[florentsorel]

What Does It Do?

• Publishes the image to the GitHub Container registry (ghcr.io/mobsuccess-devops/github-actions-php-cs-fixer) from a workflow. docker.yml builds the image on a pull request that touches it (no push), and publishes it on master when the Dockerfile or entrypoint.sh change, or when run by hand. The tag is the PHP-CS-Fixer version (v3.13.0), plus the commit SHA.
• Pins what the image is made of: php:8.1.34-alpine, and the phar is checked against its SHA-256, which is the one the current image holds.
• Removes action.yml and examples/: inherited from the upstream fork, they point at oskarstark/php-cs-fixer-ga:2.18.2, another image with older rules. No workflow of the organization uses this repository as an action; the only use is the docker:// step of mobsuccess.
• Updates mobsuccess.yml and closed.yml to the versions ms-bot writes today. Both asked for ubuntu-20.04, a runner image GitHub has retired, so the Mobsuccess PR Compliance job stayed queued forever. They are byte for byte the files of github-actions-kuberneteslint.
• Renames docker-compose.yml to compose.yml, and rewrites the README for the docker://ghcr.io/…:v3.13.0 usage.

asana.yml stays for now: it calls an archived action and the policy no longer has an asana entry, but Asana is still a required check on master. It can be removed once the check is dropped from the branch protection.

Context

The PHP-CS-Fixer check of mobsuccess fails with toomanyrequests: Data limit exceeded: 7 runs of php.yml since September 28, 4 of them on September 30. The image is pulled anonymously from ECR Public, which caps those pulls on the IPs GitHub runners share. It only weighs 34 MB, so making it smaller would not help: same cause as the Kubernetes lint (mobsuccess-devops/github-actions-kuberneteslint#41), same fix. The image was also pushed by hand, from no workflow.

The tag carries the PHP-CS-Fixer version on purpose: another version has other rules and would fail the check on the whole code base. For the same reason the image is not republished on every push to master, only when what it is made of changes: the content behind v3.13.0 must not move when ms-bot updates a workflow.

The package is public, so that workflows pull it without credentials. What is in it: PHP, the PHP-CS-Fixer phar and entrypoint.sh, which the ECR Public image already exposed. .dockerignore reduces the build context to entrypoint.sh.

After the merge, in this order

1. The Docker workflow on master creates the package, private as any package first published.
2. Someone with admin rights on the package makes it public: organization → Packages → github-actions-php-cs-fixer → Package settings → Danger Zone → Change visibility → Public. This cannot be undone.
3. Check that docker pull ghcr.io/mobsuccess-devops/github-actions-php-cs-fixer:v3.13.0 works without being logged in.
4. A pull request in mobsuccess moves php.yml and the Makefile to the ghcr.io image. No bot here: it is the only repository using it.

Until step 4, mobsuccess keeps pulling the ECR Public image, which does not change.

Test Plan

• same verdict on the real code: the new image and the equivalent of the current one (PHP 8.1.13, same phar) both pass on mobsuccess (33,000 PHP files) with the arguments of its workflow; their outputs only differ by the PHP version line
• a badly formatted file fails with the same exit code (8) and the same proposed diff on both
• the phar in the new image has the SHA-256 of the one in the current ECR image, and a wrong checksum fails the build
• actionlint, yamllint and hadolint: nothing reported
• image size: 35.6 MB compressed (34 MB today)
• this pull request's own Docker run builds the image (first run of the new workflow)
• after merge: the Docker run on master pushes v3.13.0 to ghcr.io
• after step 2: anonymous docker pull works

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

The current .dockerignore/Dockerfile combination can break docker build/docker compose build by excluding the Dockerfile from context and relying on ADD --checksum without a pinned Dockerfile syntax frontend.

Review effort: Lite
Findings: 2

Open (2)

• Add Dockerfile exception to avoid context exclusion · New
• Pin Dockerfile frontend for ADD flags · New

What changed in this PR

This PR migrates the project’s PHP-CS-Fixer container image publishing to GitHub Container Registry (GHCR), pins the image contents for reproducibility, and removes the unused “action wrapper” artifacts inherited from the upstream fork.

Changes:

• Add a dedicated Docker GitHub Actions workflow to build (PR) and publish (master / manual) the container image to ghcr.io.
• Pin the base image and PHP-CS-Fixer phar (version + SHA-256), and adjust the Dockerfile accordingly.
• Remove the unused action.yml + examples/ action wrapper, rename docker-compose.yml → compose.yml, and update README for docker://ghcr.io/... usage.

File	Description
README.md	Updates documentation to use the GHCR-hosted docker:// image and describes version/tag expectations.
examples/​.github/​workflows/​push.yml	Removes legacy example workflow tied to the old upstream image/action pattern.
Dockerfile	Pins base image and downloads php-cs-fixer.phar with a checksum, then uses entrypoint.sh as entrypoint.
docker-compose.yml	Removes the old compose file referencing the prior registry/image location.
compose.yml	Adds replacement compose file pointing at the GHCR image tag.
action.yml	Removes unused action metadata that pointed to the old upstream container image.
.github/​workflows/​docker.yml	Adds CI workflow to build on PR and publish on master / manual dispatch.
.dockerignore	Shrinks Docker build context to only the required runtime entrypoint file.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[maximus-agents]

Maximus fast — Ready to merge ✅

Every required gate passed on f1f59dd.

Required action

No action required: the verified GitHub merge strategy will be applied.

Check status

Check	Status	Key takeaway
Up to date with base	✅ Yes	Mergeable
Automated tests (CI)	✅ Passed	All required checks passed
Linear ticket	✅ Compliant	FTTECH-15150
Copilot review completed	✅ Yes	Completed
Copilot comments resolved	✅ Yes	0 unresolved threads