Skip to content

Synced php85 changes: merged builder_nodejs into builder and updated Node.js to 26 - #25

Merged
Ilyes512 merged 18 commits into
mainfrom
sync-php85-pr94-97
Nov 4, 2026
Merged

Ilyes512 merged 18 commits into
mainfrom
sync-php85-pr94-97

Conversation

@Ilyes512

@Ilyes512 Ilyes512 commented Nov 4, 2026 •

Copy link
Copy Markdown
Member

Summary

Syncs specsnl/php85#94, specsnl/php85#95, specsnl/php85#96 and specsnl/php85#97.

Dependencies

  • Updated Composer to 2.11.1

Composer path and package managers

  • Moved the Composer binary to /usr/local/bin
  • Updated corepack npm to 12.x and pnpm to 12.x
  • Downloaded the pnpm binary at build time
  • Quoted paths that use variables
  • Replaced hardcoded XDG paths with their variables
  • Removed redundant creation of the XDG data and config directories
  • Fixed ownership of the corepack cache
  • Set LANG to C.UTF-8
  • Created the pnpm and Yarn store directories owned by the user

Merged builder_nodejs into builder

  • Merged the builder_nodejs stage into builder
  • Removed the builder_nodejs target from the Taskfile
  • Updated the README for the merged builder image
  • Updated github-actions to 3.0.0
  • Updated required status checks for github-actions 3.0.0
  • Combined the fixuid setup into the first builder RUN

Node.js

  • Updated Node.js to 26 and installed corepack from npm

Debian bullseye security repository

  • Switched the bullseye security repository to archive.debian.org (snapshot.debian.org returns 503 for every archive path; archive.debian.org now hosts bullseye-security with the same final package versions and no Valid-Until, so the DEBIAN_SECURITY_SNAPSHOT build arg and the check-valid-until=no override are removed)

Decisions and skipped steps

  • The live ruleset on GitHub still requires the builder_nodejs merge checks, which no longer run. Update it when merging, or this PR stays blocked.
  • mlocati/php-extension-installer stays at 2.12.0 here; the 2.13.1 bump in php85 came from Dependabot, not from these PRs.
  • Skipped the PHP base image update: 7.4.33 is the final PHP 7.4 release and already in use.
  • FrankenPHP parts of the Taskfile, README and ruleset changes don't apply (no FrankenPHP variant). Xdebug 3.1.6 is kept.
  • The full fpm and apache images build locally with the archive.debian.org repository, and task lint passes.

Locally installed software belongs in /usr/local/bin; /usr/bin is reserved for distribution-managed packages.
pnpm 12 fetches its platform-specific binary on first run, so run it once during the build instead of on first use.
corepack runs as root after the cache was handed to the user, which left the cache root-owned and blocked installing other package manager versions.
Makes shell tools handle UTF-8 text instead of treating it as bytes.
Volumes mounted on these paths now start out owned by the user instead of root. PNPM_CONFIG_STORE_DIR pins the pnpm store when XDG_DATA_HOME is overridden.
The builder image now includes Node.js by default.
3.0.0 builds a single builder target and keeps publishing it as builder_nodejs and node (specsnl/github-actions#75).
Composer is now copied last, so a Composer update only rebuilds that layer.
Node.js 25+ no longer bundles corepack.
snapshot.debian.org returns 503 for every archive path, which broke the
build. archive.debian.org now hosts bullseye-security with the same final
package versions, and its Release file has no Valid-Until, so the
check-valid-until override is no longer needed.
@Ilyes512
Ilyes512 enabled auto-merge November 4, 2026 19:46
@Ilyes512
Ilyes512 merged commit bed143e into main Nov 4, 2026
13 checks passed
@Ilyes512
Ilyes512 deleted the sync-php85-pr94-97 branch November 4, 2026 19:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant