/bin/codecept run
+        env:
+          DB_HOST: 127.0.0.1
+          DB_PORT: ${{ job.services.mysql.ports['3306'] }}
+          DB_NAME: app
+          DB_USERNAME: root
+          DB_PASSWORD: password

examples/yii3-postgres.yml

@@ -0,0 +1,78 @@
+# GitHub Action for Yii3 web application with PostgreSQL
+# Tested with https://github.com/yiisoft/app
+name: Testing Yii3 with PostgreSQL
+on: [push, pull_request]
+jobs:
+  yii:
+    name: Yii3 (PHP ${{ matrix.php-versions }})
+    runs-on: ubuntu-latest
+    env:
+      APP_C3: true
+      APP_ENV: test
+      APP_DEBUG: false
+
+    # Docs: https://docs.github.com/en/actions/using-containerized-services
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: app
+        ports:
+          - 5432/tcp
+        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 3
+    strategy:
+      fail-fast: false
+      matrix:
+        php-versions: ['8.4', '8.5']
+        # The latest yiisoft/app release resolves Symfony 8.0 packages that require PHP 8.4+.
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      # Docs: https://github.com/shivammathur/setup-php
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-versions }}
+          extensions: fileinfo, intl, pdo_pgsql
+          ini-values: date.timezone='UTC', register_argc_argv=On
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache composer dependencies
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          # Use composer.json for key, if composer.lock is not committed.
+          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install Composer dependencies
+        run: composer install --no-progress --prefer-dist --optimize-autoloader
+
+      - name: Run migrations
+        run: php yii migrate:up --no-interaction
+        env:
+          DB_HOST: 127.0.0.1
+          DB_PORT: ${{ job.services.postgres.ports['5432'] }}
+          DB_NAME: app
+          DB_USERNAME: postgres
+          DB_PASSWORD: postgres
+
+      - name: Run codeception build
+        run: vendor/bin/codecept build
+
+      - name: Run tests with Codeception
+        run: vendor/bin/codecept run
+        env:
+          DB_HOST: 127.0.0.1
+          DB_PORT: ${{ job.services.postgres.ports['5432'] }}
+          DB_NAME: app
+          DB_USERNAME: postgres
+          DB_PASSWORD: postgres

examples/yii3.yml

@@ -0,0 +1,53 @@
+# GitHub Action for Yii3 web application
+# Tested with https://github.com/yiisoft/app
+name: Testing Yii3
+on: [push, pull_request]
+jobs:
+  yii:
+    name: Yii3 (PHP ${{ matrix.php-versions }} on ${{ matrix.operating-system }})
+    runs-on: ${{ matrix.operating-system }}
+    env:
+      APP_C3: true
+      APP_ENV: test
+      APP_DEBUG: false
+    strategy:
+      fail-fast: false
+      matrix:
+        operating-system: [ubuntu-latest, windows-latest]
+        php-versions: ['8.4', '8.5']
+        # The latest yiisoft/app release resolves Symfony 8.0 packages that require PHP 8.4+.
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      # Docs: https://github.com/shivammathur/setup-php
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-versions }}
+          extensions: fileinfo, intl
+          ini-values: date.timezone='UTC', register_argc_argv=On
+          coverage: none
+
+      - name: Get composer cache directory
+        id: composer-cache
+        shell: bash
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache composer dependencies
+        uses: actions/cache@v5
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          # Use composer.json for key, if composer.lock is not committed.
+          # key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install Composer dependencies
+        run: composer install --no-progress --prefer-dist --optimize-autoloader
+
+      - name: Run codeception build
+        run: vendor/bin/codecept build
+
+      - name: Run tests with Codeception
+        run: vendor/bin/codecept run

package.json

@@ -1,6 +1,6 @@
 {
   "name": "setup-php",
-  "version": "2.37.0",
+  "version": "2.37.1",
   "private": false,
   "description": "Setup PHP for use with GitHub Actions",
   "main": "lib/install.js",
@@ -38,26 +38,26 @@
     "compare-versions": "^6.1.1"
   },
   "devDependencies": {
-    "@eslint/compat": "^2.0.3",
+    "@eslint/compat": "^2.1.0",
     "@eslint/js": "^10.0.1",
     "@types/jest": "^30.0.0",
-    "@types/node": "^25.5.0",
+    "@types/node": "^25.7.0",
-    "@typescript-eslint/eslint-plugin": "^8.57.0",
+    "@typescript-eslint/eslint-plugin": "^8.59.3",
-    "@typescript-eslint/parser": "^8.57.0",
+    "@typescript-eslint/parser": "^8.59.3",
     "@vercel/ncc": "^0.38.4",
-    "eslint": "^10.0.3",
+    "eslint": "^10.3.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-import-resolver-typescript": "^4.4.4",
     "eslint-plugin-import-x": "^4.16.2",
-    "eslint-plugin-jest": "^29.15.0",
+    "eslint-plugin-jest": "^29.15.2",
     "eslint-plugin-prettier": "^5.5.5",
-    "globals": "^17.4.0",
+    "globals": "^17.6.0",
-    "jest": "^30.3.0",
+    "jest": "^30.4.2",
-    "jest-circus": "^30.3.0",
+    "jest-circus": "^30.4.2",
-    "nock": "^14.0.11",
+    "nock": "^14.0.15",
-    "prettier": "^3.8.1",
+    "prettier": "^3.8.3",
     "simple-git-hooks": "^2.13.1",
-    "ts-jest": "^29.4.6",
+    "ts-jest": "^29.4.9",
     "typescript": "^5.9.3"
   },
   "overrides": {

src/config.ts

@@ -16,7 +16,7 @@ export async function addINIValuesUnix(
   });
   return (
     'echo "' +
-    ini_values.join('\n') +
+    ini_values.map(v => utils.escapeForShell(v, 'linux')).join('\n') +
     '" | sudo tee -a "${pecl_file:-${ini_file[@]}}" >/dev/null 2>&1' +
     script
   );
@@ -37,7 +37,10 @@ export async function addINIValuesWindows(
       (await utils.addLog('$tick', line, 'Added to php.ini', 'win32')) + '\n';
   });
   return (
-    'Add-Content "$php_dir\\php.ini" "' + ini_values.join('\n') + '"' + script
+    'Add-Content "$php_dir\\php.ini" "' +
+    ini_values.map(v => utils.escapeForShell(v, 'win32')).join('\n') +
+    '"' +
+    script
   );
 }
 

src/configs/composer-gh-auth-no-op

@@ -0,0 +1,3 @@
+1.0.0-0 1.10.28
+2.0.0-0 2.2.28
+2.3.0-0 2.9.8

src/configs/composer-gh-auth-warn

@@ -0,0 +1 @@
+Composer %s has a known GitHub token parsing bug that exposes GitHub tokens in the error output. So, GitHub authentication has not been configured for this Composer version. Please update to the latest version of Composer. See: https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2

src/configs/os_releases.csv

@@ -21,4 +21,7 @@
 23.10,mantic
 24.04,noble
 24.10,oracular
-25.10,plucky
+25.05,plucky
+25.10,questing
+26.04,resolute
+26.10,stonking

src/install.ts

@@ -18,7 +18,10 @@ export async function getScript(os: string): Promise<string> {
   const filename = os + (await utils.scriptExtension(os));
   const script_path = path.join(__dirname, '../src/scripts', filename);
   const run_path = script_path.replace(os, 'run');
-  const extension_csv: string = await utils.getInput('extensions', false);
+  const extension_csv: string = utils.sanitizeShellInput(
+    await utils.getInput('extensions', false),
+    true
+  );
   const ini_values_csv: string = await utils.getInput('ini-values', false);
   const coverage_driver: string = await utils.getInput('coverage', false);
   const tools_csv: string = await utils.getInput('tools', false);
@@ -28,7 +31,7 @@ export async function getScript(os: string): Promise<string> {
   const ini_file: string = await utils.parseIniFile(
     await utils.getInput('ini-file', false)
   );
-  let script = await utils.joins('.', script_path, version, ini_file);
+  let script = await utils.joins('.', script_path, `'${version}'`, ini_file);
   if (extension_csv) {
     script += await extensions.addExtension(extension_csv, version, os);
   }

src/scripts/darwin.sh

@@ -300,6 +300,10 @@ export HOMEBREW_NO_INSTALL_FROM_API=1
 
 # shellcheck source=.
 . "${scripts:?}"/unix.sh
+if ! [[ "$version" =~ ^[0-9]+\.[0-9]+$ ]]; then
+  fail_fast=true
+  add_log "${cross:?}" "PHP" "Invalid PHP version: $version"
+fi
 . "${scripts:?}"/tools/brew.sh
 . "${scripts:?}"/tools/retry.sh
 . "${scripts:?}"/tools/add_tools.sh

src/scripts/extensions/gearman.sh

@@ -1,9 +1,9 @@
 # Helper function to add gearman extension.
 add_gearman_helper() {
-  install_packages libgearman-dev
   enable_extension gearman extension
   if ! check_extension gearman; then
     status="Installed and enabled"
+    install_packages libgearman-dev
     if [[ "${version:?}" =~ 5.[3-6] ]]; then
       pecl_install gearman-1.1.2
     elif [[ "${version:?}" =~ 7.0 ]]; then

src/scripts/extensions/phalcon.ps1

@@ -19,26 +19,6 @@ Function Get-PhalconReleaseAssetUrl() {
         $match = (Get-File -Url "$github/$releases/expanded_assets/v$Semver").Links.href | Select-String -Pattern "(phalcon_${arch}_.*_php${version}_${extension_version}.*[0-9]${nts}.zip)"
       } catch { }
     }
-  } else {
-    $nts = if (!$installed.ThreadSafe) { "-nts" } else { "-ts" }
-    try {
-      $match = (Invoke-RestMethod -Uri "$domain/$releases/tags/v$Semver").assets | Select-String -Pattern "browser_download_url=.*(php_phalcon-php${version}${nts}-windows.*-x64.zip)"
-    } catch { }
-    if($null -eq $match) {
-      try {
-        $match = (Get-File -Url "$github/$releases/expanded_assets/v$Semver").Links.href | Select-String -Pattern "(php_phalcon-php${version}${nts}-windows.*-x64.zip)"
-      } catch { }
-    }
-    if($null -eq $match) {
-      try {
-        $match = (Invoke-RestMethod -Uri "$domain/$releases/tags/v$Semver").assets | Select-String -Pattern "browser_download_url=.*(phalcon-php${version}${nts}-windows.*-x64.zip)"
-      } catch { }
-    }
-    if($null -eq $match) {
-      try {
-        $match = (Get-File -Url "$github/$releases/expanded_assets/v$Semver").Links.href | Select-String -Pattern "(phalcon-php${version}${nts}-windows.*-x64.zip)"
-      } catch { }
-    }
   }
   if($NULL -ne $match) {
     return "$github/$releases/download/v$Semver/$($match.Matches[0].Groups[1].Value)"
@@ -73,6 +53,8 @@ Function Get-PhalconSemver() {
     return '4.1.0'
   } elseif (($extension_version -eq '5') -and ($version -eq '7.4')) {
     return '5.4.0'
+  } elseif (($extension_version -eq '5') -and ($version -eq '8.0')) {
+    return '5.10.0'
   }
   return Get-PeclPackageVersion phalcon $extension_version stable stable | Select-Object -First 1
 }
@@ -80,7 +62,7 @@ Function Get-PhalconSemver() {
 # Function to install phalcon
 Function Add-PhalconHelper() {
   $semver = Get-PhalconSemver
-  if ($extension_version -eq '3') {
+  if ($extension_version -match '[3-4]') {
     Add-PhalconFromGitHub $semver
   } else {
     Add-Extension -Extension phalcon -Stability stable -Extension_version $semver

src/scripts/extensions/phalcon.sh

@@ -3,6 +3,8 @@ get_phalcon_version() {
   if [ "$extension" = "phalcon5" ]; then
     if [ "${version:?}" = "7.4" ]; then
       echo '5.4.0'
+    elif [ "${version:?}" = "8.0" ]; then
+      echo '5.10.0'
     else
       get_pecl_version phalcon stable 5
     fi

src/scripts/linux.sh

@@ -344,6 +344,10 @@ link_apt_fast >/dev/null 2>&1
 . /etc/os-release
 # shellcheck source=.
 . "${scripts:?}"/unix.sh
+if ! [[ "$version" =~ ^[0-9]+\.[0-9]+$ ]]; then
+  fail_fast=true
+  add_log "${cross:?}" "PHP" "Invalid PHP version: $version"
+fi
 . "${scripts:?}"/tools/ppa.sh
 . "${scripts:?}"/tools/add_tools.sh
 . "${scripts:?}"/extensions/source.sh

src/scripts/tools/add_tools.ps1

@@ -3,6 +3,7 @@ $composer_home = "$env:APPDATA\Composer"
 $composer_bin = "$composer_home\vendor\bin"
 $composer_json = "$composer_home\composer.json"
 $composer_lock = "$composer_home\composer.lock"
+$skip_composer_github_auth = $false
 
 # Function to configure composer.
 Function Edit-ComposerConfig() {
@@ -23,6 +24,7 @@ Function Edit-ComposerConfig() {
   if (-not(Test-Path $composer_json)) {
     Set-Content -Path $composer_json -Value "{}"
   }
+  Get-ToolVersion "composer" $null | Out-Null
   Set-ComposerEnv
   Add-Path $composer_bin
   Set-ComposerAuth
@@ -74,8 +76,18 @@ function Test-GitHubPublicAccess {
   }
 }
 
+Function Write-ComposerGhAuthNoOpWarning() {
+  $message = (Get-Content (Join-Path $src 'configs\composer-gh-auth-warn') -Raw).Trim().Replace('%s', $composer_version)
+  if($env:fail_fast -eq 'true') {
+    Add-Log "$cross" "composer" $message
+  } else {
+    Write-Output "::warning::$message"
+  }
+}
+
 # Function to setup authentication in composer.
 Function Set-ComposerAuth() {
+  $token = if ($env:COMPOSER_TOKEN) { $env:COMPOSER_TOKEN } else { $env:GITHUB_TOKEN }
   if(Test-Path env:COMPOSER_AUTH_JSON) {
     if(Test-Json -JSON $env:COMPOSER_AUTH_JSON) {
       Set-Content -Path $composer_home\auth.json -Value $env:COMPOSER_AUTH_JSON
@@ -83,13 +95,18 @@ Function Set-ComposerAuth() {
       Add-Log "$cross" "composer" "Could not parse COMPOSER_AUTH_JSON as valid JSON"
     }
   }
+  if($skip_composer_github_auth) {
+    Write-ComposerGhAuthNoOpWarning
+  }
   $composer_auth = @()
   if(Test-Path env:PACKAGIST_TOKEN) {
     $composer_auth += '"http-basic": {"repo.packagist.com": { "username": "token", "password": "' + $env:PACKAGIST_TOKEN + '"}}'
   }
   $write_token = $true
-  $token = if ($env:COMPOSER_TOKEN) { $env:COMPOSER_TOKEN } else { $env:GITHUB_TOKEN }
   if ($token) {
+    if ($skip_composer_github_auth) {
+      $write_token = $false
+    }
     if ($env:GITHUB_SERVER_URL -ne "https://github.com" -and -not(Test-GitHubPublicAccess $token)) {
       $write_token = $false
     }
@@ -210,8 +227,13 @@ Function Add-Tool() {
     [ValidateNotNull()]
     $tool,
     [Parameter(Position = 2, Mandatory = $false)]
-    $ver_param
+    $ver_param,
+    [Parameter(Position = 3, Mandatory = $false)]
+    $skip_composer_github_auth
   )
+  if($tool -eq "composer") {
+    $script:skip_composer_github_auth = $skip_composer_github_auth -eq 'true'
+  }
   $urls = $urls -split ','
   $tool_path = "$bin_dir\$tool"
   $is_exe = ((($urls[0] | Split-Path -Extension).ToLowerInvariant()) -eq '.exe')

src/scripts/tools/add_tools.sh

@@ -3,6 +3,7 @@ export composer_home="$HOME/.composer"
 export composer_bin="$composer_home/vendor/bin"
 export composer_json="$composer_home/composer.json"
 export composer_lock="$composer_home/composer.lock"
+skip_composer_github_auth=false
 
 # Function to extract tool version.
 get_tool_version() {
@@ -41,6 +42,7 @@ configure_composer() {
     echo '{}' | tee "$composer_json" >/dev/null
     chmod 644 "$composer_json"
   fi
+  get_tool_version composer >/dev/null
   set_composer_env
   add_path "$composer_bin"
   set_composer_auth
@@ -70,22 +72,39 @@ can_access_public_github() {
   curl --fail -s -H "Authorization: token $1" 'https://api.github.com/' >/dev/null 2>&1
 }
 
+composer_gh_auth_no_op() {
+  local message
+  message="$(<"${src:?}"/configs/composer-gh-auth-warn)"
+  message="${message//%s/$composer_version}"
+  if [ "${fail_fast:-false}" = "true" ]; then
+    add_log "${cross:?}" "composer" "$message"
+  else
+    echo "::warning::$message"
+  fi
+}
+
 # Function to setup authentication in composer.
 set_composer_auth() {
-  if [ -n "$COMPOSER_AUTH_JSON" ]; then
+  token="${COMPOSER_TOKEN:-$GITHUB_TOKEN}"
-    if php -r "json_decode('$COMPOSER_AUTH_JSON'); if(json_last_error() !== JSON_ERROR_NONE) { throw new Exception('invalid json'); }"; then
+  if [ -n "${COMPOSER_AUTH_JSON:-}" ]; then
-      echo "$COMPOSER_AUTH_JSON" | tee "$composer_home/auth.json" >/dev/null
+    if printf '%s' "$COMPOSER_AUTH_JSON" | jq -e . >/dev/null; then
+      printf '%s' "$COMPOSER_AUTH_JSON" | tee "$composer_home/auth.json" >/dev/null
     else
       add_log "${cross:?}" "composer" "Could not parse COMPOSER_AUTH_JSON as valid JSON"
     fi
   fi
+  if [ "$skip_composer_github_auth" = "true" ]; then
+    composer_gh_auth_no_op
+  fi
   composer_auth=()
   if [ -n "$PACKAGIST_TOKEN" ]; then
     composer_auth+=( '"http-basic": {"repo.packagist.com": { "username": "token", "password": "'"$PACKAGIST_TOKEN"'"}}' )
   fi
-  token="${COMPOSER_TOKEN:-$GITHUB_TOKEN}"
   if [ -n "$token" ]; then
     write_token=true
+    if [ "$skip_composer_github_auth" = "true" ]; then
+      write_token=false
+    fi
     if [ "$GITHUB_SERVER_URL" != "https://github.com" ]; then
       can_access_public_github "$token" || write_token=false
     fi
@@ -182,6 +201,9 @@ add_tool() {
   url=$1
   tool=$2
   ver_param=$3
+  if [ "$tool" = "composer" ]; then
+    skip_composer_github_auth="${4:-false}"
+  fi
   tool_path="$tool_path_dir/$tool"
   if ! [ -d "$tool_path_dir" ]; then
     sudo mkdir -p "$tool_path_dir"
@@ -206,8 +228,8 @@ add_tool() {
       url[0]="${url[0]//releases\/latest\/download/releases/download/$(get -s -n "" "$(echo "${url[0]}" | cut -d '/' -f '1-5')/releases" | grep -Eo -m 1 "([0-9]+\.[0-9]+\.[0-9]+)/$(echo "${url[0]}" | sed -e "s/.*\///")" | cut -d '/' -f 1)}"
       status_code=$(get -v -e "$tool_path" "${url[0]}")
     fi
-    if [ "$status_code" = "200" ] && [ "$use_cache" = "true" ]; then
+    if [ "$status_code" = "200" ]; then
-      sudo cp -a "$tool_path" "$cache_path"
+      [ "$use_cache" = "true" ] && sudo cp -a "$tool_path" "$cache_path"
     elif [ -f "$tool_path.bak" ]; then
       sudo mv "$tool_path.bak" "$tool_path"
     fi
@@ -215,8 +237,8 @@ add_tool() {
   fi
   if [ "$status_code" = "200" ]; then
     add_tools_helper "$tool"
-    [ -L "$tool_cache_path_dir/$tool" ] || sudo ln -s "$tool_path" "$tool_cache_path_dir/$tool" 2>/dev/null || true
     tool_version=$(get_tool_version "$tool" "$ver_param")
+    sudo ln -sfn "$tool_path" "$tool_cache_path_dir/$tool" 2>/dev/null || true
     add_log "${tick:?}" "$tool" "Added $tool $tool_version"
   else
     if [ "$tool" = "composer" ]; then

src/scripts/win32.ps1

@@ -1,7 +1,6 @@
 param (
   [Parameter(Position = 0, Mandatory = $true)]
-  [ValidateNotNull()]
+  [ValidatePattern('^\d+\.\d+$')]
-  [ValidateLength(1, [int]::MaxValue)]
   [string]
   $version = '8.4',
   [Parameter(Position = 1, Mandatory = $true)]
@@ -203,16 +202,20 @@ Function Install-PSPackage() {
     $cmdlet
   )
   $module_path = "$bin_dir\$psm1_path.psm1"
+  $imported = $false
+  try {
     if(-not (Test-Path $module_path -PathType Leaf)) {
       $zip_file = "$bin_dir\$package.zip"
       Get-File -Url $url -OutFile $zip_file
-    Expand-Archive -Path $zip_file -DestinationPath $bin_dir -Force
+      Expand-Archive -Path $zip_file -DestinationPath $bin_dir -Force -ErrorAction Stop
     }
-  Import-Module $module_path
+    Import-Module $module_path -ErrorAction Stop
-  if($null -eq (Get-Command $cmdlet -ErrorAction SilentlyContinue)) {
+    $imported = $null -ne (Get-Command $cmdlet -ErrorAction SilentlyContinue)
-    Install-Module -Name $package -Force
+  } catch { }
-  } else {
+  if($imported) {
     Add-ToProfile $current_profile "$package-search" "Import-Module $module_path"
+  } else {
+    Install-Module -Name $package -Force
   }
 }
 

src/tools.ts

@@ -95,6 +95,42 @@ interface DeployerManifestEntry {
   url: string;
 }
 
+export function skipGitHubAuthForComposerVersion(version: string): boolean {
+  if (!/^\d+\.\d+\.\d+(?:-[\w-]+)?$/.test(version)) {
+    return false;
+  }
+  return fs
+    .readFileSync(
+      path.join(__dirname, '../src/configs/composer-gh-auth-no-op'),
+      'utf8'
+    )
+    .trim()
+    .split(/\r?\n/)
+    .some(range => {
+      const [min, max] = range.trim().split(/\s+/);
+      return (
+        cv.compareVersions(version, min) >= 0 &&
+        cv.compareVersions(version, max) < 0
+      );
+    });
+}
+
+export function cleanComposerAuthJson(): void {
+  try {
+    const auth_json = process.env['COMPOSER_AUTH_JSON'] || '';
+    if (!auth_json.includes('github-oauth')) return;
+    const auth = JSON.parse(auth_json);
+    delete auth['github-oauth'];
+    if (!Object.keys(auth).length) {
+      delete process.env['COMPOSER_AUTH_JSON'];
+    } else {
+      process.env['COMPOSER_AUTH_JSON'] = JSON.stringify(auth);
+    }
+  } catch {
+    return;
+  }
+}
+
 /**
  * Function to get version in semver format.
  *
@@ -195,7 +231,7 @@ export async function getVersion(
     case !!data.repository && major_minor_regex.test(data.version):
       return await getSemverVersion(data);
     default:
-      return data.version.replace(/[><=^~]*/, '');
+      return data.version.replace(/[^a-zA-Z0-9_.:@+,/-]/g, '');
   }
 }
 
@@ -311,12 +347,9 @@ export async function addArchive(data: ToolData): Promise<string> {
 export async function addPackage(data: ToolData): Promise<string> {
   const command = await utils.getCommand(data.os, 'composer_tool');
   const parts: string[] = data.repository.split('/');
-  const args: string = await utils.joins(
+  const args = [parts[1], data.release, parts[0] + '/', data.scope]
-    parts[1],
+    .map(a => utils.safeArg(a, data.os))
-    data.release,
+    .join(' ');
-    parts[0] + '/',
-    data.scope
-  );
   return command + args;
 }
 
@@ -383,6 +416,7 @@ export async function addComposer(data: ToolData): Promise<string> {
   const version_source_url = `${getcomposer}/download/${channel}/composer.phar`;
   let cache_url = `${releases_url},${spc_url},${cds_url}`;
   let source_url = `${getcomposer}/composer.phar`;
+  let skip_composer_github_auth = '';
   switch (true) {
     case /^snapshot$/.test(channel):
       source_url = is_lts ? lts_url : source_url;
@@ -393,7 +427,11 @@ export async function addComposer(data: ToolData): Promise<string> {
     case /^1$/.test(channel):
       source_url = channel_source_url;
       break;
-    case /^\d+\.\d+\.\d+[\w-]*$/.test(data.version):
+    case /^\d+\.\d+\.\d+(?:-[\w-]+)?$/.test(data.version):
+      if (skipGitHubAuthForComposerVersion(data.version)) {
+        cleanComposerAuthJson();
+        skip_composer_github_auth = ' true';
+      }
       cache_url = `${github}/${data.repository}/releases/download/${data.version}/composer.phar`;
       source_url = version_source_url;
       break;
@@ -402,7 +440,7 @@ export async function addComposer(data: ToolData): Promise<string> {
   }
   const use_cache: boolean = (await utils.readEnv('NO_TOOLS_CACHE')) !== 'true';
   data.url = use_cache ? `${cache_url},${source_url}` : source_url;
-  data.version_parameter = data.version;
+  data.version_parameter = data.version + skip_composer_github_auth;
   return await addArchive(data);
 }
 

src/utils.ts

@@ -66,11 +66,20 @@ export async function parseVersion(version: string): Promise<string> {
       for (const manifestURL of await getManifestURLS()) {
         const fetchResult = await fetch.fetch(manifestURL);
         if (fetchResult['data'] ?? false) {
-          return JSON.parse(fetchResult['data'])[version];
+          const resolved: string = JSON.parse(fetchResult['data'])[version];
+          if (resolved !== undefined && !/^\d+\.\d+$/.test(resolved)) {
+            throw new Error(
+              `Invalid PHP version in manifest: ${resolved.slice(0, 10)}`
+            );
+          }
+          return resolved;
         }
       }
       throw new Error(`Could not fetch the PHP version manifest.`);
     default:
+      if (!/^\d+(\.\d+){0,2}$/.test(version)) {
+        throw new Error(`Invalid PHP version: ${version.slice(0, 20)}`);
+      }
       switch (true) {
         case version.length > 1:
           return version.slice(0, 3);
@@ -86,14 +95,11 @@ export async function parseVersion(version: string): Promise<string> {
  * @param ini_file
  */
 export async function parseIniFile(ini_file: string): Promise<string> {
-  switch (true) {
+  if (/^(production|development|none)$/.test(ini_file)) {
-    case /^(production|development|none)$/.test(ini_file):
     return ini_file;
-    case /php\.ini-(production|development)$/.test(ini_file):
-      return ini_file.split('-')[1];
-    default:
-      return 'production';
   }
+  const match = ini_file.match(/php\.ini-(production|development)$/);
+  return match ? match[1] : 'production';
 }
 
 /**
@@ -172,10 +178,10 @@ export async function log(
 export async function stepLog(message: string, os: string): Promise<string> {
   switch (os) {
     case 'win32':
-      return 'Step-Log "' + message + '"';
+      return 'Step-Log "' + escapeForShell(message, os) + '"';
     case 'linux':
     case 'darwin':
-      return 'step_log "' + message + '"';
+      return 'step_log "' + escapeForShell(message, os) + '"';
     default:
       return await log('Platform ' + os + ' is not supported', os, 'error');
   }
@@ -196,15 +202,52 @@ export async function addLog(
 ): Promise<string> {
   switch (os) {
     case 'win32':
-      return 'Add-Log "' + mark + '" "' + subject + '" "' + message + '"';
+      return (
+        'Add-Log "' +
+        mark +
+        '" "' +
+        escapeForShell(subject, os) +
+        '" "' +
+        escapeForShell(message, os) +
+        '"'
+      );
     case 'linux':
     case 'darwin':
-      return 'add_log "' + mark + '" "' + subject + '" "' + message + '"';
+      return (
+        'add_log "' +
+        mark +
+        '" "' +
+        escapeForShell(subject, os) +
+        '" "' +
+        escapeForShell(message, os) +
+        '"'
+      );
     default:
       return await log('Platform ' + os + ' is not supported', os, 'error');
   }
 }
 
+export function escapeForShell(value: string, os: string): string {
+  if (os === 'win32') {
+    return value.replace(/[`$"]/g, '`$&');
+  }
+  return value.replace(/[\\`$"]/g, '\\$&');
+}
+
+export function safeArg(value: string, os: string): string {
+  if (!/^[a-zA-Z0-9_./:@+,~^-]*$/.test(value)) {
+    return '"' + escapeForShell(value, os) + '"';
+  }
+  return value;
+}
+
+export function sanitizeShellInput(value: string, strict = false): string {
+  const pattern = strict
+    ? /[$`"';|&(){}[\]\\<>*?\n\r\t]/g
+    : /[$`"';|&(){}[\]\\\n\r\t]/g;
+  return value.replace(pattern, '');
+}
+
 /**
  * Function to break extension csv into an array
  *
@@ -224,11 +267,11 @@ export async function extensionArray(
           .split(',')
 
           .map(function (extension: string) {
+            extension = extension.trim().replace(/^\\\s*/, '');
             if (/.+-.+\/.+@.+/.test(extension)) {
               return extension;
             }
             return extension
-              .trim()
               .toLowerCase()
               .replace(/^(:)?(php[-_]|none|zend )|(-[^-]*)-/, '$1$3');
           })
@@ -431,12 +474,24 @@ export async function parseExtensionSource(
   );
 }
 
+const VERSION_INPUT_REGEX =
+  /^(latest|lowest|highest|nightly|master|\d+\.x|\d+(\.\d+){0,2})$/;
+
+function validatePHPVersionInput(version: string, source: string): void {
+  if (!VERSION_INPUT_REGEX.test(version)) {
+    throw new Error(
+      `Invalid PHP version in ${source}: ${version.slice(0, 20)}`
+    );
+  }
+}
+
 /**
  * Read php version from input or file
  */
 export async function readPHPVersion(): Promise<string> {
   const version = await getInput('php-version', false);
   if (version) {
+    validatePHPVersionInput(version, 'php-version input');
     return version;
   }
   const versionFile =
@@ -446,7 +501,9 @@ export async function readPHPVersion(): Promise<string> {
     const match: RegExpMatchArray | null = contents.match(
       /^(?:php\s)?(\d+\.\d+\.\d+)$/m
     );
-    return match ? match[1] : contents.trim();
+    const raw = match ? match[1] : contents.trim();
+    validatePHPVersionInput(raw, versionFile);
+    return raw;
   } else if (versionFile !== '.php-version') {
     throw new Error(`Could not find '${versionFile}' file.`);
   }
@@ -460,7 +517,9 @@ export async function readPHPVersion(): Promise<string> {
       lockFileContents['platform-overrides'] &&
       lockFileContents['platform-overrides']['php']
     ) {
-      return lockFileContents['platform-overrides']['php'];
+      const raw: string = lockFileContents['platform-overrides']['php'];
+      validatePHPVersionInput(raw, 'composer.lock platform-overrides.php');
+      return raw;
     }
   }
 
@@ -475,7 +534,9 @@ export async function readPHPVersion(): Promise<string> {
       composerFileContents['config']['platform'] &&
       composerFileContents['config']['platform']['php']
     ) {
-      return composerFileContents['config']['platform']['php'];
+      const raw: string = composerFileContents['config']['platform']['php'];
+      validatePHPVersionInput(raw, 'composer.json config.platform.php');
+      return raw;
     }
   }