From 7d2f8cf711dd20cd4542ba765b88de5d46210050 Mon Sep 17 00:00:00 2001 From: nicolasotmani Date: Wed, 30 Sep 2026 08:23:49 +0200 Subject: [PATCH 1/4] chore(action): build Docker image on the runner instead of pulling ECR Anonymous pulls of the public ECR image hit Data limit exceeded on shared GitHub runner IPs. Point the action at its Dockerfile so CI builds locally. Co-authored-by: Cursor --- README.md | 19 +++++++++++-------- action.yml | 2 +- examples/.github/workflows/push.yml | 4 ++-- 3 files changed, 14 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index 8901ef4..dbcb02b 100644 --- a/README.md +++ b/README.md @@ -13,9 +13,9 @@ jobs: name: PHP-CS-Fixer runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v4 - name: PHP-CS-Fixer - uses: docker://oskarstark/php-cs-fixer-ga + uses: mobsuccess-devops/github-actions-php-cs-fixer@master ``` _to use a custom config for example, --diff and --dry-run option:_ @@ -27,23 +27,26 @@ jobs: name: PHP-CS-Fixer runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v4 - name: PHP-CS-Fixer - uses: docker://oskarstark/php-cs-fixer-ga + uses: mobsuccess-devops/github-actions-php-cs-fixer@master + with: + args: --config=.project.php_cs --diff --dry-run ``` +The action builds its Docker image from the repository `Dockerfile` on the runner, so CI does not pull `public.ecr.aws/...` anonymously (which hits ECR Public data limits on shared GitHub runner IPs). + +Prefer `uses: mobsuccess-devops/github-actions-php-cs-fixer@...` over `uses: docker://public.ecr.aws/...`. + **You can copy/paste the .github folder (under examples/) to your project and thats all!** ## Docker -A Docker-Image is built automatically and located here: -https://hub.docker.com/r/oskarstark/php-cs-fixer-ga +You can still build and run the image locally: -You can run it in any given directory like this: +`docker compose build` -`docker run --rm -it -w=/app -v ${PWD}:/app oskarstark/php-cs-fixer-ga:latest` +`docker run --rm -it -w=/app -v ${PWD}:/app public.ecr.aws/u9q7y3l4/github-actions-php-cs-fixer:v3.13.0` ## A picture is worth a thousand words diff --git a/action.yml b/action.yml index 193b3cc..8d180e4 100644 --- a/action.yml +++ b/action.yml @@ -12,4 +12,4 @@ name: 'OSKAR-PHP-CS-Fixer' runs: using: 'docker' - image: 'docker://oskarstark/php-cs-fixer-ga:2.18.2' + image: 'Dockerfile' diff --git a/examples/.github/workflows/push.yml b/examples/.github/workflows/push.yml index 9a3796e..7059256 100644 --- a/examples/.github/workflows/push.yml +++ b/examples/.github/workflows/push.yml @@ -5,8 +5,8 @@ jobs: name: PHP-CS-Fixer runs-on: ubuntu-latest steps: - - uses: actions/checkout@master + - uses: actions/checkout@v4 - name: PHP-CS-Fixer - uses: docker://oskarstark/php-cs-fixer-ga + uses: mobsuccess-devops/github-actions-php-cs-fixer@master with: args: --diff --dry-run From 8ca5141feaaddbb09a76b5705947a2c765e4f895 Mon Sep 17 00:00:00 2001 From: nicolasotmani Date: Wed, 30 Sep 2026 08:50:01 +0200 Subject: [PATCH 2/4] chore(docker): rebuild PHP-CS-Fixer on alpine PHP packages Match the kuberneteslint approach: slim the published ECR image and push it via upgrade-aws.yml so consumers keep docker://...:v3.13.0 unchanged. Co-authored-by: Cursor --- .github/workflows/upgrade-aws.yml | 66 +++++++++++++++++++++++++++++ Dockerfile | 25 ++++++++--- README.md | 19 ++++----- action.yml | 2 +- examples/.github/workflows/push.yml | 4 +- 5 files changed, 97 insertions(+), 19 deletions(-) create mode 100644 .github/workflows/upgrade-aws.yml diff --git a/.github/workflows/upgrade-aws.yml b/.github/workflows/upgrade-aws.yml new file mode 100644 index 0000000..8f42360 --- /dev/null +++ b/.github/workflows/upgrade-aws.yml @@ -0,0 +1,66 @@ +on: + push: + branches: + - master +name: ECR +env: + DOCKER_BUILDKIT: 1 + COMPOSE_DOCKER_CLI_BUILD: 1 +jobs: + prepare-ecr: + name: Prepare ECR + runs-on: ubuntu-latest + timeout-minutes: 1 + outputs: + role: ${{ steps.prepare.outputs.role }} + branch: ${{ steps.prepare.outputs.branch }} + steps: + - name: Prepare + id: prepare + run: | + case ${{github.ref}} in + refs/heads/master) + role=arn:aws:iam::983851922138:role/GHA,github-actions-php-cs-fixer + branch=master + ;; + *) + echo "Unknown ref: ${{github.ref}}" + exit 1 + ;; + esac + echo branch: $branch + echo role: $role + echo "branch=$branch" >> $GITHUB_OUTPUT + echo "role=$role" >> $GITHUB_OUTPUT + ecr: + name: ECR + runs-on: ubuntu-latest + needs: [prepare-ecr] + timeout-minutes: 15 + permissions: + id-token: write + contents: read + steps: + - uses: actions/checkout@v3 + - name: Setup Docker Compose + run: | + if [ ! -f docker-compose.${{needs.prepare-ecr.outputs.branch}}.yml ]; then + echo 'version: "3.8"' > docker-compose.${{needs.prepare-ecr.outputs.branch}}.yml + fi + - name: Setup Docker Buildx + uses: docker/setup-buildx-action@v1 + - uses: aws-actions/configure-aws-credentials@v1 + name: Configure AWS Credentials (eu-central-1) + with: + role-to-assume: ${{needs.prepare-ecr.outputs.role}} + aws-region: us-east-1 + role-duration-seconds: 900 + - name: Login to Amazon ECR + id: login-ecr + uses: aws-actions/amazon-ecr-login@v1 + with: + registry-type: 'public' + - name: Build + run: docker-compose build --build-arg BUILDKIT_INLINE_CACHE=1 + - name: Push + run: docker-compose push diff --git a/Dockerfile b/Dockerfile index 8db475c..42d6cea 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,13 +1,28 @@ -FROM --platform=linux/amd64 php:8.1-alpine +FROM --platform=linux/amd64 alpine:3.19 LABEL "com.github.actions.name"="PHP-CS-Fixer" LABEL "com.github.actions.description"="check php files" LABEL "com.github.actions.icon"="check" LABEL "com.github.actions.color"="blue" -RUN wget https://github.com/FriendsOfPHP/PHP-CS-Fixer/releases/download/v3.13.0/php-cs-fixer.phar -O php-cs-fixer \ - && chmod a+x php-cs-fixer \ - && mv php-cs-fixer /usr/local/bin/php-cs-fixer +# Official php:*-alpine images ship a full PHP toolchain; this action only +# needs a CLI runtime for the php-cs-fixer phar. +RUN apk add --no-cache \ + php82 \ + php82-phar \ + php82-mbstring \ + php82-tokenizer \ + php82-xml \ + php82-xmlwriter \ + php82-simplexml \ + php82-iconv \ + php82-session \ + wget \ + && ln -sf /usr/bin/php82 /usr/bin/php \ + && wget -O /usr/local/bin/php-cs-fixer \ + https://github.com/FriendsOfPHP/PHP-CS-Fixer/releases/download/v3.13.0/php-cs-fixer.phar \ + && chmod a+x /usr/local/bin/php-cs-fixer \ + && apk del wget -ADD entrypoint.sh /entrypoint.sh +COPY entrypoint.sh /entrypoint.sh ENTRYPOINT ["/entrypoint.sh"] diff --git a/README.md b/README.md index dbcb02b..8901ef4 100644 --- a/README.md +++ b/README.md @@ -13,9 +13,9 @@ jobs: name: PHP-CS-Fixer runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v2 - name: PHP-CS-Fixer - uses: mobsuccess-devops/github-actions-php-cs-fixer@master + uses: docker://oskarstark/php-cs-fixer-ga ``` _to use a custom config for example, --diff and --dry-run option:_ @@ -27,26 +27,23 @@ jobs: name: PHP-CS-Fixer runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v2 - name: PHP-CS-Fixer - uses: mobsuccess-devops/github-actions-php-cs-fixer@master + uses: docker://oskarstark/php-cs-fixer-ga + with: + args: --config=.project.php_cs --diff --dry-run ``` -The action builds its Docker image from the repository `Dockerfile` on the runner, so CI does not pull `public.ecr.aws/...` anonymously (which hits ECR Public data limits on shared GitHub runner IPs). - -Prefer `uses: mobsuccess-devops/github-actions-php-cs-fixer@...` over `uses: docker://public.ecr.aws/...`. - **You can copy/paste the .github folder (under examples/) to your project and thats all!** ## Docker -You can still build and run the image locally: +A Docker-Image is built automatically and located here: +https://hub.docker.com/r/oskarstark/php-cs-fixer-ga -`docker compose build` +You can run it in any given directory like this: -`docker run --rm -it -w=/app -v ${PWD}:/app public.ecr.aws/u9q7y3l4/github-actions-php-cs-fixer:v3.13.0` +`docker run --rm -it -w=/app -v ${PWD}:/app oskarstark/php-cs-fixer-ga:latest` ## A picture is worth a thousand words diff --git a/action.yml b/action.yml index 8d180e4..ac75bc3 100644 --- a/action.yml +++ b/action.yml @@ -12,4 +12,4 @@ name: 'OSKAR-PHP-CS-Fixer' runs: using: 'docker' - image: 'Dockerfile' + image: 'docker://public.ecr.aws/u9q7y3l4/github-actions-php-cs-fixer:v3.13.0' diff --git a/examples/.github/workflows/push.yml b/examples/.github/workflows/push.yml index 7059256..9a3796e 100644 --- a/examples/.github/workflows/push.yml +++ b/examples/.github/workflows/push.yml @@ -5,8 +5,8 @@ jobs: name: PHP-CS-Fixer runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@master - name: PHP-CS-Fixer - uses: mobsuccess-devops/github-actions-php-cs-fixer@master + uses: docker://oskarstark/php-cs-fixer-ga with: args: --diff --dry-run From 5ce468a7651f566b831bce1fa37f1a3970602caa Mon Sep 17 00:00:00 2001 From: nicolasotmani Date: Wed, 30 Sep 2026 08:58:43 +0200 Subject: [PATCH 3/4] chore(docker): pin PHP 8.1.34 to match mobsuccess Co-authored-by: Cursor --- Dockerfile | 23 +++++------------------ 1 file changed, 5 insertions(+), 18 deletions(-) diff --git a/Dockerfile b/Dockerfile index 42d6cea..9cf3757 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,28 +1,15 @@ -FROM --platform=linux/amd64 alpine:3.19 +FROM --platform=linux/amd64 php:8.1.34-cli-alpine LABEL "com.github.actions.name"="PHP-CS-Fixer" LABEL "com.github.actions.description"="check php files" LABEL "com.github.actions.icon"="check" LABEL "com.github.actions.color"="blue" -# Official php:*-alpine images ship a full PHP toolchain; this action only -# needs a CLI runtime for the php-cs-fixer phar. -RUN apk add --no-cache \ - php82 \ - php82-phar \ - php82-mbstring \ - php82-tokenizer \ - php82-xml \ - php82-xmlwriter \ - php82-simplexml \ - php82-iconv \ - php82-session \ - wget \ - && ln -sf /usr/bin/php82 /usr/bin/php \ - && wget -O /usr/local/bin/php-cs-fixer \ +# Match mobsuccess: PHP 8.1.34 + php-cs-fixer 3.13.0. Use the cli-alpine +# variant (not the fuller php:8.1-alpine default) to keep the ECR image small. +RUN wget -O /usr/local/bin/php-cs-fixer \ https://github.com/FriendsOfPHP/PHP-CS-Fixer/releases/download/v3.13.0/php-cs-fixer.phar \ - && chmod a+x /usr/local/bin/php-cs-fixer \ - && apk del wget + && chmod a+x /usr/local/bin/php-cs-fixer COPY entrypoint.sh /entrypoint.sh ENTRYPOINT ["/entrypoint.sh"] From 3726af2247f6d3deb35e55e3b733a403a4cb21f9 Mon Sep 17 00:00:00 2001 From: nicolasotmani Date: Wed, 30 Sep 2026 10:01:10 +0200 Subject: [PATCH 4/4] fix(ci): use docker compose and clarify PHP pin Address review: docker compose v2 CLI, and note that php:8.1.34-cli-alpine matches php:8.1-alpine's digest today so this is a version pin, not a size win. Co-authored-by: Cursor --- .github/workflows/upgrade-aws.yml | 4 ++-- Dockerfile | 3 +-- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/workflows/upgrade-aws.yml b/.github/workflows/upgrade-aws.yml index 8f42360..8879796 100644 --- a/.github/workflows/upgrade-aws.yml +++ b/.github/workflows/upgrade-aws.yml @@ -61,6 +61,6 @@ jobs: with: registry-type: 'public' - name: Build - run: docker-compose build --build-arg BUILDKIT_INLINE_CACHE=1 + run: docker compose build --build-arg BUILDKIT_INLINE_CACHE=1 - name: Push - run: docker-compose push + run: docker compose push diff --git a/Dockerfile b/Dockerfile index 9cf3757..e65746a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -5,8 +5,7 @@ LABEL "com.github.actions.description"="check php files" LABEL "com.github.actions.icon"="check" LABEL "com.github.actions.color"="blue" -# Match mobsuccess: PHP 8.1.34 + php-cs-fixer 3.13.0. Use the cli-alpine -# variant (not the fuller php:8.1-alpine default) to keep the ECR image small. +# Pin PHP 8.1.34 to match mobsuccess (same digest as php:8.1-alpine today). RUN wget -O /usr/local/bin/php-cs-fixer \ https://github.com/FriendsOfPHP/PHP-CS-Fixer/releases/download/v3.13.0/php-cs-fixer.phar \ && chmod a+x /usr/local/bin/php-cs-fixer