build-php-cli.yml

name: Build and Push PHP-CLI Images

# IMPORTANT: This workflow depends on php-base tier images being available.
# Do NOT add push triggers for php-cli/** paths - this would cause race conditions
# where php-cli tries to build before php-base images are pushed.
# Instead, use repository_dispatch from php-base workflow or workflow_dispatch.

on:
  # NO push trigger - php-cli depends on php-base images being built first
  # Use repository_dispatch from php-base workflow instead
  workflow_dispatch:
    inputs:
      php_version:
        description: 'PHP Version to build (8.2, 8.3, 8.4, or all)'
        required: false
        default: 'all'
      os_variant:
        description: 'OS variant to build (bookworm or all)'
        required: false
        default: 'all'
  repository_dispatch:
    types: [php-base-updated]
  schedule:
    # Weekly security rebuild - Monday 02:00 UTC (after php-base at 01:00)
    - cron: '0 2 * * 1'

jobs:
  # ═══════════════════════════════════════════════════════════════════════════
  # SLIM TIER - Minimal PHP with essential extensions only
  # ═══════════════════════════════════════════════════════════════════════════
  build-slim-matrix:
    strategy:
      fail-fast: false
      matrix:
        php_version: ['8.2', '8.3', '8.4', '8.5']
        os_variant: ['bookworm']
    uses: ./.github/workflows/_build-image.yml
    with:
      image-name: php-cli
      image-type: php-cli
      php-version: ${{ matrix.php_version }}
      os-variant: ${{ matrix.os_variant }}
      tier: slim
      target: slim-root
      tag-suffix: slim
      cache-scope-prefix: cli
      enable-patch-tags: true
      enable-cosign: false
      base-image-type: cli
      test-script: |
        echo "Testing slim image $IMAGE..."
        docker run --rm $IMAGE php -v
        docker run --rm $IMAGE php -m | grep -E "opcache|redis|pdo_mysql|gd"
        docker run --rm $IMAGE composer --version
        docker run --rm $IMAGE cbox-init --version
    secrets: inherit

  build-slim-rootless-matrix:
    strategy:
      fail-fast: false
      matrix:
        php_version: ['8.2', '8.3', '8.4', '8.5']
        os_variant: ['bookworm']
    uses: ./.github/workflows/_build-image.yml
    with:
      image-name: php-cli
      image-type: php-cli
      php-version: ${{ matrix.php_version }}
      os-variant: ${{ matrix.os_variant }}
      tier: slim
      target: slim-rootless
      rootless: true
      tag-suffix: slim-rootless
      cache-scope-prefix: cli
      enable-patch-tags: true
      enable-cosign: false
      base-image-type: cli
      test-script: |
        echo "Testing slim rootless image $IMAGE..."
        docker run --rm $IMAGE id -u | grep -E "^(33|82)$"
        docker run --rm $IMAGE php -v
        docker run --rm $IMAGE composer --version
    secrets: inherit

  # ═══════════════════════════════════════════════════════════════════════════
  # STANDARD TIER (DEFAULT) - With ImageMagick, vips, Node.js
  # ═══════════════════════════════════════════════════════════════════════════
  build-matrix:
    strategy:
      fail-fast: false
      matrix:
        php_version: ['8.2', '8.3', '8.4', '8.5']
        os_variant: ['bookworm']
    uses: ./.github/workflows/_build-image.yml
    with:
      image-name: php-cli
      image-type: php-cli
      php-version: ${{ matrix.php_version }}
      os-variant: ${{ matrix.os_variant }}
      tier: standard
      target: root
      tag-suffix: ''
      cache-scope-prefix: cli
      enable-patch-tags: true
      enable-latest-tag: true
      enable-cosign: false
      base-image-type: cli
      test-script: |
        echo "Testing $IMAGE..."
        docker run --rm $IMAGE php -v
        docker run --rm $IMAGE php -m | grep -E "opcache|redis|pdo_mysql|gd|imagick"
        docker run --rm $IMAGE composer --version
        docker run --rm $IMAGE node --version
        docker run --rm $IMAGE cbox-init --version
    secrets: inherit

  build-rootless-matrix:
    strategy:
      fail-fast: false
      matrix:
        php_version: ['8.2', '8.3', '8.4', '8.5']
        os_variant: ['bookworm']
    uses: ./.github/workflows/_build-image.yml
    with:
      image-name: php-cli
      image-type: php-cli
      php-version: ${{ matrix.php_version }}
      os-variant: ${{ matrix.os_variant }}
      tier: standard
      target: rootless
      rootless: true
      tag-suffix: rootless
      cache-scope-prefix: cli
      enable-patch-tags: true
      enable-latest-tag: true
      enable-cosign: false
      base-image-type: cli
      test-script: |
        echo "Testing rootless image $IMAGE..."
        # Verify running as non-root (www-data = uid 33 on Debian Bookworm)
        docker run --rm $IMAGE id -u | grep -E "^33$"
        docker run --rm $IMAGE php -v
        docker run --rm $IMAGE php -m | grep -E "opcache|redis|pdo_mysql|gd|imagick"
        docker run --rm $IMAGE composer --version
        docker run --rm $IMAGE node --version
        docker run --rm $IMAGE cbox-init --version
    secrets: inherit

  # ═══════════════════════════════════════════════════════════════════════════
  # CHROMIUM TIER - With Chromium for Browsershot/Dusk
  # ═══════════════════════════════════════════════════════════════════════════
  build-chromium-matrix:
    strategy:
      fail-fast: false
      matrix:
        php_version: ['8.2', '8.3', '8.4', '8.5']
        os_variant: ['bookworm']
    uses: ./.github/workflows/_build-image.yml
    with:
      image-name: php-cli
      image-type: php-cli
      php-version: ${{ matrix.php_version }}
      os-variant: ${{ matrix.os_variant }}
      tier: chromium
      target: chromium-root
      tag-suffix: chromium
      cache-scope-prefix: cli
      enable-patch-tags: true
      enable-cosign: false
      base-image-type: cli
      test-script: |
        echo "Testing chromium image $IMAGE..."
        docker run --rm $IMAGE php -v
        docker run --rm $IMAGE php -m | grep -E "opcache|redis|pdo_mysql|gd|imagick"
        docker run --rm $IMAGE composer --version
        docker run --rm $IMAGE node --version
        docker run --rm $IMAGE cbox-init --version
        # Verify Chromium is installed
        docker run --rm $IMAGE which chromium-browser || docker run --rm $IMAGE which chromium
    secrets: inherit

  build-chromium-rootless-matrix:
    strategy:
      fail-fast: false
      matrix:
        php_version: ['8.2', '8.3', '8.4', '8.5']
        os_variant: ['bookworm']
    uses: ./.github/workflows/_build-image.yml
    with:
      image-name: php-cli
      image-type: php-cli
      php-version: ${{ matrix.php_version }}
      os-variant: ${{ matrix.os_variant }}
      tier: chromium
      target: chromium-rootless
      rootless: true
      tag-suffix: chromium-rootless
      cache-scope-prefix: cli
      enable-patch-tags: true
      enable-cosign: false
      base-image-type: cli
      test-script: |
        echo "Testing chromium rootless image $IMAGE..."
        docker run --rm $IMAGE id -u | grep -E "^(33|82)$"
        docker run --rm $IMAGE php -v
        docker run --rm $IMAGE composer --version
        docker run --rm $IMAGE which chromium-browser || docker run --rm $IMAGE which chromium
    secrets: inherit

  # ═══════════════════════════════════════════════════════════════════════════
  # DEV TIER - Standard + Xdebug, PCOV, SPX for development/testing
  # ═══════════════════════════════════════════════════════════════════════════
  build-dev-matrix:
    strategy:
      fail-fast: false
      matrix:
        php_version: ['8.2', '8.3', '8.4', '8.5']
        os_variant: ['bookworm']
    uses: ./.github/workflows/_build-image.yml
    with:
      image-name: php-cli
      image-type: php-cli
      php-version: ${{ matrix.php_version }}
      os-variant: ${{ matrix.os_variant }}
      tier: dev
      target: dev-root
      tag-suffix: dev
      cache-scope-prefix: cli
      enable-patch-tags: true
      enable-cosign: false
      base-image-type: cli
      test-script: |
        echo "Testing dev image $IMAGE..."
        docker run --rm $IMAGE php -v
        docker run --rm $IMAGE php -m | grep -E "opcache|redis|pdo_mysql|gd|imagick|xdebug|pcov|spx"
        docker run --rm $IMAGE composer --version
        docker run --rm $IMAGE node --version
        docker run --rm $IMAGE cbox-init --version
        # Dev tier should have chromium (inherited from chromium tier)
        docker run --rm $IMAGE which chromium-browser || docker run --rm $IMAGE which chromium
    secrets: inherit

  build-dev-rootless-matrix:
    strategy:
      fail-fast: false
      matrix:
        php_version: ['8.2', '8.3', '8.4', '8.5']
        os_variant: ['bookworm']
    uses: ./.github/workflows/_build-image.yml
    with:
      image-name: php-cli
      image-type: php-cli
      php-version: ${{ matrix.php_version }}
      os-variant: ${{ matrix.os_variant }}
      tier: dev
      target: dev-rootless
      rootless: true
      tag-suffix: dev-rootless
      cache-scope-prefix: cli
      enable-patch-tags: true
      enable-cosign: false
      base-image-type: cli
      test-script: |
        echo "Testing dev rootless image $IMAGE..."
        docker run --rm $IMAGE id -u | grep -E "^(33|82)$"
        docker run --rm $IMAGE php -v
        docker run --rm $IMAGE php -m | grep -E "xdebug|pcov|spx"
    secrets: inherit