Add thin PIE CLI extension installation helpers

Update Node.js dependencies

.github/ISSUE_TEMPLATE/bug.yml

@@ -88,7 +88,7 @@ body:
       label: "Are you willing to submit a PR?"
       description: "We accept pull requests targeting the develop branch."
       options:
-        - "Yes"
         - "No"
+        - "Yes"
     validations:
       required: true

.github/workflows/codeql.yml

@@ -26,13 +26,13 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
         with:
           config-file: ./.github/codeql/codeql-configuration.yml
           languages: javascript
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
+        uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4

.github/workflows/docs.yml

@@ -23,7 +23,7 @@ jobs:
         php-versions: ['5.3', '5.4', '5.5', '5.6', '7.0', '7.1', '7.2', '7.3', '7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5', '8.6', '8.7']
     steps:
       - name: Setup PHP
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2
         with:
           php-version: ${{ matrix.php-versions }}
           tools: none
@@ -42,7 +42,7 @@ jobs:
         run: |
           php -m | Out-File -FilePath "$env:file.all" -Append
       - name: Setup PHP
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2
         with:
           php-version: ${{ matrix.php-versions }}
           extensions: none
@@ -91,7 +91,7 @@ jobs:
           Remove-Item "$env:file.all" -Force
           Remove-Item "$env:file.builtin" -Force
       - name: Upload artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: lists-php${{ matrix.php-versions }}-${{ matrix.operating-system }}.md
           path: php${{ matrix.php-versions }}-${{ matrix.operating-system }}.md
@@ -109,7 +109,7 @@ jobs:
           repository: ${{ github.repository }}.wiki
           persist-credentials: false
       - name: Download artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           path: ${{ github.workspace }}/lists
           pattern: lists-*

.github/workflows/node.yml

@@ -39,7 +39,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node.js 24.x
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           node-version: 24.x
 

.github/workflows/php.yml

@@ -48,7 +48,7 @@ jobs:
 
       - name: Setup cache environment
         id: cache-env
-        uses: shivammathur/cache-extensions@de3c642a5fce0ef91581a1c9831e229f525196d6 # v1
+        uses: shivammathur/cache-extensions@d894929efeece5f8d386bd667369b321947064ad # v1
         with:
           php-version: ${{ matrix.php-versions || env.default-php-version }}
           extensions: ${{ env.extensions }}

.github/workflows/publish.yml

@@ -38,7 +38,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           node-version: '24.x'
           registry-url: https://registry.npmjs.org
@@ -60,7 +60,7 @@ jobs:
         run: npm publish --access public --tag "${{ steps.publish-tag.outputs.tag }}"
 
       - name: Change to GitHub Packages registry
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6
         with:
           registry-url: https://npm.pkg.github.com
           package-manager-cache: false

README.md

@@ -82,7 +82,6 @@ Both `GitHub-hosted` and `self-hosted` runners are supported by `setup-php` on t
 | macOS Golden Gate 27.x | arm64   | `xcode-27`                                                | -                 |
 | macOS Tahoe 26.x       | arm64   | `macos-latest` or `macos-26`                              | -                 |
 | macOS Sequoia 15.x     | arm64   | `macos-15`                                                | -                 |
-| macOS Sonoma 14.x      | arm64   | `macos-14`                                                | -                 |
 | macOS Tahoe 26.x       | x86_64  | `macos-26-intel`                                          | `PHP 8.5`         |
 | macOS Sequoia 15.x     | x86_64  | `macos-15-intel`                                          | `PHP 8.5`         |
 
@@ -112,8 +111,8 @@ Both `GitHub-hosted` and `self-hosted` runners are supported by `setup-php` on t
 
 On all supported OS/Platforms, the following PHP versions can be set up as per the runner.
 
-- PHP 5.3 to PHP 8.7 on GitHub-hosted runners, except for macOS ARM64 runners (macos-14).
-- PHP 5.6 to PHP 8.7 on GitHub-hosted macOS ARM64 runners (macos-14).
+- PHP 5.3 to PHP 8.7 on GitHub-hosted runners, except for macOS ARM64 runners.
+- PHP 5.6 to PHP 8.7 on GitHub-hosted macOS ARM64 runners.
 - PHP 5.6 to PHP 8.7 on self-hosted runners.
 
 | PHP Version | Stability | Release Support       | Runner Support                 |
@@ -175,6 +174,8 @@ PHP extensions can be set up using the `extensions` input. It accepts a `string`
 
 - Extensions with pre-release versions available on `PECL` can be set up by suffixing the extension's name with its state i.e `alpha`, `beta`, `devel` or `snapshot`.
 
+  This sets the minimum stability. The newest release with that stability or a more stable state is selected.
+
 ```yaml
 - name: Setup PHP with pre-release PECL extension
   uses: shivammathur/setup-php@v2

__tests__/config.test.ts

@@ -1,4 +1,4 @@
-import * as config from '../src/config';
+import * as config from '../src/config.js';
 
 describe('Config tests', () => {
   it.each`

__tests__/core.test.ts

@@ -1,4 +1,5 @@
-import * as core from '../src/core';
+import {jest} from '@jest/globals';
+import * as core from '../src/core.js';
 
 describe('Core tests', () => {
   const originalEnv = process.env;

__tests__/coverage.test.ts

@@ -1,4 +1,4 @@
-import * as coverage from '../src/coverage';
+import * as coverage from '../src/coverage.js';
 
 describe('Config tests', () => {
   it.each`

__tests__/extensions.test.ts

@@ -1,5 +1,5 @@
 import * as fs from 'fs';
-import * as extensions from '../src/extensions';
+import * as extensions from '../src/extensions.js';
 
 describe('Extension tests', () => {
   it.each`
@@ -7,6 +7,7 @@ describe('Extension tests', () => {
     ${'none'}                                    | ${'7.4'} | ${'Disable-AllShared'}
     ${':intl'}                                   | ${'7.4'} | ${'Disable-Extension intl'}
     ${'ast-beta'}                                | ${'7.4'} | ${'Add-Extension ast beta'}
+    ${'ast-stable'}                              | ${'7.4'} | ${'Add-Extension ast stable'}
     ${'blackfire'}                               | ${'7.3'} | ${'Add-Blackfire blackfire'}
     ${'blackfire-1.31.0'}                        | ${'7.3'} | ${'Add-Blackfire blackfire-1.31.0'}
     ${'grpc-1.2.3'}                              | ${'7.4'} | ${'Add-Extension grpc stable 1.2.3'}

__tests__/fetch.test.ts

@@ -1,6 +1,19 @@
-import * as fetch from '../src/fetch';
+import * as fetch from '../src/fetch.js';
 import nock from 'nock';
 
+beforeAll(() => nock.disableNetConnect());
+
+afterEach(() => {
+  const pending = nock.pendingMocks();
+  nock.cleanAll();
+  expect(pending).toEqual([]);
+});
+
+afterAll(() => {
+  nock.enableNetConnect();
+  nock.restore();
+});
+
 it('checking fetch', async () => {
   const host_url = 'https://example.com';
   const manifest_url = host_url + '/manifest';
@@ -9,9 +22,8 @@ it('checking fetch', async () => {
   nock(host_url)
     .get('/manifest')
     .reply(200, {latest: 'latest'})
-    .get('/manifest', '', {
-      reqheaders: {authorization: 'Bearer invalid_token'}
-    })
+    .get('/manifest')
+    .matchHeader('authorization', 'Bearer invalid_token')
     .reply(401, {error: '401: Unauthorized'})
     .get('/ping')
     .twice()
@@ -36,7 +48,7 @@ it('checking fetch', async () => {
   expect(response.data).toBe(undefined);
 
   response = await fetch.fetch(manifest_url, 'invalid_token');
-  expect(response.error).not.toBe(undefined);
+  expect(response.error).toBe('401: Unauthorized');
   expect(response.data).toBe(undefined);
 
   response = await fetch.fetch(host_url + '/error');

__tests__/install.test.ts

@@ -1,12 +1,11 @@
-import * as install from '../src/install';
-import * as utils from '../src/utils';
+import {jest} from '@jest/globals';
 
 /**
  * Mock install.ts
  */
-jest.mock('../src/install', () => ({
+jest.unstable_mockModule('../src/install.js', () => ({
   getScript: jest
-    .fn()
+    .fn<typeof import('../src/install.js').getScript>()
     .mockImplementation(async (os: string): Promise<string> => {
       const filename = os + (await utils.scriptExtension(os));
       const version: string = await utils.parseVersion(
@@ -36,7 +35,7 @@ jest.mock('../src/install', () => ({
 /**
  * Mock fetch.ts
  */
-jest.mock('../src/fetch', () => ({
+jest.unstable_mockModule('../src/fetch.js', () => ({
   fetch: jest.fn().mockImplementation(() => {
     return {
       data: '{ "latest": "8.3", "lowest": "8.1", "highest": "8.3", "nightly": "8.4", "5.x": "5.6" }'
@@ -44,6 +43,9 @@ jest.mock('../src/fetch', () => ({
   })
 }));
 
+const utils = await import('../src/utils.js');
+const install = await import('../src/install.js');
+
 describe('Install', () => {
   it.each`
     version      | os          | extension_csv | ini_file         | ini_values_csv | coverage_driver | tools        | output

__tests__/packagist.test.ts

@@ -1,6 +1,19 @@
-import * as packagist from '../src/packagist';
+import * as packagist from '../src/packagist.js';
 import nock from 'nock';
 
+beforeAll(() => nock.disableNetConnect());
+
+afterEach(() => {
+  const pending = nock.pendingMocks();
+  nock.cleanAll();
+  expect(pending).toEqual([]);
+});
+
+afterAll(() => {
+  nock.enableNetConnect();
+  nock.restore();
+});
+
 describe('search function', () => {
   const mockResponse = {
     packages: {

__tests__/tools.test.ts

@@ -1,6 +1,6 @@
-import * as fs from 'fs';
-import * as tools from '../src/tools';
-import {ToolData, ToolInput} from '../src/tools';
+import {jest} from '@jest/globals';
+import fs from 'fs';
+import type {ToolData, ToolInput} from '../src/tools.js';
 
 function getData(data: Partial<ToolData>): ToolData {
   const tool = data.tool || 'tool';
@@ -40,16 +40,12 @@ function unsetComposerAuthEnv(): void {
 /**
  * Mock fetch.ts
  */
-jest.mock('../src/fetch', () => ({
+jest.unstable_mockModule('../src/fetch.js', () => ({
   fetch: jest
-    .fn()
+    .fn<typeof import('../src/fetch.js').fetch>()
     .mockImplementation(
       async (url: string, token?: string): Promise<Record<string, string>> => {
-        if (url.includes('deployer')) {
-          return {
-            data: '[{"version": "1.2.3", "url": "https://deployer.org/releases/v1.2.3/deployer.phar"}]'
-          };
-        } else if (url.includes('atom') && !url.includes('no-')) {
+        if (url.includes('atom') && !url.includes('no-')) {
           return {
             data: '"releases/tag/1.2.3", "releases/tag/3.2.1", "releases/tag/2.3.1"'
           };
@@ -86,9 +82,9 @@ jest.mock('../src/fetch', () => ({
     )
 }));
 
-jest.mock('../src/packagist', () => ({
+jest.unstable_mockModule('../src/packagist.js', () => ({
   search: jest
-    .fn()
+    .fn<typeof import('../src/packagist.js').search>()
     .mockImplementation(
       async (
         package_name: string,
@@ -102,6 +98,10 @@ jest.mock('../src/packagist', () => ({
     )
 }));
 
+const tools = await import('../src/tools.js');
+
+afterEach(() => jest.restoreAllMocks());
+
 describe('Tools tests', () => {
   it.each`
     token                | version
@@ -381,6 +381,56 @@ describe('Tools tests', () => {
     }
   );
 
+  it.each`
+    release               | resolved
+    ${'phpstan'}          | ${'latest/download'}
+    ${'phpstan:0.12.68'}  | ${'download/0.12.68'}
+    ${'phpstan:^0.12.68'} | ${'download/0.12.68'}
+    ${'phpstan:0.12'}     | ${'download/1.2.3'}
+    ${'phpstan:0.12.x'}   | ${'download/1.2.3'}
+    ${'phpstan:0.12.*'}   | ${'download/1.2.3'}
+  `(
+    'resolving PHPStan PHAR fallback for $release',
+    async ({release, resolved}) => {
+      unsetComposerAuthEnv();
+      for (const os of ['linux', 'darwin', 'win32']) {
+        const data = await tools.getData(release, '8.0', os);
+        const script = await tools.addPackage(data);
+        expect(script).toContain(
+          'scoped https://github.com/phpstan/phpstan/releases/' +
+            resolved +
+            '/phpstan.phar "-V"'
+        );
+        expect(data.type).toBe('composer');
+        expect(data.release).toContain('phpstan');
+      }
+    }
+  );
+
+  it('keeps Composer available when the fallback version lookup fails', async () => {
+    process.env['GITHUB_TOKEN'] = 'invalid_token';
+    const data = await tools.getData('phpstan:0.12', '8.0', 'linux');
+    expect(await tools.addPackage(data)).toBe(
+      'add_composer_tool phpstan "phpstan:0.12.*" phpstan/ scoped'
+    );
+    unsetComposerAuthEnv();
+  });
+
+  it('uses fallback settings independently of the Composer repository', async () => {
+    const data = await tools.getData('vendor/tool:1.2.3', '8.0', 'linux', {
+      fallback: {
+        type: 'phar',
+        repository: 'releases/tool',
+        domain: 'https://example.com',
+        extension: '.phar',
+        version_prefix: 'v'
+      }
+    });
+    expect(await tools.addPackage(data)).toBe(
+      'add_composer_tool tool tool:1.2.3 vendor/ global https://example.com/releases/tool/v1.2.3/tool.phar ""'
+    );
+  });
+
   it.each`
     version     | php_version | os          | script
     ${'latest'} | ${'8.0'}    | ${'linux'}  | ${'add_tool https://github.com/phar-io/phive/releases/download/3.2.1/phive-3.2.1.phar phive'}
@@ -431,13 +481,15 @@ describe('Tools tests', () => {
 
   it.each`
     version     | url
-    ${'latest'} | ${'https://deployer.org/deployer.phar'}
-    ${'1.2.3'}  | ${'https://deployer.org/releases/v1.2.3/deployer.phar'}
-    ${'3.2.1'}  | ${'Version missing in deployer manifest'}
+    ${'latest'} | ${'https://github.com/deployphp/deployer/releases/latest/download/deployer.phar,https://deployer.org/deployer.phar deployer'}
+    ${'7.5.12'} | ${'https://github.com/deployphp/deployer/releases/download/v7.5.12/deployer.phar,https://deployer.org/releases/v7.5.12/deployer.phar deployer'}
+    ${'6.8.0'}  | ${'https://github.com/deployphp/deployer/releases/download/v6.8.0/deployer.phar,https://deployer.org/releases/v6.8.0/deployer.phar deployer'}
   `('checking addDeployer: $version', async ({version, url}) => {
     const data = getData({
       tool: 'deployer',
       domain: 'https://deployer.org',
+      repository: 'deployphp/deployer',
+      version_prefix: 'v',
       version: version
     });
     expect(await tools.addDeployer(data)).toContain(url);
@@ -527,30 +579,11 @@ describe('Tools tests', () => {
   });
 
   it('checking affected composer version with CRLF ranges', async () => {
-    let affected = false;
-    let fixed = true;
-    await jest.isolateModulesAsync(async () => {
-      jest.doMock('fs', () => ({
-        ...jest.requireActual('fs'),
-        readFileSync: (
-          filePath: fs.PathOrFileDescriptor,
-          options?: unknown
-        ) => {
-          if (String(filePath).includes('composer-gh-auth-no-op')) {
-            return '1.0.0-0 1.10.28\r\n2.0.0-0 2.2.28\r\n2.3.0-0 2.9.8';
-          }
-          return (jest.requireActual('fs') as typeof fs).readFileSync(
-            filePath,
-            options as fs.ObjectEncodingOptions & {flag?: string}
-          );
-        }
-      }));
-      const isolatedTools = jest.requireActual<typeof tools>('../src/tools');
-      affected = isolatedTools.skipGitHubAuthForComposerVersion('2.9.7');
-      fixed = isolatedTools.skipGitHubAuthForComposerVersion('2.9.8');
-    });
-    expect(affected).toBe(true);
-    expect(fixed).toBe(false);
+    jest
+      .spyOn(fs, 'readFileSync')
+      .mockReturnValue('1.0.0-0 1.10.28\r\n2.0.0-0 2.2.28\r\n2.3.0-0 2.9.8');
+    expect(tools.skipGitHubAuthForComposerVersion('2.9.7')).toBe(true);
+    expect(tools.skipGitHubAuthForComposerVersion('2.9.8')).toBe(false);
   });
 
   it.each`
@@ -655,7 +688,7 @@ describe('Tools tests', () => {
         'add_tool https://github.com/humbug/php-scoper/releases/latest/download/php-scoper.phar php-scoper "--version"',
         'add_tool https://github.com/phpDocumentor/phpDocumentor/releases/latest/download/phpDocumentor.phar phpDocumentor "--version"',
         'add_composer_tool phplint phplint overtrue/',
-        'add_tool https://github.com/phpstan/phpstan/releases/latest/download/phpstan.phar phpstan "-V"',
+        'add_composer_tool phpstan phpstan phpstan/ scoped',
         'add_tool https://phar.phpunit.de/phpunit-7.4.0.phar,https://phar.phpunit.de/phpunit-7.phar phpunit "--version"',
         'add_pecl',
         'add_tool https://www.phing.info/get/phing-latest.phar phing "-v"',
@@ -744,7 +777,7 @@ describe('Tools tests', () => {
         'blackfire-player is not a windows tool',
         'Add-Tool https://github.com/staabm/annotate-pull-request-from-checkstyle/releases/latest/download/cs2pr cs2pr "-V"',
         'Add-Tool https://github.com/bmitch/churn-php/releases/latest/download/churn.phar churn "-V"',
-        'Add-Tool https://deployer.org/deployer.phar deployer "-V"',
+        'Add-Tool https://github.com/deployphp/deployer/releases/latest/download/deployer.phar,https://deployer.org/deployer.phar deployer "-V"',
         'Tool does_not_exist is not supported',
         'Add-ComposerTool flex flex symfony/ global',
         'Add-Mago',
@@ -830,19 +863,20 @@ describe('Tools tests', () => {
   });
 
   it.each`
-    tools_csv                                    | os          | script
-    ${'phpunit:9.5.0@sha256:' + 'a'.repeat(64)}  | ${'linux'}  | ${'add_tool https://phar.phpunit.de/phpunit-9.5.0.phar,https://phar.phpunit.de/phpunit-9.phar phpunit "--version" sha256:' + 'a'.repeat(64)}
-    ${'phpunit:9.5.0@sha256:' + 'a'.repeat(64)}  | ${'win32'}  | ${'Add-Tool https://phar.phpunit.de/phpunit-9.5.0.phar,https://phar.phpunit.de/phpunit-9.phar phpunit "--version" sha256:' + 'a'.repeat(64)}
-    ${'composer:2.9.8@sha256:' + 'b'.repeat(64)} | ${'linux'}  | ${'composer 2.9.8 sha256:' + 'b'.repeat(64)}
-    ${'cs2pr:1.2.3@sha256:' + 'd'.repeat(64)}    | ${'linux'}  | ${'add_tool https://github.com/staabm/annotate-pull-request-from-checkstyle/releases/download/1.2.3/cs2pr cs2pr "-V" sha256:' + 'd'.repeat(64)}
-    ${'phive:0.15.3@sha512:' + 'c'.repeat(128)}  | ${'darwin'} | ${'add_tool https://github.com/phar-io/phive/releases/download/0.15.3/phive-0.15.3.phar phive "status" sha512:' + 'c'.repeat(128)}
-    ${'phinx:1.2.3@sha256:' + 'a'.repeat(64)}    | ${'linux'}  | ${'add_log "$cross" "phinx" "Checksum verification is not supported for phinx"'}
-    ${'pecl:1.2.3@sha256:' + 'a'.repeat(64)}     | ${'linux'}  | ${'add_log "$cross" "pecl" "Checksum verification is not supported for pecl"'}
-    ${'phpunit:9.5.0@sha256:invalid'}            | ${'linux'}  | ${'add_log "$cross" "phpunit" "Invalid sha256 checksum, expected 64 hexadecimal characters"'}
-    ${'composer:2.9.8@SHA256:' + 'b'.repeat(64)} | ${'linux'}  | ${'composer 2.9.8 sha256:' + 'b'.repeat(64)}
-    ${'composer:2.9.8@sha384:' + 'b'.repeat(96)} | ${'linux'}  | ${'add_log "$cross" "composer" "Unsupported checksum algorithm sha384, expected sha256 or sha512"'}
-    ${'composer:2.9.8@md5:' + 'b'.repeat(32)}    | ${'linux'}  | ${'add_log "$cross" "composer" "Unsupported checksum algorithm md5, expected sha256 or sha512"'}
-    ${'composer:2.9.8@sha256' + 'b'.repeat(64)}  | ${'linux'}  | ${'add_log "$cross" "composer" "Invalid checksum syntax, expected @sha256:<hash> or @sha512:<hash>"'}
+    tools_csv                                     | os          | script
+    ${'phpunit:9.5.0@sha256:' + 'a'.repeat(64)}   | ${'linux'}  | ${'add_tool https://phar.phpunit.de/phpunit-9.5.0.phar,https://phar.phpunit.de/phpunit-9.phar phpunit "--version" sha256:' + 'a'.repeat(64)}
+    ${'phpunit:9.5.0@sha256:' + 'a'.repeat(64)}   | ${'win32'}  | ${'Add-Tool https://phar.phpunit.de/phpunit-9.5.0.phar,https://phar.phpunit.de/phpunit-9.phar phpunit "--version" sha256:' + 'a'.repeat(64)}
+    ${'composer:2.9.8@sha256:' + 'b'.repeat(64)}  | ${'linux'}  | ${'composer 2.9.8 sha256:' + 'b'.repeat(64)}
+    ${'cs2pr:1.2.3@sha256:' + 'd'.repeat(64)}     | ${'linux'}  | ${'add_tool https://github.com/staabm/annotate-pull-request-from-checkstyle/releases/download/1.2.3/cs2pr cs2pr "-V" sha256:' + 'd'.repeat(64)}
+    ${'deployer:7.5.12@sha256:' + 'e'.repeat(64)} | ${'linux'}  | ${'add_tool https://github.com/deployphp/deployer/releases/download/v7.5.12/deployer.phar,https://deployer.org/releases/v7.5.12/deployer.phar deployer "-V" sha256:' + 'e'.repeat(64)}
+    ${'phive:0.15.3@sha512:' + 'c'.repeat(128)}   | ${'darwin'} | ${'add_tool https://github.com/phar-io/phive/releases/download/0.15.3/phive-0.15.3.phar phive "status" sha512:' + 'c'.repeat(128)}
+    ${'phinx:1.2.3@sha256:' + 'a'.repeat(64)}     | ${'linux'}  | ${'add_log "$cross" "phinx" "Checksum verification is not supported for phinx"'}
+    ${'pecl:1.2.3@sha256:' + 'a'.repeat(64)}      | ${'linux'}  | ${'add_log "$cross" "pecl" "Checksum verification is not supported for pecl"'}
+    ${'phpunit:9.5.0@sha256:invalid'}             | ${'linux'}  | ${'add_log "$cross" "phpunit" "Invalid sha256 checksum, expected 64 hexadecimal characters"'}
+    ${'composer:2.9.8@SHA256:' + 'b'.repeat(64)}  | ${'linux'}  | ${'composer 2.9.8 sha256:' + 'b'.repeat(64)}
+    ${'composer:2.9.8@sha384:' + 'b'.repeat(96)}  | ${'linux'}  | ${'add_log "$cross" "composer" "Unsupported checksum algorithm sha384, expected sha256 or sha512"'}
+    ${'composer:2.9.8@md5:' + 'b'.repeat(32)}     | ${'linux'}  | ${'add_log "$cross" "composer" "Unsupported checksum algorithm md5, expected sha256 or sha512"'}
+    ${'composer:2.9.8@sha256' + 'b'.repeat(64)}   | ${'linux'}  | ${'add_log "$cross" "composer" "Invalid checksum syntax, expected @sha256:<hash> or @sha512:<hash>"'}
   `(
     'checking addTools with checksum: $tools_csv, $os',
     async ({tools_csv, os, script}) => {
@@ -948,26 +982,14 @@ describe('Tools tests', () => {
       }
     });
 
-    let result: string = '';
-    await jest.isolateModulesAsync(async () => {
-      jest.doMock('fs', () => ({
-        ...jest.requireActual('fs'),
-        readFileSync: (
-          filePath: fs.PathOrFileDescriptor,
-          options?: unknown
-        ) => {
-          if (String(filePath).includes('tools.json')) {
-            return brokenToolsJson;
-          }
-          return (jest.requireActual('fs') as typeof fs).readFileSync(
-            filePath,
-            options as fs.ObjectEncodingOptions & {flag?: string}
-          );
-        }
-      }));
-      const isolatedTools = jest.requireActual<typeof tools>('../src/tools');
-      result = await isolatedTools.addTools('broken-tool', '7.4', 'linux');
+    const readFileSync = fs.readFileSync;
+    jest.spyOn(fs, 'readFileSync').mockImplementation((filePath, options) => {
+      if (String(filePath).includes('tools.json')) {
+        return brokenToolsJson;
+      }
+      return readFileSync(filePath, options);
     });
+    const result = await tools.addTools('broken-tool', '7.4', 'linux');
 
     expect(result).toContain(
       'add_log "$cross" "broken-tool" "broken-tool has no function defined. Please report this issue."'

__tests__/utils.test.ts

@@ -1,9 +1,13 @@
+import {fileURLToPath} from 'url';
+import {jest} from '@jest/globals';
 import fs from 'fs';
 import os from 'os';
-import {spawnSync} from 'child_process';
 import * as path from 'path';
-import * as utils from '../src/utils';
-import * as fetchModule from '../src/fetch';
+const fetchMock = jest.fn<typeof import('../src/fetch.js').fetch>();
+jest.unstable_mockModule('../src/fetch.js', () => ({fetch: fetchMock}));
+const utils = await import('../src/utils.js');
+
+const dirname = path.dirname(fileURLToPath(import.meta.url));
 
 describe('Utils tests', () => {
   it('checking readEnv', async () => {
@@ -41,9 +45,9 @@ describe('Utils tests', () => {
   });
 
   it('checking parseVersion', async () => {
-    const fetchSpy = jest.spyOn(fetchModule, 'fetch').mockResolvedValue({
+    const fetchSpy = fetchMock.mockResolvedValue({
       data: fs.readFileSync(
-        path.join(__dirname, '../src/configs/php-versions.json'),
+        path.join(dirname, '../src/configs/php-versions.json'),
         'utf8'
       )
     });
@@ -54,6 +58,9 @@ describe('Utils tests', () => {
     expect(await utils.parseVersion('8.7.0')).toBe('8.7');
     expect(await utils.parseVersion('7')).toBe('7.0');
     expect(await utils.parseVersion('7.4')).toBe('7.4');
+    expect(await utils.parseVersion('8.10')).toBe('8.10');
+    expect(await utils.parseVersion('10')).toBe('10.0');
+    expect(await utils.parseVersion('10.0')).toBe('10.0');
     expect(await utils.parseVersion('5.x')).toBe('5.6');
     expect(await utils.parseVersion('pre')).toBe('pre');
     expect(await utils.parseVersion('pre-installed')).toBe('pre');
@@ -325,8 +332,8 @@ describe('Utils tests', () => {
       "Could not find '.phpenv-version' file."
     );
 
-    const existsSync = jest.spyOn(fs, 'existsSync').mockImplementation();
-    const readFileSync = jest.spyOn(fs, 'readFileSync').mockImplementation();
+    const existsSync = jest.spyOn(fs, 'existsSync').mockReturnValue(false);
+    const readFileSync = jest.spyOn(fs, 'readFileSync').mockReturnValue('');
 
     existsSync.mockReturnValue(true);
     readFileSync.mockReturnValue('8.1');
@@ -392,8 +399,8 @@ describe('Utils tests', () => {
   });
 
   it('readPHPVersion rejects unsupported values from each source', async () => {
-    const existsSync = jest.spyOn(fs, 'existsSync').mockImplementation();
-    const readFileSync = jest.spyOn(fs, 'readFileSync').mockImplementation();
+    const existsSync = jest.spyOn(fs, 'existsSync').mockReturnValue(false);
+    const readFileSync = jest.spyOn(fs, 'readFileSync').mockReturnValue('');
 
     process.env['php-version'] = '$0';
     await expect(utils.readPHPVersion()).rejects.toThrow('php-version input');
@@ -447,20 +454,8 @@ describe('Utils tests', () => {
   });
 });
 
-const hasPwsh =
-  spawnSync('pwsh', ['-NoProfile', '-Command', 'exit 0']).status === 0;
-const scripts = path.join(__dirname, '../src/scripts');
-const unixInit = fs.readFileSync(path.join(scripts, 'unix.sh'), 'utf8');
-const windowsSource = fs.readFileSync(path.join(scripts, 'win32.ps1'), 'utf8');
-const windowsInit = [
-  windowsSource.match(/Function Invoke-WithoutTrace[\s\S]*?\n}/)![0],
-  windowsSource.match(
-    /\$setup_php_trace = 0\r?\nif \(\$env:SETUP_PHP_TRACE[\s\S]*?\n}/
-  )![0]
-].join('\n');
-
 describe.each(['linux', 'darwin', 'win32'])(
-  'Verbose scripts on %s',
+  'Verbose script preparation on %s',
   platform => {
     let root: string;
     let run: string;
@@ -473,19 +468,12 @@ describe.each(['linux', 'darwin', 'win32'])(
       const scripts = path.join(root, 'src', 'scripts');
       const extension = platform === 'win32' ? '.ps1' : '.sh';
       fs.mkdirSync(path.join(scripts, 'tools'), {recursive: true});
-      const init = path.join(scripts, 'init' + extension);
-      fs.writeFileSync(
-        init,
-        platform === 'win32'
-          ? windowsInit
-          : unixInit + '\nrunner=self-hosted read_env\n'
-      );
       helper = path.join(scripts, 'tools', 'helper' + extension);
       run = path.join(scripts, 'run' + extension);
       fs.writeFileSync(helper, 'echo helper-output\n');
       fs.writeFileSync(
         run,
-        `. '${init}'\n. '${helper}' ${platform === 'win32' ? '>$null' : '>/dev/null'} 2>&1\n`
+        `. '${helper}' ${platform === 'win32' ? '>$null' : '>/dev/null'} 2>&1\n`
       );
       delete process.env.verbose;
       delete process.env.VERBOSE;
@@ -516,22 +504,6 @@ describe.each(['linux', 'darwin', 'win32'])(
           tracing ? String(verbose!.length - 1) : '0'
         );
         expect(fs.readFileSync(run, 'utf8')).toBe(original);
-        if (platform === 'win32' ? hasPwsh : process.platform !== 'win32') {
-          const result = spawnSync(
-            platform === 'win32' ? 'pwsh' : 'bash',
-            platform === 'win32'
-              ? ['-NoProfile', '-File', prepared]
-              : [prepared],
-            {encoding: 'utf8', env: process.env}
-          );
-          expect(result.status).toBe(0);
-          expect(/helper-output\r?\n/.test(result.stdout)).toBe(enabled);
-          expect(
-            platform === 'win32'
-              ? result.stdout.includes('DEBUG:')
-              : result.stderr.includes('+ ')
-          ).toBe(tracing);
-        }
       }
     );
 
@@ -556,18 +528,6 @@ describe.each(['linux', 'darwin', 'win32'])(
           `echo nested-output ${platform === 'win32' ? '2>&1 | Out-Host' : ''}\n${probe}\n`
         );
         expect(fs.readFileSync(helper, 'utf8')).toContain(pipe);
-        const shell = platform === 'win32' ? 'pwsh' : 'bash';
-        if (platform === 'win32' ? hasPwsh : process.platform !== 'win32') {
-          const result = spawnSync(
-            shell,
-            platform === 'win32'
-              ? ['-NoProfile', '-File', prepared]
-              : [prepared],
-            {encoding: 'utf8', env: process.env}
-          );
-          expect(result.status).toBe(0);
-          expect(result.stdout).toMatch(/nested-output\r?\n/);
-        }
         process.env.verbose = 'false';
         expect(await utils.addVerbose(run, platform)).toBe(run);
         expect(process.env.SETUP_PHP_TRACE).toBe('0');
@@ -591,277 +551,6 @@ describe.each(['linux', 'darwin', 'win32'])(
       }
     );
 
-    it.each(['true', 'vv', 'vvv'])(
-      'protects nested sensitive calls and restores tracing for verbose=%s',
-      async verbose => {
-        const windows = platform === 'win32';
-        if (windows ? !hasPwsh : process.platform === 'win32') return;
-        process.env.verbose = verbose;
-        process.env.GITHUB_TOKEN = 'example-github-token';
-        process.env.TRACE_TEST_OUTPUT = path.join(root, 'tokens');
-        fs.writeFileSync(
-          helper,
-          windows
-            ? `$result = 0
-try {
-  Invoke-WithoutTrace {
-    Invoke-WithoutTrace {
-      $token = $env:GITHUB_TOKEN
-      Set-Content $env:TRACE_TEST_OUTPUT $token
-    }
-    $token = $env:GITHUB_TOKEN
-    Add-Content $env:TRACE_TEST_OUTPUT $token
-    if ($env:TRACE_TEST_STATUS -ne '0') { throw 'example-failure' }
-  }
-} catch {
-  if ($_.Exception.Message -ne 'example-failure') { throw }
-  $result = [int]$env:TRACE_TEST_STATUS
-}
-$after_wrapper = 'after-wrapper'
-Write-Output $after_wrapper
-Write-Output "status=$result"
-`
-            : `inner_sensitive() {
-  token="$GITHUB_TOKEN"
-  printf '%s\\n' "$token" > "$TRACE_TEST_OUTPUT"
-  return "$TRACE_TEST_STATUS"
-}
-outer_sensitive() {
-  without_trace inner_sensitive
-  local result=$?
-  token="$GITHUB_TOKEN"
-  printf '%s\\n' "$token" >> "$TRACE_TEST_OUTPUT"
-  return "$result"
-}
-without_trace outer_sensitive
-result=$?
-echo "\${token:+state-preserved}"
-echo after-wrapper
-exit "$result"
-`
-        );
-        const prepared = await utils.addVerbose(run, platform);
-        for (const status of [0, 37]) {
-          const result = spawnSync(
-            windows ? 'pwsh' : 'bash',
-            windows ? ['-NoProfile', '-File', prepared] : [prepared],
-            {
-              encoding: 'utf8',
-              env: {...process.env, TRACE_TEST_STATUS: String(status)}
-            }
-          );
-          expect(result.status).toBe(windows ? 0 : status);
-          expect(result.stdout + result.stderr).not.toContain(
-            'example-github-token'
-          );
-          expect(result.stdout).toContain('after-wrapper');
-          expect(
-            windows
-              ? /DEBUG:.*Write-Output \$after_wrapper/.test(result.stdout)
-              : result.stderr.includes('+ echo after-wrapper')
-          ).toBe(verbose !== 'true');
-          if (windows) {
-            expect(result.stdout).toContain('status=' + status);
-            expect(/DEBUG:\s+!\s+SET \$after_wrapper/.test(result.stdout)).toBe(
-              verbose === 'vvv'
-            );
-          } else {
-            expect(result.stdout).toContain('state-preserved');
-          }
-          expect(
-            fs
-              .readFileSync(process.env.TRACE_TEST_OUTPUT!, 'utf8')
-              .trim()
-              .split(/\r?\n/)
-          ).toEqual(['example-github-token', 'example-github-token']);
-        }
-      }
-    );
-
-    it.each(['true', 'vv', 'vvv'])(
-      'keeps Blackfire credentials out of traces for verbose=%s',
-      async verbose => {
-        const windows = platform === 'win32';
-        if (windows ? !hasPwsh : process.platform === 'win32') return;
-        process.env.verbose = verbose;
-        process.env.TRACE_TEST_OUTPUT = path.join(root, 'blackfire-config');
-        process.env.BLACKFIRE_SERVER_ID = 'example-blackfire-server-id';
-        process.env.BLACKFIRE_SERVER_TOKEN = 'example-blackfire-server-token';
-        process.env.BLACKFIRE_CLIENT_ID = 'example-blackfire-client-id';
-        process.env.BLACKFIRE_CLIENT_TOKEN = 'example-blackfire-client-token';
-        fs.writeFileSync(
-          helper,
-          fs.readFileSync(
-            path.join(
-              scripts,
-              'tools',
-              'blackfire' + (windows ? '.ps1' : '.sh')
-            ),
-            'utf8'
-          ) +
-            (windows
-              ? `
-function Invoke-RestMethod { @{cli='1.2.3'} }
-function Get-File {}
-function Expand-Archive {}
-function Add-ToProfile {}
-function Add-Log {}
-function blackfire { Add-Content $env:TRACE_TEST_OUTPUT ($args -join ' ') }
-$version = '8.4'
-$bin_dir = 'unused'
-Add-Blackfire
-Write-Output after-blackfire
-`
-              : `
-blackfire() { printf '%s\\n' "$@" >> "$TRACE_TEST_OUTPUT"; }
-os=Test
-blackfire_config
-echo after-blackfire
-`)
-        );
-        const prepared = await utils.addVerbose(run, platform);
-        const result = spawnSync(
-          windows ? 'pwsh' : 'bash',
-          windows ? ['-NoProfile', '-File', prepared] : [prepared],
-          {encoding: 'utf8', env: process.env}
-        );
-        expect(result.status).toBe(0);
-        expect(result.stdout + result.stderr).not.toContain(
-          'example-blackfire-'
-        );
-        expect(result.stdout).toContain('after-blackfire');
-        expect(
-          windows
-            ? /DEBUG:.*Write-Output after-blackfire/.test(result.stdout)
-            : result.stderr.includes('+ echo after-blackfire')
-        ).toBe(verbose !== 'true');
-        const config = fs.readFileSync(process.env.TRACE_TEST_OUTPUT!, 'utf8');
-        for (const value of [
-          'server-id',
-          'server-token',
-          'client-id',
-          'client-token'
-        ]) {
-          expect(config).toContain('example-blackfire-' + value);
-        }
-      }
-    );
-
-    it('keeps Composer credentials out of traces and resumes tracing', async () => {
-      if (platform === 'win32' ? !hasPwsh : process.platform === 'win32')
-        return;
-      process.env.verbose = 'vvv';
-      process.env.GITHUB_TOKEN = 'example-github-token';
-      process.env.COMPOSER_TOKEN = 'example-composer-token';
-      process.env.PACKAGIST_TOKEN = 'example-packagist-token';
-      process.env.COMPOSER_AUTH_JSON =
-        '{"bearer":{"example.org":"example-json-token"}}';
-      process.env.GITHUB_SERVER_URL = 'https://github.com';
-      const windows = platform === 'win32';
-      const source = fs.readFileSync(
-        path.join(scripts, 'tools', 'add_tools' + (windows ? '.ps1' : '.sh')),
-        'utf8'
-      );
-      fs.writeFileSync(
-        helper,
-        source +
-          (windows
-            ? `\n$composer_home='${root}'\nSet-ComposerAuth\nWrite-Output after-auth\n`
-            : `\ncomposer_home='${root}'\nset_composer_auth\necho after-auth\n`)
-      );
-      const prepared = await utils.addVerbose(run, platform);
-      const result = spawnSync(
-        windows ? 'pwsh' : 'bash',
-        windows ? ['-NoProfile', '-File', prepared] : [prepared],
-        {encoding: 'utf8', env: process.env}
-      );
-      expect(result.status).toBe(0);
-      expect(result.stdout + result.stderr).not.toMatch(
-        /example-(github|composer|packagist|json)-token/
-      );
-      expect(windows ? result.stdout : result.stderr).toMatch(
-        windows ? /DEBUG:.*Write-Output after-auth/ : /\+ echo after-auth/
-      );
-      const auth = JSON.parse(
-        fs.readFileSync(path.join(root, 'auth.json'), 'utf8')
-      );
-      expect(auth['github-oauth']['github.com']).toBe('example-composer-token');
-      expect(auth['http-basic']['repo.packagist.com'].password).toBe(
-        'example-packagist-token'
-      );
-      expect(auth.bearer['example.org']).toBe('example-json-token');
-    });
-
-    if (platform !== 'win32') {
-      (process.platform === 'win32' ? it.skip : it).each([
-        ['exit 37', 37],
-        ['set -e\nfalse', 1]
-      ])('preserves shell termination for %s', async (failure, status) => {
-        process.env.verbose = 'vvv';
-        process.env.GITHUB_TOKEN = 'example-github-token';
-        fs.writeFileSync(
-          helper,
-          `
-sensitive_failure() {
-  token="$GITHUB_TOKEN"
-  ${failure}
-  echo should-not-run
-}
-trap 'echo cleanup' EXIT
-without_trace sensitive_failure
-echo should-not-run
-`
-        );
-        const prepared = await utils.addVerbose(run, platform);
-        const result = spawnSync('bash', [prepared], {
-          encoding: 'utf8',
-          env: process.env
-        });
-        expect(result.status).toBe(status);
-        expect(result.stdout).toBe('cleanup\n');
-        expect(result.stdout + result.stderr).not.toContain(
-          'example-github-token'
-        );
-      });
-
-      (process.platform === 'win32' ? it.skip : it).each(['true', 'vv', 'vvv'])(
-        'protects Relay credentials and preserves tracing and status for verbose=%s',
-        async verbose => {
-          process.env.verbose = verbose;
-          const ini = path.join(root, 'relay.ini');
-          fs.writeFileSync(
-            helper,
-            fs.readFileSync(path.join(scripts, 'extensions/relay.sh'), 'utf8') +
-              '\nsudo() { if [ "$1" = rm ]; then return "$RELAY_TEST_STATUS"; fi; "$@"; }\n' +
-              `init_relay_ini '${ini}'\nrelay_status=$?\necho after-relay\nexit "$relay_status"\n`
-          );
-          const prepared = await utils.addVerbose(run, platform);
-          for (const status of [0, 37]) {
-            fs.writeFileSync(ini, '; relay.key =\n');
-            const result = spawnSync('bash', [prepared], {
-              encoding: 'utf8',
-              env: {
-                ...process.env,
-                RELAY_KEY: 'example-relay-key',
-                RELAY_TEST_STATUS: String(status)
-              }
-            });
-            expect(result.status).toBe(status);
-            expect(result.stdout + result.stderr).not.toContain(
-              'example-relay-key'
-            );
-            expect(result.stdout).toContain('after-relay');
-            expect(result.stderr.includes('+ echo after-relay')).toBe(
-              verbose !== 'true'
-            );
-            expect(fs.readFileSync(ini, 'utf8')).toBe(
-              'relay.key = example-relay-key\n'
-            );
-          }
-        }
-      );
-    }
-
     (process.platform === 'win32' ? it.skip : it)(
       'uses fresh copies without writing through source symlinks',
       async () => {

dist/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

eslint.config.mjs

@@ -1,5 +1,5 @@
+import {createRequire} from 'node:module';
 import typescriptEslint from '@typescript-eslint/eslint-plugin';
-import {importX} from 'eslint-plugin-import-x';
 import jest from 'eslint-plugin-jest';
 import prettierRecommended from 'eslint-plugin-prettier/recommended';
 import eslintConfigPrettier from 'eslint-config-prettier';
@@ -7,6 +7,11 @@ import globals from 'globals';
 import tsParser from '@typescript-eslint/parser';
 import js from '@eslint/js';
 
+// Until import-x supports minimatch 11, use its CommonJS entry point to avoid
+// the removed makeRe import in no-internal-modules, unused by these presets.
+// https://github.com/un-ts/eslint-plugin-import-x/pull/570
+const {importX} = createRequire(import.meta.url)('eslint-plugin-import-x');
+
 export default [
   js.configs.recommended,
   ...typescriptEslint.configs['flat/recommended'],

jest.config.js

@@ -1,11 +1,15 @@
-module.exports = {
+export default {
   clearMocks: true,
   moduleFileExtensions: ['js', 'ts'],
+  extensionsToTreatAsEsm: ['.ts'],
+  moduleNameMapper: {
+    '^(\\.{1,2}/.*)\\.js$': '$1'
+  },
   testEnvironment: 'node',
   testMatch: ['**/*.test.ts'],
   testRunner: 'jest-circus/runner',
   transform: {
-    '^.+\\.ts$': ['ts-jest', {tsconfig: 'tsconfig.test.json'}]
+    '^.+\\.ts$': ['ts-jest', {tsconfig: 'tsconfig.test.json', useESM: true}]
   },
   verbose: true,
   collectCoverage: true

package.json

@@ -1,8 +1,9 @@
 {
   "name": "setup-php",
-  "version": "2.40.0-beta",
+  "version": "2.40.1",
   "private": false,
   "description": "Setup PHP for use with GitHub Actions",
+  "type": "module",
   "main": "lib/install.js",
   "types": "lib/install.d.ts",
   "directories": {
@@ -21,7 +22,7 @@
     "format-check": "prettier --check **/src/*.ts **/__tests__/*.ts",
     "release": "ncc build -m -o dist && git add -f dist/",
     "typecheck": "tsc --project tsconfig.test.json --noEmit",
-    "test": "jest"
+    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js"
   },
   "repository": {
     "type": "git",
@@ -35,39 +36,37 @@
   "author": "shivammathur",
   "license": "MIT",
   "dependencies": {
-    "@actions/exec": "^2.0.0",
+    "@actions/exec": "^3.0.0",
     "compare-versions": "^6.1.1"
   },
   "devDependencies": {
     "@eslint/compat": "^2.1.1",
     "@eslint/js": "^10.0.1",
     "@types/jest": "^30.0.0",
-    "@types/node": "^26.6.2",
-    "@typescript-eslint/eslint-plugin": "^8.70.0",
-    "@typescript-eslint/parser": "^8.70.0",
+    "@types/node": "^26.6.6",
+    "@typescript-eslint/eslint-plugin": "^8.72.1",
+    "@typescript-eslint/parser": "^8.72.1",
     "@typescript/native": "npm:typescript@^7.0.2",
     "@vercel/ncc": "^0.45.0",
-    "eslint": "^10.11.0",
+    "eslint": "^10.14.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-import-resolver-typescript": "^4.4.5",
     "eslint-plugin-import-x": "^4.17.1",
-    "eslint-plugin-jest": "^29.16.6",
-    "eslint-plugin-prettier": "^5.5.6",
-    "globals": "^17.12.0",
+    "eslint-plugin-jest": "^29.17.0",
+    "eslint-plugin-prettier": "^5.5.7",
+    "globals": "^17.14.0",
     "jest": "^30.5.2",
     "jest-circus": "^30.5.2",
-    "nock": "^14.0.17",
-    "prettier": "^3.9.8",
+    "nock": "^15.0.5",
+    "prettier": "^3.9.10",
     "simple-git-hooks": "^2.14.0",
-    "ts-jest": "^29.4.12",
+    "ts-jest": "^29.4.15",
     "typescript": "npm:@typescript/typescript6@^6.0.2"
   },
   "overrides": {
-    "@babel/core": "^7.29.7",
-    "js-yaml": "^4.2.0",
-    "test-exclude": "^7.0.1",
-    "glob": "^13.0.6",
-    "minimatch": "^10.2.1"
+    "deepmerge": "npm:@shivammathur/deepmerge@4.3.2",
+    "glob": "^14.0.3",
+    "minimatch": "^11.0.3"
   },
   "bugs": {
     "url": "https://github.com/shivammathur/setup-php/issues"
@@ -76,8 +75,9 @@
     "pre-commit": "npm run format && npm run lint && npm run test && npm run build && npm run release"
   },
   "allowScripts": {
+    "@parcel/watcher@2.6.0": true,
     "fsevents@2.3.3": true,
-    "simple-git-hooks@2.13.1": true,
-    "unrs-resolver@1.11.1": true
+    "simple-git-hooks@2.14.0": true,
+    "unrs-resolver@1.12.2": true
   }
 }

src/config.ts

@@ -1,4 +1,4 @@
-import * as utils from './utils';
+import * as utils from './utils.js';
 
 /**
  * Add script to set custom ini values for unix

src/configs/pie-extensions.json

@@ -0,0 +1,111 @@
+{
+  "amqp": "php-amqp/php-amqp",
+  "apcu": "apcu/apcu",
+  "apfd": "m6w6/ext-apfd",
+  "arrow": "flow-php/arrow-ext",
+  "ast": "nikic/php-ast",
+  "biscuit_php": "ptondereau/biscuit-php",
+  "bitset": "pecl/bitset",
+  "brotli": "kjdev/brotli",
+  "bsdiff": "bsdiff/bsdiff",
+  "csv": "girgias/csv",
+  "dbus": "pecl/dbus",
+  "decimal": "php-decimal/ext-decimal",
+  "deepclone": "symfony/deepclone",
+  "dio": "pecl/dio",
+  "ds": "php-ds/ext-ds",
+  "ev": "osmanov/pecl-ev",
+  "event": "osmanov/pecl-event",
+  "excel": "iliaal/php-excel",
+  "excimer": "wikimedia/excimer",
+  "fast_uuid": "iliaal/fast_uuid",
+  "fastchart": "iliaal/fastchart",
+  "fastjson": "iliaal/fastjson",
+  "geospatial": "php-geospatial/geospatial",
+  "glfw": "mario-deluna/php-glfw",
+  "grpc": "grpc/grpc-php-ext",
+  "hdr_histogram": "beberlei/hdrhistogram",
+  "hdrhistogram": "beberlei/hdrhistogram",
+  "highlighter": "yiipress/highlighter",
+  "http": "m6w6/ext-http",
+  "igbinary": "igbinary/igbinary",
+  "imagick": "imagick/imagick",
+  "inotify": "arnaud-lb/inotify",
+  "ip2location": "ip2location/ip2location-pie",
+  "ip2proxy": "ip2location/ip2proxy-pie",
+  "json_post": "m6w6/ext-json_post",
+  "jsonpath": "supermetrics/jsonpath",
+  "judy": "orieg/judy",
+  "krb5": "pecl/krb5",
+  "lchash": "iliaal/lchash",
+  "luasandbox": "wikimedia/luasandbox",
+  "lz4": "kjdev/lz4",
+  "lzf": "pecl/lzf",
+  "mailparse": "pecl/mailparse",
+  "maxminddb": "maxmind-db/reader-ext",
+  "mcrypt": "pecl/mcrypt",
+  "mdparser": "iliaal/mdparser",
+  "memcached": "php-memcached/php-memcached",
+  "memprof": "arnaud-lb/memprof",
+  "mjml": "kcs/mjml",
+  "mongodb": "mongodb/mongodb-extension",
+  "msgpack": "msgpack/msgpack-php",
+  "mustache": "jbboehr/php-mustache",
+  "oci8": "oci8/oci8",
+  "openswoole": "openswoole/ext-openswoole",
+  "opentelemetry": "open-telemetry/ext-opentelemetry",
+  "operator": "jblo/operator",
+  "parallel": "pecl/parallel",
+  "pcov": "pecl/pcov",
+  "pdo_duckdb": "thomas-0816/pdo-duckdb-php",
+  "pdo_oci": "pecl/pdo_oci",
+  "pdo_sqlsrv": "microsoft/pdo_sqlsrv",
+  "pecl_http": "m6w6/ext-http",
+  "phalcon": "phalcon/cphalcon",
+  "phonetic": "iliaal/phonetic",
+  "phpser": "iliaal/phpser",
+  "phpstan_turbo": "phpstan/turbo",
+  "pkcs11": "gamringer/pkcs11",
+  "pq": "m6w6/ext-pq",
+  "quickhash": "derickr/quickhash",
+  "raphf": "m6w6/ext-raphf",
+  "rar": "cataphract/rar",
+  "rdkafka": "rdkafka/rdkafka",
+  "redis": "phpredis/phpredis",
+  "relay": "cachewerk/ext-relay",
+  "rpminfo": "remi/rpminfo",
+  "scrypt": "woohoolabs/php-scrypt",
+  "selinux": "pecl/selinux",
+  "snappy": "kjdev/snappy",
+  "solr": "pecl/solr",
+  "spx": "noisebynorthwest/php-spx",
+  "sqlsrv": "microsoft/sqlsrv",
+  "statgrab": "iliaal/statgrab",
+  "swoole": "swoole/swoole",
+  "swow": "swow/swow-extension",
+  "taint": "laruence/taint",
+  "tensor": "rubix/tensor_ext",
+  "timezonedb": "pecl/timezonedb",
+  "translit": "derickr/translit",
+  "uopz": "krakjoe/uopz",
+  "uuid": "pecl/uuid",
+  "uv": "amphp/uv",
+  "valkey_glide": "valkey-io/valkey-glide-php",
+  "vld": "derickr/vld",
+  "wikidiff2": "wikimedia/wikidiff2",
+  "win32service": "win32service/win32service",
+  "xattr": "pecl/xattr",
+  "xdebug": "xdebug/xdebug",
+  "xdiff": "pecl/xdiff",
+  "xlswriter": "viest/xlswriter",
+  "xmldiff": "pecl/xml-xmldiff",
+  "xpass": "remi/xpass",
+  "yac": "laruence/yac",
+  "yaconf": "laruence/yaconf",
+  "yaf": "laruence/yaf",
+  "yaml": "pecl/yaml",
+  "yar": "laruence/yar",
+  "yaz": "indexdata/yaz",
+  "zip": "pecl/zip",
+  "zstd": "kjdev/zstd"
+}

src/configs/pm/phpunit.json

@@ -3,21 +3,77 @@
     {
       "owner": "phpunit",
       "pattern": [
-        {
-          "regexp": "^\\d+\\)\\s.*$"
-        },
-        {
-          "regexp": "^(.*Failed\\sasserting\\sthat.*)$",
-          "message": 1
-        },
-        {
-          "regexp": "^\\s*$"
-        },
-        {
-          "regexp": "^(.*):(\\d+)$",
-          "file": 1,
-          "line": 2
-        }
+        { "regexp": "^\\d+\\)\\s.*$" },
+        { "regexp": "^(.*Failed\\sasserting\\sthat.*)$", "message": 1 },
+        { "regexp": "^\\s*$" },
+        { "regexp": "^(.*):(\\d+)$", "file": 1, "line": 2 }
+      ]
+    },
+    {
+      "owner": "phpunit-no-blank",
+      "pattern": [
+        { "regexp": "^\\d+\\)\\s.*$" },
+        { "regexp": "^(.*Failed\\sasserting\\sthat.*)$", "message": 1 },
+        { "regexp": "^(.*):(\\d+)$", "file": 1, "line": 2 }
+      ]
+    },
+    {
+      "owner": "phpunit-custom-message",
+      "pattern": [
+        { "regexp": "^\\d+\\)\\s.*$" },
+        { "regexp": "^(?!.*Failed\\sasserting)(.+)$", "message": 1 },
+        { "regexp": "^.*Failed\\sasserting\\sthat.*$" },
+        { "regexp": "^(.*):(\\d+)$", "file": 1, "line": 2 }
+      ]
+    },
+    {
+      "owner": "phpunit-custom-message-blank",
+      "pattern": [
+        { "regexp": "^\\d+\\)\\s.*$" },
+        { "regexp": "^(?!.*Failed\\sasserting)(.+)$", "message": 1 },
+        { "regexp": "^.*Failed\\sasserting\\sthat.*$" },
+        { "regexp": "^\\s*$" },
+        { "regexp": "^(.*):(\\d+)$", "file": 1, "line": 2 }
+      ]
+    },
+    {
+      "owner": "phpunit-other-blank",
+      "pattern": [
+        { "regexp": "^\\d+\\)\\s.*$" },
+        { "regexp": "^(?!.*Failed\\sasserting)(.+)$", "message": 1 },
+        { "regexp": "^(?:\\s*|[-+@ ].*)$" },
+        { "regexp": "^(.*):(\\d+)$", "file": 1, "line": 2 }
+      ]
+    },
+    {
+      "owner": "phpunit-other",
+      "pattern": [
+        { "regexp": "^\\d+\\)\\s.*$" },
+        { "regexp": "^(?!.*Failed\\sasserting)(.+)$", "message": 1 },
+        { "regexp": "^(.*):(\\d+)$", "file": 1, "line": 2 }
+      ]
+    },
+    {
+      "owner": "phpunit-warning",
+      "severity": "warning",
+      "pattern": [
+        { "regexp": "^There (?:was|were) \\d+ (?:(?:risky|skipped) tests?(?: suites?)?|(?:PHPUnit(?: test runner)? )?warnings?):$" },
+        { "regexp": "^(?:(\\s*(/.*|[A-Za-z]:[\\\\/].*):(\\d+)|(?!-+$|There (?:was|were) \\d+ .+:$|\\d+ tests? triggered \\d+ .+:$|OK(?: \\(\\d+ tests?, \\d+ assertions?\\)|, but (?:there were issues|some tests were skipped|incomplete, skipped, or risky tests)!)$|(?:FAILURES|ERRORS|WARNINGS)!$|Tests: \\d+(?:,|\\.?$)|PHPUnit \\d+\\.\\S+ by |Triggered by:$).*)|Triggered by:)$", "message": 1, "file": 2, "line": 3, "loop": true }
+      ]
+    },
+    {
+      "owner": "phpunit-notice",
+      "severity": "notice",
+      "pattern": [
+        { "regexp": "^There (?:was|were) \\d+ (?:incomplete tests?(?: suites?)?|(?:PHPUnit(?: test runner)? )?notices?):$" },
+        { "regexp": "^(?:(\\s*(/.*|[A-Za-z]:[\\\\/].*):(\\d+)|(?!-+$|There (?:was|were) \\d+ .+:$|\\d+ tests? triggered \\d+ .+:$|OK(?: \\(\\d+ tests?, \\d+ assertions?\\)|, but (?:there were issues|some tests were skipped|incomplete, skipped, or risky tests)!)$|(?:FAILURES|ERRORS|WARNINGS)!$|Tests: \\d+(?:,|\\.?$)|PHPUnit \\d+\\.\\S+ by |Triggered by:$).*)|Triggered by:)$", "message": 1, "file": 2, "line": 3, "loop": true }
+      ]
+    },
+    {
+      "owner": "phpunit-issue",
+      "pattern": [
+        { "regexp": "^\\d+ tests? triggered \\d+ (?:PHP(?:Unit)? )?(error|warning|notice)s?:$", "severity": 1 },
+        { "regexp": "^(?:\\d+\\)\\s)?(?:(\\s*(/.*|[A-Za-z]:[\\\\/].*):(\\d+)|(?!-+$|There (?:was|were) \\d+ .+:$|\\d+ tests? triggered \\d+ .+:$|OK(?: \\(\\d+ tests?, \\d+ assertions?\\)|, but (?:there were issues|some tests were skipped|incomplete, skipped, or risky tests)!)$|(?:FAILURES|ERRORS|WARNINGS)!$|Tests: \\d+(?:,|\\.?$)|PHPUnit \\d+\\.\\S+ by |Triggered by:$).*)|Triggered by:)$", "message": 1, "file": 2, "line": 3, "loop": true }
       ]
     }
   ]

src/configs/tools.json

@@ -153,12 +153,17 @@
     "version_parameter": "-V"
   },
   "phpstan": {
-    "type": "phar",
+    "type": "composer",
     "repository": "phpstan/phpstan",
-    "extension": ".phar",
-    "domain": "https://github.com",
-    "version_prefix": "",
-    "version_parameter": "-V"
+    "scope": "scoped",
+    "fallback": {
+      "type": "phar",
+      "repository": "phpstan/phpstan",
+      "extension": ".phar",
+      "domain": "https://github.com",
+      "version_prefix": "",
+      "version_parameter": "-V"
+    }
   },
   "pie": {
     "type": "phar",

src/configs/tools_schema.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://raw.githubusercontent.com/shivammathur/setup-php/develop/src/configs/tools_schema.json",
   "type": "object",
   "title": "Tools",
@@ -14,123 +14,161 @@
         "function": "function_name",
         "repository": "user/tool",
         "packagist": "user/tool",
-        "scope": "global, scoped",
-        "type": "phar, composer, custom-package or custom-function",
+        "scope": "scoped",
+        "type": "composer",
         "version_parameter": "--version",
-        "version_prefix": "v"
+        "version_prefix": "v",
+        "fallback": {
+          "type": "phar",
+          "repository": "user/tool",
+          "domain": "https://github.com",
+          "extension": ".phar",
+          "version_prefix": "v",
+          "version_parameter": "--version"
+        }
       }
     }
   ],
-  "items": {
-    "properties": {
-      "alias": {
-        "$id": "#/items/properties/alias",
-        "type": "string",
-        "title": "The alias schema",
-        "description": "Alias for a tool.",
-        "examples": [
-          "tool_alias"
-        ]
+  "additionalProperties": {
+    "$ref": "#/$defs/tool"
+  },
+  "$defs": {
+    "tool": {
+      "type": "object",
+      "properties": {
+        "alias": {
+          "type": "string",
+          "title": "The alias schema",
+          "description": "Alias for a tool.",
+          "examples": [
+            "tool_alias"
+          ]
+        },
+        "domain": {
+          "type": "string",
+          "title": "The domain schema",
+          "description": "Domain URL of the tool.",
+          "examples": [
+            "https://example.com"
+          ]
+        },
+        "extension": {
+          "type": "string",
+          "title": "The extension schema",
+          "description": "File extension of the tool.",
+          "examples": [
+            ".ext"
+          ]
+        },
+        "fetch_latest": {
+          "type": "string",
+          "title": "The fetch_latest schema",
+          "description": "Fetch the latest version from GitHub releases.",
+          "enum": [
+            "true",
+            "false"
+          ]
+        },
+        "function": {
+          "type": "string",
+          "title": "The function schema",
+          "description": "Function name in tools.ts which returns the script to setup the tool.",
+          "examples": [
+            "function_name"
+          ]
+        },
+        "repository": {
+          "type": "string",
+          "title": "The repository schema",
+          "description": "GitHub repository of the tool.",
+          "examples": [
+            "user/tool"
+          ]
+        },
+        "packagist": {
+          "type": "string",
+          "title": "The repository schema",
+          "description": "Packagist repository of the tool in case different from repository.",
+          "examples": [
+            "user/tool"
+          ]
+        },
+        "scope": {
+          "type": "string",
+          "title": "The scope schema",
+          "description": "Scope of tool installation: global or scoped",
+          "enum": [
+            "global",
+            "scoped"
+          ]
+        },
+        "type": {
+          "type": "string",
+          "title": "The type schema",
+          "description": "Type of tool: phar, composer, custom-package or custom-function.",
+          "enum": [
+            "phar",
+            "composer",
+            "custom-package",
+            "custom-function"
+          ]
+        },
+        "version_parameter": {
+          "type": "string",
+          "title": "The version_parameter schema",
+          "description": "Parameter to get the tool version.",
+          "examples": [
+            "--version"
+          ]
+        },
+        "version_prefix": {
+          "type": "string",
+          "title": "The version_prefix schema",
+          "description": "Prefix of the version in the download URL.",
+          "examples": [
+            "v"
+          ]
+        },
+        "fallback": {
+          "$ref": "#/$defs/pharFallback"
+        }
       },
-      "domain": {
-        "$id": "#/items/properties/domain",
-        "type": "string",
-        "title": "The domain schema",
-        "description": "Domain URL of the tool.",
-        "examples": [
-          "https://example.com"
-        ]
-      },
-      "extension": {
-        "$id": "#/items/properties/extension",
-        "type": "string",
-        "title": "The extension schema",
-        "description": "File extension of the tool.",
-        "examples": [
-          ".ext"
-        ]
-      },
-      "fetch_latest": {
-        "$id": "#/items/properties/fetch_latest",
-        "type": "string",
-        "title": "The fetch_latest schema",
-        "description": "Fetch the latest version from GitHub releases.",
-        "enum": [
-          "true",
-          "false"
-        ]
-      },
-      "function": {
-        "$id": "#/items/properties/function",
-        "type": "string",
-        "title": "The function schema",
-        "description": "Function name in tools.ts which returns the script to setup the tool.",
-        "examples": [
-          "function_name"
-        ]
-      },
-      "repository": {
-        "$id": "#/items/properties/repository",
-        "type": "string",
-        "title": "The repository schema",
-        "description": "GitHub repository of the tool.",
-        "examples": [
-          "user/tool"
-        ]
-      },
-      "packagist": {
-        "$id": "#/items/properties/packagist",
-        "type": "string",
-        "title": "The repository schema",
-        "description": "Packagist repository of the tool in case different from repository.",
-        "examples": [
-          "user/tool"
-        ]
-      },
-      "scope": {
-        "$id": "#/items/properties/scope",
-        "type": "string",
-        "title": "The scope schema",
-        "description": "Scope of tool installation: global or scoped",
-        "enum": [
-          "global",
-          "scoped"
-        ]
-      },
-      "type": {
-        "$id": "#/items/properties/type",
-        "type": "string",
-        "title": "The type schema",
-        "description": "Type of tool: phar, composer, custom-package or custom-function.",
-        "enum": [
-          "phar",
-          "composer",
-          "custom-package",
-          "custom-function"
-        ]
-      },
-      "version_parameter": {
-        "$id": "#/items/properties/version_parameter",
-        "type": "string",
-        "title": "The version_parameter schema",
-        "description": "Parameter to get the tool version.",
-        "examples": [
-          "--version"
-        ]
-      },
-      "version_prefix": {
-        "$id": "#/items/properties/version_prefix",
-        "type": "string",
-        "title": "The version_prefix schema",
-        "description": "Prefix of the version in the download URL.",
-        "examples": [
-          "v"
-        ]
-      }
+      "required": [
+        "type"
+      ],
+      "additionalProperties": true
     },
-    "required": [
-      "type"
-    ],
-    "additionalProperties": true
+    "pharFallback": {
+      "type": "object",
+      "title": "The fallback schema",
+      "description": "PHAR installation settings used when Composer installation fails.",
+      "properties": {
+        "type": {
+          "const": "phar"
+        },
+        "repository": {
+          "$ref": "#/$defs/tool/properties/repository"
+        },
+        "domain": {
+          "$ref": "#/$defs/tool/properties/domain"
+        },
+        "extension": {
+          "$ref": "#/$defs/tool/properties/extension"
+        },
+        "fetch_latest": {
+          "$ref": "#/$defs/tool/properties/fetch_latest"
+        },
+        "version_parameter": {
+          "$ref": "#/$defs/tool/properties/version_parameter"
+        },
+        "version_prefix": {
+          "$ref": "#/$defs/tool/properties/version_prefix"
+        }
+      },
+      "required": [
+        "type"
+      ],
+      "additionalProperties": false
+    }
   }
-}
+}

src/coverage.ts

@@ -1,6 +1,6 @@
-import * as utils from './utils';
-import * as extensions from './extensions';
-import * as config from './config';
+import * as utils from './utils.js';
+import * as extensions from './extensions.js';
+import * as config from './config.js';
 
 export async function checkXdebugError(
   extension: string,

src/extensions.ts

@@ -1,4 +1,4 @@
-import * as utils from './utils';
+import * as utils from './utils.js';
 
 /**
  * Install and enable extensions for darwin
@@ -180,7 +180,7 @@ export async function addExtensionWindows(
         add_script += await utils.joins(
           '\nAdd-Extension',
           ext_name,
-          ext_version.replace('stable', '')
+          ext_version
         );
         break;
       // match extensions for compiling from source

src/install.ts

@@ -1,12 +1,15 @@
+import {fileURLToPath} from 'url';
 import path from 'path';
-import fs from 'fs';
 import {exec} from '@actions/exec';
-import * as config from './config';
-import * as core from './core';
-import * as coverage from './coverage';
-import * as extensions from './extensions';
-import * as tools from './tools';
-import * as utils from './utils';
+import fs from 'fs';
+import * as config from './config.js';
+import * as core from './core.js';
+import * as coverage from './coverage.js';
+import * as extensions from './extensions.js';
+import * as tools from './tools.js';
+import * as utils from './utils.js';
+
+const dirname = path.dirname(fileURLToPath(import.meta.url));
 
 /**
  * Build the script
@@ -16,7 +19,7 @@ import * as utils from './utils';
 export async function getScript(os: string): Promise<string> {
   const url = 'https://setup-php.com/sponsor';
   const filename = os + (await utils.scriptExtension(os));
-  const script_path = path.join(__dirname, '../src/scripts', filename);
+  const script_path = path.join(dirname, '../src/scripts', filename);
   const run_path = script_path.replace(os, 'run');
   const extension_csv: string = utils.sanitizeShellInput(
     await utils.getInput('extensions', false),

src/packagist.ts

@@ -1,5 +1,5 @@
 import * as cv from 'compare-versions';
-import * as fetch from './fetch';
+import * as fetch from './fetch.js';
 
 type RS = Record<string, string>;
 type RSRS = Record<string, RS>;

src/scripts/darwin.sh

@@ -168,8 +168,12 @@ patch_brew() {
 # Function to update dependencies.
 update_dependencies() {
   if ! [ -e /tmp/update_dependencies ]; then
-    for repo in "$brew_repo" "${core_repo:?}"; do
-      if [ -e "$repo" ]; then
+    local repos=("$brew_repo")
+    if [ -n "${HOMEBREW_NO_INSTALL_FROM_API:-}" ]; then
+      repos+=("${core_repo:?}")
+    fi
+    for repo in "${repos[@]}"; do
+      if [ -d "$repo" ]; then
         git_retry -C "$repo" fetch origin main && git -C "$repo" reset --hard origin/main || return $?
       fi
     done
@@ -199,20 +203,26 @@ setup_cached_versions() {
 
 # Function to setup PHP 5.6 and newer using Homebrew.
 add_php() {
-  local exit_code
+  local exit_code php_alias
   action=$1
   existing_version=$2
   suffix="$(get_php_formula_suffix)"
   php_keg="php@$version$suffix"
   php_formula="shivammathur/php/$php_keg"
   if [[ "$existing_version" = "false" || -n "$suffix" || "$action" = "upgrade" ]]; then
-    if [ "$(uname -m)" = "x86_64" ] || { [ "${runner:?}" != "self-hosted" ] && [ "${use_package_cache:-true}" != "false" ]; }; then
+    if [ "$(uname -m)" = "x86_64" ] || { [ "${runner:?}" != "self-hosted" ] && [ "${use_builds_cache:-true}" != "false" ]; }; then
       setup_cached_versions && return 0
       [ "$(uname -m)" != "x86_64" ] || return 1
     fi
     update_dependencies
     add_brew_tap "$php_tap"
   fi
+  # Resolve PHP aliases before invoking brew to avoid scanning unrelated installed formulae.
+  php_alias="$tap_dir/$php_tap/Aliases/$php_keg"
+  if [ -L "$php_alias" ]; then
+    php_keg="$(basename "$(readlink "$php_alias")" .rb)"
+    php_formula="shivammathur/php/$php_keg"
+  fi
   if [[ "$existing_version" != "false" && -z "$suffix" ]]; then
     if [ "$action" = "upgrade" ]; then
       safe_brew install --only-dependencies "$php_formula" || return $?
@@ -335,7 +345,6 @@ export HOMEBREW_NO_AUTO_UPDATE=1
 export HOMEBREW_NO_ENV_HINTS=1
 export HOMEBREW_NO_INSTALL_CLEANUP=1
 export HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK=1
-export HOMEBREW_NO_INSTALL_FROM_API=1
 
 # shellcheck source=.
 . "${scripts:?}"/unix.sh

src/scripts/extensions/add_extensions.ps1

@@ -85,6 +85,67 @@ Function Add-ExtensionFromGithub {
   }
 }
 
+# Function to install a PIE package or mapped version. Windows uses prebuilt DLLs.
+Function Add-PieExtension {
+  Param (
+    [Parameter(Position = 0, Mandatory = $true)]
+    [ValidateNotNull()]
+    [string]
+    $extension,
+    [Parameter(Position = 1, Mandatory = $false)]
+    [string]
+    $package = '',
+    [Parameter(Position = 2, Mandatory = $false)]
+    [Alias('AllowSourceBuild')]
+    [bool]
+    $allow_source = $false
+  )
+  $requested = ($package -split ':', 2)[-1]
+  if ($package -notmatch '/') {
+    $mapping = Get-Content "$src\configs\pie-extensions.json" -Raw | ConvertFrom-Json
+    $package = $mapping.$extension
+    if (-not $package) { throw "No PIE package mapping for $extension" }
+    if ($requested -in @('', 'latest', 'stable')) { $requested = '' } else { $package += ":$requested" }
+  } elseif ($package -notmatch ':') {
+    $requested = ''
+  }
+  & "$php_dir\php.exe" -r 'exit(extension_loaded($argv[1]) && ($argv[2] === "" || phpversion($argv[1]) === $argv[2]) ? 0 : 1);' -- $extension "$requested" >$null 2>&1
+  if ($LASTEXITCODE -eq 0) {
+    Add-Log $tick $extension 'Enabled'
+    return
+  }
+  $pie_args = @('install', $package, '--no-interaction', '--skip-enable-extension', '--no-build-tools-check', '--no-system-dependencies-check', "--with-php-path=$php_dir\php.exe")
+  if (-not $allow_source) {
+    # Skip CPU detection when compilation is disabled.
+    $pie_args += @('--suppress-download-url-method=composer-default', '--suppress-download-url-method=pre-packaged-source', '--make-parallel-jobs=1')
+  }
+  New-Item -ItemType Directory -Path $composer_home -Force >$null
+  Set-ComposerAuth
+  $pie_log = Join-Path ([System.IO.Path]::GetTempPath()) "pie-$extension.log"
+  $pie_path = Join-Path $bin_dir 'pie'
+  if ([version]$installed.MajorMinorVersion -lt [version]'8.1') {
+    $pie_path = Join-Path $bin_dir 'pie-cli.exe'
+    if (-not (Test-Path $pie_path -PathType Leaf)) {
+      Get-File -Url https://github.com/php/pie/releases/latest/download/pie-Windows-X64.exe -OutFile $pie_path
+    }
+    & $pie_path @pie_args >$pie_log 2>&1
+  } else {
+    if (-not (Test-Path $pie_path -PathType Leaf)) {
+      Add-Tool https://github.com/php/pie/releases/latest/download/pie.phar pie '-V' >$null 2>&1
+    }
+    & "$php_dir\php.exe" $pie_path @pie_args >$pie_log 2>&1
+  }
+  if ($LASTEXITCODE -ne 0) {
+    Get-Content $pie_log | ForEach-Object { Write-Host $_ }
+    throw "Could not install $package using PIE (exit code $LASTEXITCODE)"
+  }
+  Enable-ExtensionDependencies $extension
+  Enable-PhpExtension -Extension $extension -Path $php_dir
+  & "$php_dir\php.exe" -r 'exit(extension_loaded($argv[1]) ? 0 : 1);' -- $extension >$null 2>&1
+  if ($LASTEXITCODE -ne 0) { throw "Could not load $extension after installing $package using PIE" }
+  Add-Log $tick $extension 'Installed and enabled'
+}
+
 # Function to add PHP extensions.
 Function Add-Extension {
   Param (
@@ -104,6 +165,7 @@ Function Add-Extension {
     [string]
     $extension_version = ''
   )
+  $minimum_stability_requested = $PSBoundParameters.ContainsKey('stability') -and $extension_version -eq ''
   $extension_backup = ''
   $restore_startup_errors = $false
   try {
@@ -115,7 +177,7 @@ Function Add-Extension {
       $extension_info = Get-PhpExtension -Path $php_dir | Where-Object { $_.Name -eq $extension -or $_.Handle -eq $extension }
     }
     # Only suppress startup errors while probing a cached DLL or replacing an installed DLL.
-    if($cached -or ($extension_version -ne '' -and $extension_info.Version -ne $extension_version -and (Test-Path "$ext_dir\php_$extension.dll"))) {
+    if($cached -or (($minimum_stability_requested -or ($extension_version -ne '' -and $extension_info.Version -ne $extension_version)) -and (Test-Path "$ext_dir\php_$extension.dll"))) {
       $startup_errors = Get-PhpIniKey -Key display_startup_errors -Path "$php_dir\php.ini"
       if($startup_errors -notmatch '^(0|off|false|no)$') {
         $restore_startup_errors = $true
@@ -147,7 +209,7 @@ Function Add-Extension {
       Remove-Item "$ext_dir\php_$extension.dll" -Force
       $extension_info = $null
     }
-    if ($null -ne $extension_info -and ($extension_version -eq '' -or $extension_info.Version -eq $extension_version)) {
+    if ($null -ne $extension_info -and ($extension_info.State -eq 'Builtin' -or (-not $minimum_stability_requested -and ($extension_version -eq '' -or $extension_info.Version -eq $extension_version)))) {
       switch ($extension_info.State) {
         'Builtin' {
           Add-Log $tick $extension "Enabled"
@@ -169,8 +231,9 @@ Function Add-Extension {
         if ($version -match '8.[1-4]' -and $stability -eq 'stable') {
           $minimumStability = 'snapshot'
         }
+        $maximumStability = if ($extension_version -eq '') { 'stable' } else { $stability }
 
-        $params = @{ Extension = $extension; MinimumStability = $minimumStability; MaximumStability = $stability; Path = $php_dir; AdditionalFilesPath = $deps_dir; NoDependencies = $true }
+        $params = @{ Extension = $extension; MinimumStability = $minimumStability; MaximumStability = $maximumStability; Path = $php_dir; AdditionalFilesPath = $deps_dir; NoDependencies = $true }
         if ($extension_version -ne '')
         {
           $params["Version"] = $extension_version

src/scripts/extensions/add_extensions.sh

@@ -165,19 +165,75 @@ add_extension() {
 # Function to get the PECL version of an extension.
 get_pecl_version() {
   local extension=$1
-  states=("stable" "rc" "preview" "beta" "alpha" "snapshot")
-  stability="$(echo "$2" | grep -m 1 -Eio "($(IFS='|' ; echo "${states[*]}"))")"
-  IFS=' ' read -r -a states <<< "$(echo "${states[@]}" | grep -Eo "$stability.*")"
+  local requested=${2:-stable}
+  local states=("stable" "rc" "preview" "beta" "alpha" "devel" "snapshot")
+  local stability major_version response pecl_version pattern
+  response=$(get -s -n "" "https://pecl.php.net/rest/r/$extension/allreleases.xml")
+  if [[ "$requested" =~ ^[0-9] ]]; then
+    # Preserve exact pins and PECL's case-sensitive archive directory names.
+    pecl_version=$(echo "$response" | grep -Fio "<v>$requested</v>" | head -n 1 | cut -d '>' -f 2 | cut -d '<' -f 1)
+    echo "${pecl_version:-$requested}"
+    return
+  fi
+  requested="$(echo "$requested" | tr '[:upper:]' '[:lower:]')"
+  [[ " ${states[*]} " = *" $requested "* ]] || return 0
+  IFS=' ' read -r -a states <<< "$(echo "${states[@]}" | grep -Eo ".*$requested")"
+  stability="$(IFS='|' ; echo "${states[*]}")"
   major_version=${3:-'[0-9]+'}
-  pecl_rest='https://pecl.php.net/rest/r/'
-  response=$(get -s -n "" "$pecl_rest$extension"/allreleases.xml)
-  for state in "${states[@]}"; do
-    pecl_version=$(echo "$response" | grep -m 1 -Eio "($major_version\.[0-9]+\.[0-9]+${state}[0-9]+<)" | cut -d '<' -f 1)
-    [ -z "$pecl_version" ] && pecl_version=$(echo "$response" | grep -m 1 -Eio "v>(.*)<\/v>.*$state<" | grep -m 1 -Eo "($major_version\.[0-9]+\.[0-9]+.*)<" | cut -d '<' -f 1)
-    [ -n "$pecl_version" ] && break;
-  done
-  [ -z "$pecl_version" ] && pecl_version=$(echo "$response" | grep -m 1 -Eo "($major_version\.[0-9]+\.[0-9]+)<" | cut -d '<' -f 1)
-  echo "$pecl_version"
+  pattern="v>($major_version\.[0-9]+(\.[0-9]+)?)[^<]*</v>[[:space:]]*<s>($stability)<"
+  if [[ "$requested" = rc || "$requested" = preview ]]; then
+    pattern="$pattern|v>($major_version\.[0-9]+(\.[0-9]+)?)($stability)[0-9]*<"
+  fi
+  # PECL orders releases by version, so select the first acceptable state.
+  echo "$response" | grep -Eio "$pattern" | head -n 1 | cut -d '>' -f 2 | cut -d '<' -f 1
+}
+
+# Install a PIE package or mapped version: extension, package, allow_source=false, prefix.
+pie_install() {
+  local extension=$1 package=${2:-} allow_source=${3:-false}
+  local prefix=${4:-$(get_extension_prefix "$extension")} requested pie_path php_config asset arch
+  requested=${package##*:}
+  if [[ "$package" != */* ]]; then
+    package=$(jq -er --arg extension "$extension" '.[$extension]' "${src:?}/configs/pie-extensions.json") || return 1
+    case "$requested" in ''|latest|stable) requested= ;; *) package="$package:$requested" ;; esac
+  elif [[ "$package" != *:* ]]; then
+    requested=
+  fi
+  if php -d display_errors=0 -r 'exit(extension_loaded($argv[1]) && ($argv[2] === "" || phpversion($argv[1]) === $argv[2]) ? 0 : 1);' -- "$extension" "$requested"; then
+    return 0
+  fi
+  local pie_args=(install "$package" --no-interaction --skip-enable-extension --no-build-tools-check --no-system-dependencies-check)
+  php_config=$(command -v php-config) || return 1
+  pie_args+=("--with-php-config=$php_config")
+  if [ "$allow_source" != true ]; then
+    # Skip CPU detection when compilation is disabled.
+    pie_args+=(--suppress-download-url-method=composer-default --suppress-download-url-method=pre-packaged-source --make-parallel-jobs=1)
+  fi
+  if php -r 'exit(PHP_VERSION_ID >= 80100 ? 0 : 1);'; then
+    if ! command -v pie >/dev/null 2>&1; then
+      add_tool https://github.com/php/pie/releases/latest/download/pie.phar pie '-V' >/dev/null 2>&1 || return 1
+    fi
+    pie_path=$(command -v pie) || return 1
+  else
+    arch=$(uname -m)
+    case "$arch" in x86_64|amd64) arch=X64 ;; arm64|aarch64) arch=ARM64 ;; *) return 1 ;; esac
+    asset="pie-$(uname -s)-$arch"
+    [ "$(uname -s)" != Darwin ] || asset="pie-macOS-$arch"
+    pie_path="${tool_path_dir:?}/pie-cli"
+    if [ ! -x "$pie_path" ]; then
+      [ "$(get -v -e "$pie_path" "https://github.com/php/pie/releases/latest/download/$asset")" = 200 ] || return 1
+    fi
+  fi
+  mkdir -p "${composer_home:?}"
+  set_composer_auth
+  sudo -E "$pie_path" "${pie_args[@]}" >"/tmp/pie-$extension.log" 2>&1 || {
+    local status=$?
+    cat "/tmp/pie-$extension.log" >&2
+    return "$status"
+  }
+  sudo rm -f /tmp/php"${version:?}"_extensions
+  enable_extension "$extension" "$prefix" || return 1
+  check_extension "$extension"
 }
 
 # Function to install PECL extensions and accept default options
@@ -190,7 +246,10 @@ pecl_install() {
   # Install using the source interface as it allows for patching.
   if [[ $(printf "%s\n%s" "${version:?}" "8.3" | sort -V | head -n1) != "$version" ]]; then
     extension_version=${extension##*-};
-    [ "$extension_version" = "${extension%-*}" ] &&  extension_version=$(get_pecl_version "$extension" "stable")
+    if [ "$extension_version" = "${extension%-*}" ]; then
+      extension_version=$(get_pecl_version "$extension" "stable")
+      [ -n "$extension_version" ] || return 1
+    fi
     add_extension_from_source "${extension%-*}" https://pecl.php.net "${extension%-*}" "${extension%-*}" "$extension_version" "$prefix" pecl
     check_extension "${extension%-*}" && return 0 || return 1;
   else
@@ -217,7 +276,7 @@ add_pecl_extension() {
   local extension=$1
   local pecl_version=$2
   local prefix=$3
-  if [[ $pecl_version =~ .*(alpha|beta|rc|snapshot|preview).* ]]; then
+  if [[ $pecl_version =~ (alpha|beta|rc|snapshot|preview|devel) ]]; then
     pecl_version=$(get_pecl_version "$extension" "$pecl_version")
   fi
   # Cache versioned extensions using suffixless copies in extension_dir.
@@ -234,12 +293,21 @@ add_pecl_extension() {
     [ -n "$pecl_version" ] && sudo rm -f "${ext_dir:?}/$extension-$pecl_version"
     [ -n "$pecl_version" ] && pecl_version="-$pecl_version"
     pecl_install "$extension$pecl_version" || ( [ "${fail_fast:?}" = "false" ] && add_extension "$extension" "$(get_extension_prefix "$extension")" >/dev/null 2>&1)
-    extension_version="$(php -r "echo phpversion('$extension');")"
+    if ! extension_version="$(php -d display_errors=0 -d display_startup_errors=0 -r "echo phpversion('$extension'); exit(extension_loaded('$extension') ? 0 : 1);" 2>/dev/null)"; then
+      add_log "${cross:?}" "$extension" "Could not install $extension on PHP ${semver:?}"
+      return
+    fi
+    if [ -n "$pecl_version" ] && [ "${extension_version/-/}" != "${pecl_version#-}" ]; then
+      [ "${fail_fast:?}" = "true" ] && add_log "${cross:?}" "$extension-$extension_version" "Installed and enabled, but $extension$pecl_version was requested"
+      add_log "!" "$extension-$extension_version" "Installed and enabled, but $extension$pecl_version was requested"
+      echo "::warning::Installed $extension-$extension_version, but $extension$pecl_version was requested"
+      return
+    fi
     if [ -n "$pecl_version" ] && [ "${extension_version/-/}" = "${pecl_version#-}" ]; then
-      sudo cp "${ext_dir:?}/$extension.so" "${ext_dir:?}/$extension-$extension_version" 2>/dev/null || true
+      sudo cp "${ext_dir:?}/$extension.so" "${ext_dir:?}/$extension$pecl_version" 2>/dev/null || true
     fi
     [ -n "$extension_version" ] && extension_version="-$extension_version"
-    add_extension_log "$extension$extension_version" "Installed and enabled"
+    add_log "${tick:?}" "$extension$extension_version" "Installed and enabled"
   fi
 }
 
@@ -249,6 +317,10 @@ add_unstable_extension() {
   local stability=$2
   local prefix=$3
   pecl_version=$(get_pecl_version "$extension" "$stability")
+  if [ -z "$pecl_version" ]; then
+    add_log "${cross:?}" "$extension-$stability" "No release found with minimum stability $stability"
+    return
+  fi
   add_pecl_extension "$extension" "$pecl_version" "$prefix"
 }
 

src/scripts/extensions/source.sh

@@ -126,7 +126,7 @@ fetch_extension() {
     run_group "git clone -nv $url/$org/$repo /tmp/$repo-$release" "git clone"
     cd /tmp/"$repo-$release" || exit 1
     git checkout -q "$release"
-    cd "$sub_dir" || exit 1
+    cd "${sub_dir:-.}" || exit 1
     if [ -e .gitmodules ]; then
       jobs="$(grep -c "\[submodule" .gitmodules)"
       run_group "git submodule update --jobs $jobs --init --recursive" "git submodule"

src/scripts/linux.sh

@@ -21,7 +21,11 @@ self_hosted_helper() {
     trap "sudo rm -f /usr/bin/apt-fast 2>/dev/null" exit
   fi
   sudo mkdir -p /opt/hostedtoolcache >/dev/null 2>&1 || true
-  install_packages apt-transport-https ca-certificates curl file make jq unzip autoconf automake gcc g++ gnupg
+  local packages=()
+  mapfile -t packages < <(filter_packages apt-transport-https ca-certificates curl file make jq unzip autoconf automake gcc g++ gnupg)
+  if [ "${#packages[@]}" -gt 0 ]; then
+    install_packages "${packages[@]}"
+  fi
 }
 
 # Function to fix broken packages.
@@ -90,6 +94,21 @@ check_package() {
   apt-cache policy "$1" 2>/dev/null | grep -q 'Candidate'
 }
 
+# Function to filter out installed packages
+filter_packages() {
+  [ "$#" -gt 0 ] || return 0
+  local package architecture status
+  local -A installed=()
+  while IFS=$'\t' read -r package architecture status; do
+    [[ "$status" = [ih]'i ' ]] && status=1 || status=0
+    installed["$package"]=$(( ${installed["$package"]:-1} && status ))
+    installed["$package:$architecture"]=$status
+  done < <(dpkg-query -W -f='${Package}\t${Architecture}\t${db:Status-Abbrev}\n' -- "$@" 2>/dev/null)
+  for package in "$@"; do
+    [ "${installed[$package]:-0}" -eq 1 ] || printf '%s\n' "$package"
+  done
+}
+
 # Helper function to add an extension.
 add_extension_helper() {
   local extension=$1
@@ -226,7 +245,7 @@ update_php() {
 
 # Function to install PHP.
 add_php() {
-  if [ "${runner:?}" = "self-hosted" ] || [ "${use_package_cache:-true}" = "false" ]; then
+  if [ "${runner:?}" = "self-hosted" ] || [ "${use_builds_cache:-true}" = "false" ]; then
     if [[ "$version" =~ ${php_builder_versions:?} || "$ts" = "zts" ]]; then
         setup_php_builder
     else
@@ -285,6 +304,9 @@ add_php_config() {
 # Function to Setup PHP
 setup_php() {
   step_log "Setup PHP"
+  if [ "${builds_cache_warning:-false}" = "true" ]; then
+    add_log "!" "PHP" "Cached PHP builds are experimental on this runner and may fail to install"
+  fi
   sudo mkdir -m 777 -p /var/run /run/php
   php_config="$(command -v php-config)"
   check_pre_installed

src/scripts/tools/add_tools.ps1

@@ -237,6 +237,26 @@ Function Add-ToolsHelper() {
   }
 }
 
+# Function to find the newest stable release containing a tool asset.
+Function Get-LastRelease($url) {
+  $releases_url = $url.Split('/latest/download/')[0]
+  $asset = $url.Split('/')[-1]
+  $page = 1
+  do {
+    $releases = (Get-File -Url "${releases_url}?page=$page&q=prerelease%3Afalse").Content
+    foreach ($match in [regex]::Matches($releases, 'src="([^"]+/releases/expanded_assets/[^"]+)"')) {
+      $assets_url = $match.Groups[1].Value
+      if (-not $assets_url.StartsWith("$releases_url/expanded_assets/")) { continue }
+      $download_path = $assets_url.Substring('https://github.com'.Length).Replace('/expanded_assets/', '/download/') + "/$asset"
+      $assets = (Get-File -Url $assets_url).Content
+      if ($assets.Contains("href=`"$download_path`"")) {
+        return "https://github.com$download_path"
+      }
+    }
+    $page++
+  } while ($releases.Contains('class="next_page"'))
+}
+
 # Function to add tools.
 Function Add-Tool() {
   Param (
@@ -288,15 +308,17 @@ Function Add-Tool() {
       try {
         $status_code = (Invoke-WebRequest -Passthru -Uri $url -OutFile $tool_path).StatusCode
       } catch {
-        if($url -match '.*github.com.*releases.*latest.*') {
+        $status_code = 0
+        if($url -match '^https://github\.com/[^/]+/[^/]+/releases/latest/download/[^/?#]+$') {
           try {
-            $url = $url.replace("releases/latest/download", "releases/download/" + ([regex]::match((Get-File -Url ($url.split('/release')[0] + "/releases")).Content, "([0-9]+\.[0-9]+\.[0-9]+)/" + ($url.Substring($url.LastIndexOf("/") + 1))).Groups[0].Value).split('/')[0])
-            $status_code = (Invoke-WebRequest -Passthru -Uri $url -OutFile $tool_path).StatusCode
+            $release_url = Get-LastRelease $url
+            if ($release_url) {
+              $url = $release_url
+              $status_code = (Invoke-WebRequest -Passthru -Uri $url -OutFile $tool_path).StatusCode
+            }
           } catch {
             $status_code = 0
           }
-        } else {
-          $status_code = 0
         }
       }
       if($status_code -eq 200 -and (Test-Path $tool_path)) {
@@ -375,23 +397,33 @@ Function Add-ComposerToolHelper() {
       composer global config --no-plugins allow-plugins."$prefix$tool" true >$null 2>&1
     }
     composer global require $prefix$release $composer_args >$null 2>&1
+    if($LASTEXITCODE -ne 0) {
+      return
+    }
     return composer global show $prefix$tool 2>&1 | findstr '^versions'
   } else {
     $release_stream = [System.IO.MemoryStream]::New([System.Text.Encoding]::ASCII.GetBytes($release))
     $scoped_dir_suffix = (Get-FileHash -InputStream $release_stream -Algorithm sha256).Hash
     $scoped_dir = "$composer_bin\_tools\$tool-$scoped_dir_suffix"
     $unix_scoped_dir = $scoped_dir.replace('\', '/')
-    if(-not(Test-Path $scoped_dir)) {
+    if(-not(Test-Path $scoped_dir\vendor\autoload.php)) {
       New-Item -ItemType Directory -Force -Path $scoped_dir > $null 2>&1
       Set-Content -Path $scoped_dir\composer.json -Value "{}"
       if((composer show $prefix$tool $tool_version -d $unix_scoped_dir -a 2>&1 | findstr '^type *: *composer-plugin') -and ($composer_args -ne '')) {
         composer config -d $unix_scoped_dir --no-plugins allow-plugins."$prefix$tool" true >$null 2>&1
       }
       composer require $prefix$release -d $unix_scoped_dir $composer_args >$null 2>&1
+      if($LASTEXITCODE -ne 0) {
+        return
+      }
+    }
+    $log = composer show $prefix$tool -d $unix_scoped_dir 2>&1 | findstr '^versions'
+    if(-not $log) {
+      return
     }
     [System.Environment]::SetEnvironmentVariable(($tool.replace('-', '_') + '_bin'), "$scoped_dir\vendor\bin")
     Add-Path $scoped_dir\vendor\bin
-    return composer show $prefix$tool -d $unix_scoped_dir 2>&1 | findstr '^versions'
+    return $log
   }
 }
 
@@ -417,7 +449,13 @@ Function Add-ComposerTool() {
     [ValidateNotNull()]
     [ValidateLength(1, [int]::MaxValue)]
     [string]
-    $scope
+    $scope,
+    [Parameter(Position = 4, Mandatory = $false)]
+    [string]
+    $fallback_url,
+    [Parameter(Position = 5, Mandatory = $false)]
+    [string]
+    $fallback_version_parameter
   )
   $composer_args = ""
   if($composer_version.split('.')[0] -ne "1") {
@@ -433,10 +471,13 @@ Function Add-ComposerTool() {
   if(Test-Path $composer_bin\composer) {
     Copy-Item -Path "$bin_dir\composer" -Destination "$composer_bin\composer" -Force
   }
-  Add-ToolsHelper $tool
   if($log) {
     $tool_version = Get-ToolVersion "Write-Output" "$log"
+    Add-ToolsHelper $tool
     Add-Log $tick $tool "Added $tool $tool_version"
+  } elseif($fallback_url) {
+    Add-Log "!" $tool "Could not setup $tool using Composer. Falling back to PHAR."
+    Add-Tool $fallback_url $tool $fallback_version_parameter
   } else {
     Add-Log $cross $tool "Could not setup $tool"
   }

src/scripts/tools/add_tools.sh

@@ -203,6 +203,27 @@ add_tools_helper() {
   done
 }
 
+# Function to find the newest stable release containing a tool asset.
+get_last_release() {
+  local releases_url="${1%/latest/download/*}"
+  local asset="${1##*/}"
+  local page=1 releases assets_url tag download_path
+  while true; do
+    releases=$(get -s -n "" "$releases_url?page=$page&q=prerelease%3Afalse") || return 1
+    while IFS= read -r assets_url; do
+      [[ "$assets_url" = "$releases_url/expanded_assets/"* ]] || continue
+      tag="${assets_url#"$releases_url/expanded_assets/"}"
+      download_path="${releases_url#https://github.com}/download/$tag/$asset"
+      if get -s -n "" "$assets_url" | grep -Fq "href=\"$download_path\""; then
+        printf 'https://github.com%s\n' "$download_path"
+        return 0
+      fi
+    done <<< "$(printf '%s' "$releases" | grep -Eo 'src="[^"]+/releases/expanded_assets/[^"]+"' | cut -d '"' -f 2)"
+    [[ "$releases" = *'class="next_page"'* ]] || return 1
+    page=$((page + 1))
+  done
+}
+
 # Function to setup a remote tool.
 add_tool() {
   url=$1
@@ -243,9 +264,12 @@ add_tool() {
   else
     [ -f "$tool_path" ] && sudo cp -a "$tool_path" "$tool_path.bak"
     status_code=$(get -v -e "$tool_path" "${url[@]}")
-    if [ "$status_code" != "200" ] && [[ "${url[0]}" =~ .*github.com.*releases.*latest.* ]]; then
-      url[0]="${url[0]//releases\/latest\/download/releases/download/$(get -s -n "" "$(echo "${url[0]}" | cut -d '/' -f '1-5')/releases" | grep -Eo -m 1 "([0-9]+\.[0-9]+\.[0-9]+)/$(echo "${url[0]}" | sed -e "s/.*\///")" | cut -d '/' -f 1)}"
-      status_code=$(get -v -e "$tool_path" "${url[0]}")
+    if [ "$status_code" != "200" ] && [[ "${url[0]}" =~ ^https://github\.com/[^/]+/[^/]+/releases/latest/download/[^/?#]+$ ]]; then
+      local release_url
+      if release_url=$(get_last_release "${url[0]}"); then
+        url[0]="$release_url"
+        status_code=$(get -v -e "$tool_path" "${url[0]}")
+      fi
     fi
     if [ "$status_code" = "200" ]; then
       if [ -n "$checksum" ] && ! verify_checksum "$tool_path" "$checksum"; then
@@ -293,19 +317,20 @@ add_composer_tool_helper() {
     if composer global show "$prefix$tool" "$tool_version" -a 2>&1 | grep -qE '^type *: *composer-plugin' && [ -n "$composer_args" ]; then
       composer global config --no-plugins allow-plugins."$prefix$tool" true >/dev/null 2>&1
     fi
-    composer global require "$prefix$release" "$composer_args" >/dev/null 2>&1
+    composer global require "$prefix$release" "$composer_args" >/dev/null 2>&1 || return 1
     composer global show "$prefix$tool" 2>&1 | grep -E ^versions | sudo tee /tmp/composer.log >/dev/null 2>&1
   else
     scoped_dir="$composer_bin/_tools/$tool-$(echo -n "$release" | shasum -a 256 | cut -d ' ' -f 1)"
-    if ! [ -d "$scoped_dir" ]; then
+    if ! [ -f "$scoped_dir/vendor/autoload.php" ]; then
       mkdir -p "$scoped_dir"
       echo '{}' | tee "$scoped_dir/composer.json" >/dev/null
       if composer show "$prefix$tool" "$tool_version" -d "$scoped_dir" -a 2>&1 | grep -qE '^type *: *composer-plugin' && [ -n "$composer_args" ]; then
         composer config -d "$scoped_dir" --no-plugins allow-plugins."$prefix$tool" true >/dev/null 2>&1
       fi
-      composer require "$prefix$release" -d "$scoped_dir" "$composer_args" >/dev/null 2>&1
-      composer show "$prefix$tool" -d "$scoped_dir" 2>&1 | grep -E ^versions | sudo tee /tmp/composer.log >/dev/null 2>&1
+      composer require "$prefix$release" -d "$scoped_dir" "$composer_args" >/dev/null 2>&1 || return 1
     fi
+    composer show "$prefix$tool" -d "$scoped_dir" 2>&1 | grep -E ^versions | sudo tee /tmp/composer.log >/dev/null 2>&1
+    [ -s /tmp/composer.log ] || return 1
     add_path "$scoped_dir"/vendor/bin
   fi
 }
@@ -316,6 +341,7 @@ add_composer_tool() {
   release=$2
   prefix=$3
   scope=$4
+  local fallback_url=${5:-} fallback_version_parameter=${6:-}
   composer_args=
   composer_major_version=$(cut -d'.' -f 1 /tmp/composer_version)
   if [ "$composer_major_version" != "1" ]; then
@@ -326,11 +352,17 @@ add_composer_tool() {
       return
     fi
   fi
-  add_composer_tool_helper "$tool" "$release" "$prefix" "$scope" "$composer_args"
-  tool_version=$(get_tool_version cat /tmp/composer.log)
-  ([ -s /tmp/composer.log ] && add_log "$tick" "$tool" "Added $tool $tool_version"
-  ) || add_log "$cross" "$tool" "Could not setup $tool"
-  add_tools_helper "$tool"
+  sudo rm -f /tmp/composer.log
+  if add_composer_tool_helper "$tool" "$release" "$prefix" "$scope" "$composer_args" && [ -s /tmp/composer.log ]; then
+    tool_version=$(get_tool_version cat /tmp/composer.log)
+    add_tools_helper "$tool"
+    add_log "$tick" "$tool" "Added $tool $tool_version"
+  elif [ -n "$fallback_url" ]; then
+    add_log "!" "$tool" "Could not setup $tool using Composer. Falling back to PHAR."
+    add_tool "$fallback_url" "$tool" "$fallback_version_parameter"
+  else
+    add_log "$cross" "$tool" "Could not setup $tool"
+  fi
   if [ -e "$composer_bin/composer" ]; then
     sudo cp -a "$tool_path_dir/composer" "$composer_bin"
   fi

src/scripts/tools/brew.sh

@@ -225,6 +225,11 @@ configure_brew() {
   tap_dir="$brew_repo"/Library/Taps
   core_repo="$tap_dir"/homebrew/homebrew-core
 
+  if [ -d "$core_repo" ]; then
+    export HOMEBREW_NO_INSTALL_FROM_API=1
+  else
+    unset HOMEBREW_NO_INSTALL_FROM_API
+  fi
   export HOMEBREW_CHANGE_ARCH_TO_ARM=1
   export HOMEBREW_NO_AUTO_UPDATE=1
   export HOMEBREW_NO_ENV_HINTS=1

src/scripts/unix.sh

@@ -33,6 +33,8 @@ add_log() {
   local message=$3
   if [ "$mark" = "$tick" ]; then
     printf "\033[32;1m%s \033[0m\033[34;1m%s \033[0m\033[90;1m%s\033[0m\n" "$mark" "$subject" "$message"
+  elif [ "$mark" = "!" ]; then
+    printf "\033[33;1m%s \033[0m\033[34;1m%s \033[0m\033[90;1m%s\033[0m\n" "$mark" "$subject" "$message"
   else
     printf "\033[31;1m%s \033[0m\033[34;1m%s \033[0m\033[90;1m%s\033[0m\n" "$mark" "$subject" "$message"
     [ "$fail_fast" = "true" ] && exit 1
@@ -58,6 +60,22 @@ without_trace() {
   return "$setup_php_trace_status"
 }
 
+# Function to check third-party runners eligible for the builds cache.
+check_builds_cache_runner() {
+  local pid=$PPID executable
+  while [[ "$pid" =~ ^[0-9]+$ && "$pid" -gt 1 ]]; do
+    executable="$(readlink -f "/proc/$pid/exe")" || return 1
+    if [[ "$executable" = */bin/Runner.Worker ]]; then
+      jq -e --arg name "${RUNNER_NAME:-}" \
+        '.AgentName == $name and (.AgentName | test("^(blacksmith|depot)-"))' \
+        "${executable%/bin/Runner.Worker}/.runner" >/dev/null 2>&1
+      return $?
+    fi
+    pid="$(awk '$1 == "PPid:" {print $2}' "/proc/$pid/status")" || return 1
+  done
+  return 1
+}
+
 # Function to read env inputs.
 read_env() {
   if [[ "${SETUP_PHP_TRACE:-0}" =~ ^[12]$ ]]; then
@@ -67,10 +85,19 @@ read_env() {
   [ "${debug:-${DEBUG:-false}}" = "true" ] && debug=debug && update=true || debug=release
   [[ "${phpts:-${PHPTS:-nts}}" = "ts" || "${phpts:-${PHPTS:-nts}}" = "zts" ]] && ts=zts && update=true || ts=nts
   fail_fast="${fail_fast:-${FAIL_FAST:-false}}"
+  use_builds_cache="${use_builds_cache:-${use_package_cache:-}}"
   [[ ( -z "$ImageOS" && -z "$ImageVersion" ) ||
      ( -n "$RUNNER_ENVIRONMENT" && "$RUNNER_ENVIRONMENT" = "self-hosted" ) ||
      -n "$ACT" || -n "$CONTAINER" ]] && _runner=self-hosted || _runner=github
   runner="${runner:-${RUNNER:-$_runner}}"
+  if [[ $_runner = "self-hosted" && "${use_builds_cache:-false}" = "true" ]]; then
+    runner=github
+    if [[ "${ID:-}" = "ubuntu" && -z "$ACT" && -z "$CONTAINER" &&
+          ( -n "${BLACKSMITH_VM_ID:-}" || "${RUNNER_NAME:-}" =~ ^(blacksmith|depot)- ) ]] && check_builds_cache_runner; then
+      _runner=github
+      builds_cache_warning=true
+    fi
+  fi
   tool_path_dir="${setup_php_tools_dir:-${SETUP_PHP_TOOLS_DIR:-/usr/local/bin}}"
   tool_cache_path_dir="${setup_php_tool_cache_dir:-${SETUP_PHP_TOOL_CACHE_DIR:-${RUNNER_TOOL_CACHE:-/opt/hostedtoolcache}/setup-php/tools}}"  
 

src/scripts/win32.ps1

@@ -20,6 +20,8 @@ Function Step-Log($message) {
 Function Add-Log($mark, $subject, $message) {
   if ($mark -eq $tick) {
     printf "\033[32;1m%s \033[0m\033[34;1m%s \033[0m\033[90;1m%s \033[0m\n" $mark $subject $message
+  } elseif ($mark -eq "!") {
+    printf "\033[33;1m%s \033[0m\033[34;1m%s \033[0m\033[90;1m%s \033[0m\n" $mark $subject $message
   } else {
     printf "\033[31;1m%s \033[0m\033[34;1m%s \033[0m\033[90;1m%s \033[0m\n" $mark $subject $message
     if($env:fail_fast -eq 'true') {

src/tools.ts

@@ -1,9 +1,12 @@
+import {fileURLToPath} from 'url';
 import path from 'path';
 import fs from 'fs';
 import * as cv from 'compare-versions';
-import * as fetch from './fetch';
-import * as packagist from './packagist';
-import * as utils from './utils';
+import * as fetch from './fetch.js';
+import * as packagist from './packagist.js';
+import * as utils from './utils.js';
+
+const dirname = path.dirname(fileURLToPath(import.meta.url));
 
 /**
  * Valid function names for custom tool handlers
@@ -48,6 +51,7 @@ export interface ToolData {
   url: string;
   uri?: string;
   error?: string;
+  fallback?: ToolFallback;
 }
 
 /**
@@ -72,8 +76,19 @@ interface ToolConfig {
   version_parameter?: string;
   version_prefix?: string;
   packagist?: string;
+  fallback?: ToolFallback;
 }
 
+type ToolFallback = Pick<
+  ToolConfig,
+  | 'repository'
+  | 'domain'
+  | 'extension'
+  | 'fetch_latest'
+  | 'version_parameter'
+  | 'version_prefix'
+> & {type: 'phar'};
+
 /**
  * Regex to match a checksum suffix in a tool release - tool:version@sha256:<hash>
  */
@@ -141,21 +156,13 @@ interface GitHubRef {
   };
 }
 
-/**
- * Deployer manifest entry
- */
-interface DeployerManifestEntry {
-  version: string;
-  url: string;
-}
-
 export function skipGitHubAuthForComposerVersion(version: string): boolean {
   if (!/^\d+\.\d+\.\d+(?:-[\w-]+)?$/.test(version)) {
     return false;
   }
   return fs
     .readFileSync(
-      path.join(__dirname, '../src/configs/composer-gh-auth-no-op'),
+      path.join(dirname, '../src/configs/composer-gh-auth-no-op'),
       'utf8'
     )
     .trim()
@@ -414,7 +421,23 @@ export async function addPackage(data: ToolData): Promise<string> {
   const args = [parts[1], data.release, parts[0] + '/', data.scope]
     .map(a => utils.safeArg(a, data.os))
     .join(' ');
-  return command + args;
+  if (!data.fallback) return command + args;
+  const fallback = await getData(
+    data.release.replace(/\.\*$/, ''),
+    data.php_version,
+    data.os,
+    data.fallback
+  );
+  // A failed version lookup must not prevent a successful Composer install.
+  if (fallback.error) return command + args;
+  return (
+    command +
+    args +
+    ' ' +
+    utils.safeArg(fallback.url, data.os) +
+    ' ' +
+    (fallback.version_parameter || '""')
+  );
 }
 
 /**
@@ -514,29 +537,17 @@ export async function addComposer(data: ToolData): Promise<string> {
  * @param data
  */
 export async function addDeployer(data: ToolData): Promise<string> {
-  if (data.version === 'latest') {
-    data.url = data.domain + '/deployer.phar';
-  } else {
-    const manifest = await fetch.fetch('https://deployer.org/manifest.json');
-    const version_data: Record<string, DeployerManifestEntry> = JSON.parse(
-      manifest.data
-    );
-    const version_key: string | undefined = Object.keys(version_data).find(
-      (key: string) => {
-        return version_data[key].version === data.version;
-      }
-    );
-    if (version_key) {
-      data.url = version_data[version_key].url;
-    } else {
-      return await utils.addLog(
-        '$cross',
-        'deployer',
-        'Version missing in deployer manifest',
-        data.os
-      );
-    }
-  }
+  const github_url = await getUrl({
+    ...data,
+    domain: data.github,
+    prefix: 'releases',
+    verb: 'download'
+  });
+  const source_url =
+    data.version === 'latest'
+      ? `${data.domain}/deployer.phar`
+      : `${data.domain}/releases/v${data.version}/deployer.phar`;
+  data.url = `${github_url},${source_url}`;
   return await addArchive(data);
 }
 
@@ -670,9 +681,10 @@ export async function addWPCLI(data: ToolData): Promise<string> {
 export async function getData(
   release: string,
   php_version: string,
-  os: string
+  os: string,
+  overrides: ToolConfig = {}
 ): Promise<ToolData> {
-  const json_file_path = path.join(__dirname, '../src/configs/tools.json');
+  const json_file_path = path.join(dirname, '../src/configs/tools.json');
   const json_file: string = fs.readFileSync(json_file_path, 'utf8');
   const json_objects: Record<string, ToolConfig> = JSON.parse(json_file);
   release = release.replace(/\s+/g, '');
@@ -702,6 +714,7 @@ export async function getData(
       config = {tool};
     }
   }
+  config = {...config, ...overrides};
   const github = 'https://github.com';
   const domain = config.domain ?? github;
   const data: ToolData = {
@@ -727,7 +740,8 @@ export async function getData(
     packagist: config.packagist ?? config.repository ?? '',
     type: config.type,
     function: config.function,
-    alias: config.alias
+    alias: config.alias,
+    fallback: config.fallback
   };
   data.checksum = checksum_data.checksum;
   data.error = checksum_data.error;

src/utils.ts

@@ -1,7 +1,10 @@
+import {fileURLToPath} from 'url';
 import fs from 'fs';
 import * as path from 'path';
-import * as core from './core';
-import * as fetch from './fetch';
+import * as core from './core.js';
+import * as fetch from './fetch.js';
+
+const dirname = path.dirname(fileURLToPath(import.meta.url));
 
 /**
  * Function to read environment variable and return a string value.
@@ -88,12 +91,9 @@ export async function parseVersion(version: string): Promise<string> {
       if (!/^\d+(\.\d+){0,2}$/.test(version)) {
         throw new Error(`Invalid PHP version: ${version.slice(0, 20)}`);
       }
-      switch (true) {
-        case version.length > 1:
-          return version.slice(0, 3);
-        default:
-          return version + '.0';
-      }
+      return version.includes('.')
+        ? version.split('.').slice(0, 2).join('.')
+        : version + '.0';
   }
 }
 
@@ -480,7 +480,7 @@ export async function customPackage(
   const pkg_name: string = pkg.replace(/\d+|(pdo|pecl)[_-]|[_-]db2/, '');
   const script_extension: string = await scriptExtension(os);
   const script: string = path.join(
-    __dirname,
+    dirname,
     '../src/scripts/' + type + '/' + pkg_name + script_extension
   );
   const command: string = await getCommand(os, pkg_name);

tsconfig.json

@@ -5,8 +5,8 @@
     "lib": [
       "ES2025"
     ],
-    "module": "Node20",
-    "moduleResolution": "Node16",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
     "noImplicitAny": true,
     "outDir": "./lib",
     "removeComments": true,