[rmcdaniel]

The actual published-package caller now reaches PHP setup but the pinned installer release asset returns404. Central PR353 replaced that acquisition with the same reviewed installer bytes held from repository source, and PR354 catalogs the exact helper under its existing role.

On2.20.x, update three references together: setup-php-linux, the canonical terminal-control checkout and terminal control_source all use exact ed150. Private-pip/Composer trust stays at242c. The system Python selection, Ubuntu24/PHP8.3 profile, Composer/PHPUnit pins, maintained-harness versus published-product separation, trigger/permission graph and both cleanup paths are unchanged. No product, dependency or support delta.

Validation: 17 routing/admission/system-Python source controls pass; canonical ordinary policy at accepted central main edba47c8 admits the complete workflow inventory. The old catalog refuses this exact helper, while the accepted catalog retains other-action-path and whole-target Composer refusals. The host has no PHP CLI; PHP-dependent feature routing belongs to normal hosted checks. This is the exact three-reference maintenance backport of accepted main PR1060; the product fix,2.20.5 metadata and stable support/dependency graph remain unchanged.

The two consumed caller attempts remain NONPASS, including installer404 from run42348212659/a1. This source PR selects no PHP setup/bootstrap, actual published-package caller, tag, package release or retry. A new actual caller requires its separate exact subject, reviewed packet and distinct decision. Refs central297 and #1052.

[rmcdaniel]

PASS — finite Source/trigger review

Reviewed exact head 53685b59b1337b94862344a96a74319a094562e4, tree f574cea0fa917e730bdaf4d3dcd7e54feba1340a, parent 2283af7354cf0608017b606c8b24718d02e4c77c.

The delta is one workflow file and exactly the three coupled 8ba5caae2546f3d5f41b7616c5722b9b337b8fc0 → ed15002a156725523b23eefb935a243cb1f84952 substitutions: the central control checkout, the setup-php-linux action reference, and terminal control_source. The resulting workflow blob is 9ae8e5ef7df872ee17aabffa444daad8142f6030, byte-identical to the already accepted main counterpart in PR 1060. Product, dependency, support-contract, and 2.20.5 metadata remain the maintenance-parent bytes; triggers, permissions, profile inputs, private-pip pin, harness/product separation, terminal predicates, and cleanup are unchanged.

The complete maintenance worktree passes canonical action-policy validation against protected central main edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f, whose accepted catalog binds exact helper source ed15002a156725523b23eefb935a243cb1f84952 to the existing bound-linux-php role. The 17 focused routing, admission, and system-Python controls also pass locally.

Hosted qualification is terminal on this unchanged head: 11 SUCCESS, seven intended SKIPPED, zero failures, zero pending. This includes central policy, repository contracts, public-boundary scans, quality, regression corpus, tracing HTTP, and the three PR-only PHP/backend jobs.

No Source or trigger finding remains for this exact backport. This accepts only the reviewed source and ordinary hosted qualification. It does not relabel either consumed caller attempt, select a tag or setup/bootstrap call, accept an installed profile, or authorize a caller/publication effect.

[rmcdaniel]

PASS — exact maintenance-main Source/custody carry for the reviewed Workflow caller backport.

The merged commit is b8f6bcdb951602b22259274b13b2261fdebff542, with exact reviewed tree f574cea0fa917e730bdaf4d3dcd7e54feba1340a and ordered parents 2283af7354cf0608017b606c8b24718d02e4c77c + reviewed head 53685b59b1337b94862344a96a74319a094562e4. The current 2.20.x branch ref resolves to that merge.

Actual maintenance-push qualification is terminal: run 42355376829 has 21 successes and four intended skips (three PR-only jobs plus non-main Sonar), and public-boundary run 42355376848 has one success. No job failed or remained active. This carries the prior exact Source/trigger review to the merged identity only.

The accepted scope remains the single caller workflow with the same three coordinated 8ba5caae... → ed15002a... substitutions. Product/dependency/support metadata, published 2.20.5 selection, setup execution, package/tag publication and installed caller acceptance remain separate; none is inferred from this Source carry.

[rmcdaniel]

Maintenance Source/main/cleanup is complete. Normal2.20.x merge b8f6bcdb951602b22259274b13b2261fdebff542 has exact reviewed tree f574cea0fa917e730bdaf4d3dcd7e54feba1340a, ordered parents2283 +5368, and all26 actual-maintenance checks terminal22SUCCESS/4intendedSKIP. The PR had11SUCCESS/7intendedSKIP; independent exact Source/trigger PASS is6704447305. Its release-verification workflow blob is byte-identical to accepted main1060.

Expected-head leased topic deletion, fresh Git absence/REST404, local topic absence and clean detached maintenance checkout are verified. Product fix,2.20.5 metadata and stable dependency/support bytes remain unchanged. The earlier published2.20.4 tag remains immutable.

The genuinely changed main-harness caller42356468339/a1 separately completed all13 jobs SUCCESS, with actual post-product setup/private-pip/Composer cleanup evidence in297/6704687093; independent terminal audit remains the gate before that carry. This maintenance Source merge selects no tag, package publication or actual caller. The next General action is the qualified2.20.5 patch release after accepted caller audit, followed by actual registry/package and affected-consumer verification.