chore(php): set up latest PHP 8.3 in test-generator and keep Composer timeout

Merged
2Y
1d ago
+9-2

Why

The test-generator job fails in the PHP snapshot tests (e.g. TestSnapPhpModelNamespaceUnusedImport) when composer update runs on the generated SDK:

- php is present at version 8.3.6 and cannot be modified by Composer
- Root composer.json requires roave/security-advisories dev-latest -> satisfiable by roave/security-advisories[dev-latest].
- roave/security-advisories dev-latest conflicts with php <8.2.35|>=8.3,<8.3.36|>=8.4,<8.4.27|>=8.5,<8.5.12.

test-generator has no setup-php step, so it uses the PHP preinstalled on the runner image (8.3.6). Generated PHP SDKs require roave/security-advisories: dev-latest, which now conflicts with PHP 8.3 releases older than 8.3.36. #127 made test-php.yml install the latest 8.3 patch, but test.yml was not covered.

Adding setup-php brings a second issue: it exports COMPOSER_PROCESS_TIMEOUT=0 to later steps, and Composer reads that variable before its config. The composer config --global process-timeout 300 calls in both workflows were therefore overridden, leaving Composer processes with no timeout. This was already the case in test-php.yml.

What changed

  • .github/workflows/test.yml: add the same pinned setup-php step test-php.yml uses (php-version: "8.3", update: true) to test-generator, before the Composer steps.
  • .github/workflows/test.yml, .github/workflows/test-php.yml: pass COMPOSER_PROCESS_TIMEOUT: 300 to setup-php so it exports that value instead of 0, and drop the now-overridden composer config --global process-timeout 300 calls.

No generator or template changes; no generated output changes.

Testing

  • Both workflow files parse as YAML; git diff --check is clean.
  • update is read from the step environment, not from with: inputs (src/scripts/unix.sh in setup-php v2.37.2). COMPOSER_PROCESS_TIMEOUT set on the step replaces the 0 default in setup-php's composer.env (set_composer_env in src/scripts/tools/add_tools.sh).
  • Not run locally: the workflows themselves. The test-generator and PHP jobs on this PR exercise the change.

Follow-up, not addressed here: because generated SDKs depend on roave/security-advisories: dev-latest, a future PHP security release can break CI again until setup-php's prebuilt PHP builds include the new patch.

Public-safety check

  • This change contains no credentials, customer documents, private repository URLs, private filesystem paths, or unredacted private logs.
  • Title, body, comments, and commit messages name no customers or customer-derived identifiers, private paths or trackers, or workflow provenance, and are understandable without private context (.claude/skills/public-repo-communication/SKILL.md).
  • Generated fixtures and review SDK changes are public-safe.
  • I reviewed git diff --check.

Summary by cubic

Fixes the test-generator CI job, which failed when Composer could not resolve dependencies on the runner's preinstalled PHP 8.3.6.

  • Adds the same pinned setup-php step (php-version: "8.3", update: true) used by test-php.yml so the latest 8.3 patch is installed.
  • Passes COMPOSER_PROCESS_TIMEOUT: 300 to setup-php in both workflows, because it exports COMPOSER_PROCESS_TIMEOUT=0 to later steps, overriding the removed composer config --global process-timeout 300 calls.