Merge pull request #25 from specsnl/sync-php85-pr94-97

Synced php85 changes: merged builder_nodejs into builder and updated Node.js to 26

Author: Ilyes512

.github/rulesets/Main.json

@@ -52,21 +52,13 @@
                         "context": "merge (ghcr.io/specsnl/php74) / builder / Merge Images (builder)",
                         "integration_id": 15368
                     },
-                    {
-                        "context": "merge (ghcr.io/specsnl/php74) / builder_nodejs / Merge Images (builder_nodejs)",
-                        "integration_id": 15368
-                    },
                     {
                         "context": "merge (ghcr.io/specsnl/php74/apache) / runtime / Merge Images (runtime)",
                         "integration_id": 15368
                     },
                     {
                         "context": "merge (ghcr.io/specsnl/php74/apache) / builder / Merge Images (builder)",
                         "integration_id": 15368
-                    },
-                    {
-                        "context": "merge (ghcr.io/specsnl/php74/apache) / builder_nodejs / Merge Images (builder_nodejs)",
-                        "integration_id": 15368
                     }
                 ]
             }

.github/workflows/main.yml

@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   build:
-    uses: specsnl/github-actions/.github/workflows/build-php.yml@2.4.4
+    uses: specsnl/github-actions/.github/workflows/build-php.yml@3.0.0
     strategy:
       fail-fast: false
       matrix:
@@ -36,7 +36,7 @@ jobs:
       dockerfile: ${{ matrix.docker.dockerfile }}
 
   merge:
-    uses: specsnl/github-actions/.github/workflows/merge-php.yml@2.4.4
+    uses: specsnl/github-actions/.github/workflows/merge-php.yml@3.0.0
     needs: build
     strategy:
       matrix:

.github/workflows/pr.yml

@@ -34,7 +34,7 @@ jobs:
 
   build:
     needs: check
-    uses: specsnl/github-actions/.github/workflows/build-php.yml@2.4.4
+    uses: specsnl/github-actions/.github/workflows/build-php.yml@3.0.0
     strategy:
       fail-fast: false
       matrix:
@@ -55,7 +55,7 @@ jobs:
       dockerfile: ${{ matrix.docker.dockerfile }}
 
   merge:
-    uses: specsnl/github-actions/.github/workflows/merge-php.yml@2.4.4
+    uses: specsnl/github-actions/.github/workflows/merge-php.yml@3.0.0
     needs: build
     strategy:
       matrix:

.github/workflows/tag.yml

@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   build:
-    uses: specsnl/github-actions/.github/workflows/build-php.yml@2.4.4
+    uses: specsnl/github-actions/.github/workflows/build-php.yml@3.0.0
     strategy:
       fail-fast: false
       matrix:
@@ -36,7 +36,7 @@ jobs:
       dockerfile: ${{ matrix.docker.dockerfile }}
 
   merge:
-    uses: specsnl/github-actions/.github/workflows/merge-php.yml@2.4.4
+    uses: specsnl/github-actions/.github/workflows/merge-php.yml@3.0.0
     needs: build
     strategy:
       matrix:

Dockerfile.tmpl

@@ -9,14 +9,16 @@ FROM {{ getenv "BASE_IMAGE" }} AS runtime
 
 ARG DEBIAN_FRONTEND=noninteractive
 
+ENV LANG=C.UTF-8
+
 ARG XDG_CONFIG_HOME=/config
-ENV XDG_CONFIG_HOME=$XDG_CONFIG_HOME
+ENV XDG_CONFIG_HOME="$XDG_CONFIG_HOME"
 
 ARG XDG_DATA_HOME=/data
-ENV XDG_DATA_HOME=$XDG_DATA_HOME
+ENV XDG_DATA_HOME="$XDG_DATA_HOME"
 
 ARG XDG_CACHE_HOME=/cache
-ENV XDG_CACHE_HOME=$XDG_CACHE_HOME
+ENV XDG_CACHE_HOME="$XDG_CACHE_HOME"
 
 # Latest version of event-extension: https://pecl.php.net/package/event
 ARG PHP_EVENT_VERSION=3.1.6
@@ -27,14 +29,12 @@ ARG PHP_REDIS_VERSION=6.3.0
 # Latest version of amqp-extension: https://pecl.php.net/package/amqp
 ARG PHP_AMQP_VERSION=2.2.0
 
-ARG DEBIAN_SECURITY_SNAPSHOT=20260901T000000Z
-
 WORKDIR /var/www
 
 RUN --mount=type=bind,from=php_extension_installer,source=/usr/bin/install-php-extensions,target=/usr/local/bin/install-php-extensions \
     # Bullseye is EOL:
-    sed -i -E "s|^deb http://deb.debian.org/debian-security (.*)|deb [check-valid-until=no] http://snapshot.debian.org/archive/debian-security/$DEBIAN_SECURITY_SNAPSHOT \1|" /etc/apt/sources.list \
-    && grep -q snapshot.debian.org /etc/apt/sources.list \
+    sed -i -E "s|^deb http://deb.debian.org/debian-security (.*)|deb http://archive.debian.org/debian-security \1|" /etc/apt/sources.list \
+    && grep -q archive.debian.org /etc/apt/sources.list \
     && apt-get update \
     && apt-get install --assume-yes --no-install-recommends \
         apt-transport-https \
@@ -58,9 +58,9 @@ RUN --mount=type=bind,from=php_extension_installer,source=/usr/bin/install-php-e
         "amqp-$PHP_AMQP_VERSION" \
     && cp "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini" \
     && mkdir -p \
-        $XDG_CONFIG_HOME \
-        $XDG_DATA_HOME \
-        $XDG_CACHE_HOME \
+        "$XDG_CONFIG_HOME" \
+        "$XDG_DATA_HOME" \
+        "$XDG_CACHE_HOME" \
     && rm -rf /var/www/* \
     # Cleanup
     && apt-get autoremove --assume-yes \
@@ -73,6 +73,9 @@ COPY files/general /
 # Latest version of Composer: https://hub.docker.com/r/composer/composer/tags
 FROM {{ getenv "COMPOSER_IMAGE" }} AS composer
 
+# Latest version of node: https://hub.docker.com/_/node/tags
+FROM {{ getenv "NODE_IMAGE" }} AS node
+
 FROM runtime AS builder
 
 ARG TARGETARCH
@@ -83,6 +86,16 @@ ARG XDEBUG_VERSION=3.1.6
 # Latest version of pcov: https://pecl.php.net/package/pcov
 ARG PCOV_VERSION=1.0.12
 
+# Latest version of fixuid: https://github.com/boxboat/fixuid/releases/latest
+ARG FIXUID_VERSION=0.6.0
+
+ARG USER=code
+ARG GROUP=code
+ARG USER_UID=1000
+ARG USER_GID=1000
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
 RUN --mount=type=bind,from=php_extension_installer,source=/usr/bin/install-php-extensions,target=/usr/local/bin/install-php-extensions \
     apt-get update \
     && apt-get install --assume-yes --no-install-recommends \
@@ -93,6 +106,9 @@ RUN --mount=type=bind,from=php_extension_installer,source=/usr/bin/install-php-e
         p7zip-full \
         unzip \
         curl \
+        gcc \
+        g++ \
+        make \
     # Download Composer keys
     && mkdir -p "$XDG_CONFIG_HOME/composer" \
     && curl -fsSLo "$XDG_CONFIG_HOME/composer/keys.dev.pub" https://composer.github.io/snapshots.pub \
@@ -103,23 +119,8 @@ RUN --mount=type=bind,from=php_extension_installer,source=/usr/bin/install-php-e
         "xdebug-$XDEBUG_VERSION" \
         "pcov-$PCOV_VERSION" \
     && cp "$PHP_INI_DIR/php.ini-development" "$PHP_INI_DIR/php.ini" \
-    # Cleanup
-    && apt-get autoremove --assume-yes \
-    && apt-get clean --assume-yes \
-    && rm -rf /var/lib/apt/lists/* \
-    && rm -rf /tmp/*
-
-# Latest version of fixuid: https://github.com/boxboat/fixuid/releases/latest
-ARG FIXUID_VERSION=0.6.0
-
-ARG USER=code
-ARG GROUP=code
-ARG USER_UID=1000
-ARG USER_GID=1000
-
-SHELL ["/bin/bash", "-o", "pipefail", "-c"]
-
-RUN curl -fsSLo /tmp/fixuid.tar.gz "https://github.com/boxboat/fixuid/releases/download/v$FIXUID_VERSION/fixuid-${FIXUID_VERSION}-linux-${TARGETARCH}.tar.gz" \
+    # Install fixuid
+    && curl -fsSLo /tmp/fixuid.tar.gz "https://github.com/boxboat/fixuid/releases/download/v$FIXUID_VERSION/fixuid-${FIXUID_VERSION}-linux-${TARGETARCH}.tar.gz" \
     && tar -xf /tmp/fixuid.tar.gz -C /usr/local/bin fixuid \
     && chown root:root /usr/local/bin/fixuid \
     && chmod 4755 /usr/local/bin/fixuid \
@@ -133,51 +134,53 @@ RUN curl -fsSLo /tmp/fixuid.tar.gz "https://github.com/boxboat/fixuid/releases/d
     && useradd --uid "$USER_UID" --gid "$USER_GID" --create-home "$USER" --shell /bin/bash \
     && mkdir -p \
         /etc/fixuid \
-        "/data" \
-        "/config" \
-        "/cache/npm" \
-        "/cache/node" \
+        "$XDG_CACHE_HOME/npm" \
+        "$XDG_CACHE_HOME/node" \
+        "$XDG_CACHE_HOME/yarn" \
+        "$XDG_DATA_HOME/pnpm/store" \
+        "$XDG_DATA_HOME/yarn/berry" \
     && chown -R "$USER_UID":"$USER_GID" \
-        "/data" \
-        "/config" \
-        "/cache" \
+        "$XDG_DATA_HOME" \
+        "$XDG_CONFIG_HOME" \
+        "$XDG_CACHE_HOME" \
+    # Cleanup
+    && apt-get autoremove --assume-yes \
+    && apt-get clean --assume-yes \
+    && rm -rf /var/lib/apt/lists/* \
+    && rm -rf /tmp/* \
     && cat <<EOF > /etc/fixuid/config.yml
 user: $USER
 group: $existing_group
 paths:
   - /var/www
-  - /home/$USER
-  - /data
-  - /config
-  - /cache
+  - "/home/$USER"
+  - "$XDG_DATA_HOME"
+  - "$XDG_CONFIG_HOME"
+  - "$XDG_CACHE_HOME"
 
 EOF
 
-COPY --from=composer /composer /usr/bin/composer
-
-# Latest version of node: https://hub.docker.com/_/node/tags
-FROM {{ getenv "NODE_IMAGE" }} AS node
-
-FROM builder AS builder_nodejs
-
-ARG DEBIAN_FRONTEND=noninteractive
-
 ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 ENV npm_config_cache="$XDG_CACHE_HOME/npm"
+ENV PNPM_CONFIG_STORE_DIR="$XDG_DATA_HOME/pnpm/store"
 
 COPY --from=node /usr/local/bin/node /usr/local/bin/node
 COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
 
-RUN apt-get update \
-    && apt-get install --assume-yes --no-install-recommends \
-        gcc \
-        g++ \
-        make \
-    && ln -s ../lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack \
-    && corepack install --global npm@11.x yarn@4.x pnpm@10.x \
+# Latest version of corepack: https://www.npmjs.com/package/corepack
+ARG COREPACK_VERSION=0.36.0
+
+# Node.js 25+ no longer bundles corepack. npm's bin links are not copied from the node stage, and its cache goes to /tmp
+# so no root-owned files end up in npm_config_cache.
+RUN node /usr/local/lib/node_modules/npm/bin/npm-cli.js install --global \
+        --cache /tmp/npm-cache --no-update-notifier --no-audit --no-fund \
+        "corepack@$COREPACK_VERSION" \
+    && corepack install --global npm@12.x yarn@4.x pnpm@12.x \
     && corepack enable npm yarn pnpm \
+    # pnpm downloads its platform-specific binary on first run
+    && pnpm --version \
+    && chown -R --reference="$XDG_CACHE_HOME" "$XDG_CACHE_HOME/node" \
     # Cleanup
-    && apt-get autoremove --assume-yes \
-    && apt-get clean --assume-yes \
-    && rm -rf /var/lib/apt/lists/* \
     && rm -rf /tmp/*
+
+COPY --from=composer /composer /usr/local/bin/composer

README.md

@@ -10,27 +10,28 @@ A PHP 7.4 (FPM and Apache) based Docker base image.
 # FPM
 docker pull ghcr.io/specsnl/php74:latest
 docker pull ghcr.io/specsnl/php74/builder:latest
-docker pull ghcr.io/specsnl/php74/builder_nodejs:latest
 
 # Apache
 docker pull ghcr.io/specsnl/php74/apache:latest
 docker pull ghcr.io/specsnl/php74/apache/builder:latest
-docker pull ghcr.io/specsnl/php74/apache/builder_nodejs:latest
 ```
 
 The image name scheme: `ghcr.io/specsnl/php74[/{VARIANT}][/{TARGET}]:{VERSION}`
 
 - **{VARIANT}**: omitted for FPM, otherwise `apache`
-- **{TARGET}**: omitted for `runtime`, otherwise `builder` or `builder_nodejs` (also published as `node`)
+- **{TARGET}**: omitted for `runtime`, otherwise `builder`
 - **{VERSION}**: `latest`, a release tag (i.e. `0.5.5`), `main` or `pr-<number>`
 
+The `builder` image is also published under its old names, `builder_nodejs` and `node`, from the time Node.js had its own
+target. These names are deprecated and will be removed ([specsnl/github-actions#76](https://github.com/specsnl/github-actions/issues/76));
+use `builder` instead.
+
 ## Building the docker image(s)
 
 There are multiple targets:
 
   - **runtime**: this is for *production*. It does not contain any development tools like Composer and Xdebug.
-  - **builder**: this is for *development*. This is based on the runtime-target and it adds Composer, Xdebug etc.
-  - **builder_nodejs**: this is for *development*. This is based on the builder-target and it adds NodeJS.
+  - **builder**: this is for *development*. This is based on the runtime-target and it adds Composer, Xdebug, Node.js etc.
 
 Building `runtime`-target:
 
@@ -44,37 +45,16 @@ Building `builder`-target:
 docker build --tag ghcr.io/specsnl/php74/builder:latest --file fpm/Dockerfile --target builder .
 ```
 
-Building `builder_nodejs`-target:
-
-```
-docker build --tag ghcr.io/specsnl/php74/builder_nodejs:latest --file fpm/Dockerfile --target builder_nodejs .
-```
-
-## Debian bullseye is EOL (`DEBIAN_SECURITY_SNAPSHOT`)
+## Debian bullseye is EOL
 
 PHP 7.4 images are only published for Debian 11 (bullseye), which is past end-of-life. Its security
-suite has stopped being maintained, and the mirrors have moved on in a way that breaks `apt-get`:
-
-- `deb.debian.org` still serves the `bullseye-security` package index, but the `.deb` pool behind it
-  has been purged — every package download returns a 404.
-- `archive.debian.org`, where EOL suites normally end up, does not have `bullseye-security` yet. As
-  of this writing it only goes up to `buster`.
-- The final `Release` file (published 2026-08-31) carries a 7-day `Valid-Until` that has long since
-  lapsed, so `apt` rejects the repository as expired even where it is reachable.
-
-To still get the last published security updates, the runtime stage rewrites the `bullseye-security`
-entry in `/etc/apt/sources.list` to point at [snapshot.debian.org](https://snapshot.debian.org),
-which keeps every historical mirror state permanently. The build arg pins which state is used:
-
-```
-ARG DEBIAN_SECURITY_SNAPSHOT=20260901T000000Z
-```
+suite has stopped being maintained, and `deb.debian.org` still serves the `bullseye-security` package
+index while the `.deb` pool behind it has been purged — every package download returns a 404.
 
-That timestamp sits just after the final security publish, so the image gets the complete, final set
-of bullseye security updates. Because the snapshot is immutable, this does not break when Debian
-finishes moving bullseye to `archive.debian.org`. The rewrite also disables `apt`'s freshness check
-for that one repository — signatures are still verified, only the "is this recent?" assertion is
-skipped, which is unavoidable for a deliberately frozen suite.
+To still get the final published security updates, the runtime stage rewrites the `bullseye-security`
+entry in `/etc/apt/sources.list` to point at `archive.debian.org`, where Debian keeps EOL suites
+permanently. The archived `Release` file carries no `Valid-Until`, so no `apt` freshness override is
+needed.
 
 A `grep` guard follows the rewrite so the build fails loudly if the base image ever changes its
 `sources.list` format, rather than silently falling back to building without security updates.