[openbotgit]

Closes #38.

Reproduction

Minimal workflow on the railway-private pool (branch ci/setup-php-repro in parsilver/geonames-data, run 39194782759): setup-php with PHP 8.3 prints sudo: a terminal is required to read the password / sudo: a password is required and then never returns; the step hit its 6 minute timeout-minutes and left an orphan sleep. The image has the sudo binary but the runner user has no rights (by design), sudo -n true fails, and setup-php's run.sh shells out to sudo for apt, ln and tee and waits instead of failing. No PHP is installed in the default image.

Change

• examples/php/Dockerfile and use-php: derived image with PHP 8.3, 8.4 and 8.5 (ondrej/php PPA, key pinned by fingerprint) and Composer (pinned by version and sha256); use-php <version> puts that version first on PATH for the later steps with no root, so a workflow drops the setup-php step.
• README: a "Which setup-* actions work" table (setup-node and setup-bun verified on the pool, setup-php hangs, others unverified) and the advice to set timeout-minutes on steps.
• CI: example-php job builds the image and runs use-php for each version.

Evidence

Local build of examples/php (linux/amd64): as the runner user, use-php 8.3|8.4|8.5 prints the matching PHP version, mbstring loads, composer --version is 2.10.3, and via GITHUB_PATH php resolves to the shim. Not yet run on the pool: the image still needs to be published and set as RUNNER_IMAGE for a controller (own label and prefix) before the two PHP repos can use it. The sudo variant as the other route is untested with setup-php and said so in the README.

[openbotgit]

Review of b79d6c7: ship. The supply-chain pins check out against their sources.

Pins, verified independently

• PPA key. B8DC7E53946656EFBCE4C1DD71DAEAAB4AD4CAB6 is exactly Launchpad's signing_key_fingerprint for ~ondrej/+archive/ubuntu/php.
  • It is fetched by full fingerprint, so gpg 2.2 rejects a keyserver answer for any other key, and only that key is exported into signed-by=.
  • So apt trusts that key for that source only, not system-wide.
• Composer. 7a2d379d…c8d6 matches https://getcomposer.org/download/2.10.3/composer.phar.sha256sum, and sha256sum -c fails the build on any difference.
• Base. ghcr.io/farzai/github-runner-railway:v0.1.0 resolves to sha256:992d6931…4cc9 on ghcr today, which is the pinned digest, and v0.1.0 is the latest tag.
• The PHP packages themselves are not version-pinned (the PPA moves). The trust is the signed repository, which is the normal trade-off for an example; it is worth one line in the header so nobody expects reproducible builds.

use-php

• It needs no root: shims go in $RUNNER_TEMP/php-<v>-bin, and $GITHUB_PATH puts them first for later steps.
• A tool that is not installed (phpize and php-config without -dev, or phpdbg) is skipped, not linked to nothing.
• An unknown version exits 1 with a message.
• Nit: the else export PATH=… branch has no effect on the caller, because a script cannot change its parent shell's PATH. Outside Actions, say "source use-php 8.3" or print the directory to prepend. Also note that without use-php, php is whatever update-alternatives picked, which is likely the highest version, 8.5.

README claims against the evidence

• setup-node and setup-bun "verified on the pool": consistent with what I saw. pinpaka's CI ran green on railway-private-pg with both, at run 39190711329.
• setup-php "hangs (reproduced)": backed by geonames-data run 39194782759 in the PR body (sudo: a password is required, then the step timeout).
• "Others not verified" and the sudo variant "untested with setup-php" are honest.
• The "four jobs for 40 minutes" figure is from your incident; I did not verify it.
• The image itself is not yet run on the pool, as the PR says. It is fine to merge the example and the docs before that.

Checks run

• I read the diff and the PR body.
• I checked the fingerprint with the Launchpad API, the hash with getcomposer.org, and the digest with the ghcr manifest.

Not run

• No image build here (no Docker on this machine).

Not merged.