phar.yml

# https://help.github.com/en/categories/automating-your-workflow-with-github-actions

name: "Compile PHAR"

on:
  pull_request:
  push:
    branches:
      - "2.3.x"
    tags:
      - '2.3.*'

concurrency:
  group: phar-${{ github.ref }} # will be canceled on subsequent pushes in both branches and pull requests
  cancel-in-progress: true

# Read-only GITHUB_TOKEN everywhere; jobs needing more declare their own
# block. The commit job pushes with a PAT, not the workflow token.
permissions:
  contents: read

env:
  # Turbo binaries phpstan/phpstan used to carry but no compile leg builds any
  # more (paths under turbo-ext/, shell globs). The commit job deletes them
  # from the dist; without this, the torn-set guard there would refuse every
  # version bump, since a retired binary has no freshly built replacement.
  # None at the moment: the Linux ZTS binaries retired for 8.3-8.5 are built
  # again (see turbo-compile).
  TURBO_RETIRED_BINARIES: ""
  # The php-parser version whose grammar tables and semantic actions the
  # native parser engine (turbo-ext/src/parser/) was ported against.
  SUPPORTED_PHP_PARSER_VERSION: "v5.9.0"

jobs:
  compiler-tests:
    name: "Compiler Tests"

    runs-on: "ubuntu-latest"
    timeout-minutes: 60

    permissions:
      contents: read # actions/checkout of this repository
      pull-requests: read # dorny/paths-filter lists the PR's changed files through the API

    outputs:
      checksum: ${{ steps.checksum.outputs.md5 }}
      compiler_changed: ${{ steps.changes.outputs.compiler }}

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: "Install PHP"
        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
        with:
          coverage: "none"
          php-version: "8.2"
          extensions: mbstring, intl

      - uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0
        with:
          ignore-cache: true

      # only sebastian/diff ^4 supports PHP 7.4 so we need that in the PHAR
      # it stays in require, the PHAR is built without dev dependencies and the fixer needs it
      - name: "Downgrade PHPUnit"
        run: |
          composer require --no-update sebastian/diff:^4.0
          composer require --dev --no-update phpunit/phpunit:^9.6 doctrine/instantiator:^1.0
          composer update phpunit/phpunit sebastian/diff doctrine/instantiator --with-all-dependencies --ignore-platform-reqs

      - name: "Install compiler dependencies"
        uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0
        with:
          working-directory: "compiler"
          ignore-cache: true

      - name: "Compiler tests"
        working-directory: "compiler"
        run: "vendor/bin/phpunit -c tests/phpunit.xml tests"

      - name: "Compiler PHPStan"
        working-directory: "compiler"
        run: "vendor/bin/phpstan analyse -l 8 src tests"

      - name: "Prepare for PHAR compilation"
        working-directory: "compiler"
        run: "php bin/prepare"

      - name: "Dump autoloader one more time for attributes"
        run: "composer dump"

      - name: "Install Box dependencies"
        uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0
        with:
          working-directory: "compiler/box"
          ignore-cache: true

      - name: "Compile PHAR"
        working-directory: "compiler/build"
        run: "php ../box/vendor/bin/box compile --no-parallel --sort-compiled-files"

      # Box leaves the members with mtime 0 here, which OPcache refuses to
      # cache at all; the commit date also keeps consecutive builds apart for
      # opcache.validate_timestamps (see OpcacheSettings::resolveIniEntries()).
      # resign.php fails if any member is left at mtime 0.
      - name: "Stamp PHAR member timestamps"
        run: php compiler/build/resign.php tmp/phpstan.phar "$(git log -1 --format=%cI)"

      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: phar-file
          path: tmp/phpstan.phar

      - name: "Run PHAR"
        working-directory: "compiler"
        run: "../tmp/phpstan.phar list"

      # The autoloader dump generates the version TurboExtensionEnabler
      # activates from git; without it in the phar, no turbo binary would
      # ever activate.
      - name: "Check the PHAR carries the expected turbo extension version"
        run: |
          BAKED="$(php -r 'echo require "phar://" . getcwd() . "/tmp/phpstan.phar/vendor/turbo-extension-version.php";')"
          EXPECTED="$(php build/turbo-extension-version.php)"
          echo "PHAR expects: $BAKED, last commit touching turbo-ext/src: $EXPECTED"
          [ "$BAKED" = "$EXPECTED" ]

      - name: "Delete PHAR"
        run: "rm tmp/phpstan.phar"

      - name: "Set autoloader suffix"
        run: "composer config autoloader-suffix PHPStanChecksum"

      - uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0
        env:
          COMPOSER_ROOT_VERSION: "2.3.x-dev"
        with:
          ignore-cache: true

      - name: "Compile PHAR for checksum"
        working-directory: "compiler/build"
        run: "php ../box/vendor/bin/box compile --no-parallel --sort-compiled-files"
        env:
          PHAR_CHECKSUM: "1"
          COMPOSER_ROOT_VERSION: "2.3.x-dev"

      - name: "Re-sign PHAR"
        run: "php compiler/build/resign.php tmp/phpstan.phar"

      - name: "Unset autoloader suffix"
        run: "composer config autoloader-suffix --unset"

      - name: "Save checksum"
        id: "checksum"
        run: echo "md5=$(md5sum tmp/phpstan.phar | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"

      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: phar-file-checksum
          path: tmp/phpstan.phar

      - name: "Delete checksum PHAR"
        run: "rm tmp/phpstan.phar"

      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        id: changes
        with:
          filters: |
            compiler:
              - 'compiler/**'
              - '.github/workflows/phar.yml'
              - '.github/scripts/**'

  turbo-missing-note:
    name: "Note about a phar without PHPStan Turbo"
    needs: compiler-tests
    runs-on: "ubuntu-latest"
    timeout-minutes: 10

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      # the compiler-tests job runs the phar only for `list`, which prints
      # no note
      - name: "Install PHP"
        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
        with:
          coverage: "none"
          php-version: "8.4"

      - name: "Download PHAR"
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: phar-file
          path: bare

      # a copy of phpstan.phar alone prints the note, the same phar with a
      # turbo-ext/ directory next to it (as in the Composer package) does not
      - name: "Check the note"
        run: |
          printf '<?php\n\necho 1;\n' > test.php
          php bare/phpstan.phar analyse -l 0 --no-progress test.php 2> bare.err
          cat bare.err
          grep -q 'PHPStan runs without PHPStan Turbo' bare.err
          mkdir -p with-turbo-ext/turbo-ext
          cp bare/phpstan.phar with-turbo-ext/
          php with-turbo-ext/phpstan.phar analyse -l 0 --no-progress test.php 2> with-turbo-ext.err
          cat with-turbo-ext.err
          ! grep -q 'PHPStan Turbo' with-turbo-ext.err

  turbo-version:
    name: "Turbo Extension Version Check"
    runs-on: "ubuntu-latest"
    timeout-minutes: 5

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0 # git log over turbo-ext/src needs full history

      - name: "Install PHP"
        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
        with:
          coverage: "none"
          php-version: "8.5"

      # side-by-side.php collects the attributes with reflection against the
      # dumped autoloader and byte-compares the generated vendor/turbo-* files
      - uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0
        with:
          ignore-cache: true

      - name: "Check the shadowed PHP and C++ implementations are in sync (method parity)"
        run: "php turbo-ext/bin/side-by-side.php"

      - name: "Check the vendored php-parser matches the version the native parser engine was ported against"
        run: |
          INSTALLED="$(jq -r '.packages[] | select(.name == "nikic/php-parser") | .version' composer.lock)"
          echo "composer.lock: $INSTALLED, native engine ported against: $SUPPORTED_PHP_PARSER_VERSION"
          if [ "$INSTALLED" != "$SUPPORTED_PHP_PARSER_VERSION" ]; then
            echo "::error::nikic/php-parser was updated to $INSTALLED but turbo-ext/src/parser/ was ported against $SUPPORTED_PHP_PARSER_VERSION."
            echo "::error::Update procedure: diff ParserAbstract.php helpers between the two versions (grammar tables need nothing — they are read at run time), run turbo-ext/bin/generate-parser-actions.php and port any flagged closure bodies via action-overrides/, run turbo-ext/tests/parser-corpus.php and turbo-ext/tests/parser-upstream-corpus.php until byte-identical, run the full suite, then bump SUPPORTED_PHP_PARSER_VERSION here."
            exit 1
          fi

      - name: "Check the parser actions are generated (regenerate and diff)"
        run: |
          php turbo-ext/bin/generate-parser-actions.php
          git diff --exit-code turbo-ext/src/parser/

      - name: "Check turbo-ext/VERSION.txt is not committed"
        run: |
          # VERSION.txt is generated into the phpstan/turbo-ext subsplit by
          # subsplit-turbo-ext.yml; a copy committed here would go stale and
          # silently win over git in phpize builds.
          if [ -e turbo-ext/VERSION.txt ]; then
            echo "::error::turbo-ext/VERSION.txt must not exist in the monorepo — it is generated per replayed commit by the subsplit-turbo-ext.yml workflow."
            exit 1
          fi

  turbo-phpize:
    # Builds through phpize && ./configure && make — the pipeline PIE drives
    # when it falls back to a source build of the phpstan/turbo package
    # (config.m4). The distributed binaries keep coming from the Makefile
    # legs in turbo-compile: the libtool link here cannot statically fold
    # libstdc++/libgcc into the .so, which the shipped Linux binaries need
    # to stay independent of the host's GLIBCXX symbol versions. One PHP
    # version suffices — per-version compile coverage comes from
    # turbo-compile; this job guards the build system itself.
    name: "Turbo Extension phpize Build"
    runs-on: ${{ matrix.operating-system }}
    timeout-minutes: 30

    strategy:
      fail-fast: false
      matrix:
        operating-system: ["ubuntu-latest", "macos-latest"]

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0 # the VERSION.txt written below bakes from git log over turbo-ext/src

      - name: "Install PHP"
        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
        with:
          coverage: "none"
          php-version: "8.5"

      - name: "Build via phpize outside the checkout"
        # The copy is deliberately outside the git checkout and gets a
        # VERSION.txt generated the same way subsplit-turbo-ext.yml commits
        # it into phpstan/turbo-ext — the exact shape a PIE source build
        # sees: no monorepo history, the version supplied by the file.
        run: |
          if [ "$RUNNER_OS" = "macOS" ]; then
            command -v autoconf > /dev/null || brew install autoconf
          fi
          cp -R turbo-ext "$RUNNER_TEMP/turbo-ext"
          git log -1 --format=%H -- turbo-ext/src | cut -c1-7 > "$RUNNER_TEMP/turbo-ext/VERSION.txt"
          echo "VERSION.txt: $(cat "$RUNNER_TEMP/turbo-ext/VERSION.txt")"
          cd "$RUNNER_TEMP/turbo-ext"
          phpize
          ./configure
          make -j"$(getconf _NPROCESSORS_ONLN)"

      - name: "Verify the built extension reports the expected version"
        run: |
          REPORTED="$(php -d extension="$RUNNER_TEMP/turbo-ext/modules/phpstan_turbo.so" -r 'echo phpversion("phpstan_turbo");')"
          EXPECTED="$(php build/turbo-extension-version.php)"
          echo "built extension reports: $REPORTED, enabler expects: $EXPECTED"
          [ "$REPORTED" = "$EXPECTED" ]

      - uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0
        with:
          ignore-cache: true

      - name: "Smoke test (differential: native vs PHP implementations)"
        # the Type-family child processes (tests/type-family.php) locate the
        # extension through TURBO_DLL — its default, turbo-ext/phpstan_turbo.so,
        # only exists in Makefile builds
        env:
          TURBO_DLL: ${{ runner.temp }}/turbo-ext/modules/phpstan_turbo.so
        run: php -d extension="$RUNNER_TEMP/turbo-ext/modules/phpstan_turbo.so" turbo-ext/tests/smoke.php

      - name: "Arena smoke test (cross-process shared-memory records)"
        # the test's child processes locate the extension through TURBO_DLL —
        # its default, turbo-ext/phpstan_turbo.so, only exists in Makefile builds
        env:
          TURBO_DLL: ${{ runner.temp }}/turbo-ext/modules/phpstan_turbo.so
        run: php -d extension="$RUNNER_TEMP/turbo-ext/modules/phpstan_turbo.so" turbo-ext/tests/arena-smoke.php

      - name: "Forked-worker exit (exitImmediately() ends a child whose teardown would wedge)"
        run: php -d extension="$RUNNER_TEMP/turbo-ext/modules/phpstan_turbo.so" turbo-ext/tests/exit-immediately.php

      - name: "Trusted types (the optimizer pass drops type checks under the prefix only)"
        # the opcache.file_cache child process locates the extension through
        # TURBO_DLL — its default, turbo-ext/phpstan_turbo.so, only exists in
        # Makefile builds
        env:
          TURBO_DLL: ${{ runner.temp }}/turbo-ext/modules/phpstan_turbo.so
        run: php -d extension="$RUNNER_TEMP/turbo-ext/modules/phpstan_turbo.so" -d opcache.enable_cli=1 turbo-ext/tests/trusted-types.php

      - name: "Signature parity (reflect native classes against the PHP twins)"
        run: php -d extension="$RUNNER_TEMP/turbo-ext/modules/phpstan_turbo.so" turbo-ext/tests/signature-parity.php

      - name: "Parser corpus (differential: native vs PHP ASTs must be byte-identical)"
        run: php -d extension="$RUNNER_TEMP/turbo-ext/modules/phpstan_turbo.so" -d memory_limit=4G turbo-ext/tests/parser-corpus.php

      - name: "make install into a scratch root (PIE finishes with make install)"
        run: |
          make -C "$RUNNER_TEMP/turbo-ext" install INSTALL_ROOT="$RUNNER_TEMP/install-root"
          find "$RUNNER_TEMP/install-root" -name 'phpstan_turbo.so' | grep .

  php-windows-prereleases:
    name: "Find PHP Prereleases for Windows"
    # For an unreleased minor, setup-php installs a nightly build on Windows,
    # which has no devel pack to compile against; the Windows legs replace it
    # with the official prerelease. This resolves the current one for every
    # minor in this workflow's matrices that has no stable Windows build yet
    # (.github/scripts/find-php-windows-prereleases.sh), once per run, so all
    # legs install the same build even when a new release candidate comes out
    # in the meantime.
    runs-on: "ubuntu-latest"
    timeout-minutes: 5

    permissions:
      contents: read # actions/checkout of this repository

    outputs:
      prereleases: ${{ steps.find.outputs.prereleases }}

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: |
            .github/scripts
            .github/workflows

      - name: "Find the prerelease of every PHP minor without a stable Windows build"
        id: find
        run: |
          MINORS="$(yq -r '[.jobs[].strategy.matrix["php-version"] | select(. != null) | .[]] | unique | .[] | select(test("^[0-9]+\\.[0-9]+$"))' .github/workflows/phar.yml | tr '\n' ' ')"
          echo "PHP minors in the matrices: $MINORS"
          MINORS="$MINORS" bash .github/scripts/find-php-windows-prereleases.sh

  turbo-origins:
    name: "Find Reusable Turbo Extension Builds"
    # Most pushes and pull requests leave the extension's build inputs
    # untouched, and building a platform's profile-guided core takes up to
    # 12 minutes. For each core, this finds the newest earlier run that
    # compiled it from identical build inputs
    # (.github/scripts/find-turbo-origins.sh has the exact conditions), and
    # its turbo-compile-core leg skips the build altogether: it runs on
    # ubuntu-latest, outside any build container, and only carries that core
    # over into this run. The same goes for each turbo-shared-core-gate
    # leg's fingerprint. The per-version extensions always compile (a
    # minute each) against it, then go through the version check and the
    # differential tests of the turbo-differential jobs like any build —
    # they compare the native side with the PHP side of this commit, which
    # may have changed. An extension compiled against 8.6 prerelease headers
    # that moved on since fails its own leg, not the reused core.
    # Only runs of this workflow triggered by a push to 2.3.x qualify — the
    # same runs whose compiled binaries the commit job stages into
    # phpstan/phpstan — so reusing their artifacts trusts no code the
    # distributed binaries do not already depend on. actions/cache was ruled
    # out for that reason: any workflow running on 2.3.x can write entries
    # into the branch's cache, one this workflow would then restore.
    runs-on: "ubuntu-latest"
    timeout-minutes: 5

    permissions:
      contents: read # actions/checkout of this repository
      actions: read # lists the earlier runs of this workflow and their artifacts

    outputs:
      origins: ${{ steps.find.outputs.origins }}

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0 # the earlier runs' commits are diffed against HEAD

      - name: "Find the newest build of each binary from identical build inputs"
        id: find
        env:
          GH_TOKEN: ${{ github.token }}
          BRANCH: "2.3.x"
        run: bash .github/scripts/find-turbo-origins.sh

  turbo-compile-core:
    name: "Compile Turbo Extension Core"
    # The distributed binaries are a shared core per platform plus a thin
    # extension per PHP version (turbo-ext/README.md, "Shared core"). The
    # core is everything but the four version-specific sources: it compiles
    # to the same code against every supported PHP's headers
    # (turbo-shared-core-gate proves it), so it is built once per platform,
    # here, profile-guided against one PHP version (matrix php-version), and
    # every turbo-compile leg of the platform links its extension against it.
    # A leg whose core turbo-origins found in an earlier run builds nothing:
    # it runs on ubuntu-latest without a container and carries that core
    # over (runs-on and container cannot read env, hence the lookup of
    # ORIGIN_RUN_ID repeated in both).
    runs-on: ${{ fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('phpstan_turbo_core-{0}', matrix.target.name)] && 'ubuntu-latest' || matrix.target.runs-on }}
    # Container legs pin the binaries' userland floor independently of the
    # runner image: the gnu legs run in the prebuilt ubuntu:22.04-based
    # image (.github/turbo-build/Dockerfile, published to GHCR by
    # turbo-build-image.yml) — the glibc symbol floor stays at 2.34 (RHEL 9,
    # Ubuntu 22.04+, Debian 12+) and the jobs run no apt at all — and
    # alpine:3.24 builds the musl variant. The linux-musl-arm64 core is in
    # turbo-compile-core-musl-arm64 (see turbo-compile-musl-arm64 for why).
    container: ${{ !(fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('phpstan_turbo_core-{0}', matrix.target.name)]) && (matrix.target.family == 'gnu' && format('ghcr.io/phpstan/turbo-build:gnu-php{0}', matrix.target.php-version) || matrix.target.container) || '' }}
    needs: turbo-origins
    timeout-minutes: 30

    permissions:
      contents: read # actions/checkout of this repository
      actions: read # downloads a reused core from an earlier run, see turbo-origins

    env:
      PHP_MINOR: ${{ matrix.target.php-version }}
      PHP_ZTS: "0"
      TURBO_ARTIFACT: "phpstan_turbo_core-${{ matrix.target.name }}"
      PGO_PROFILE_ARTIFACT: "turbo-pgo-profile-${{ matrix.target.name }}"
      ORIGIN_RUN_ID: ${{ fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('phpstan_turbo_core-{0}', matrix.target.name)] }}

    strategy:
      fail-fast: false
      matrix:
        # php-version: the PHP the core is compiled and profiled against —
        # any supported one gives the same code (the gate); the newest
        # stable one runs the training workload the way most users will
        target:
          - name: "linux-gnu-x86_64"
            runs-on: "ubuntu-latest"
            family: "gnu"
            php-version: "8.5"
          - name: "linux-gnu-arm64"
            runs-on: "ubuntu-24.04-arm"
            family: "gnu"
            php-version: "8.5"
          - name: "linux-musl-x86_64"
            runs-on: "ubuntu-latest"
            container: "alpine:3.24"
            family: "musl"
            php-version: "8.5"
          # arm64 (Apple Silicon) only: setup-php dropped Intel macOS, and
          # TurboExtensionSelector resolves Darwin to macos-arm64 only when
          # php_uname('m') says arm64.
          - name: "macos-arm64"
            runs-on: "macos-latest"
            family: "macos"
            php-version: "8.5"

    steps:
      - name: Harden the runner (Audit all outbound calls)
        if: env.ORIGIN_RUN_ID != '' || matrix.target.family == 'macos'
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      # See turbo-origins. The build steps below are all skipped on this leg.
      - name: "Download the core compiled from identical build inputs"
        if: env.ORIGIN_RUN_ID != ''
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: ${{ env.TURBO_ARTIFACT }}
          path: "turbo-ext"
          run-id: ${{ env.ORIGIN_RUN_ID }}
          github-token: ${{ github.token }}

      # the profile that core was compiled with, uploaded before it (see
      # "Upload the core's profile")
      - name: "Download the profile of the core compiled from identical build inputs"
        if: env.ORIGIN_RUN_ID != ''
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: ${{ env.PGO_PROFILE_ARTIFACT }}
          path: "turbo-ext"
          run-id: ${{ env.ORIGIN_RUN_ID }}
          github-token: ${{ github.token }}

      - name: "Record the run that compiled the core"
        if: env.ORIGIN_RUN_ID != ''
        run: echo "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$ORIGIN_RUN_ID" | tee turbo-reused.txt

      # actions/checkout needs git inside the Alpine container; PHP itself is
      # installed after checkout, by a script from the repository. The GNU
      # container legs have the toolchain baked in.
      - name: "Install git (Alpine container)"
        if: env.ORIGIN_RUN_ID == '' && matrix.target.family == 'musl'
        run: apk add --no-cache git

      - name: "Checkout"
        if: env.ORIGIN_RUN_ID == ''
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          # The Makefile bakes the version via git log over the watched
          # paths; a shallow clone would resolve every build to the
          # checked-out commit itself — on pull requests the synthetic merge
          # commit, which matches nothing.
          fetch-depth: 0

      # In container legs the workspace volume is owned by the host runner
      # user while steps run as the container user, so git refuses the repo
      # ("dubious ownership") — which would silently bake the version as
      # "dev" via the Makefile's $(shell git log ...) fallback.
      - name: "Trust the checkout despite the container/host uid mismatch"
        if: env.ORIGIN_RUN_ID == ''
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: "Install PHP and build tools (Alpine container)"
        if: env.ORIGIN_RUN_ID == '' && matrix.target.family == 'musl'
        run: sh .github/scripts/install-alpine-php.sh

      - name: "Install PHP (macOS)"
        if: env.ORIGIN_RUN_ID == '' && matrix.target.family == 'macos'
        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
        with:
          coverage: "none"
          php-version: "${{ matrix.target.php-version }}"

      # The training run of `make pgo` (bin/pgo-train.sh) runs bin/phpstan on
      # the checkout, so the dependencies must be in place before the build.
      - uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0
        if: env.ORIGIN_RUN_ID == '' && matrix.target.family == 'macos'
        with:
          ignore-cache: true

      - name: "Install Composer dependencies (verified composer)"
        if: env.ORIGIN_RUN_ID == '' && matrix.target.family != 'macos'
        # signature-verified composer (.github/scripts/download-composer.sh;
        # the distro composers are unusable here: jammy's 2.2.6 fatals under
        # PHP 8.5, and Alpine's /usr/bin/composer is a shell wrapper
        # hardwired to the distro-default PHP), run under the matrix PHP so
        # platform requirements are validated against the interpreter the
        # build trains on
        run: |
          sh .github/scripts/download-composer.sh
          php composer.phar install --no-interaction --no-progress
          rm composer.phar

      - name: "Compile the core with strict warnings (profile-guided)"
        if: env.ORIGIN_RUN_ID == ''
        working-directory: "turbo-ext"
        # `make SPLIT=1 pgo`: an instrumented core and extension, a training
        # run of PHPStan over its own sources with them loaded, then the
        # final build using the recorded profile — the same three stages
        # locally, so a profile-guided core can be reproduced outside CI.
        # The strict set itself lives in turbo-ext/Makefile
        # (STRICT_WARN_FLAGS), which documents why each exemption is there.
        # `make pgo-pack` keeps the core's share of the profile for the pie
        # legs of turbo-compile, which build with it instead of training again.
        run: |
          make SPLIT=1 pgo WARN_FLAGS="$(make -s print-warn-flags)" -j"$(getconf _NPROCESSORS_ONLN 2>/dev/null || nproc)"
          make SPLIT=1 pgo-pack

      # Before signing (stripping invalidates a signature) and before the
      # upload. The symbol tables are a quarter of the binary; see `strip`
      # in the Makefile.
      - name: "Strip symbol tables"
        if: env.ORIGIN_RUN_ID == ''
        working-directory: "turbo-ext"
        run: |
          ls -l phpstan_turbo_core.so phpstan_turbo.so
          make SPLIT=1 strip
          ls -l phpstan_turbo_core.so phpstan_turbo.so

      # On arm64 AMFI refuses to map unsigned code, so the binary must carry
      # at least an ad-hoc signature. Quarantine (and thus
      # Gatekeeper/notarization) only applies to browser downloads —
      # composer/git/curl installs never see it — so an ad-hoc signature is
      # enough and needs no secrets.
      - name: "Ad-hoc sign the core (macOS)"
        if: env.ORIGIN_RUN_ID == '' && matrix.target.family == 'macos'
        working-directory: "turbo-ext"
        run: |
          codesign --force --sign - phpstan_turbo_core.so phpstan_turbo.so
          codesign --verify --verbose=2 phpstan_turbo_core.so

      # The extension the training run loaded proves the core loads and
      # carries the version the extension expects; a reused core passed
      # this in the run compiling it.
      - name: "Verify the core reports the expected version"
        if: env.ORIGIN_RUN_ID == ''
        run: |
          REPORTED="$(php -d extension="$PWD/turbo-ext/phpstan_turbo.so" -r 'echo phpversion("phpstan_turbo");')"
          EXPECTED="$(php build/turbo-extension-version.php)"
          echo "core + extension report: $REPORTED, enabler expects: $EXPECTED"
          [ "$REPORTED" = "$EXPECTED" ]

      # Before the core, so that a run carrying the core (all that
      # find-turbo-origins.sh checks) carries its profile too. A reused one
      # is uploaded again, like the core.
      - name: "Upload the core's profile"
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ env.PGO_PROFILE_ARTIFACT }}
          path: "turbo-ext/pgo-profile.tar"
          if-no-files-found: "error"

      # A reused core is uploaded again under the same name, so the
      # turbo-compile legs find it in this run.
      - name: "Upload core artifact"
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ env.TURBO_ARTIFACT }}
          path: "turbo-ext/phpstan_turbo_core.so"
          if-no-files-found: "error"

      # Keeps later runs from reusing the copy above: they take the core
      # from the run that compiled it (see find-turbo-origins.sh).
      - name: "Mark the core artifact as reused"
        if: env.ORIGIN_RUN_ID != ''
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: "turbo-reused-${{ env.TURBO_ARTIFACT }}"
          path: "turbo-reused.txt"
          if-no-files-found: "error"

  turbo-compile-core-musl-arm64:
    name: "Compile Turbo Extension Core (musl arm64)"
    # The arm64 counterpart of the linux-musl-x86_64 leg of
    # turbo-compile-core, driving an Alpine container through docker exec
    # (see turbo-compile-musl-arm64 for why it cannot be a container leg).
    runs-on: ${{ fromJSON(needs.turbo-origins.outputs.origins || '{}')['phpstan_turbo_core-linux-musl-arm64'] && 'ubuntu-latest' || 'ubuntu-24.04-arm' }}
    needs: turbo-origins
    timeout-minutes: 30

    permissions:
      contents: read # actions/checkout of this repository
      actions: read # downloads a reused core from an earlier run, see turbo-origins

    env:
      # the PHP the core is compiled and profiled against, as in turbo-compile-core
      PHP_MINOR: "8.5"
      PHP_ZTS: "0"
      TURBO_ARTIFACT: "phpstan_turbo_core-linux-musl-arm64"
      PGO_PROFILE_ARTIFACT: "turbo-pgo-profile-linux-musl-arm64"
      ORIGIN_RUN_ID: ${{ fromJSON(needs.turbo-origins.outputs.origins || '{}')['phpstan_turbo_core-linux-musl-arm64'] }}

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      # See the same three steps in turbo-compile-core.
      - name: "Download the core compiled from identical build inputs"
        if: env.ORIGIN_RUN_ID != ''
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: ${{ env.TURBO_ARTIFACT }}
          path: "turbo-ext"
          run-id: ${{ env.ORIGIN_RUN_ID }}
          github-token: ${{ github.token }}

      - name: "Download the profile of the core compiled from identical build inputs"
        if: env.ORIGIN_RUN_ID != ''
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: ${{ env.PGO_PROFILE_ARTIFACT }}
          path: "turbo-ext"
          run-id: ${{ env.ORIGIN_RUN_ID }}
          github-token: ${{ github.token }}

      - name: "Record the run that compiled the core"
        if: env.ORIGIN_RUN_ID != ''
        run: echo "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$ORIGIN_RUN_ID" | tee turbo-reused.txt

      - name: "Checkout"
        if: env.ORIGIN_RUN_ID == ''
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0 # the version is baked from git log over turbo-ext/src

      - name: "Start the Alpine build container"
        if: env.ORIGIN_RUN_ID == ''
        run: |
          docker run -d --name alpine-build \
            -v "$PWD:/work" -w /work \
            -e PHP_MINOR -e PHP_ZTS \
            alpine:3.24 sleep 7200

      - name: "Install PHP and build tools"
        if: env.ORIGIN_RUN_ID == ''
        run: docker exec alpine-build sh .github/scripts/install-alpine-php.sh

      # The workspace volume is owned by the host runner user while the
      # container runs as root, so git refuses the repo ("dubious
      # ownership") — which would silently bake the version as "dev".
      - name: "Trust the checkout despite the container/host uid mismatch"
        if: env.ORIGIN_RUN_ID == ''
        run: docker exec alpine-build git config --global --add safe.directory /work

      # The training run of `make pgo` runs bin/phpstan on the checkout.
      - name: "Install Composer dependencies (verified composer)"
        if: env.ORIGIN_RUN_ID == ''
        run: |
          docker exec -i alpine-build sh -e <<'EOF'
          sh .github/scripts/download-composer.sh
          COMPOSER_HOME="$(mktemp -d)" php composer.phar install --no-interaction --no-progress
          rm composer.phar
          EOF

      - name: "Compile the core with strict warnings (profile-guided)"
        if: env.ORIGIN_RUN_ID == ''
        run: |
          docker exec -i -w /work/turbo-ext alpine-build sh -e <<'EOF'
          make SPLIT=1 pgo WARN_FLAGS="$(make -s print-warn-flags)" -j"$(getconf _NPROCESSORS_ONLN 2>/dev/null || nproc)"
          make SPLIT=1 pgo-pack
          make SPLIT=1 strip
          ls -l phpstan_turbo_core.so phpstan_turbo.so
          EOF

      - name: "Verify the core reports the expected version"
        if: env.ORIGIN_RUN_ID == ''
        run: |
          docker exec -i alpine-build sh -e <<'EOF'
          REPORTED="$(php -d extension="$PWD/turbo-ext/phpstan_turbo.so" -r 'echo phpversion("phpstan_turbo");')"
          EXPECTED="$(php build/turbo-extension-version.php)"
          echo "core + extension report: $REPORTED, enabler expects: $EXPECTED"
          [ "$REPORTED" = "$EXPECTED" ]
          EOF

      - name: "Upload the core's profile"
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ env.PGO_PROFILE_ARTIFACT }}
          path: "turbo-ext/pgo-profile.tar"
          if-no-files-found: "error"

      - name: "Upload core artifact"
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ env.TURBO_ARTIFACT }}
          path: "turbo-ext/phpstan_turbo_core.so"
          if-no-files-found: "error"

      - name: "Mark the core artifact as reused"
        if: env.ORIGIN_RUN_ID != ''
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: "turbo-reused-${{ env.TURBO_ARTIFACT }}"
          path: "turbo-reused.txt"
          if-no-files-found: "error"

  turbo-compile:
    name: "Compile Turbo Extension"
    # The extension of one PHP version: the four version-specific sources
    # (the Makefile's SHIM_SOURCES) compiled against that version's headers
    # and linked against the platform's core from turbo-compile-core. A
    # minute's work, so it always runs; the core is what earlier runs'
    # builds are reused for. The artifact carries the core next to the
    # extension — the tests of the turbo-differential jobs load it from
    # there, and the commit job checks that every leg of a platform carries
    # the same core.
    # The `pie` variant legs build the same version self-contained instead,
    # profile-guided with the profile the platform's core was built with
    # (`make pgo-from-profile`) — PIE installs a pre-packaged binary by
    # copying the one extension file, so the PIE release assets cannot be
    # the thin extension (see .github/scripts/turbo-pie-assets.sh). Nothing
    # else ships them, so they only run for release tags (turbo-pie-release
    # publishes them) and on pull requests labelled turbo-pie.
    runs-on: ${{ matrix.target.runs-on }}
    # Container legs pin the binaries' userland floor independently of the
    # runner image, like turbo-compile-core. Every Linux target has a ZTS
    # leg (ts: zts, artifact suffix -zts) next to the NTS one for every
    # minor: distros, ppa:ondrej/php, sury, Remi and setup-php ship an NTS
    # CLI, while the official Docker images build every 8.6+ variant
    # thread-safe, cli and alpine included (docker-library/php#1686), and
    # their php:*-zts tags (the base of FrankenPHP) do so for older minors.
    # The thread-safe extension is only the per-version shim — it links
    # against the platform's one core, which never touches TSRM
    # (turbo-shared-core-gate compares the two builds too) — so a ZTS leg
    # compiles only those few sources. ondrej/php packages no thread-safe
    # PHP, so the gnu-php<minor>-zts images build the minor's newest
    # official tarball (build-php.sh; so does gnu-php8.6, a prerelease), and
    # the musl ZTS legs build it in alpine:3.24, since Alpine packages no
    # thread-safe PHP either. Alpine's NTS php86 packages are
    # currently only in edge/testing.
    container: ${{ matrix.target.family == 'gnu' && format('ghcr.io/phpstan/turbo-build:gnu-php{0}{1}', matrix.php-version, matrix.ts == 'zts' && '-zts' || '') || matrix.target.family == 'musl' && matrix.php-version == '8.6' && matrix.ts != 'zts' && 'alpine:edge' || matrix.target.container || '' }}
    needs: turbo-compile-core
    # one platform's failed core must not skip every platform's legs: a leg
    # whose core is missing fails at its download instead
    if: ${{ !cancelled() }}
    timeout-minutes: ${{ matrix.variant == 'pie' && 45 || 20 }}

    env:
      PHP_MINOR: ${{ matrix.php-version }}
      PHP_ZTS: ${{ matrix.ts == 'zts' && '1' || '0' }}
      TURBO_ARTIFACT: "${{ matrix.variant == 'pie' && 'phpstan_turbo_pie' || 'phpstan_turbo' }}-${{ matrix.target.name }}-php${{ matrix.php-version }}${{ matrix.ts == 'zts' && '-zts' || '' }}"

    strategy:
      fail-fast: false
      matrix:
        php-version: ["8.2", "8.3", "8.4", "8.5", "8.6"]
        # the musl arm64 legs are in turbo-compile-musl-arm64
        target:
          - name: "linux-gnu-x86_64"
            runs-on: "ubuntu-latest"
            family: "gnu"
          - name: "linux-gnu-arm64"
            runs-on: "ubuntu-24.04-arm"
            family: "gnu"
          - name: "linux-musl-x86_64"
            runs-on: "ubuntu-latest"
            container: "alpine:3.24"
            family: "musl"
          # arm64 (Apple Silicon) only, like turbo-compile-core
          - name: "macos-arm64"
            runs-on: "macos-latest"
            family: "macos"
        ts: ["nts", "zts"]
        # split: the thin extension the dist ships; pie: self-contained, for
        # the PIE release assets (see above)
        variant: ${{ fromJSON((startsWith(github.ref, 'refs/tags/') || contains(github.event.pull_request.labels.*.name, 'turbo-pie')) && '["split", "pie"]' || '["split"]') }}
        # Homebrew and setup-php ship an NTS PHP on macOS, and no
        # thread-safe distribution is common enough there to build for
        exclude:
          - target:
              name: "macos-arm64"
              runs-on: "macos-latest"
              family: "macos"
            ts: "zts"

    steps:
      - name: Harden the runner (Audit all outbound calls)
        if: matrix.target.family == 'macos'
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      # actions/checkout needs git inside the Alpine container; PHP itself is
      # installed after checkout, by a script from the repository. The GNU
      # container legs have the toolchain baked in.
      - name: "Install git (Alpine container)"
        if: matrix.target.family == 'musl'
        run: apk add --no-cache git

      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          # the version is baked from git log over turbo-ext/src, see
          # turbo-compile-core
          fetch-depth: 0

      # see turbo-compile-core
      - name: "Trust the checkout despite the container/host uid mismatch"
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      # The thread-safe legs and 8.2 build PHP from source, minutes on every
      # leg; install-alpine-php.sh keeps that build in alpine-php-cache, under
      # a key naming exactly what it built (see the script). Nothing to cache
      # for a leg installing Alpine's packages (release= is empty).
      - name: "Resolve the PHP build to cache (Alpine container)"
        id: alpine-php
        if: matrix.target.family == 'musl'
        run: sh .github/scripts/install-alpine-php.sh --resolve >> "$GITHUB_OUTPUT"

      - name: "Restore the PHP build (Alpine container)"
        if: steps.alpine-php.outputs.release != ''
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: "alpine-php-cache"
          key: "alpine-php-${{ steps.alpine-php.outputs.release }}-${{ hashFiles('.github/turbo-build/build-php.sh') }}"

      # The build needs php/php-config on PATH for the matrix PHP version.
      - name: "Install PHP and build tools (Alpine container)"
        if: matrix.target.family == 'musl'
        # the container's path of the workspace, which github.workspace is not
        run: PHP_CACHE_DIR="$GITHUB_WORKSPACE/alpine-php-cache" sh .github/scripts/install-alpine-php.sh

      - name: "Install PHP (macOS)"
        if: matrix.target.family == 'macos'
        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
        with:
          coverage: "none"
          php-version: "${{ matrix.php-version }}"

      - name: "Download the platform's core"
        if: matrix.variant == 'split'
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: "phpstan_turbo_core-${{ matrix.target.name }}"
          path: "turbo-ext"

      # The strict set lives in turbo-ext/Makefile (STRICT_WARN_FLAGS).
      - name: "Compile the extension with strict warnings"
        if: matrix.variant == 'split'
        working-directory: "turbo-ext"
        run: |
          make SPLIT=1 extension WARN_FLAGS="$(make -s print-warn-flags)" -j"$(getconf _NPROCESSORS_ONLN 2>/dev/null || nproc)"

      # The profile the platform's core was compiled with (turbo-compile-core,
      # `make pgo-pack`): the core is all but the four version-specific
      # sources and compiles to the same code against every version's
      # headers, so the self-contained build of this version uses its profile
      # instead of training one of its own — which took most of the leg.
      - name: "Download the profile of the platform's core"
        if: matrix.variant == 'pie'
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: "turbo-pgo-profile-${{ matrix.target.name }}"
          path: "turbo-ext"

      # see the same steps in turbo-compile-core: the training run of
      # `make pgo` runs bin/phpstan on the checkout (pgo-from-profile falls
      # back to it when another compiler recorded the profile)
      - uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0
        if: matrix.variant == 'pie' && matrix.target.family == 'macos'
        with:
          ignore-cache: true

      - name: "Install Composer dependencies (verified composer)"
        if: matrix.variant == 'pie' && matrix.target.family != 'macos'
        run: |
          sh .github/scripts/download-composer.sh
          php composer.phar install --no-interaction --no-progress
          rm composer.phar

      # A plain `make pgo-use` builds one self-contained phpstan_turbo.so.
      - name: "Compile the self-contained extension with strict warnings (profile-guided)"
        if: matrix.variant == 'pie'
        working-directory: "turbo-ext"
        run: |
          make pgo-from-profile WARN_FLAGS="$(make -s print-warn-flags)" -j"$(getconf _NPROCESSORS_ONLN 2>/dev/null || nproc)"

      # Before signing and the upload; a plain `make strip` leaves the core
      # (already stripped and signed by its own job) untouched.
      - name: "Strip symbol tables"
        working-directory: "turbo-ext"
        run: |
          ls -l phpstan_turbo*.so
          make strip
          ls -l phpstan_turbo*.so

      # see turbo-compile-core
      - name: "Ad-hoc sign the extension (macOS)"
        if: matrix.target.family == 'macos'
        working-directory: "turbo-ext"
        run: |
          codesign --force --sign - phpstan_turbo.so
          codesign --verify --verbose=2 phpstan_turbo.so

      # Stays here rather than in turbo-differential: the commit job stages
      # this binary, and one baked with the wrong version — or paired with a
      # core of another version, which leaves it reporting "core-mismatch" —
      # would ship inactive.
      - name: "Verify the built extension reports the expected version"
        run: |
          REPORTED="$(php -d extension="$PWD/turbo-ext/phpstan_turbo.so" -r 'echo phpversion("phpstan_turbo");')"
          EXPECTED="$(php build/turbo-extension-version.php)"
          echo "built extension reports: $REPORTED, enabler expects: $EXPECTED"
          [ "$REPORTED" = "$EXPECTED" ]
          # the loader rejects a ts-mismatched binary, so php loading it above
          # proves the binary matches the interpreter; assert the interpreter
          # itself so a -zts artifact cannot silently carry an NTS build
          [ "$(php -r 'echo (int) ((bool) PHP_ZTS);')" = "$PHP_ZTS" ]

      - name: "Upload extension artifact"
        if: matrix.variant == 'split'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ env.TURBO_ARTIFACT }}
          path: |
            turbo-ext/phpstan_turbo.so
            turbo-ext/phpstan_turbo_core.so
          if-no-files-found: "error"

      - name: "Upload self-contained extension artifact"
        if: matrix.variant == 'pie'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ env.TURBO_ARTIFACT }}
          path: "turbo-ext/phpstan_turbo.so"
          if-no-files-found: "error"

  turbo-compile-musl-arm64:
    name: "Compile Turbo Extension (musl arm64)"
    # The arm64 counterpart of the linux-musl-x86_64 leg in turbo-compile.
    # It cannot be a `container: alpine` leg there: JavaScript-based actions
    # cannot run in Alpine containers on arm64 runners (the runner only
    # ships an x64 musl Node). Instead the workflow steps run on the arm64
    # host and only the build commands run inside a long-lived Alpine
    # container via docker exec — native arm64, no QEMU.
    runs-on: "ubuntu-24.04-arm"
    needs: turbo-compile-core-musl-arm64
    if: ${{ !cancelled() }}
    timeout-minutes: ${{ matrix.variant == 'pie' && 45 || 20 }}

    env:
      PHP_MINOR: ${{ matrix.php-version }}
      PHP_ZTS: ${{ matrix.ts == 'zts' && '1' || '0' }}
      TURBO_ARTIFACT: "${{ matrix.variant == 'pie' && 'phpstan_turbo_pie' || 'phpstan_turbo' }}-linux-musl-arm64-php${{ matrix.php-version }}${{ matrix.ts == 'zts' && '-zts' || '' }}"

    strategy:
      fail-fast: false
      matrix:
        php-version: ["8.2", "8.3", "8.4", "8.5", "8.6"]
        # thread-safe for every minor too, see turbo-compile
        ts: ["nts", "zts"]
        # see turbo-compile
        variant: ${{ fromJSON((startsWith(github.ref, 'refs/tags/') || contains(github.event.pull_request.labels.*.name, 'turbo-pie')) && '["split", "pie"]' || '["split"]') }}

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0 # the version is baked from git log over turbo-ext/src

      - name: "Download the platform's core"
        if: matrix.variant == 'split'
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: "phpstan_turbo_core-linux-musl-arm64"
          path: "turbo-ext"

      # see turbo-compile
      - name: "Download the profile of the platform's core"
        if: matrix.variant == 'pie'
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: "turbo-pgo-profile-linux-musl-arm64"
          path: "turbo-ext"

      - name: "Start the Alpine build container"
        env:
          ALPINE_IMAGE: ${{ matrix.php-version == '8.6' && matrix.ts == 'nts' && 'alpine:edge' || 'alpine:3.24' }}
        run: |
          docker run -d --name alpine-build \
            -v "$PWD:/work" -w /work \
            -e PHP_MINOR -e PHP_ZTS -e PHP_CACHE_DIR=/work/alpine-php-cache \
            "$ALPINE_IMAGE" sleep 7200

      # see turbo-compile
      - name: "Resolve the PHP build to cache"
        id: alpine-php
        run: docker exec alpine-build sh .github/scripts/install-alpine-php.sh --resolve >> "$GITHUB_OUTPUT"

      - name: "Restore the PHP build"
        if: steps.alpine-php.outputs.release != ''
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: "alpine-php-cache"
          key: "alpine-php-${{ steps.alpine-php.outputs.release }}-${{ hashFiles('.github/turbo-build/build-php.sh') }}"

      - name: "Install PHP and build tools"
        run: docker exec alpine-build sh .github/scripts/install-alpine-php.sh

      # see turbo-compile-core-musl-arm64
      - name: "Trust the checkout despite the container/host uid mismatch"
        run: docker exec alpine-build git config --global --add safe.directory /work

      - name: "Compile the extension with strict warnings"
        if: matrix.variant == 'split'
        run: |
          docker exec -i -w /work/turbo-ext alpine-build sh -e <<'EOF'
          make SPLIT=1 extension WARN_FLAGS="$(make -s print-warn-flags)" -j"$(getconf _NPROCESSORS_ONLN 2>/dev/null || nproc)"
          make strip
          ls -l phpstan_turbo.so phpstan_turbo_core.so
          EOF

      # see turbo-compile: the training run of `make pgo`, which
      # pgo-from-profile falls back to, runs bin/phpstan on the checkout
      - name: "Compile the self-contained extension with strict warnings (profile-guided)"
        if: matrix.variant == 'pie'
        run: |
          docker exec -i -w /work alpine-build sh -e <<'EOF'
          sh .github/scripts/download-composer.sh
          php composer.phar install --no-interaction --no-progress
          rm composer.phar
          cd turbo-ext
          make pgo-from-profile WARN_FLAGS="$(make -s print-warn-flags)" -j"$(getconf _NPROCESSORS_ONLN 2>/dev/null || nproc)"
          make strip
          ls -l phpstan_turbo.so
          EOF

      - name: "Verify the built extension reports the expected version"
        run: |
          docker exec -i alpine-build sh -e <<'EOF'
          REPORTED="$(php -d extension="$PWD/turbo-ext/phpstan_turbo.so" -r 'echo phpversion("phpstan_turbo");')"
          EXPECTED="$(php build/turbo-extension-version.php)"
          echo "built extension reports: $REPORTED, enabler expects: $EXPECTED"
          [ "$REPORTED" = "$EXPECTED" ]
          [ "$(php -r 'echo (int) ((bool) PHP_ZTS);')" = "$PHP_ZTS" ]
          EOF

      - name: "Upload extension artifact"
        if: matrix.variant == 'split'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ env.TURBO_ARTIFACT }}
          path: |
            turbo-ext/phpstan_turbo.so
            turbo-ext/phpstan_turbo_core.so
          if-no-files-found: "error"

      - name: "Upload self-contained extension artifact"
        if: matrix.variant == 'pie'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ env.TURBO_ARTIFACT }}
          path: "turbo-ext/phpstan_turbo.so"
          if-no-files-found: "error"

  turbo-shared-core-gate:
    name: "Turbo Shared Core Gate"
    # The core every platform ships is compiled against one PHP version's
    # headers and runs on all of them, so the sources it is built from must
    # compile to identical code against each supported version's — a source
    # reading a member whose offset moved, a constant whose value changed or
    # a function whose signature did would otherwise misbehave on the other
    # versions only, on the paths that touch it. Each leg compiles every
    # source against one version's headers in its CI build image with clang
    # and uploads a fingerprint of the result (a hash per function, data
    # section and relocation table, see turbo-ext/bin/shared-core/gate.py);
    # turbo-shared-core-gate-compare compares them. A leg whose fingerprint
    # turbo-origins found in an earlier run from identical build inputs only
    # carries it over, like a reused core.
    needs: turbo-origins
    runs-on: "ubuntu-latest"
    timeout-minutes: 30

    permissions:
      contents: read # actions/checkout of this repository
      actions: read # downloads a reused fingerprint from an earlier run, see turbo-origins

    env:
      GATE_ARTIFACT: "turbo-gate-fingerprint-${{ matrix.php-version }}"
      ORIGIN_RUN_ID: ${{ fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('turbo-gate-fingerprint-{0}', matrix.php-version)] }}

    strategy:
      fail-fast: false
      matrix:
        # every PHP the cores run on; thread-safe builds are "<minor>-zts"
        php-version: ["8.2", "8.3", "8.4", "8.5", "8.6", "8.2-zts", "8.3-zts", "8.4-zts", "8.5-zts", "8.6-zts"]

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      - name: "Download the fingerprint compiled from identical build inputs"
        if: env.ORIGIN_RUN_ID != ''
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: ${{ env.GATE_ARTIFACT }}
          path: "fingerprints"
          run-id: ${{ env.ORIGIN_RUN_ID }}
          github-token: ${{ github.token }}

      - name: "Record the run that compiled the fingerprint"
        if: env.ORIGIN_RUN_ID != ''
        run: echo "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$ORIGIN_RUN_ID" | tee turbo-reused.txt

      - name: "Checkout"
        if: env.ORIGIN_RUN_ID == ''
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: "Compile against the PHP ${{ matrix.php-version }} headers and fingerprint the result"
        if: env.ORIGIN_RUN_ID == ''
        env:
          SHARED_CORE_WORK_DIR: ${{ runner.temp }}/shared-core
          GATE_VERSIONS: ${{ matrix.php-version }}
        run: |
          mkdir -p "$SHARED_CORE_WORK_DIR" fingerprints
          GATE_JOBS="$(nproc)" bash turbo-ext/bin/shared-core/fingerprint-linux.sh
          cp "$SHARED_CORE_WORK_DIR/fingerprints/fingerprint-$GATE_VERSIONS.tsv" fingerprints/

      - name: "Upload the fingerprint"
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ env.GATE_ARTIFACT }}
          path: "fingerprints/fingerprint-${{ matrix.php-version }}.tsv"
          if-no-files-found: "error"

      - name: "Mark the fingerprint as reused"
        if: env.ORIGIN_RUN_ID != ''
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: "turbo-reused-${{ env.GATE_ARTIFACT }}"
          path: "turbo-reused.txt"
          if-no-files-found: "error"

  turbo-shared-core-gate-compare:
    name: "Turbo Shared Core Gate (compare)"
    # Fails on any function, data section or relocation table outside the
    # version-specific sources (Abi.cpp, Shadow.cpp, TrustedTypes.cpp,
    # main.cpp) whose fingerprint differs from the build against the
    # version the cores are compiled against (turbo-compile-core). Not a
    # gate of the commit job, like the other jobs that only test the
    # shipped bits (see there).
    needs: turbo-shared-core-gate
    runs-on: "ubuntu-latest"
    timeout-minutes: 5

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: turbo-ext/bin/shared-core

      - name: "Download the fingerprints"
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: "turbo-gate-fingerprint-*"
          path: "fingerprints"
          merge-multiple: true

      - name: "Compare the shared code across the supported PHP versions"
        run: python3 -I turbo-ext/bin/shared-core/gate.py compare 8.5 fingerprints
  turbo-docker-run:
    name: "Run with Turbo Extension (Docker PHP builds)"
    needs: "turbo-compile"
    # The docker-library php images build the official php.net tarballs
    # without regenerating the parser, so their runtime can differ from the
    # distro/setup-php builds the .so artifacts are compiled against and
    # that turbo-run exercises. The canonical incident is the T_* token
    # numbering (https://github.com/phpstan/phpstan/issues/15037): the
    # userland token ids are assigned by the bison that generated the
    # tarball's zend_language_parser.c — the 8.3.21 tarball ships the
    # Bison 3.8.2 numbering, the 8.3.22 one the Bison 3.0.4 numbering —
    # and with ids baked in at compile time the extension silently dropped
    # every comment, and with them every PHPDoc, on the other numbering's
    # builds. The next incompatibility of that kind will not announce
    # itself in a probe written for the last one, so this job loads the
    # freshly built extension into docker-library images and runs the same
    # make tests + make phpstan as turbo-run: any turbo-vs-environment
    # mismatch fails ordinary tests (verified against the pre-fix
    # token-numbering bug: 2462 of 21065 tests fail and self-analysis
    # crashes on the Bison 3.0.4 image, both green on the matched one).
    # The 8.3 images are pinned to one release of each known numbering;
    # 8.4/8.5 float on the minor tag and 8.6 on the prerelease tag so a future
    # release with a surprising build is picked up on the next run without
    # a workflow change. Legs run on x86_64 only: the token numbering comes
    # from the bison that generated the tarball's parser, not from arch or
    # libc, and per-arch coverage stays with turbo-run and
    # turbo-differential. The 8.6+ images are thread-safe
    # (docker-library/php#1686), so those legs load the -zts binaries, and
    # an Alpine leg covers the musl one — php:*-alpine is the other image
    # family people run PHPStan in. The 8.5 php:*-zts pair (the base of
    # FrankenPHP's images) does the same for the older minors' ZTS
    # binaries, which are compiled against our own build of the tarball. No macOS/Windows legs: those runners
    # cannot run Linux containers, and no alternative-numbered official
    # build is distributed for either platform today.
    runs-on: "ubuntu-latest"
    timeout-minutes: 60

    env:
      IMAGE: ${{ (matrix.php-version == '8.6' || contains(matrix.image, 'alpine')) && format('phpstan-turbo-test:{0}', matrix.binary) || matrix.image }}

    permissions:
      contents: read

    strategy:
      fail-fast: false
      matrix:
        image:
          - "php:8.2-cli-bookworm"
          - "php:8.3.21-cli-bookworm"
          - "php:8.3.22-cli-bookworm"
          - "php:8.4-cli-bookworm"
          - "php:8.5-cli-bookworm"
          - "php:8.5-zts-bookworm"
          - "php:8.5-zts-alpine"
          - "php:8.6-rc-cli-bookworm"
          - "php:8.6-rc-cli-alpine"
        check: ["tests", "phpstan"]
        include:
          - image: "php:8.2-cli-bookworm"
            php-version: "8.2"
            binary: "linux-gnu-x86_64-php8.2"
          - image: "php:8.3.21-cli-bookworm"
            php-version: "8.3"
            binary: "linux-gnu-x86_64-php8.3"
          - image: "php:8.3.22-cli-bookworm"
            php-version: "8.3"
            binary: "linux-gnu-x86_64-php8.3"
          - image: "php:8.4-cli-bookworm"
            php-version: "8.4"
            binary: "linux-gnu-x86_64-php8.4"
          - image: "php:8.5-cli-bookworm"
            php-version: "8.5"
            binary: "linux-gnu-x86_64-php8.5"
          - image: "php:8.5-zts-bookworm"
            php-version: "8.5"
            binary: "linux-gnu-x86_64-php8.5-zts"
          - image: "php:8.5-zts-alpine"
            php-version: "8.5"
            binary: "linux-musl-x86_64-php8.5-zts"
          - image: "php:8.6-rc-cli-bookworm"
            php-version: "8.6"
            binary: "linux-gnu-x86_64-php8.6-zts"
          - image: "php:8.6-rc-cli-alpine"
            php-version: "8.6"
            binary: "linux-musl-x86_64-php8.6-zts"
          # The tests legs invoke paratest directly instead of a literal
          # `make tests`: its install-paratest step needs a composer, which
          # the images do not carry — tests/vendor is installed on the
          # runner host below, the same way tests.yml runs the suite.
          - check: "tests"
            script: "php tests/vendor/bin/paratest --runner WrapperRunner --no-coverage"
          - check: "phpstan"
            script: "make phpstan"

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0 # the autoloader dump generates the expected turbo version from git log over turbo-ext/src

      # vendor/ (and tests/vendor for the tests legs) is installed on the
      # runner host and only read from the mounted workspace: the
      # docker-library images carry neither a composer nor an unzip.
      - name: "Install PHP"
        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
        with:
          coverage: "none"
          php-version: "${{ matrix.php-version }}"

      - uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0
        with:
          ignore-cache: true

      - name: "Install paratest"
        if: matrix.check == 'tests'
        run: composer install --working-dir tests

      - name: "Download extension artifact"
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: "phpstan_turbo-${{ matrix.binary }}"
          path: "turbo-ext"

      - name: "Add mbstring, bash and make to the 8.6 prerelease and Alpine images"
        if: matrix.php-version == '8.6' || contains(matrix.image, 'alpine')
        env:
          PHP_IMAGE: ${{ matrix.image }}
        # Unlike the stable images, the 8.6 prerelease omits mbstring,
        # which PHPUnit and PHPStan's test fixtures require. The Alpine
        # images also drop the build tools after building PHP, and carry no
        # bash, which the run step below needs, and no make, which
        # `make phpstan` needs.
        run: |
          docker build --build-arg "PHP_IMAGE=$PHP_IMAGE" -t "$IMAGE" - <<'DOCKERFILE'
          ARG PHP_IMAGE
          FROM ${PHP_IMAGE}
          RUN if command -v apk > /dev/null; then \
              apk add --no-cache bash make; \
            fi \
            && if ! php -m | grep -qx mbstring; then \
              if command -v apk > /dev/null; then \
                apk add --no-cache oniguruma \
                && apk add --no-cache --virtual .mbstring-build-deps $PHPIZE_DEPS oniguruma-dev \
                && docker-php-ext-install mbstring \
                && apk del .mbstring-build-deps; \
              else \
                apt-get update && apt-get install -y --no-install-recommends libonig-dev \
                && docker-php-ext-install mbstring \
                && rm -rf /var/lib/apt/lists/*; \
              fi; \
            fi
          DOCKERFILE

      # Guards the matrix above: a binary of the wrong thread-safety would
      # fail the probe below anyway, but with an undefined-symbol error
      # instead of this message.
      - name: "Verify the binary matches the image's thread-safety"
        env:
          BINARY: ${{ matrix.binary }}
        run: |
          IMAGE_ZTS="$(docker run --rm "$IMAGE" php -r 'echo (int) PHP_ZTS;')"
          BINARY_ZTS=$([ "${BINARY%-zts}" != "$BINARY" ] && echo 1 || echo 0)
          echo "image PHP_ZTS=$IMAGE_ZTS, binary $BINARY"
          [ "$IMAGE_ZTS" = "$BINARY_ZTS" ]

      # Fast fail with a one-line diagnosis: a token-numbering mismatch
      # would otherwise surface as thousands of unrelated-looking failures
      # in the suite run below.
      - name: "Token-id probe in ${{ matrix.image }}"
        run: docker run --rm -v "$PWD:/work" -w /work "$IMAGE" php -d extension=/work/turbo-ext/phpstan_turbo.so turbo-ext/tests/token-id-probe.php

      # Bind-mounted into conf.d of every docker run below. The images
      # ship no php.ini, so memory_limit would default to 128M, which the
      # test bootstrap (DI container compilation) already exceeds.
      - name: "Prepare the extension ini"
        run: printf 'extension=/work/turbo-ext/phpstan_turbo.so\nmemory_limit=-1\n' > "$RUNNER_TEMP/turbo-docker.ini"

      - name: "Verify the extension is active in ${{ matrix.image }}"
        run: |
          docker run --rm -v "$PWD:/work" -v "$RUNNER_TEMP/turbo-docker.ini:/usr/local/etc/php/conf.d/zz-turbo.ini" -w /work "$IMAGE" php -r '
            require "vendor/autoload.php";
            PHPStan\Turbo\TurboExtensionEnabler::activateIfCompatible();
            if (!PHPStan\Turbo\TurboExtensionEnabler::isActive() || !(new ReflectionMethod("PHPStan\\Analyser\\ScopeOps", "nodeKey"))->isInternal()) {
              fwrite(STDERR, "turbo extension is not shadowing ScopeOps" . PHP_EOL);
              exit(1);
            }
          '

      - name: "Run ${{ matrix.check }} in ${{ matrix.image }}"
        # --shm-size: the arena allocates cross-worker shared memory, and
        # docker's default 64M /dev/shm makes parallel analysis SIGBUS.
        env:
          SCRIPT: ${{ matrix.script }}
        run: docker run --rm --shm-size=1g -v "$PWD:/work" -v "$RUNNER_TEMP/turbo-docker.ini:/usr/local/etc/php/conf.d/zz-turbo.ini" -w /work "$IMAGE" bash -c "$SCRIPT"

  turbo-compile-core-windows:
    name: "Compile Turbo Extension Core (Windows)"
    # The Windows core, once per thread-safety flavour: a DLL imports the
    # engine from php8.dll or php8ts.dll by name, so the two cannot share
    # one. Built against the oldest supported minor's devel pack with its
    # toolset (VS16, linker 14.2x): PHP's loader only checks the toolset of
    # the extension DLL it loads (turbo-compile-windows builds each with its
    # minor's), and a core linked with an older toolset runs on every newer
    # VC runtime.
    runs-on: ${{ fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('phpstan_turbo_core-windows-x86_64{0}', matrix.ts == 'zts' && '-zts' || '')] && 'ubuntu-latest' || 'windows-2022' }}
    needs: turbo-origins
    timeout-minutes: 40

    permissions:
      contents: read # actions/checkout of this repository
      actions: read # downloads a reused core from an earlier run, see turbo-origins

    env:
      # php/php-sdk-binary-tools — the toolchain every PHP Windows build
      # uses (ships bison and the unix tools phpize/configure expect).
      PHP_SDK_COMMIT: "c73faaf1cce914e2fc04da5587132f8f425996af" # php-sdk-2.7.1
      TURBO_ARTIFACT: "phpstan_turbo_core-windows-x86_64${{ matrix.ts == 'zts' && '-zts' || '' }}"
      ORIGIN_RUN_ID: ${{ fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('phpstan_turbo_core-windows-x86_64{0}', matrix.ts == 'zts' && '-zts' || '')] }}

    strategy:
      fail-fast: false
      matrix:
        ts: ["nts", "zts"]
        php-version: ["8.3"]
        vs: ["vs16"]
        toolset: ["14.29"]

    steps:
      # See the same two steps in turbo-compile-core; this leg runs on
      # ubuntu-latest.
      - name: "Download the core compiled from identical build inputs"
        if: env.ORIGIN_RUN_ID != ''
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: ${{ env.TURBO_ARTIFACT }}
          path: "turbo-ext"
          run-id: ${{ env.ORIGIN_RUN_ID }}
          github-token: ${{ github.token }}

      - name: "Record the run that compiled the core"
        if: env.ORIGIN_RUN_ID != ''
        run: echo "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$ORIGIN_RUN_ID" | tee turbo-reused.txt

      - name: "Checkout"
        if: env.ORIGIN_RUN_ID == ''
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0 # the version is baked from git log over turbo-ext/src

      - name: "Install PHP"
        if: env.ORIGIN_RUN_ID == ''
        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
        env:
          phpts: "${{ matrix.ts == 'zts' && 'ts' || 'nts' }}"
        with:
          coverage: "none"
          php-version: "${{ matrix.php-version }}"

      - name: "Compute the extension version and download the build tools"
        if: env.ORIGIN_RUN_ID == ''
        shell: bash
        env:
          MATRIX_TS: ${{ matrix.ts }}
          MATRIX_VS: ${{ matrix.vs }}
        run: bash .github/scripts/download-php-windows-devel.sh

      - name: "Set up MSVC environment"
        if: env.ORIGIN_RUN_ID == ''
        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
        with:
          arch: x64
          toolset: ${{ matrix.toolset }}

      - name: "Build the core"
        if: env.ORIGIN_RUN_ID == ''
        shell: cmd
        working-directory: turbo-ext
        run: |
          for /d %%d in (C:\php-devel\php-*-devel-*) do set DEVEL=%%d
          set PATH=%DEVEL%;C:\php-sdk\bin;C:\php-sdk\msys2\usr\bin;%PATH%
          call phpize.bat
          if errorlevel 1 exit /b 1
          call configure.bat --enable-phpstan-turbo=core
          if errorlevel 1 exit /b 1
          nmake

      # the DLL and its import library, which turbo-compile-windows links
      # each extension against
      - name: "Collect the core"
        if: env.ORIGIN_RUN_ID == ''
        shell: bash
        env:
          MATRIX_TS: ${{ matrix.ts }}
        run: |
          CORE=$([ "$MATRIX_TS" = "zts" ] && echo phpstan_turbo_core-zts || echo phpstan_turbo_core)
          mkdir -p core-out
          DLL=$(find turbo-ext -name "$CORE.dll" | head -1)
          LIB=$(find turbo-ext -name "$CORE.lib" | head -1)
          [ -n "$DLL" ] && [ -n "$LIB" ]
          cp "$DLL" "$LIB" core-out/
          ls -l core-out
          echo "CORE_DIR=core-out" >> "$GITHUB_ENV"

      - name: "Point the upload at the reused core"
        if: env.ORIGIN_RUN_ID != ''
        run: echo "CORE_DIR=turbo-ext" >> "$GITHUB_ENV"

      - name: "Upload core artifact"
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ env.TURBO_ARTIFACT }}
          path: "${{ env.CORE_DIR }}/phpstan_turbo_core*"
          if-no-files-found: "error"

      - name: "Mark the core artifact as reused"
        if: env.ORIGIN_RUN_ID != ''
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: "turbo-reused-${{ env.TURBO_ARTIFACT }}"
          path: "turbo-reused.txt"
          if-no-files-found: "error"

  turbo-compile-windows:
    name: "Compile Turbo Extension (Windows)"
    # The extension DLL of one PHP version, linked against the core of
    # turbo-compile-core-windows (its import library) and delay-loading it
    # from its own directory at run time (main.cpp, config.w32). The `pie`
    # variant legs build it self-contained instead, see turbo-compile.
    # windows-latest and windows-2025 serve the VS2026 image, whose 14.5x
    # toolset links DLLs the official php.net binaries (built with vs17,
    # toolset 14.4x) refuse to load — PHP's loader rejects modules linked
    # with a newer toolset generation than the core. The windows-2022 image
    # is the one that ships VS2022.
    # PHP 8.6's vs18 development packs need the VS2026 toolchain.
    runs-on: ${{ matrix.php-version == '8.6' && 'windows-2025-vs2026' || 'windows-2022' }}
    needs:
      - php-windows-prereleases
      - turbo-compile-core-windows
    # see turbo-compile
    if: ${{ !cancelled() }}
    timeout-minutes: ${{ matrix.variant == 'pie' && 45 || 30 }}

    env:
      PHP_SDK_COMMIT: "c73faaf1cce914e2fc04da5587132f8f425996af" # php-sdk-2.7.1, see turbo-compile-core-windows
      TURBO_ARTIFACT: "${{ matrix.variant == 'pie' && 'phpstan_turbo_pie' || 'phpstan_turbo' }}-windows-x86_64-php${{ matrix.php-version }}${{ matrix.ts == 'zts' && '-zts' || '' }}"

    strategy:
      fail-fast: false
      matrix:
        php-version: ["8.2", "8.3", "8.4", "8.5", "8.6"]
        ts: ["nts", "zts"]
        # see turbo-compile
        variant: ${{ fromJSON((startsWith(github.ref, 'refs/tags/') || contains(github.event.pull_request.labels.*.name, 'turbo-pie')) && '["split", "pie"]' || '["split"]') }}
        # The official 8.2 and 8.3 Windows binaries are built with VS16
        # (linker 14.2x) and PHP's module loader is one-directional (module
        # toolset generation <= core's), so their DLLs must be linked with
        # the v142 toolset — which the windows-2022 image ships alongside the
        # default v143. The devel pack name carries the same vs infix.
        include:
          - php-version: "8.2"
            vs: "vs16"
            toolset: "14.29"
          - php-version: "8.3"
            vs: "vs16"
            toolset: "14.29"
          - php-version: "8.4"
            vs: "vs17"
          - php-version: "8.5"
            vs: "vs17"
          - php-version: "8.6"
            vs: "vs18"

    steps:
      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          # full history: the extension version is baked from git log over
          # the watched paths
          fetch-depth: 0

      - name: "Install PHP"
        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
        env:
          phpts: "${{ matrix.ts == 'zts' && 'ts' || 'nts' }}"
        with:
          coverage: "none"
          php-version: "${{ matrix.php-version }}"

      - name: "Install the PHP prerelease runtime"
        if: fromJSON(needs.php-windows-prereleases.outputs.prereleases)[matrix.php-version]
        shell: bash
        env:
          MATRIX_TS: ${{ matrix.ts }}
          PHP_PRERELEASE: ${{ toJSON(fromJSON(needs.php-windows-prereleases.outputs.prereleases)[matrix.php-version]) }}
        run: bash .github/scripts/install-php-windows-prerelease.sh

      - name: "Compute the extension version and download the build tools"
        shell: bash
        env:
          MATRIX_TS: ${{ matrix.ts }}
          MATRIX_VS: ${{ matrix.vs }}
          PHP_PRERELEASE: ${{ toJSON(fromJSON(needs.php-windows-prereleases.outputs.prereleases)[matrix.php-version]) }}
        run: bash .github/scripts/download-php-windows-devel.sh

      # the DLL and its import library, into the extension directory where
      # config.w32 expects the library
      - name: "Download the core"
        if: matrix.variant == 'split'
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: "phpstan_turbo_core-windows-x86_64${{ matrix.ts == 'zts' && '-zts' || '' }}"
          path: "turbo-ext"

      - name: "Set up MSVC environment"
        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
        with:
          arch: x64
          # empty on the vs17/vs18 legs = the image's default toolset
          toolset: ${{ matrix.toolset }}

      - name: "Build the extension"
        shell: cmd
        working-directory: turbo-ext
        env:
          VARIANT: ${{ matrix.variant }}
        run: |
          for /d %%d in (C:\php-devel\php-*-devel-*) do set DEVEL=%%d
          set PATH=%DEVEL%;C:\php-sdk\bin;C:\php-sdk\msys2\usr\bin;%PATH%
          call phpize.bat
          if errorlevel 1 exit /b 1
          if "%VARIANT%"=="pie" (
            call configure.bat --enable-phpstan-turbo
          ) else (
            call configure.bat --enable-phpstan-turbo=extension
          )
          if errorlevel 1 exit /b 1
          nmake

      # See the same step in turbo-compile. The extension loads its core
      # from its own directory, so the core goes next to the built DLL first;
      # the self-contained one (pie) carries the PHP generation it is built
      # for instead, which the PIE asset name needs.
      - name: "Verify the built extension reports the expected version"
        shell: bash
        env:
          MATRIX_TS: ${{ matrix.ts }}
          MATRIX_VS: ${{ matrix.vs }}
          VARIANT: ${{ matrix.variant }}
        run: |
          DLL=$(find turbo-ext -name "php_phpstan_turbo.dll" | head -1)
          [ -n "$DLL" ]
          mkdir -p ext-out
          cp "$DLL" ext-out/php_phpstan_turbo.dll
          if [ "$VARIANT" = "pie" ]; then
            echo "$MATRIX_VS" > ext-out/compiler
          else
            CORE=$([ "$MATRIX_TS" = "zts" ] && echo phpstan_turbo_core-zts.dll || echo phpstan_turbo_core.dll)
            cp "turbo-ext/$CORE" ext-out/
          fi
          REPORTED="$(php -d extension="$(cygpath -w "$PWD/ext-out/php_phpstan_turbo.dll")" -r 'echo phpversion("phpstan_turbo");')"
          EXPECTED="$(php build/turbo-extension-version.php)"
          echo "built extension reports: $REPORTED, enabler expects: $EXPECTED"
          [ "$REPORTED" = "$EXPECTED" ]
          # the loader rejects a ts-mismatched DLL, so php loading it above
          # proves the DLL matches the interpreter; assert the interpreter
          # itself so both sides cannot silently be NTS on the zts leg
          WANT_ZTS=$([ "$MATRIX_TS" = "zts" ] && echo 1 || echo 0)
          [ "$(php -r 'echo (int) ((bool) PHP_ZTS);')" = "$WANT_ZTS" ]

      - name: "Upload extension artifact"
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: ${{ env.TURBO_ARTIFACT }}
          path: ${{ matrix.variant == 'pie' && 'ext-out/*' || 'ext-out/*.dll' }}
          if-no-files-found: "error"

  turbo-artifact:
    name: "Aggregate Turbo Extension Artifact"
    needs:
      - turbo-compile
      - turbo-compile-musl-arm64
      - turbo-compile-windows
    runs-on: "ubuntu-latest"
    timeout-minutes: 5

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      # before the download: checkout empties the workspace
      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: .github/scripts

      - name: "Download extension artifacts"
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: "phpstan_turbo-*"
          path: "turbo-artifacts"

      - name: "Arrange the distribution layout"
        # each artifact's extension and the platform's core, mapped by
        # .github/scripts/turbo-dist-layout.sh (which also refuses legs of
        # one platform carrying different cores) — so new targets need no
        # change here. The integration/extension/other test workflows in
        # phpstan/phpstan download this artifact next to the phar under test.
        run: |
          bash .github/scripts/turbo-dist-layout.sh turbo-artifacts > layout.tsv
          while IFS=$'\t' read -r file dest; do
            install -D -m 644 "$file" "turbo-ext-dist/$dest"
          done < layout.tsv
          find turbo-ext-dist -type f | sort

      - name: "Upload aggregated artifact"
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: "turbo-ext-files"
          path: "turbo-ext-dist"
          if-no-files-found: "error"

  turbo-pie-release:
    name: "Turbo Extension PIE Release"
    # Publishes the self-contained binaries of the `pie` variant legs as the
    # phpstan/turbo-ext release of the tag, named per PIE's release-asset
    # conventions (.github/scripts/turbo-pie-assets.sh) so that
    # `pie install phpstan/turbo` finds them. The tag itself is created in
    # phpstan/turbo-ext by subsplit-turbo-ext.yml. On pull requests labelled
    # turbo-pie it only packages them, as an artifact.
    if: startsWith(github.ref, 'refs/tags/') || contains(github.event.pull_request.labels.*.name, 'turbo-pie')
    needs:
      - turbo-compile
      - turbo-compile-musl-arm64
      - turbo-compile-windows
    runs-on: "ubuntu-latest"
    timeout-minutes: 15

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      # before the download: checkout empties the workspace
      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          sparse-checkout: .github/scripts

      - name: "Download the self-contained extension artifacts"
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: "phpstan_turbo_pie-*"
          path: "turbo-pie-artifacts"

      - name: "Package them as PIE release assets"
        env:
          VERSION: ${{ startsWith(github.ref, 'refs/tags/') && github.ref_name || 'dev' }}
        run: |
          bash .github/scripts/turbo-pie-assets.sh turbo-pie-artifacts "$VERSION" pie-assets
          ls -l pie-assets

      - name: "Upload the PIE release assets"
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: "turbo-pie-assets"
          path: "pie-assets"
          if-no-files-found: "error"

      - name: "Create the phpstan/turbo-ext release and upload the assets"
        if: startsWith(github.ref, 'refs/tags/')
        env:
          GH_TOKEN: ${{ secrets.PHPSTAN_BOT_TOKEN }}
          TAG: ${{ github.ref_name }}
        run: |
          # The release must point at the tag subsplit-turbo-ext.yml creates
          # in phpstan/turbo-ext when this repository is tagged; fail loudly
          # if it has not appeared, and re-run this job once it has.
          if ! gh api "repos/phpstan/turbo-ext/git/ref/tags/$TAG" > /dev/null; then
            echo "::error::Tag $TAG does not exist in phpstan/turbo-ext yet. The subsplit-turbo-ext.yml workflow creates it; re-run this job once it has."
            exit 1
          fi

          # Releases in the phpstan org are immutable — a published release
          # can never gain or replace assets. Create a draft, upload every
          # asset into it, and only then publish. A re-run resumes a
          # half-finished draft; a published release is final.
          state="$(gh api repos/phpstan/turbo-ext/releases --jq 'first(.[] | select(.tag_name == env.TAG) | if .draft then "draft" else "published" end)')"
          case "${state:-absent}" in
            published)
              echo "Release $TAG is already published and immutable, nothing to do."
              exit 0
              ;;
            draft)
              echo "Draft release $TAG already exists, resuming the upload."
              ;;
            absent)
              gh release create "$TAG" --repo phpstan/turbo-ext --verify-tag --draft \
                --title "$TAG" \
                --notes "Prebuilt \`phpstan_turbo\` binaries for [PIE](https://github.com/php/pie): \`pie install phpstan/turbo\`. Matches [PHPStan $TAG](https://github.com/phpstan/phpstan/releases/tag/$TAG)."
              ;;
          esac
          gh release upload "$TAG" --repo phpstan/turbo-ext --clobber pie-assets/*
          gh release edit "$TAG" --repo phpstan/turbo-ext --draft=false

  turbo-differential:
    name: "Run with Turbo Extension (differential tests)"
    # The differential tests (native vs the PHP implementations of this
    # commit) for every binary the compile jobs hand over, compiled or
    # reused, under the runtime setup-php installs on the platform the
    # binary is built for. Kept out of the compile jobs so the commit job,
    # which only needs the binaries, does not wait for them (see there).
    # The musl binaries are tested in turbo-differential-musl. The linux-gnu
    # 8.6 and ZTS legs run in the image the binary is compiled in instead:
    # setup-php's Linux 8.6 is a nightly snapshot that can predate the
    # release the binary targets, and a module API mismatch refuses to load
    # it at all; the ZTS legs so as not to depend on setup-php's thread-safe
    # Linux builds.
    needs:
      - php-windows-prereleases
      - turbo-compile
      - turbo-compile-windows
    runs-on: ${{ matrix.runs-on }}
    container: ${{ matrix.container || '' }}
    timeout-minutes: 30

    defaults:
      run:
        shell: bash

    env:
      TURBO_ARTIFACT: "phpstan_turbo-${{ matrix.target }}-php${{ matrix.php-version }}${{ matrix.ts == 'zts' && '-zts' || '' }}"

    strategy:
      fail-fast: false
      matrix:
        php-version: ["8.2", "8.3", "8.4", "8.5", "8.6"]
        target: ["linux-gnu-x86_64", "linux-gnu-arm64", "macos-arm64", "windows-x86_64"]
        ts: ["nts", "zts"]
        # macOS ships no ZTS binary (see turbo-compile)
        exclude:
          - target: "macos-arm64"
            ts: "zts"
        include:
          - target: "linux-gnu-x86_64"
            runs-on: "ubuntu-latest"
          - target: "linux-gnu-arm64"
            runs-on: "ubuntu-24.04-arm"
          - target: "macos-arm64"
            runs-on: "macos-latest"
          # see turbo-run for why windows-latest loads the DLL
          - target: "windows-x86_64"
            runs-on: "windows-latest"
          - target: "linux-gnu-x86_64"
            php-version: "8.6"
            ts: "nts"
            container: "ghcr.io/phpstan/turbo-build:gnu-php8.6"
          - target: "linux-gnu-arm64"
            php-version: "8.6"
            ts: "nts"
            container: "ghcr.io/phpstan/turbo-build:gnu-php8.6"
          # the linux-gnu ZTS legs, in the image the binary is compiled in
          # (see above); the official php:*-zts images get turbo-docker-run
          - target: "linux-gnu-x86_64"
            php-version: "8.2"
            ts: "zts"
            runs-on: "ubuntu-latest"
            container: "ghcr.io/phpstan/turbo-build:gnu-php8.2-zts"
          - target: "linux-gnu-arm64"
            php-version: "8.2"
            ts: "zts"
            runs-on: "ubuntu-24.04-arm"
            container: "ghcr.io/phpstan/turbo-build:gnu-php8.2-zts"
          - target: "linux-gnu-x86_64"
            php-version: "8.3"
            ts: "zts"
            runs-on: "ubuntu-latest"
            container: "ghcr.io/phpstan/turbo-build:gnu-php8.3-zts"
          - target: "linux-gnu-arm64"
            php-version: "8.3"
            ts: "zts"
            runs-on: "ubuntu-24.04-arm"
            container: "ghcr.io/phpstan/turbo-build:gnu-php8.3-zts"
          - target: "linux-gnu-x86_64"
            php-version: "8.4"
            ts: "zts"
            runs-on: "ubuntu-latest"
            container: "ghcr.io/phpstan/turbo-build:gnu-php8.4-zts"
          - target: "linux-gnu-arm64"
            php-version: "8.4"
            ts: "zts"
            runs-on: "ubuntu-24.04-arm"
            container: "ghcr.io/phpstan/turbo-build:gnu-php8.4-zts"
          - target: "linux-gnu-x86_64"
            php-version: "8.5"
            ts: "zts"
            runs-on: "ubuntu-latest"
            container: "ghcr.io/phpstan/turbo-build:gnu-php8.5-zts"
          - target: "linux-gnu-arm64"
            php-version: "8.5"
            ts: "zts"
            runs-on: "ubuntu-24.04-arm"
            container: "ghcr.io/phpstan/turbo-build:gnu-php8.5-zts"
          - target: "linux-gnu-x86_64"
            php-version: "8.6"
            ts: "zts"
            runs-on: "ubuntu-latest"
            container: "ghcr.io/phpstan/turbo-build:gnu-php8.6-zts"
          - target: "linux-gnu-arm64"
            php-version: "8.6"
            ts: "zts"
            runs-on: "ubuntu-24.04-arm"
            container: "ghcr.io/phpstan/turbo-build:gnu-php8.6-zts"

    steps:
      - name: Harden the runner (Audit all outbound calls)
        if: ${{ !matrix.container }}
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0 # the autoloader dump generates the expected turbo version from git log over turbo-ext/src

      - name: "Install PHP"
        if: ${{ !matrix.container }}
        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
        env:
          phpts: "${{ matrix.ts == 'zts' && 'ts' || 'nts' }}"
        with:
          coverage: "none"
          php-version: "${{ matrix.php-version }}"

      - name: "Install the PHP prerelease runtime"
        if: matrix.target == 'windows-x86_64' && fromJSON(needs.php-windows-prereleases.outputs.prereleases)[matrix.php-version]
        env:
          MATRIX_TS: ${{ matrix.ts }}
          PHP_PRERELEASE: ${{ toJSON(fromJSON(needs.php-windows-prereleases.outputs.prereleases)[matrix.php-version]) }}
        run: bash .github/scripts/install-php-windows-prerelease.sh

      - uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0
        if: ${{ !matrix.container }}
        with:
          ignore-cache: true

      # the autoloader dump reads the expected turbo version from git
      - name: "Trust the checkout despite the container/host uid mismatch"
        if: ${{ matrix.container }}
        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

      - name: "Install Composer dependencies (verified composer)"
        if: ${{ matrix.container }}
        run: |
          sh .github/scripts/download-composer.sh
          php composer.phar install --no-interaction --no-progress
          rm composer.phar

      - name: "Download extension artifact"
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: ${{ env.TURBO_ARTIFACT }}
          path: "turbo-ext"

      # The tests' child processes locate the extension through TURBO_DLL
      # too; its default, turbo-ext/phpstan_turbo.so, misses the DLL.
      - name: "Locate the extension"
        run: |
          FILE="$(find turbo-ext -maxdepth 1 \( -name phpstan_turbo.so -o -name php_phpstan_turbo.dll \) | head -1)"
          [ -n "$FILE" ]
          EXT="$PWD/$FILE"
          if command -v cygpath > /dev/null; then
            EXT="$(cygpath -w "$EXT")"
          fi
          echo "TURBO_DLL=$EXT" >> "$GITHUB_ENV"

      - name: "Verify the extension reports the expected version"
        env:
          MATRIX_TS: ${{ matrix.ts }}
        run: |
          REPORTED="$(php -d extension="$TURBO_DLL" -r 'echo phpversion("phpstan_turbo");')"
          EXPECTED="$(php build/turbo-extension-version.php)"
          echo "extension reports: $REPORTED, enabler expects: $EXPECTED"
          [ "$REPORTED" = "$EXPECTED" ]
          # the loader rejects a ts-mismatched binary, so php loading it above
          # proves the binary matches the interpreter; assert the interpreter
          # itself so both sides cannot silently be NTS on the zts legs
          WANT_ZTS=$([ "$MATRIX_TS" = "zts" ] && echo 1 || echo 0)
          [ "$(php -r 'echo (int) ((bool) PHP_ZTS);')" = "$WANT_ZTS" ]

      - name: "Smoke test (differential: native vs PHP implementations)"
        run: php -d extension="$TURBO_DLL" turbo-ext/tests/smoke.php

      # One NodeScopeResolver walk over the default corpus with the native
      # classes and one with the PHP implementations, in separate processes;
      # the traces must be identical. It compares the engine ports as the
      # engine runs them (native calling native under the real class names),
      # which the prefixed single-process harnesses in smoke.php cannot. One
      # leg is enough: it checks engine behaviour, not the platform.
      - name: "Walk trace (differential: whole NodeScopeResolver walks, native vs PHP)"
        if: matrix.target == 'linux-gnu-x86_64' && matrix.php-version == '8.5'
        run: php -d extension="$TURBO_DLL" turbo-ext/tests/walk-trace.php --shards="$(nproc)"

      - name: "Arena smoke test (cross-process shared-memory records)"
        run: php -d extension="$TURBO_DLL" turbo-ext/tests/arena-smoke.php

      - name: "Forked-worker exit (exitImmediately() ends a child whose teardown would wedge)"
        run: php -d extension="$TURBO_DLL" turbo-ext/tests/exit-immediately.php

      - name: "Trusted types (the optimizer pass drops type checks under the prefix only)"
        run: php -d extension="$TURBO_DLL" -d opcache.enable_cli=1 turbo-ext/tests/trusted-types.php

      - name: "Signature parity (reflect native classes against the PHP twins)"
        run: php -d extension="$TURBO_DLL" turbo-ext/tests/signature-parity.php

      - name: "Parser corpus (differential: native vs PHP ASTs must be byte-identical)"
        run: php -d extension="$TURBO_DLL" -d memory_limit=4G turbo-ext/tests/parser-corpus.php

      - name: "Parser upstream corpus (the same differential over php-parser's own test cases)"
        if: matrix.target != 'windows-x86_64'
        run: php -d extension="$TURBO_DLL" turbo-ext/tests/parser-upstream-corpus.php

  turbo-differential-musl:
    name: "Run with Turbo Extension (differential tests, musl)"
    # turbo-differential for the musl binaries, in the Alpine environment
    # they are built in. The commands run through docker exec for the reason
    # turbo-compile-musl-arm64 gives, on both architectures alike.
    needs:
      - turbo-compile
      - turbo-compile-musl-arm64
    runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
    timeout-minutes: 30

    env:
      PHP_MINOR: ${{ matrix.php-version }}
      PHP_ZTS: ${{ matrix.ts == 'zts' && '1' || '0' }}
      TURBO_ARTIFACT: "phpstan_turbo-linux-musl-${{ matrix.arch }}-php${{ matrix.php-version }}${{ matrix.ts == 'zts' && '-zts' || '' }}"

    strategy:
      fail-fast: false
      matrix:
        arch: ["x86_64", "arm64"]
        php-version: ["8.2", "8.3", "8.4", "8.5", "8.6"]
        # thread-safe for every minor too, see turbo-compile
        ts: ["nts", "zts"]

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0 # the autoloader dump generates the expected turbo version from git log over turbo-ext/src

      # The same container, packages and composer as turbo-compile-musl-arm64.
      - name: "Start the Alpine container"
        env:
          ALPINE_IMAGE: ${{ matrix.php-version == '8.6' && matrix.ts == 'nts' && 'alpine:edge' || 'alpine:3.24' }}
        run: |
          docker run -d --name alpine-test \
            -v "$PWD:/work" -w /work \
            -e PHP_MINOR -e PHP_ZTS -e PHP_CACHE_DIR=/work/alpine-php-cache \
            "$ALPINE_IMAGE" sleep 7200

      # see turbo-compile
      - name: "Resolve the PHP build to cache"
        id: alpine-php
        run: docker exec alpine-test sh .github/scripts/install-alpine-php.sh --resolve >> "$GITHUB_OUTPUT"

      - name: "Restore the PHP build"
        if: steps.alpine-php.outputs.release != ''
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: "alpine-php-cache"
          key: "alpine-php-${{ steps.alpine-php.outputs.release }}-${{ hashFiles('.github/turbo-build/build-php.sh') }}"

      - name: "Install PHP and tools"
        run: docker exec alpine-test sh .github/scripts/install-alpine-php.sh

      - name: "Trust the checkout despite the container/host uid mismatch"
        run: docker exec alpine-test git config --global --add safe.directory /work

      - name: "Install Composer dependencies (verified composer)"
        run: |
          docker exec -i alpine-test sh -e <<'EOF'
          sh .github/scripts/download-composer.sh
          COMPOSER_HOME="$(mktemp -d)" php composer.phar install --no-interaction --no-progress
          rm composer.phar
          EOF

      - name: "Download extension artifact"
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: ${{ env.TURBO_ARTIFACT }}
          path: "turbo-ext"

      - name: "Verify the extension reports the expected version"
        run: |
          docker exec -i alpine-test sh -e <<'EOF'
          REPORTED="$(php -d extension=/work/turbo-ext/phpstan_turbo.so -r 'echo phpversion("phpstan_turbo");')"
          EXPECTED="$(php build/turbo-extension-version.php)"
          echo "extension reports: $REPORTED, enabler expects: $EXPECTED"
          [ "$REPORTED" = "$EXPECTED" ]
          [ "$(php -r 'echo (int) ((bool) PHP_ZTS);')" = "$PHP_ZTS" ]
          EOF

      - name: "Smoke test (differential: native vs PHP implementations)"
        run: docker exec alpine-test php -d extension=/work/turbo-ext/phpstan_turbo.so turbo-ext/tests/smoke.php

      - name: "Arena smoke test (cross-process shared-memory records)"
        run: docker exec alpine-test php -d extension=/work/turbo-ext/phpstan_turbo.so turbo-ext/tests/arena-smoke.php

      - name: "Forked-worker exit (exitImmediately() ends a child whose teardown would wedge)"
        run: docker exec alpine-test php -d extension=/work/turbo-ext/phpstan_turbo.so turbo-ext/tests/exit-immediately.php

      - name: "Trusted types (the optimizer pass drops type checks under the prefix only)"
        run: docker exec alpine-test php -d extension=/work/turbo-ext/phpstan_turbo.so -d opcache.enable_cli=1 turbo-ext/tests/trusted-types.php

      - name: "Signature parity (reflect native classes against the PHP twins)"
        run: docker exec alpine-test php -d extension=/work/turbo-ext/phpstan_turbo.so turbo-ext/tests/signature-parity.php

      - name: "Parser corpus (differential: native vs PHP ASTs must be byte-identical)"
        run: docker exec alpine-test php -d extension=/work/turbo-ext/phpstan_turbo.so -d memory_limit=4G turbo-ext/tests/parser-corpus.php

      - name: "Parser upstream corpus (the same differential over php-parser's own test cases)"
        if: matrix.arch == 'x86_64'
        run: docker exec alpine-test php -d extension=/work/turbo-ext/phpstan_turbo.so turbo-ext/tests/parser-upstream-corpus.php

  turbo-run:
    name: "Run with Turbo Extension"
    needs:
      - php-windows-prereleases
      - turbo-compile
      - turbo-compile-windows
    runs-on: ${{ matrix.operating-system }}
    timeout-minutes: 60

    defaults:
      run:
        shell: bash

    strategy:
      fail-fast: false
      # windows-latest only runs the DLL, it cannot build it: the DLL is
      # linked with the 14.4x toolset on windows-2022, and the loader's
      # linker-generation gate is one-directional (module <= core), so the
      # vs17-built official PHP loads it fine.
      matrix:
        operating-system: ["ubuntu-latest", "windows-latest"]
        php-version: ["8.2", "8.3", "8.4", "8.5", "8.6"]
        ts: ["nts", "zts"]
        script: ["make tests", "make phpstan"]
        # The Linux ZTS binaries run the same checks in turbo-docker-run, in
        # the official thread-safe images, instead of under setup-php.
        exclude:
          - operating-system: "ubuntu-latest"
            ts: "zts"
          # setup-php's Linux 8.6 is a nightly snapshot that can predate the
          # release the binary is compiled against (on 2026-09-25 it still
          # had the module API 8.6.0RC2 replaced), and a module API mismatch
          # refuses to load the extension at all. turbo-docker-run runs the
          # same checks with this binary in the official 8.6 prerelease image.
          - operating-system: "ubuntu-latest"
            php-version: "8.6"
        # macOS runs the shipped ad-hoc-signed arm64 binary; there is no
        # macOS zts build, and 8.3/8.4 coverage comes from the other legs.
        include:
          - operating-system: "macos-latest"
            php-version: "8.5"
            ts: "nts"
            script: "make tests"
          - operating-system: "macos-latest"
            php-version: "8.5"
            ts: "nts"
            script: "make phpstan"
          - operating-system: "macos-latest"
            php-version: "8.6"
            ts: "nts"
            script: "make tests"
          - operating-system: "macos-latest"
            php-version: "8.6"
            ts: "nts"
            script: "make phpstan"

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0 # the autoloader dump generates the expected turbo version from git log over turbo-ext/src

      - name: "Install PHP"
        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
        env:
          phpts: "${{ matrix.ts == 'zts' && 'ts' || 'nts' }}"
        with:
          coverage: "none"
          php-version: "${{ matrix.php-version }}"

      - name: "Install the PHP prerelease runtime"
        if: matrix.operating-system == 'windows-latest' && fromJSON(needs.php-windows-prereleases.outputs.prereleases)[matrix.php-version]
        env:
          MATRIX_TS: ${{ matrix.ts }}
          PHP_PRERELEASE: ${{ toJSON(fromJSON(needs.php-windows-prereleases.outputs.prereleases)[matrix.php-version]) }}
        run: bash .github/scripts/install-php-windows-prerelease.sh

      - name: "Download extension artifact"
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: "phpstan_turbo-${{ matrix.operating-system == 'windows-latest' && 'windows-x86_64' || matrix.operating-system == 'macos-latest' && 'macos-arm64' || 'linux-gnu-x86_64' }}-php${{ matrix.php-version }}${{ matrix.ts == 'zts' && '-zts' || '' }}"
          path: "turbo-ext"

      - name: "Install extension"
        # The ini line needs a native path and the redirection a POSIX one,
        # hence the cygpath round-trip on Windows; setup-php's Linux ini is
        # root-owned, hence the sudo fallback.
        run: |
          FILE="$(find turbo-ext -maxdepth 1 \( -name phpstan_turbo.so -o -name php_phpstan_turbo.dll \) | head -1)"
          [ -n "$FILE" ]
          EXT="$PWD/$FILE"
          INI="$(php -r 'echo php_ini_loaded_file();')"
          if command -v cygpath > /dev/null; then
            EXT="$(cygpath -w "$EXT")"
            INI="$(cygpath -u "$INI")"
          fi
          if [ -w "$INI" ]; then
            echo "extension=$EXT" >> "$INI"
          else
            sudo bash -c "echo 'extension=$EXT' >> '$INI'"
          fi
          php -m | grep phpstan_turbo

      - uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0
        with:
          ignore-cache: true

      - name: "Verify the extension is active"
        run: |
          php -r '
            require "vendor/autoload.php";
            PHPStan\Turbo\TurboExtensionEnabler::activateIfCompatible();
            if (!PHPStan\Turbo\TurboExtensionEnabler::isActive() || !(new ReflectionMethod("PHPStan\\Analyser\\ScopeOps", "nodeKey"))->isInternal()) {
              fwrite(STDERR, "turbo extension is not shadowing ScopeOps" . PHP_EOL);
              exit(1);
            }
          '

      - name: "Run"
        # The Windows runner image ships GNU make only inside its MSYS2
        # install, which is not on PATH.
        env:
          SCRIPT: ${{ matrix.script }}
        run: |
          if ! command -v make > /dev/null && [ -e /c/msys64/usr/bin/make.exe ]; then
            export PATH="$PATH:/c/msys64/usr/bin"
          fi
          eval "$SCRIPT"

  phar-run:
    name: "Run PHAR on PHP ${{ matrix.php-version }}"
    needs: compiler-tests
    runs-on: "ubuntu-latest"
    timeout-minutes: 20

    strategy:
      fail-fast: false
      matrix:
        php-version: ["7.4", "8.0", "8.1", "8.2", "8.3", "8.4", "8.5", "8.6"]

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: "Install PHP"
        # Deliberately without `ini-file: development`: that ini lists the
        # pcntl functions in disable_functions, and RestartManager then never
        # asks TurboExtensionSelector for the binary. With pcntl available
        # the phar boots through the turbo restart code, which bin/phpstan
        # loads before the Composer autoloader - on PHP < 8.0 without the
        # symfony polyfills (https://github.com/phpstan/phpstan/issues/15137).
        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
        with:
          coverage: "none"
          php-version: "${{ matrix.php-version }}"

      - name: "Download PHAR"
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: phar-file
          path: tmp

      - name: "Verify the turbo restart path is reachable"
        run: |
          php -r 'exit(function_exists("pcntl_exec") && function_exists("pcntl_fork") ? 0 : 1);'

      - name: "Run PHAR"
        # No turbo binary sits next to this phar (the turbo-* jobs cover
        # those), so ForkParallelChecker spawns the two workers phpstan.neon
        # asks for. At -vvv each reports what it runs with: the OPcache
        # setup its command line carries (see ProcessHelper) took effect.
        run: |
          php tmp/phpstan.phar --version
          cd e2e/phar-run
          php ../../tmp/phpstan.phar analyse -vvv 2>&1 | tee output.txt
          OPCACHE="$(php -r 'echo extension_loaded("Zend OPcache") ? "on" : "off";')"
          grep -F "Spawned worker 1/2 checked in: turbo off, OPcache $OPCACHE, trusted types off" output.txt
          grep -F "Spawned worker 2/2 checked in: turbo off, OPcache $OPCACHE, trusted types off" output.txt

      - name: "Reuse the result cache"
        # Control for the same step of phar-run-windows, see
        # https://github.com/phpstan/phpstan/issues/15152: a second run of the unchanged
        # project must restore the cache the first run wrote.
        run: |
          cd e2e/phar-run
          php ../../tmp/phpstan.phar analyse -vv 2>&1 | tee output-warm.txt
          grep -F "Result cache restored. 0 files will be reanalysed." output-warm.txt

  phar-run-windows:
    name: "Run PHAR on Windows, PHP ${{ matrix.php-version }}"
    needs:
      - compiler-tests
      - turbo-compile-windows
    runs-on: "windows-latest"
    timeout-minutes: 20

    defaults:
      run:
        shell: bash

    strategy:
      fail-fast: false
      matrix:
        include:
          # below TurboExtensionSelector::MINIMUM_PHP_VERSION_ID there is no
          # binary to find: the workers get the OPcache entries alone
          - php-version: "8.1"
            turbo: "off"
          - php-version: "8.5"
            turbo: "on"

    steps:
      - name: "Checkout"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: "Install PHP"
        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
        with:
          coverage: "none"
          php-version: "${{ matrix.php-version }}"
          extensions: "opcache"

      - name: "Download PHAR"
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: phar-file
          path: tmp

      - name: "Download extension artifact"
        if: matrix.turbo == 'on'
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: "phpstan_turbo-windows-x86_64-php${{ matrix.php-version }}"
          path: "tmp/turbo-artifact"

      - name: "Place the extension next to the PHAR"
        # the distribution layout TurboExtensionSelector looks for, see the
        # turbo-artifact job
        if: matrix.turbo == 'on'
        env:
          PHP_VERSION: ${{ matrix.php-version }}
        run: |
          mkdir -p tmp/turbo-ext/windows-x86_64
          cp tmp/turbo-artifact/php_phpstan_turbo.dll "tmp/turbo-ext/windows-x86_64/phpstan_turbo-$PHP_VERSION.dll"
          cp tmp/turbo-artifact/phpstan_turbo_core*.dll tmp/turbo-ext/windows-x86_64/

      - name: "Diagnose"
        # Without pcntl the main process cannot restart itself, so the
        # workers are spawned and their command line is where the extension
        # and OPcache come in - each worker with its own OPcache instance
        # (see ProcessHelper).
        env:
          TURBO: ${{ matrix.turbo }}
        run: |
          cd e2e/phar-run
          php ../../tmp/phpstan.phar diagnose --no-ansi 2>&1 | tee diagnose.txt
          grep -F "Mechanism:                 spawn (react/child-process)" diagnose.txt
          grep -F "opcache.enable_cli=1" diagnose.txt
          grep -E "opcache\.cache_id=phpstan-[0-9]+-1" diagnose.txt
          grep -F "phpstan.restarted=1" diagnose.txt
          if [ "$TURBO" = on ]; then
            grep -F "Turbo extension: enabled in worker processes" diagnose.txt
          else
            grep -F "Turbo extension: not loaded" diagnose.txt
          fi

      - name: "Run PHAR"
        env:
          TURBO: ${{ matrix.turbo }}
        run: |
          php tmp/phpstan.phar --version
          cd e2e/phar-run
          php ../../tmp/phpstan.phar analyse -vvv --no-ansi 2>&1 | tee output.txt
          grep -F "Spawned worker 1/2 checked in: turbo $TURBO, OPcache on, trusted types $TURBO" output.txt
          grep -F "Spawned worker 2/2 checked in: turbo $TURBO, OPcache on, trusted types $TURBO" output.txt

      - name: "Reuse the result cache"
        # https://github.com/phpstan/phpstan/issues/15152: since 2.2.9 a second run of an
        # unchanged project on Windows is reported to discard the cache with "metadata do not
        # match: ... executedFilesHashes" - the phar:// URLs of the runtime stubs registered as
        # bootstrapFiles. Every invocation form is tried and all of them are reported before
        # the step fails.
        run: |
          cd e2e/phar-run
          FAILED=0
          check() {
            if grep -qF "Result cache restored. 0 files will be reanalysed." "$1"; then
              echo "OK: $2"
            else
              echo "::error::$2: the result cache was not reused"
              grep -F "Result cache" "$1" || true
              FAILED=1
            fi
          }

          echo "::group::Second run through the relative path"
          php ../../tmp/phpstan.phar analyse -vv --no-ansi 2>&1 | tee output-relative.txt
          echo "::endgroup::"
          check output-relative.txt "relative invocation after the first run"

          # the invocation form the issue describes
          PHAR="$(cygpath -w "$GITHUB_WORKSPACE/tmp/phpstan.phar")"
          echo "::group::Runs through the absolute path $PHAR"
          php "$PHAR" analyse -vv --no-ansi 2>&1 | tee output-absolute-1.txt
          php "$PHAR" analyse -vv --no-ansi 2>&1 | tee output-absolute-2.txt
          echo "::endgroup::"
          check output-absolute-1.txt "absolute invocation after the relative ones"
          check output-absolute-2.txt "absolute invocation after an absolute one"

          # vendor/phpstan/phpstan/phpstan, the entry point of a Composer install, maps the
          # archive under its alias and requires bin/phpstan through it
          printf '%s\n' '<?php' "Phar::loadPhar(__DIR__ . '/phpstan.phar', 'phpstan.phar');" "require 'phar://phpstan.phar/bin/phpstan';" > ../../tmp/phpstan
          echo "::group::Runs through a Composer-style wrapper"
          php ../../tmp/phpstan analyse -vv --no-ansi 2>&1 | tee output-wrapper-1.txt
          php ../../tmp/phpstan analyse -vv --no-ansi 2>&1 | tee output-wrapper-2.txt
          echo "::endgroup::"
          check output-wrapper-1.txt "wrapper invocation after the direct ones"
          check output-wrapper-2.txt "wrapper invocation after a wrapper one"

          exit "$FAILED"

  integration-tests:
    if: github.event_name == 'pull_request'
    needs:
      - compiler-tests
      - turbo-artifact
    uses: phpstan/phpstan/.github/workflows/integration-tests.yml@2.3.x
    with:
      ref: 2.3.x
      phar-checksum: ${{needs.compiler-tests.outputs.checksum}}

  extension-tests:
    if: github.event_name == 'pull_request'
    needs:
      - compiler-tests
      - turbo-artifact
    uses: phpstan/phpstan/.github/workflows/extension-tests.yml@2.3.x
    with:
      ref: 2.3.x
      phar-checksum: ${{needs.compiler-tests.outputs.checksum}}

  other-tests:
    if: github.event_name == 'pull_request'
    needs:
      - compiler-tests
      - turbo-artifact
    uses: phpstan/phpstan/.github/workflows/other-tests.yml@2.3.x
    with:
      ref: 2.3.x
      phar-checksum: ${{needs.compiler-tests.outputs.checksum}}

  download-base-sha-phar:
    name: "Download base SHA PHAR"
    needs: compiler-tests
    if: github.event_name == 'pull_request' && needs.compiler-tests.outputs.compiler_changed == 'true'
    runs-on: "ubuntu-latest"
    permissions:
      contents: read # actions/checkout of this repository
      actions: read # find-artifact.js lists runs/artifacts; the by-ID cross-run download authenticates with the workflow token
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Get base commit SHA
        id: base
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: echo "base_sha=$BASE_SHA" >> "$GITHUB_OUTPUT"

      - name: Set up Node.js
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24
          package-manager-cache: false

      - name: Install dependencies
        working-directory: .github/scripts
        run: npm ci

      - name: "Compile TS scripts"
        working-directory: .github/scripts
        run: npx tsc

      - name: Find phar-file-checksum from base commit
        id: find-artifact
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          BASE_SHA: ${{ steps.base.outputs.base_sha }}
          ARTIFACT_NAME: phar-file-checksum
          WORKFLOW_NAME: Compile PHAR
        with:
          script: |
            const script = require('./.github/scripts/dist/find-artifact.js');
            await script({github, context, core})

      # saved to phar-file-checksum/phpstan.phar
      - name: Download old artifact by ID
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          artifact-ids: ${{ steps.find-artifact.outputs.artifact_id }}
          run-id: ${{ steps.find-artifact.outputs.run_id }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          # download-artifact v5+ extracts single by-ID downloads directly into
          # `path`, no longer nested under the artifact name; keep the old layout
          path: phar-file-checksum

      - name: "Upload old artifact"
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: phar-file-checksum-base
          path: phar-file-checksum/phpstan.phar

  checksum-phar:
    name: "Checksum PHAR"
    needs:
      - compiler-tests
      - download-base-sha-phar
    runs-on: "ubuntu-latest"
    steps:
      # saved to phpstan.phar
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      - name: "Download base phpstan.phar"
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: phar-file-checksum-base

      - name: "Save old checksum"
        id: "old_checksum"
        run: echo "md5=$(md5sum phpstan.phar | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"

      - name: "Assert checksum"
        env:
          OLD_CHECKSUM: ${{ steps.old_checksum.outputs.md5 }}
          NEW_CHECKSUM: ${{ needs.compiler-tests.outputs.checksum }}
        run: |
          [[ "$OLD_CHECKSUM" == "$NEW_CHECKSUM" ]];

  phar-prefix-diff:
    name: "PHAR Prefix Diff"
    needs: download-base-sha-phar
    runs-on: "ubuntu-latest"
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      # saved to phar-file-checksum/phpstan.phar
      - name: "Download phpstan.phar"
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: phar-file-checksum
          path: phar-file-checksum

      # saved to phar-file-checksum-base/phpstan.phar
      - name: "Download base phpstan.phar"
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: phar-file-checksum-base
          path: phar-file-checksum-base

      - name: "Install PHP"
        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
        with:
          coverage: "none"
          php-version: "8.2"

      - uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0
        with:
          ignore-cache: true

      - name: "Install Box dependencies"
        uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0
        with:
          working-directory: "compiler/box"
          ignore-cache: true

      - name: "Extract old phpstan.phar"
        run: "php compiler/box/vendor/bin/box extract phar-file-checksum-base/phpstan.phar phar-old"

      - name: "Extract new phpstan.phar"
        run: "php compiler/box/vendor/bin/box extract phar-file-checksum/phpstan.phar phar-new"

      - name: "List prefix locations in old PHAR"
        run: 'php .github/scripts/listPrefix.php "$GITHUB_WORKSPACE/phar-old" > phar-old.txt'

      - name: "List prefix locations in new PHAR"
        run: 'php .github/scripts/listPrefix.php "$GITHUB_WORKSPACE/phar-new" > phar-new.txt'

      - name: "Diff locations"
        run: "diff -u phar-old.txt phar-new.txt > diff.txt || true"

      - name: "Diff files where prefix changed"
        run: 'php .github/scripts/diffPrefixes.php "$GITHUB_WORKSPACE/diff.txt" "$GITHUB_WORKSPACE/phar-old" "$GITHUB_WORKSPACE/phar-new"'

  commit:
    name: "Commit PHAR"
    if: "github.repository_owner == 'phpstan' && (github.ref == 'refs/heads/2.3.x' || startsWith(github.ref, 'refs/tags/'))"
    # Gated on every job that produces the committed bits or checks them
    # against their sources: the compile jobs build the staged binaries (or
    # carry over ones compiled from identical build inputs, see
    # turbo-origins) and check the version they report; turbo-version
    # guards the parity of the native and PHP implementations. The jobs
    # that only test those bits are deliberately not gates: the
    # "Run with Turbo Extension" jobs (turbo-differential,
    # turbo-differential-musl, turbo-run, turbo-docker-run), the shared-core
    # gate (turbo-shared-core-gate, turbo-shared-core-gate-compare) and
    # turbo-phpize, whose build nothing ships (PIE
    # builds from the phpstan/turbo-ext subsplit). They produce nothing the
    # commit consumes, waiting for them would delay every dev phar by their
    # duration, and a red leg caused by environment drift (the floating
    # docker-library tags, the PHP 8.6 prerelease) would skip the commit and
    # halt phar publication while the binaries already in dist are equally
    # affected — nothing protective gained. They still fail the workflow
    # loudly for follow-up.
    needs:
      - compiler-tests
      - turbo-version
      - turbo-compile
      - turbo-compile-musl-arm64
      - turbo-compile-windows
    runs-on: "ubuntu-latest"
    timeout-minutes: 60
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
        with:
          egress-policy: audit

      -
        name: Import GPG key
        id: import-gpg
        uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
        with:
          gpg_private_key: ${{ secrets.GPG_PHPSTANBOT_PRIVATE_KEY }}
          passphrase: ${{ secrets.GPG_PHPSTANBOT_KEY_PASSPHRASE }}
          git_config_global: true
          git_user_signingkey: true
          git_commit_gpgsign: true

      - name: "Checkout phpstan-dist"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: phpstan/phpstan
          path: phpstan-dist
          token: ${{ secrets.PHPSTAN_BOT_TOKEN }}
          ref: 2.3.x
          # deliberately persisted: the push steps below authenticate with
          # this bot token
          persist-credentials: true

      - name: "Get previous pushed dist commit"
        id: previous-commit
        working-directory: phpstan-dist
        run: echo "sha=$(sed -n '2p' .phar-checksum)" >> "$GITHUB_OUTPUT"

      - name: "Checkout phpstan-src"
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0
          path: phpstan-src

      - name: "Get Git log"
        id: git-log
        working-directory: phpstan-src
        env:
          PREVIOUS_SHA: ${{ steps.previous-commit.outputs.sha }}
          AFTER_SHA: ${{ github.event.after }}
        run: |
          echo "log<<MESSAGE" >> "$GITHUB_OUTPUT"
          git log "$PREVIOUS_SHA".."$AFTER_SHA" --reverse --pretty='https://github.com/phpstan/phpstan-src/commit/%H %s' >> "$GITHUB_OUTPUT"
          echo 'MESSAGE' >> "$GITHUB_OUTPUT"

      - name: "Get short phpstan-src SHA"
        id: short-src-sha
        working-directory: phpstan-src
        run: echo "sha=$(git rev-parse --short=7 HEAD)" >> "$GITHUB_OUTPUT"

      - name: "Check PHAR checksum"
        id: checksum-difference
        working-directory: phpstan-dist
        env:
          CHECKSUM: ${{ needs.compiler-tests.outputs.checksum }}
        run: |
          checksum="$CHECKSUM"
          if [[ $(head -n 1 .phar-checksum) != "$checksum" ]]; then
            echo "result=different" >> "$GITHUB_OUTPUT"
          else
            echo "result=same" >> "$GITHUB_OUTPUT"
          fi

      - name: "Download turbo extension artifacts"
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: "phpstan_turbo-*"
          path: "turbo-artifacts"

      - name: "Check turbo extension version and binary set"
        id: turbo-difference
        run: |
          EXPECTED="$(php phpstan-src/build/turbo-extension-version.php)"
          CURRENT="$(cat phpstan-dist/turbo-ext/.version 2>/dev/null || echo none)"
          echo "enabler expects: $EXPECTED, dist carries: $CURRENT"
          RESULT=same
          VERSION_CHANGED=no
          if [[ "$EXPECTED" != "$CURRENT" ]]; then
            RESULT=different
            VERSION_CHANGED=yes
          fi
          # A new compile-matrix leg (new PHP minor or platform) produces
          # binaries the dist does not carry even though the extension
          # version is unchanged. The layout script maps each artifact file
          # to its dist path (extensions and the platforms' cores).
          bash phpstan-src/.github/scripts/turbo-dist-layout.sh turbo-artifacts > turbo-layout.tsv
          while IFS=$'\t' read -r _ dest; do
            if [[ ! -f "phpstan-dist/turbo-ext/$dest" ]]; then
              echo "missing from dist: phpstan-dist/turbo-ext/$dest"
              RESULT=different
            fi
          done < turbo-layout.tsv
          # A retired binary still in the dist needs a commit deleting it,
          # even at an unchanged extension version.
          for pattern in $TURBO_RETIRED_BINARIES; do
            for retired in phpstan-dist/turbo-ext/$pattern; do
              if [[ -f "$retired" ]]; then
                echo "retired, to be deleted from dist: $retired"
                RESULT=different
              fi
            done
          done
          echo "result=$RESULT" >> "$GITHUB_OUTPUT"
          echo "version-changed=$VERSION_CHANGED" >> "$GITHUB_OUTPUT"
          echo "version=$EXPECTED" >> "$GITHUB_OUTPUT"

      # The phar is staged only when its checksum changed (or on tags, which
      # always produce a commit) — a turbo-only update must not churn the
      # byte-unstable phar; existing turbo binaries are overwritten only when
      # the extension version changed, since native builds are never
      # byte-reproducible (signing timestamps, Mach-O UUIDs). Binaries the
      # dist does not carry at all are staged even at an unchanged version.
      - name: "Download phpstan.phar"
        if: startsWith(github.ref, 'refs/tags/') || steps.checksum-difference.outputs.result == 'different'
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: phar-file

      - name: "mv PHAR"
        if: startsWith(github.ref, 'refs/tags/') || steps.checksum-difference.outputs.result == 'different'
        run: mv phpstan.phar phpstan-dist/phpstan.phar

      - name: "chmod PHAR"
        if: startsWith(github.ref, 'refs/tags/') || steps.checksum-difference.outputs.result == 'different'
        run: chmod 755 phpstan-dist/phpstan.phar

      - name: "Update checksum"
        if: startsWith(github.ref, 'refs/tags/') || steps.checksum-difference.outputs.result == 'different'
        env:
          CHECKSUM: ${{ needs.compiler-tests.outputs.checksum }}
          HEAD_COMMIT_ID: ${{ github.event.head_commit.id }}
        run: |
          echo "$CHECKSUM" > phpstan-dist/.phar-checksum
          echo "$HEAD_COMMIT_ID" >> phpstan-dist/.phar-checksum

      - name: "Sign PHAR"
        if: startsWith(github.ref, 'refs/tags/') || steps.checksum-difference.outputs.result == 'different'
        working-directory: phpstan-dist
        run: rm phpstan.phar.asc && gpg --command-fd 0 --pinentry-mode loopback -u "$GPG_ID" --batch --detach-sign --armor --output phpstan.phar.asc phpstan.phar
        env:
          GPG_ID: ${{ steps.import-gpg.outputs.fingerprint }}

      - name: "Verify PHAR"
        if: startsWith(github.ref, 'refs/tags/') || steps.checksum-difference.outputs.result == 'different'
        working-directory: phpstan-dist
        run: "gpg --verify phpstan.phar.asc"

      - name: "Stage turbo extension binaries"
        if: steps.turbo-difference.outputs.result == 'different'
        env:
          TURBO_VERSION: ${{ steps.turbo-difference.outputs.version }}
          VERSION_CHANGED: ${{ steps.turbo-difference.outputs.version-changed }}
        run: |
          # Retired targets go first: they have no replacement by design, and
          # a stale one must not keep shipping (`git add .` stages the deletion).
          for pattern in $TURBO_RETIRED_BINARIES; do
            for retired in phpstan-dist/turbo-ext/$pattern; do
              if [[ -f "$retired" ]]; then
                echo "deleting retired binary: $retired"
                rm -f "$retired"
              fi
            done
          done
          # A version bump must refresh EVERY binary the dist carries: staging a
          # partial artifact set and bumping .version anyway would leave the
          # missing platforms on a stale extension the new phar refuses to
          # activate - permanently, because later runs compare .version and see
          # "same". Fail loudly instead of committing a torn set.
          if [[ "$VERSION_CHANGED" == "yes" ]]; then
            MISSING=""
            if ! ls turbo-artifacts/phpstan_turbo-* >/dev/null 2>&1; then
              echo "::error::no turbo extension artifacts were downloaded"
              MISSING=yes
            fi
            # every binary the dist carries — extensions and cores alike —
            # needs a freshly built replacement in the layout
            for dist_file in phpstan-dist/turbo-ext/*/phpstan_turbo*; do
              [ -f "$dist_file" ] || continue
              rel="${dist_file#phpstan-dist/turbo-ext/}"
              if ! cut -f2 turbo-layout.tsv | grep -qxF "$rel"; then
                echo "::error::$dist_file has no freshly built replacement in the downloaded artifacts - refusing to bump turbo-ext/.version over a stale binary."
                MISSING=yes
              fi
            done
            if [[ -n "$MISSING" ]]; then
              exit 1
            fi
          fi
          while IFS=$'\t' read -r file rel; do
            dest="phpstan-dist/turbo-ext/$rel"
            if [[ "$VERSION_CHANGED" == "yes" || ! -f "$dest" ]]; then
              install -D -m 644 "$file" "$dest"
            fi
          done < turbo-layout.tsv
          echo "$TURBO_VERSION" > phpstan-dist/turbo-ext/.version

      - name: "Install lucky_commit"
        uses: baptiste0928/cargo-install@8195d4f734a149db85385bb4102b42efcd373759 # v3.5.0
        with:
          crate: lucky_commit
          args: --no-default-features

      - name: "Commit PHAR - development"
        if: "!startsWith(github.ref, 'refs/tags/') && (steps.checksum-difference.outputs.result == 'different' || steps.turbo-difference.outputs.result == 'different')"
        working-directory: phpstan-dist
        env:
          INPUT_LOG: ${{ steps.git-log.outputs.log }}
          AFTER_SHA: ${{ github.event.after }}
          SHORT_SRC_SHA: ${{ steps.short-src-sha.outputs.sha }}
        run: |
          git config --global user.name "phpstan-bot"
          git config --global user.email "ondrej+phpstanbot@mirtes.cz"
          git add .
          git commit --gpg-sign -m "Updated PHPStan to commit $AFTER_SHA" -m "$INPUT_LOG" --author "phpstan-bot <ondrej+phpstanbot@mirtes.cz>"
          lucky_commit "$SHORT_SRC_SHA"
          git push

      - name: "Commit PHAR - tag"
        if: "startsWith(github.ref, 'refs/tags/')"
        uses: stefanzweifel/git-auto-commit-action@d0b01107b5db882071f96de5dd4b54961ea93f4c # v7.2.1
        with:
          commit_user_name: "phpstan-bot"
          commit_user_email: "ondrej+phpstanbot@mirtes.cz"
          commit_author: "phpstan-bot <ondrej+phpstanbot@mirtes.cz>"
          commit_options: "--gpg-sign"
          repository: phpstan-dist
          commit_message: "PHPStan ${{github.ref_name}}"
          tagging_message: ${{github.ref_name}}