From 8223b792217493e582b1f228981481266b285d1d Mon Sep 17 00:00:00 2001 From: Nelson Isioma Date: Thu, 22 Oct 2026 13:15:46 +0100 Subject: [PATCH 1/7] Build the phar in the release workflow The release workflow uploaded the committed builds/ohdear as-is, so a release only contained new code if someone remembered to rebuild and commit the phar first. v5.3.0 needed a follow-up rebuild, and v5.4.0 shipped the 5.3.0 binary. Add a build job that compiles the phar from the tagged commit with the tag as its version, checks that --version matches, and hands it to both the GitHub release and Docker jobs. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release.yml | 54 +++++++++++++++++++++++++++++++++-- 1 file changed, 52 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 703aeb5..061ad6a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,8 +6,8 @@ on: - 'v*' jobs: - phar-release: - name: PHAR + build: + name: Build PHAR runs-on: ubuntu-latest if: github.repository == 'ohdearapp/ohdear-cli' @@ -17,6 +17,45 @@ jobs: - name: Checkout uses: actions/checkout@v4 + - name: Setup PHP + uses: shivammathur/setup-php@v2 + with: + php-version: 8.4 + extensions: zlib + coverage: none + + - name: Install dependencies + run: composer install --prefer-dist --no-interaction + + - name: Build PHAR + run: php ohdear app:build ohdear --build-version="${GITHUB_REF_NAME#v}" --no-interaction + + - name: Verify PHAR version + run: | + php builds/ohdear --version | tee /dev/stderr | grep -qF "${GITHUB_REF_NAME#v}" + + - name: Upload PHAR + uses: actions/upload-artifact@v4 + with: + name: ohdear-phar + path: builds/ohdear + if-no-files-found: error + + phar-release: + name: PHAR + runs-on: ubuntu-latest + needs: build + + if: github.repository == 'ohdearapp/ohdear-cli' + + steps: + + - name: Download PHAR + uses: actions/download-artifact@v4 + with: + name: ohdear-phar + path: builds + - name: Prepare Phar for upload run: | mv builds/ohdear builds/ohdear.phar @@ -31,6 +70,7 @@ jobs: docker-release: name: Docker runs-on: ubuntu-latest + needs: build if: github.repository == 'ohdearapp/ohdear-cli' @@ -43,6 +83,16 @@ jobs: - name: Checkout uses: actions/checkout@v4 + - name: Download PHAR + uses: actions/download-artifact@v4 + with: + name: ohdear-phar + path: builds + + # Artifacts don't keep file modes, and the image runs /ohdear directly. + - name: Make PHAR executable + run: chmod +x builds/ohdear + - name: Login to Docker Hub uses: docker/login-action@v3 with: From 5e3e02773a23065148bb99a4561eaf581dbd0882 Mon Sep 17 00:00:00 2001 From: Mattias Geniar Date: Fri, 23 Oct 2026 12:15:07 +0000 Subject: [PATCH 2/7] Compare the built phar's version exactly --- .github/workflows/release.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 061ad6a..2e3e06b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -31,8 +31,11 @@ jobs: run: php ohdear app:build ohdear --build-version="${GITHUB_REF_NAME#v}" --no-interaction - name: Verify PHAR version + shell: bash run: | - php builds/ohdear --version | tee /dev/stderr | grep -qF "${GITHUB_REF_NAME#v}" + actual="$(php builds/ohdear --version --no-ansi)" + echo "$actual" + [[ "$actual" == "Oh Dear ${GITHUB_REF_NAME#v}" ]] - name: Upload PHAR uses: actions/upload-artifact@v4 From 1b3b8d0854c8bebcae794a2bf0a772367a163694 Mon Sep 17 00:00:00 2001 From: Mattias Geniar Date: Fri, 23 Oct 2026 12:15:15 +0000 Subject: [PATCH 3/7] Fail the release when the committed phar doesn't match the tag --- .github/workflows/release.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2e3e06b..3944b13 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -24,6 +24,19 @@ jobs: extensions: zlib coverage: none + # Composer installs run the committed builds/ohdear, not the phar built below. + # A stale committed phar would ship an old version to Composer users. + - name: Verify committed PHAR version + shell: bash + run: | + expected="Oh Dear ${GITHUB_REF_NAME#v}" + actual="$(php builds/ohdear --version --no-ansi)" + echo "$actual" + if [[ "$actual" != "$expected" ]]; then + echo "::error file=builds/ohdear::The committed builds/ohdear reports '$actual', not '$expected'. Composer users get the committed file. Rebuild it with 'php ohdear app:build ohdear --build-version=${GITHUB_REF_NAME#v}', commit it, and push a new tag." + exit 1 + fi + - name: Install dependencies run: composer install --prefer-dist --no-interaction From 2b9adda4191437414b309992c8817058e9ad84be Mon Sep 17 00:00:00 2001 From: Mattias Geniar Date: Fri, 23 Oct 2026 12:15:22 +0000 Subject: [PATCH 4/7] Point the stale-phar error at the next version, not the failed tag --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3944b13..eec817d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -33,7 +33,7 @@ jobs: actual="$(php builds/ohdear --version --no-ansi)" echo "$actual" if [[ "$actual" != "$expected" ]]; then - echo "::error file=builds/ohdear::The committed builds/ohdear reports '$actual', not '$expected'. Composer users get the committed file. Rebuild it with 'php ohdear app:build ohdear --build-version=${GITHUB_REF_NAME#v}', commit it, and push a new tag." + echo "::error file=builds/ohdear::The committed builds/ohdear reports '$actual', not '$expected'. Composer users get the committed file. Rebuild it with 'php ohdear app:build ohdear --build-version=', commit it, and tag that commit." exit 1 fi From bf25e49680b8abfe32df529b64450d768942b926 Mon Sep 17 00:00:00 2001 From: Mattias Geniar Date: Fri, 23 Oct 2026 12:15:30 +0000 Subject: [PATCH 5/7] Give the release workflow read-only permissions by default --- .github/workflows/release.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index eec817d..451721b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -5,6 +5,9 @@ on: tags: - 'v*' +permissions: + contents: read + jobs: build: name: Build PHAR @@ -64,6 +67,9 @@ jobs: if: github.repository == 'ohdearapp/ohdear-cli' + permissions: + contents: write + steps: - name: Download PHAR From 0eeb03c00be5b5010f9d9d1950f80445254740b3 Mon Sep 17 00:00:00 2001 From: Mattias Geniar Date: Fri, 23 Oct 2026 12:15:30 +0000 Subject: [PATCH 6/7] Publish tags like v5.5.0-rc.1 as prereleases --- .github/workflows/release.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 451721b..27e71e8 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -86,6 +86,7 @@ jobs: id: create_release uses: softprops/action-gh-release@v1 with: + prerelease: ${{ contains(github.ref_name, '-') }} files: | builds/ohdear.phar From 0117c712580b3ceb86e634096087ad3da0f499b9 Mon Sep 17 00:00:00 2001 From: Mattias Geniar Date: Fri, 23 Oct 2026 12:15:30 +0000 Subject: [PATCH 7/7] Use current major versions of the release and artifact actions --- .github/workflows/release.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 27e71e8..12c3a69 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -54,7 +54,7 @@ jobs: [[ "$actual" == "Oh Dear ${GITHUB_REF_NAME#v}" ]] - name: Upload PHAR - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: ohdear-phar path: builds/ohdear @@ -73,7 +73,7 @@ jobs: steps: - name: Download PHAR - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: ohdear-phar path: builds @@ -84,7 +84,7 @@ jobs: - name: Create GitHub Release id: create_release - uses: softprops/action-gh-release@v1 + uses: softprops/action-gh-release@v3 with: prerelease: ${{ contains(github.ref_name, '-') }} files: | @@ -107,7 +107,7 @@ jobs: uses: actions/checkout@v4 - name: Download PHAR - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: ohdear-phar path: builds