ci: Replace shivammathur/setup-php with direct apt commands

[mtrezza]

Summary

Replace untrusted third-party shivammathur/setup-php action with direct apt commands to reduce supply chain attack surface. The ondrej/php PPA is the standard source for PHP packages on Ubuntu.

Changes

• Replace shivammathur/setup-php@v2 with apt-get install from ppa:ondrej/php in ci.yml, release-automated.yml, and release-manual-docs.yml
• Installs PHP version + mbstring, xml, curl extensions (required by Composer and the SDK)

Summary by CodeRabbit

• Chores
  • Updated CI/CD pipelines to configure PHP using direct shell commands instead of relying on a third-party GitHub Action, maintaining consistent PHP version and extension installations across all workflows.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e025c581-12f1-4a5e-b57b-ea98802cecb3

📥 Commits

Reviewing files that changed from the base of the PR and between 24adcf1 and b8646de.

📒 Files selected for processing (3)

• .github/workflows/ci.yml
• .github/workflows/release-automated.yml
• .github/workflows/release-manual-docs.yml

---

📝 Walkthrough

Walkthrough

Replaced GitHub Action–based PHP setup (shivammathur/setup-php@v2) with explicit Ubuntu shell commands across three CI/CD workflow files. Each workflow now adds the Ondřej Surý PHP PPA, installs PHP with required extensions, and configures system alternatives. Downstream workflow steps remain unchanged.

Changes

Cohort / File(s)	Summary
GitHub Actions PHP Setup Migration .github/workflows/ci.yml, .github/workflows/release-automated.yml, .github/workflows/release-manual-docs.yml	Replaced shivammathur/setup-php@v2 action with inline shell commands that add ondrej/php PPA, install php${PHP_VERSION} with mbstring, xml, and curl extensions, update system php alternative, and print version info. All downstream workflow steps unchanged.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 3

❌ Failed checks (2 warnings, 1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description is missing several required sections from the template including the checklist, issue reference, and pre-merge TODOs.	Add the missing template sections: New Pull Request Checklist (with vulnerability and issue reference checks), Closes link, and TODOs before merging section.
Security Check	⚠️ Warning	Critical security vulnerabilities detected: missing GPG key verification for PPA (CWE-295/347), lack of error handling with set -e (CWE-252), unquoted variable substitution (CWE-94), and unverified external PPA dependency (CWE-427).	Add GPG key verification before PPA, include set -e for error handling, quote variables, and consider pinning versions or using pre-installed PHP runners instead of external PPAs.
Engage In Review Feedback	❓ Inconclusive	Assessment requires access to GitHub PR comments and review feedback not available in local git repository.	Access the actual GitHub PR #523 to review reviewer comments, feedback, and discussion threads to determine if review feedback exists and if the user has engaged with it.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title 'ci: Replace shivammathur/setup-php with direct apt commands' begins with the required 'ci:' prefix and clearly summarizes the main change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 actionlint (1.7.12)

.github/workflows/ci.yml

could not read ".github/workflows/ci.yml": open .github/workflows/ci.yml: no such file or directory

.github/workflows/release-automated.yml

could not read ".github/workflows/release-automated.yml": open .github/workflows/release-automated.yml: no such file or directory

.github/workflows/release-manual-docs.yml

could not read ".github/workflows/release-manual-docs.yml": open .github/workflows/release-manual-docs.yml: no such file or directory

🔧 YAMLlint (1.38.0)

.github/workflows/release-automated.yml

[Errno 2] No such file or directory: '.github/workflows/release-automated.yml'

.github/workflows/ci.yml

[Errno 2] No such file or directory: '.github/workflows/ci.yml'

.github/workflows/release-manual-docs.yml

[Errno 2] No such file or directory: '.github/workflows/release-manual-docs.yml'

🔧 Checkov (3.2.513)

.github/workflows/ci.yml

2026-04-04 19:04:44,032 [MainThread ] [ERROR] Template file not found: .github/workflows/ci.yml
2026-04-04 19:04:44,038 [MainThread ] [ERROR] Template file not found: .github/workflows/ci.yml
2026-04-04 19:04:44,083 [MainThread ] [ERROR] Template file not found: .github/workflows/ci.yml
2026-04-04 19:04:44,129 [MainThread ] [WARNI] Secret scanning: could not process file .github/workflows/ci.yml
2026-04-04 19:04:44,117 [MainThread ] [ERROR] Failed to invoke function /usr/local/lib/python3.11/dist-packages/checkov/common/runners/object_runner. with .github/workflows/ci.yml
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 88, in func_wrapper
result = original_func(item)
^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/common/runners/object_runner.py", line 74, in
results = parallel_runner.run_function(lambda f: (f, self.parse

... [truncated 8994 characters] ...

[Errno 2] No such file or directory: '.github/workflows/ci.yml'
2026-04-04 19:04:44,149 [MainThread ] [ERROR] Exception traceback:
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/checkov/main.py", line 647, in run
self.scan_reports = runner_registry.run(
^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/common/runners/runner_registry.py", line 177, in run
for result in parallel_runner_results:
File "/usr/local/lib/python3.11/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 118, in _run_function_multiprocess_fork
raise v.internal_exception.with_traceback(v.internal_exception.traceback)
FileNotFoundError: [Errno 2] No such file or directory: '.github/workflows/ci.yml'

.github/workflows/release-automated.yml

2026-04-04 19:04:44,247 [MainThread ] [ERROR] Template file not found: .github/workflows/release-automated.yml
2026-04-04 19:04:44,260 [MainThread ] [ERROR] Template file not found: .github/workflows/release-automated.yml
2026-04-04 19:04:44,306 [MainThread ] [ERROR] Template file not found: .github/workflows/release-automated.yml
2026-04-04 19:04:44,311 [MainThread ] [ERROR] Failed to invoke function /usr/local/lib/python3.11/dist-packages/checkov/common/runners/object_runner. with .github/workflows/release-automated.yml
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 88, in func_wrapper
result = original_func(item)
^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/common/runners/object_runner.py", line 74, in
results = parallel_runner.run_function(lambda f: (f, self._parse_file(f)), files_to_load)

... [truncated 9249 characters] ...

cess file .github/workflows/release-automated.yml
2026-04-04 19:04:44,383 [MainThread ] [ERROR] Exception traceback:
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/checkov/main.py", line 647, in run
self.scan_reports = runner_registry.run(
^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/common/runners/runner_registry.py", line 177, in run
for result in parallel_runner_results:
File "/usr/local/lib/python3.11/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 118, in _run_function_multiprocess_fork
raise v.internal_exception.with_traceback(v.internal_exception.traceback)
FileNotFoundError: [Errno 2] No such file or directory: '.github/workflows/release-automated.yml'

.github/workflows/release-manual-docs.yml

2026-04-04 19:04:44,379 [MainThread ] [ERROR] Template file not found: .github/workflows/release-manual-docs.yml
2026-04-04 19:04:44,387 [MainThread ] [ERROR] Template file not found: .github/workflows/release-manual-docs.yml
2026-04-04 19:04:44,428 [MainThread ] [ERROR] Template file not found: .github/workflows/release-manual-docs.yml
2026-04-04 19:04:44,429 [MainThread ] [ERROR] Failed to invoke function /usr/local/lib/python3.11/dist-packages/checkov/common/runners/object_runner. with .github/workflows/release-manual-docs.yml
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 88, in func_wrapper
result = original_func(item)
^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/common/runners/object_runner.py", line 74, in
results = parallel_runner.run_function(lambda f: (f, self._parse_file(f)), files_to_load)

... [truncated 9283 characters] ...

file .github/workflows/release-manual-docs.yml
2026-04-04 19:04:44,519 [MainThread ] [ERROR] Exception traceback:
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/checkov/main.py", line 647, in run
self.scan_reports = runner_registry.run(
^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/common/runners/runner_registry.py", line 177, in run
for result in parallel_runner_results:
File "/usr/local/lib/python3.11/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 118, in _run_function_multiprocess_fork
raise v.internal_exception.with_traceback(v.internal_exception.traceback)
FileNotFoundError: [Errno 2] No such file or directory: '.github/workflows/release-manual-docs.yml'

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}