Unreleased php version is used

[aurimasrim]

Describe the bug We noticed today that our CI started to fail even though we haven't made any changes. We found that the CI step is trying to install PHP version 8.3.8 even though it has not been officially released yet. The tag is released but there's no package yet. I'm not even sure where it gets this version from.

Version

• [ ] I have checked releases, and the bug exists in the latest patch version of v1 or v2.
• [X] v2
• [ ] v1

Runners

• [X] GitHub Hosted
• [ ] Self Hosted

Operating systems Ubuntu 22.04.4 LTS

PHP versions PHP 8.3

To Reproduce

            -   name: Install PHP
                uses: shivammathur/setup-php@v2
                with:
                    coverage: none
                    ini-values: date.timezone=UTC
                    php-version: 8.3

Expected behavior Version 8.3.7 is installed

Screenshots/Logs

/usr/bin/bash /home/runner/work/_actions/shivammathur/setup-php/v2/src/scripts/run.sh
==> Setup PHP
✓ PHP Installed PHP 8.3.8

Additional context

PHP 8.3.8 introduced a bug / BC break https://github.com/php/php-src/issues/14480

Are you willing to submit a PR?

[xelaris]

We did some digging and found out that the problem seems to be in https://github.com/shivammathur/php-ubuntu. Thats where the 8.3.8 version seem to come from, unless use_package_cache is set to false. It's not the PPA per Default (in our configuration). The php_8.3-* builds (without patch level) in shivammathur/php-ubuntu contain version 8.3.8, instead of the latest officially released version 8.3.7. This might be due to cache.yml workflow not to consider 8.3 while cache-nightly.yml does, but I'm not sure.

Unfortunately, defining the patch level in php-version doesn't have an effect, because the version gets cut to the minor level silently. That's why it does not seem to be possible to convince the setup-php action to fetch a particular patch version. We found a hacky workaround by hard-coding the patch level version here: https://github.com/shivammathur/setup-php/commit/34c5646b2cfa9a5370b89c23d6697dc61f67830e. But shivammathur/php-ubuntu does not provide all patch levels anyway. Regarding 8.3.x, there are only 8.3.7 and 8.3.8 available currently. With the mentioned hard-coded version, we were able to get back to 8.3.7 and have our unit tests pass, but we are experiencing random segmentation faults in the php-fpm processes. That could be related to a (re-)build of the 8.3.7 builds on Monday.

Another option could be, to avoid the package cache (shivammathur/php-ubuntu), by defining env use_package_cache to false. Since 8.3 is still considered a nightly build (https://github.com/shivammathur/setup-php/blob/2.30.5/src/scripts/unix.sh#L7) though, it would reach out to https://github.com/shivammathur/php-builder/releases/tag/8.3, which contains 8.3.8 as well, rather than using the PPA to install php via a package.

To sum it up, it seems as 8.3 should not be treated as nightly anymore in this repo and in shivammathur/php-ubuntu.

I could open a PR with https://github.com/shivammathur/setup-php/commit/d3685fe0c9a0236ab5a2016a01e3f381a7acc9f4, but I not sure yet about the necessary changes to shivammathur/php-ubuntu.

[shivammathur]

Builds have been updated with the patch that fixed the bug. https://github.com/shivammathur/php-builder/commit/b45bda11f5ef1de4eac836709b2abab6f77c6e09

[shivammathur]

@spaze The patch was not applied correctly for PHP 8.3 in https://github.com/shivammathur/php-builder/commit/b45bda11f5ef1de4eac836709b2abab6f77c6e09

I have rebuilt it with correct patch in https://github.com/shivammathur/php-builder/commit/595dc3fc7a1f505a23c52bcdf3cf568b15602ade, so the bug in https://github.com/php/php-src/issues/14493 should not be there anymore.

[spaze]

Nice @shivammathur, thanks! I actually wanted to file the issue here, even had it first written here, and then decided it must be an upstream bug 😅

Can confirm it works now again 👍