build-php.yml

name: Build PHP

# Required repository secrets (same names as nativephp-php-bin-mobile):
#   R2_ACCESS_KEY_ID      - Cloudflare R2 access key
#   R2_SECRET_ACCESS_KEY  - Cloudflare R2 secret key

permissions:
  contents: read

on:
  workflow_dispatch:

env:
  SPC_VERSION: 2.8.5
  # Each branch uploads to its own directory: main/, feature-x/, etc.
  R2_PREFIX: ${{ format('{0}/', github.ref_name) }}
  R2_ENDPOINT: https://713f4e1d515cf082921cdf5122bf1739.r2.cloudflarestorage.com
  R2_BUCKET: nativephplibs

jobs:
  build:
    name: ${{ matrix.version }} ${{ matrix.os }}
    runs-on: ${{ matrix.os }}

    strategy:
      matrix:
        version: ["8.3", "8.4", "8.5"]
        os: [ "macos-15-intel", "macos-latest", "windows-latest", "ubuntu-latest", "ubuntu-24.04-arm" ]

    continue-on-error: true

    steps:
      - uses: actions/checkout@v6

      - name: Set SPC binary name
        shell: bash
        run: echo "SPC_BINARY=spc" >> $GITHUB_ENV

      - name: Set SPC URL for macos-15-intel
        shell: bash
        if: matrix.os == 'macos-15-intel'
        run: echo "SPC_URL=https://github.com/crazywhalecc/static-php-cli/releases/download/${{ env.SPC_VERSION }}/spc-macos-x86_64.tar.gz" >> $GITHUB_ENV

      - name: Set SPC URL for macos-latest
        shell: bash
        if: matrix.os == 'macos-latest'
        run: echo "SPC_URL=https://github.com/crazywhalecc/static-php-cli/releases/download/${{ env.SPC_VERSION }}/spc-macos-aarch64.tar.gz" >> $GITHUB_ENV

      - name: Set SPC URL for ubuntu-latest and ubuntu-24.04
        shell: bash
        if: matrix.os == 'ubuntu-latest'
        run: echo "SPC_URL=https://github.com/crazywhalecc/static-php-cli/releases/download/${{ env.SPC_VERSION }}/spc-linux-x86_64.tar.gz" >> $GITHUB_ENV

      - name: Set SPC URL for ubuntu-24.04-arm
        shell: bash
        if: matrix.os == 'ubuntu-24.04-arm'
        run: echo "SPC_URL=https://github.com/crazywhalecc/static-php-cli/releases/download/${{ env.SPC_VERSION }}/spc-linux-aarch64.tar.gz" >> $GITHUB_ENV

      - name: Set SPC URL for windows-latest
        shell: bash
        if: matrix.os == 'windows-latest'
        run: |
          echo "SPC_URL=https://github.com/crazywhalecc/static-php-cli/releases/download/${{ env.SPC_VERSION }}/spc-windows-x64.exe" >> $GITHUB_ENV
          echo "SPC_BINARY=spc.exe" >> $GITHUB_ENV

      - name: Download SPC
        shell: bash
        run: |
          cd ..
          if [[ "${{ matrix.os }}" == "windows-latest" ]]; then
            curl -fsSL -o ${{ env.SPC_BINARY }} ${{ env.SPC_URL }}
          else
            curl -fsSL -o ${{ env.SPC_BINARY }}.tar.gz ${{ env.SPC_URL }}
            tar -xzf ${{ env.SPC_BINARY }}.tar.gz
          fi
          chmod +x ${{ env.SPC_BINARY }}
          [ ! -d static-php-cli/bin ] && mkdir -p static-php-cli/bin
          mv ${{ env.SPC_BINARY }} static-php-cli/bin/

      - name: Create php-bin directory
        shell: bash
        run: |
          cd ..
          [ ! -d php-bin ] && mkdir -p php-bin
          cd php-bin

      - shell: bash
        run: |
          PHP_VERSION=$(echo "${{ matrix.version }}" | cut -d. -f1,2)
          echo "PHP_VERSION=$PHP_VERSION" >> $GITHUB_ENV

      - shell: bash
        run: echo "SPC_BUILD_ARCH=x64" >> $GITHUB_ENV

      - shell: bash
        if: matrix.os == 'macos-latest' || matrix.os == 'ubuntu-24.04-arm'
        run: echo "SPC_BUILD_ARCH=arm64" >> $GITHUB_ENV

      - shell: bash
        if: contains(matrix.os, 'macos')
        run: |
          brew install automake gzip
          echo "SPC_BUILD_OS=mac" >> $GITHUB_ENV

      - shell: bash
        if: matrix.os == 'windows-latest'
        run: echo "SPC_BUILD_OS=win" >> $GITHUB_ENV

      - shell: bash
        if: matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-24.04-arm'
        run: echo "SPC_BUILD_OS=linux" >> $GITHUB_ENV

      - name: Setup system PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: 8.3
          tools: pecl, composer
          extensions: curl, openssl, mbstring, sodium, tokenizer, filter
          ini-values: memory_limit=-1

      - name: SPC doctor
        run: |
          cd ../static-php-cli
          ./bin/${{ env.SPC_BINARY }} doctor
          cd ../php-bin

      - name: Read PHP extensions from file
        id: read-extensions
        shell: bash
        run: |
          EXTENSIONS=$(php -r "echo trim(file_get_contents('php-extensions.txt'));")
          EXT_HASH=$(php -r "echo md5(getenv('EXTENSIONS'));")
          echo "PHP_EXTENSIONS=$EXTENSIONS" >> $GITHUB_ENV
          echo "PHP_EXT_HASH=$EXT_HASH" >> $GITHUB_ENV

      - name: Read PHP libraries from file
        id: read-libs
        shell: bash
        run: |
          LIBRARIES=$(php -r "echo trim(file_get_contents('php-libraries.txt'));")
          LIBRARIES_HASH=$(php -r "echo md5(getenv('LIBRARIES'));")
          echo "PHP_LIBS=$LIBRARIES" >> $GITHUB_ENV

      # Cache downloaded source
      - id: cache-spc-downloads
        uses: actions/cache@v5
        with:
          path: ../static-php-cli/downloads
          key: spc-downloads-${{ env.PHP_EXT_HASH }}

      - name: Download PHP extension sources
        if: steps.cache-spc-downloads.outputs.cache-hit != 'true'
        run: |
          cd ../static-php-cli
          ./bin/${{ env.SPC_BINARY }} download --with-php=${{ matrix.version }} --for-extensions "${{ env.PHP_EXTENSIONS }}" --prefer-pre-built
          cd ../php-bin

      - name: Build PHP
        run: |
          cd ../static-php-cli
          ./bin/${{ env.SPC_BINARY }} build --build-cli "${{ env.PHP_EXTENSIONS }}" --with-libs="${{ env.PHP_LIBS }}" --debug
          cd ../php-bin

      - name: Get built PHP version
        shell: bash
        run: |
          if [[ "${{ matrix.os }}" == "windows-latest" ]]; then
            PHP_VERSION_FULL=$(../static-php-cli/buildroot/bin/php.exe -r "echo PHP_VERSION;")
          else
            PHP_VERSION_FULL=$(../static-php-cli/buildroot/bin/php -r "echo PHP_VERSION;")
          fi
          echo "PHP_VERSION_FULL=$PHP_VERSION_FULL" >> $GITHUB_ENV

      - name: Create bin directories
        shell: bash
        run: |
          mkdir -p bin/${{ env.SPC_BUILD_OS }}/${{ env.SPC_BUILD_ARCH }}
          mkdir -p license-files
          mkdir -p build-meta

      - name: Zip PHP binary, copy metadata
        shell: bash
        run: |
          if [[ "${{ matrix.os }}" == "windows-latest" ]]; then
            powershell Compress-Archive -Path "../static-php-cli/buildroot/bin/php.exe" -DestinationPath "bin/${{ env.SPC_BUILD_OS }}/${{ env.SPC_BUILD_ARCH }}/php-${{ env.PHP_VERSION }}.zip" -Force
          else
            rm -f bin/${{ env.SPC_BUILD_OS }}/${{ env.SPC_BUILD_ARCH }}/php-${{ env.PHP_VERSION }}.zip
            mkdir -p tmp-bin
            cp ../static-php-cli/buildroot/bin/php tmp-bin/
            cd tmp-bin
            zip ../bin/${{ env.SPC_BUILD_OS }}/${{ env.SPC_BUILD_ARCH }}/php-${{ env.PHP_VERSION }}.zip php
            cd ..
            rm -rf tmp-bin
          fi
          cp ../static-php-cli/buildroot/license/* license-files/
          cp ../static-php-cli/buildroot/build-extensions.json build-meta/build-extensions-${{ env.SPC_BUILD_OS }}.json
          cp ../static-php-cli/buildroot/build-libraries.json build-meta/build-libraries-${{ env.SPC_BUILD_OS }}.json

      # Upload the built zip (and a sha256 sidecar) to R2 instead of committing
      # it to git. Mirrors nativephp-php-bin-mobile/.github/workflows/build.yml:
      # same `aws s3 cp` tooling, R2_* secrets, endpoint and --cache-control.
      # `shell: bash` runs under Git Bash on the windows-latest matrix leg too.
      - name: Upload to R2
        shell: bash
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: auto
        run: |
          ZIP="bin/${SPC_BUILD_OS}/${SPC_BUILD_ARCH}/php-${PHP_VERSION}.zip"
          DEST="${R2_PREFIX}desktop/${SPC_BUILD_OS}/${SPC_BUILD_ARCH}/php-${PHP_VERSION}.zip"

          # Compute the checksum and upload it as a sidecar first.
          if command -v sha256sum >/dev/null 2>&1; then
            SHA=$(sha256sum "$ZIP" | awk '{print $1}')
          else
            SHA=$(shasum -a 256 "$ZIP" | awk '{print $1}')
          fi
          echo "$SHA  $(basename "$ZIP")" > "$ZIP.sha256"

          echo "Uploading $ZIP -> ${DEST} (sha256=$SHA)"
          aws s3 cp "$ZIP" "s3://${R2_BUCKET}/${DEST}" \
            --endpoint-url "$R2_ENDPOINT" \
            --cache-control "public, max-age=31536000, immutable"

          aws s3 cp "$ZIP.sha256" "s3://${R2_BUCKET}/${DEST}.sha256" \
            --endpoint-url "$R2_ENDPOINT" \
            --content-type "text/plain" \
            --cache-control "public, max-age=31536000, immutable"

  # Regenerate the branch manifest from everything currently in R2. Runs after
  # all build jobs; safe because it lists the whole bucket prefix, so it always
  # reflects every platform/version actually uploaded (mac, linux, win).
  manifest:
    needs: build
    # Run even if some matrix legs failed, so the manifest still reflects the
    # binaries that DID upload. Skip only on cancellation. The generator lists
    # the live bucket, so it never references a missing object.
    if: always() && needs.build.result != 'cancelled'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Generate and upload versions.json
        shell: bash
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: auto
          BUCKET: ${{ env.R2_BUCKET }}
          BASE_URL: https://bin.nativephp.com
        run: |
          chmod +x .github/scripts/generate-versions-json.sh
          .github/scripts/generate-versions-json.sh > versions.json
          echo "versions.json:"
          cat versions.json

          # Manifest LAST, after every binary it references is already in R2.
          aws s3 cp versions.json "s3://${R2_BUCKET}/${R2_PREFIX}desktop/versions.json" \
            --endpoint-url "$R2_ENDPOINT" \
            --content-type "application/json" \
            --cache-control "no-cache, no-store"