[AshGodfrey]

Why

The PHP test workflow runs setup-php with php-version: "8.3". When the requested minor version is preinstalled on the runner image, setup-php switches to that build instead of installing the newest patch, so CI kept running whatever 8.3.x the runner image was built with until the image was rebuilt. PHP security releases should reach CI on the next run, not on the next image refresh.

What changed

• .github/workflows/test-php.yml: set update: true on the setup-php step so it installs the latest 8.3 patch release on every run.

No generator or template changes; no generated output changes.

Testing

• git diff --check is clean.
• Verified against the setup-php README: preinstalled versions are not updated to their latest patch unless update is set.
• Not run locally: the workflow itself. The PHP test jobs on this PR exercise the change.

Public-safety check

• This change contains no credentials, customer documents, private repository URLs, private filesystem paths, or unredacted private logs.
• Title, body, comments, and commit messages name no customers or customer-derived identifiers, private paths or trackers, or workflow provenance, and are understandable without private context (.claude/skills/public-repo-communication/SKILL.md).
• Generated fixtures and review SDK changes are public-safe.
• I reviewed git diff --check.

---

Summary by cubic

Ensures CI installs the latest PHP 8.3 patch release every run by setting update: true on the setup-php step, so security fixes reach CI immediately instead of waiting for a runner image rebuild. The flag is passed as an environment variable since setup-php reads update from the environment rather than its inputs.

^{Written for commit 16b339f. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would auto-approve. Sets update: true on the setup-php step in the PHP CI workflow so each run installs the latest PHP 8.3 patch, ensuring security fixes are tested promptly instead of waiting for a runner image rebuild. This is a bounded one-line change to development-only CI configuration.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would auto-approve. Moves the setup-php update: true flag into an env var in the PHP CI workflow so each run installs the latest PHP 8.3 patch, since setup-php reads update from the environment. This is a bounded, development-only CI configuration change with no runtime or product impact.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[bflad]

Weird way to do it but confirmed in their docs 👍