feat: update php 8

Author: zhengkunwang223

.github/workflows/php8-security-release.yml

@@ -0,0 +1,89 @@
+name: Build PHP 8 Security Images
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: php8-security-release
+  cancel-in-progress: false
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+jobs:
+  docker:
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      max-parallel: 1
+      matrix:
+        phpVersion: ["8.2.35", "8.3.36", "8.4.27", "8.5.12"]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Prepare source build with 1Panel configuration
+        shell: bash
+        env:
+          PHP_VERSION: ${{ matrix.phpVersion }}
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          import os
+          import shutil
+          from pathlib import Path
+
+          version = os.environ["PHP_VERSION"]
+          source = Path("php/8")
+          context = Path(os.environ["RUNNER_TEMP"]) / "php-security"
+          context.mkdir()
+          shutil.copytree(source / "data", context / "data")
+          for helper in (source / "upstream").glob("docker-php-*"):
+              shutil.copy2(helper, context / helper.name)
+              (context / helper.name).chmod(0o755)
+
+          upstream = (source / "upstream" / version / "Dockerfile").read_text()
+          assert upstream.count("FROM debian:trixie-slim\n") == 1
+          assert f"ENV PHP_VERSION {version}\n" in upstream
+          assert upstream.count('make -j "$(nproc)"') == 1
+          upstream = upstream.replace("FROM debian:trixie-slim\n", "FROM debian:trixie-slim AS php-upstream\n", 1)
+          upstream = upstream.replace('make -j "$(nproc)"', 'make -j 2', 1)
+
+          runtime = (source / "Dockerfile").read_text()
+          base = "ARG PHP_VERSION\nFROM php:${PHP_VERSION}-fpm\n"
+          assert runtime.startswith(base)
+          runtime = "FROM php-upstream\n" + runtime[len(base):]
+          smoke = f"\nRUN php -r 'exit(PHP_VERSION === \"{version}\" ? 0 : 1);' && php-fpm -t && supervisord --version && composer --version\n"
+          (context / "Dockerfile").write_text(upstream + "\n" + runtime + smoke)
+          PY
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+        with:
+          buildkitd-config-inline: |
+            [worker.oci]
+              max-parallelism = 1
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+      - name: Build PHP-FPM security image and push
+        uses: docker/build-push-action@v7
+        with:
+          context: ${{ runner.temp }}/php-security
+          file: ${{ runner.temp }}/php-security/Dockerfile
+          platforms: linux/amd64,linux/arm/v7,linux/arm64/v8
+          pull: true
+          push: true
+          tags: 1panel/php:${{ matrix.phpVersion }}-fpm
+          cache-from: type=gha,scope=php-security-${{ matrix.phpVersion }}
+          cache-to: type=gha,mode=max,scope=php-security-${{ matrix.phpVersion }}

README.md

@@ -26,6 +26,10 @@ Current images in this repository:
 - `1panel/php`: PHP-FPM runtime images for multiple versions
 - `1panel/java`: Java JDK runtime images based on Eclipse Temurin
 
+## PHP 8 security releases
+
+`Build PHP 8 Security Images` builds PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 from pinned upstream Dockerfiles, without waiting for official base image tags. See [source provenance and build instructions](php/8/upstream/README.md).
+
 ## PHP 7.3 / 7.4
 
 The `Build PHP 7 Image` workflow (`.github/workflows/php7-release.yml`) builds PHP 7.3 and 7.4 from `php/7`, independently of PHP 8. For example:

README_zh.md

@@ -26,6 +26,10 @@
 - `1panel/php`：多个版本的 PHP-FPM 运行环境镜像
 - `1panel/java`：基于 Eclipse Temurin 的 Java JDK 运行环境镜像
 
+## PHP 8 安全版本
+
+`Build PHP 8 Security Images` 从固定上游提交的 Dockerfile 构建 PHP 8.2.35、8.3.36、8.4.27 和 8.5.12，不依赖尚未发布的官方基础镜像标签。详见[源码来源和构建说明](php/8/upstream/README.md)。
+
 ## PHP 7.3 / 7.4
 
 `Build PHP 7 Image` 工作流（`.github/workflows/php7-release.yml`）从 `php/7` 构建 PHP 7.3 和 7.4，与 PHP 8 分开维护。例如：