Build Linux ZTS turbo binaries for PHP 8.3-8.5 too

.github/scripts/install-alpine-php.sh

@@ -9,7 +9,7 @@ set -eu
 apk add --no-cache bash curl git make g++ musl-dev linux-headers patch tar zstd
 
 if [ "${PHP_ZTS:-0}" = "1" ]; then
-	apk add --no-cache pkgconf xz libxml2-dev oniguruma-dev curl-dev openssl-dev zlib-dev
+	apk add --no-cache jq pkgconf xz libxml2-dev oniguruma-dev curl-dev openssl-dev zlib-dev
 	PHP_MINOR="$PHP_MINOR" PHP_ZTS=1 sh "$(dirname "$0")/../turbo-build/build-php.sh"
 	exit 0
 fi

.github/turbo-build/Dockerfile

@@ -1,7 +1,7 @@
 # Prebuilt image for the turbo-compile gnu legs in phar.yml, published to
 # ghcr.io/phpstan/turbo-build by turbo-build-image.yml (tags gnu-php8.3,
-# gnu-php8.4, gnu-php8.5, gnu-php8.6, gnu-php8.6-zts; each a linux/amd64 +
-# linux/arm64 manifest).
+# gnu-php8.4, gnu-php8.5, gnu-php8.6 and the thread-safe gnu-php8.3-zts to
+# gnu-php8.6-zts; each a linux/amd64 + linux/arm64 manifest).
 #
 # Baking the PHP toolchain in keeps apt and the ondrej/php PPA out of the
 # compile jobs entirely: ports.ubuntu.com (the only Ubuntu arm64 mirror,
@@ -18,8 +18,9 @@ ARG PHP_MINOR
 ARG PHP_ZTS=0
 ENV DEBIAN_FRONTEND=noninteractive
 
-# These images build PHP from the official release tarball pinned in
-# build-php.sh instead of installing it from ondrej/php:
+# These images build PHP from the newest official tarball of the minor
+# (build-php.sh resolves it from php.net) instead of installing it from
+# ondrej/php:
 # - PHP 8.6 is a prerelease, and ondrej/php trails its tags by weeks: on
 #   2026-09-25 it still served 8.6.0beta3, whose module API (20250926) the
 #   8.6.0RC2 that the php:8.6-rc images ship had already replaced
@@ -50,7 +51,7 @@ RUN test -n "$PHP_MINOR"; \
 	}; \
 	apt_install software-properties-common gnupg ca-certificates curl git make g++ patch unzip zstd \
 	&& if [ "$PHP_MINOR" = "8.6" ] || [ "$PHP_ZTS" = "1" ]; then \
-		apt_install pkg-config xz-utils libxml2-dev libonig-dev libcurl4-openssl-dev libssl-dev zlib1g-dev \
+		apt_install jq pkg-config xz-utils libxml2-dev libonig-dev libcurl4-openssl-dev libssl-dev zlib1g-dev \
 		&& PHP_MINOR="$PHP_MINOR" PHP_ZTS="$PHP_ZTS" sh /tmp/build-php.sh; \
 	else \
 		add-apt-repository -y ppa:ondrej/php \

.github/turbo-build/build-php.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
-# Builds and installs PHP $PHP_MINOR into /usr/local from the official
-# release tarball pinned below, thread-safe when $PHP_ZTS is 1. Used by the
+# Builds and installs the newest release of PHP $PHP_MINOR into /usr/local
+# from the official tarball, thread-safe when $PHP_ZTS is 1. Used by the
 # Dockerfile for the PHP builds ondrej/php does not ship (prerelease
 # minors, and every thread-safe build), and by the musl ZTS legs in
 # phar.yml, which run it in Alpine — Alpine packages no thread-safe PHP.
@@ -11,19 +11,39 @@
 # and curl, mbstring, openssl, xml and zlib for Composer.
 set -eu
 
-# The tarball for each minor this script builds; one pin shared by the
-# glibc image and the musl legs, so both build the same release.
-case "$PHP_MINOR" in
-	8.6)
-		PHP_VERSION=8.6.0RC2
-		PHP_URL=https://downloads.php.net/~mbeccati/php-8.6.0RC2.tar.xz
-		PHP_SHA256=ef3fba21c311e9bbace0e2102702446d322c275b8a10e6b33b28f2561299671c
-		;;
+# The release is resolved from php.net at build time, so the weekly image
+# rebuild and every musl leg pick up a new patch release (or the next
+# release candidate of a prerelease minor) without a change here: an
+# extension built against one patch release loads into every other of the
+# minor. The sha256 published next to the tarball guards the download. A
+# minor without a stable release yet is not in the releases API; its
+# current release candidate is in the pre-release one, under <minor>.0.
+php_net() {
+	curl -fsSL --retry 3 "$1"
+}
+RELEASE_JSON="$(php_net "https://www.php.net/releases/index.php?json&version=$PHP_MINOR")"
+PHP_VERSION="$(printf '%s' "$RELEASE_JSON" | jq -r '.version // empty')"
+if [ -n "$PHP_VERSION" ]; then
+	PHP_URL="https://www.php.net/distributions/php-$PHP_VERSION.tar.xz"
+	PHP_SHA256="$(printf '%s' "$RELEASE_JSON" | jq -r --arg file "php-$PHP_VERSION.tar.xz" '.source[] | select(.filename == $file) | .sha256')"
+else
+	PRERELEASE_JSON="$(php_net "https://www.php.net/pre-release-builds.php?format=json" | jq --arg minor "$PHP_MINOR.0" '.[$minor].release // empty')"
+	PHP_VERSION="$(printf '%s' "$PRERELEASE_JSON" | jq -r '.version // empty')"
+	PHP_URL="$(printf '%s' "$PRERELEASE_JSON" | jq -r '.files.xz.path // empty')"
+	PHP_SHA256="$(printf '%s' "$PRERELEASE_JSON" | jq -r '.files.xz.sha256 // empty')"
+fi
+case "$PHP_VERSION" in
+	"$PHP_MINOR".*) ;;
 	*)
-		echo "build-php.sh: no tarball pinned for PHP $PHP_MINOR" >&2
+		echo "build-php.sh: php.net lists no release of PHP $PHP_MINOR (resolved \"$PHP_VERSION\")" >&2
 		exit 1
 		;;
 esac
+if [ -z "$PHP_URL" ] || [ -z "$PHP_SHA256" ]; then
+	echo "build-php.sh: php.net lists no tar.xz with a sha256 for PHP $PHP_VERSION" >&2
+	exit 1
+fi
+echo "build-php.sh: building PHP $PHP_VERSION from $PHP_URL"
 export PHP_VERSION
 PHP_ZTS="${PHP_ZTS:-0}"
 export PHP_ZTS