build: wait 2 days before using a new PHP build

.github/workflows/update-php.yml

@@ -6,6 +6,11 @@ on:
   schedule:
     - cron: "30 6 * * *"
   workflow_dispatch:
+    inputs:
+      cooldown_days:
+        description: Only use releases published at least this many days ago (0 to skip the cooldown, e.g. for a security fix)
+        type: number
+        default: 2
 
 permissions:
   contents: read
@@ -32,6 +37,8 @@ jobs:
         id: check
         env:
           GH_TOKEN: ${{ github.token }}
+          # Empty on scheduled runs, so the script's default applies.
+          COOLDOWN_DAYS: ${{ inputs.cooldown_days }}
         run: |
           scripts/update-php.sh "$RUNNER_TEMP/title" "$RUNNER_TEMP/body"
           if [[ -f "$RUNNER_TEMP/title" ]]; then

CLAUDE.md

@@ -154,8 +154,8 @@ make download-php
 ```
 
 **Upgrading PHP Version**:
-- The `update-php` workflow runs daily: it finds the latest cli-php-builds release for the current PHP minor version, and opens or updates a pull request that updates `PHP_VERSION`, `PHP_BUILD` and the checksums (with `scripts/update-php.sh`). The pull request lists the changed source archives (from the releases' `sources.json`)
-- For a new PHP minor version: trigger the build workflow at [upsun/cli-php-builds](https://github.com/upsun/cli-php-builds/actions) with the new version, then set `PHP_VERSION` to it and `PHP_BUILD` to `0` (builds are numbered from 1), run `scripts/update-php.sh <title-file> <body-file>`, and `make download-php` to check the downloads
+- The `update-php` workflow runs daily: it finds the latest cli-php-builds release for the current PHP minor version that was published at least 2 days ago (a cooldown, so that problems with new upstream releases can be found first; run the workflow with `cooldown_days` set to 0 to skip it, e.g. for a security fix), and opens or updates a pull request that updates `PHP_VERSION`, `PHP_BUILD` and the checksums (with `scripts/update-php.sh`). The pull request lists the changed source archives (from the releases' `sources.json`)
+- For a new PHP minor version: trigger the build workflow at [upsun/cli-php-builds](https://github.com/upsun/cli-php-builds/actions) with the new version, then set `PHP_VERSION` to it and `PHP_BUILD` to `0` (builds are numbered from 1), run `COOLDOWN_DAYS=0 scripts/update-php.sh <title-file> <body-file>`, and `make download-php` to check the downloads
 
 ## Development Notes
 

scripts/update-php.sh

@@ -1,12 +1,18 @@
 #!/usr/bin/env bash
 # Updates the pinned PHP build (in the Makefile and the checksums file) to the latest cli-php-builds release for the
-# current PHP minor version.
+# current PHP minor version, among those published at least COOLDOWN_DAYS days ago (default 2), so that problems with
+# new upstream releases can be found first. Set COOLDOWN_DAYS=0 to skip the cooldown, e.g. for a security fix.
 # Writes a pull request title and body to the files given as arguments, if anything changed.
 # Requires: gh (authenticated), jq, curl, sha256sum.
 set -euo pipefail
 
 title_file=${1:?Usage: $0 TITLE_FILE BODY_FILE}
 body_file=${2:?Usage: $0 TITLE_FILE BODY_FILE}
+cooldown_days=${COOLDOWN_DAYS:-2}
+if ! [[ "$cooldown_days" =~ ^[0-9]+$ ]]; then
+  echo "COOLDOWN_DAYS must be a whole number of days: $cooldown_days" >&2
+  exit 1
+fi
 
 repo=upsun/cli-php-builds
 sums_file=internal/legacy/php_sha256sums.txt
@@ -28,21 +34,26 @@ php_build=$(makefile_var PHP_BUILD)
 old_tag="php-$php_version-$php_build"
 minor=$(cut -d. -f1,2 <<< "$php_version")
 
-new_tag=$(gh release list --repo "$repo" --exclude-drafts --exclude-pre-releases --limit 100 \
-  --json tagName --jq '.[].tagName' \
-  | grep -E "^php-${minor//./\\.}\.[0-9]+-[0-9]+$" | sort -V | tail -n1 || true)
+tags=$(gh release list --repo "$repo" --exclude-drafts --exclude-pre-releases --limit 100 \
+  --json tagName,publishedAt \
+  | jq -r --argjson days "$cooldown_days" \
+    '.[] | select((.publishedAt | fromdateiso8601) <= now - $days * 86400) | .tagName' \
+  | grep -E "^php-${minor//./\\.}\.[0-9]+-[0-9]+$" || true)
+new_tag=$(sort -V <<< "$tags" | tail -n1)
 if [[ -z "$new_tag" ]]; then
-  echo "No release found for PHP $minor" >&2
+  echo "No release found for PHP $minor published at least $cooldown_days day(s) ago" \
+    "(set COOLDOWN_DAYS=0 to skip the cooldown)" >&2
   exit 1
 fi
 
 if [[ "$new_tag" == "$old_tag" ]]; then
   echo "Up to date: $old_tag"
   exit 0
 fi
+# The pinned release may be newer than the cooldown allows, if it was updated manually.
 if [[ "$(sort -V <<< "$old_tag"$'\n'"$new_tag" | tail -n1)" != "$new_tag" ]]; then
-  echo "The latest release $new_tag is older than $old_tag" >&2
-  exit 1
+  echo "Up to date: $old_tag is newer than $new_tag, the latest release published at least $cooldown_days day(s) ago"
+  exit 0
 fi
 new_version=$(sed -E 's/^php-(.*)-[0-9]+$/\1/' <<< "$new_tag")
 new_build=${new_tag##*-}