build: wait 2 days before using a new PHP build

.github/workflows/update-php.yml

@@ -6,6 +6,11 @@ on:
   schedule:
     - cron: "30 6 * * *"
   workflow_dispatch:
+    inputs:
+      cooldown_days:
+        description: Only use releases published at least this many days ago (0 to skip the cooldown, e.g. for a security fix)
+        type: number
+        default: 2
 
 permissions:
   contents: read
@@ -32,22 +37,31 @@ jobs:
         id: check
         env:
           GH_TOKEN: ${{ github.token }}
+          # Empty on scheduled runs, so the script's default applies.
+          COOLDOWN_DAYS: ${{ inputs.cooldown_days }}
         run: |
           scripts/update-php.sh "$RUNNER_TEMP/title" "$RUNNER_TEMP/body"
           if [[ -f "$RUNNER_TEMP/title" ]]; then
             echo "title=$(cat "$RUNNER_TEMP/title")" >> "$GITHUB_OUTPUT"
           fi
 
-      # Skips pushing again (and re-running CI) if the branch already has this update.
+      # Skips pushing again (and re-running CI) if the branch already has this
+      # build, or a newer one (e.g. from a run that skipped the cooldown).
       - name: Check the existing branch
         id: existing
         if: steps.check.outputs.title
-        env:
-          TITLE: ${{ steps.check.outputs.title }}
         run: |
-          if git fetch --depth=1 origin "$BRANCH" 2>/dev/null \
-            && [[ "$(git log -1 --format=%s FETCH_HEAD)" == "$TITLE" ]]; then
-            echo "up_to_date=true" >> "$GITHUB_OUTPUT"
+          pinned() {
+            echo "$(sed -n 's/^PHP_VERSION = //p' "$1")-$(sed -n 's/^PHP_BUILD = //p' "$1")"
+          }
+          if git fetch --depth=1 origin "$BRANCH" 2>/dev/null; then
+            git show FETCH_HEAD:Makefile > "$RUNNER_TEMP/branch.mk"
+            new=$(pinned Makefile)
+            existing=$(pinned "$RUNNER_TEMP/branch.mk")
+            if [[ "$(printf '%s\n' "$new" "$existing" | sort -V | tail -n1)" == "$existing" ]]; then
+              echo "The branch already has PHP $existing"
+              echo "up_to_date=true" >> "$GITHUB_OUTPUT"
+            fi
           fi
 
       - name: Verify the downloads

CLAUDE.md

@@ -154,8 +154,8 @@ make download-php
 ```
 
 **Upgrading PHP Version**:
-- The `update-php` workflow runs daily: it finds the latest cli-php-builds release for the current PHP minor version, and opens or updates a pull request that updates `PHP_VERSION`, `PHP_BUILD` and the checksums (with `scripts/update-php.sh`). The pull request lists the changed source archives (from the releases' `sources.json`)
-- For a new PHP minor version: trigger the build workflow at [upsun/cli-php-builds](https://github.com/upsun/cli-php-builds/actions) with the new version, then set `PHP_VERSION` to it and `PHP_BUILD` to `0` (builds are numbered from 1), run `scripts/update-php.sh <title-file> <body-file>`, and `make download-php` to check the downloads
+- The `update-php` workflow runs daily: it finds the latest cli-php-builds release for the current PHP minor version that was published at least 2 days ago (a cooldown, so that problems with new upstream releases can be found first; run the workflow with `cooldown_days` set to 0 to skip it, e.g. for a security fix), and opens or updates a pull request that updates `PHP_VERSION`, `PHP_BUILD` and the checksums (with `scripts/update-php.sh`). The pull request lists the changed source archives (from the releases' `sources.json`)
+- For a new PHP minor version: trigger the build workflow at [upsun/cli-php-builds](https://github.com/upsun/cli-php-builds/actions) with the new version, then set `PHP_VERSION` to it and `PHP_BUILD` to `0` (builds are numbered from 1), run `COOLDOWN_DAYS=0 scripts/update-php.sh <title-file> <body-file>`, and `make download-php` to check the downloads
 
 ## Development Notes
 

scripts/update-php.sh

@@ -1,12 +1,18 @@
 #!/usr/bin/env bash
 # Updates the pinned PHP build (in the Makefile and the checksums file) to the latest cli-php-builds release for the
-# current PHP minor version.
+# current PHP minor version, among those published at least COOLDOWN_DAYS days ago (default 2), so that problems with
+# new upstream releases can be found first. Set COOLDOWN_DAYS=0 to skip the cooldown, e.g. for a security fix.
 # Writes a pull request title and body to the files given as arguments, if anything changed.
 # Requires: gh (authenticated), jq, curl, sha256sum.
 set -euo pipefail
 
 title_file=${1:?Usage: $0 TITLE_FILE BODY_FILE}
 body_file=${2:?Usage: $0 TITLE_FILE BODY_FILE}
+cooldown_days=${COOLDOWN_DAYS:-2}
+if ! [[ "$cooldown_days" =~ ^[0-9]+$ ]]; then
+  echo "COOLDOWN_DAYS must be a whole number of days: $cooldown_days" >&2
+  exit 1
+fi
 
 repo=upsun/cli-php-builds
 sums_file=internal/legacy/php_sha256sums.txt
@@ -28,21 +34,31 @@ php_build=$(makefile_var PHP_BUILD)
 old_tag="php-$php_version-$php_build"
 minor=$(cut -d. -f1,2 <<< "$php_version")
 
-new_tag=$(gh release list --repo "$repo" --exclude-drafts --exclude-pre-releases --limit 100 \
-  --json tagName --jq '.[].tagName' \
-  | grep -E "^php-${minor//./\\.}\.[0-9]+-[0-9]+$" | sort -V | tail -n1 || true)
+releases=$(gh release list --repo "$repo" --exclude-drafts --exclude-pre-releases --limit 100 \
+  --json tagName,publishedAt)
+tag_pattern="^php-${minor//./\\.}\.[0-9]+-[0-9]+$"
+all_tags=$(jq -r '.[].tagName' <<< "$releases")
+cooled_tags=$(jq -r --argjson days "$cooldown_days" \
+  '.[] | select((.publishedAt | fromdateiso8601) <= now - $days * 86400) | .tagName' <<< "$releases")
+new_tag=$({ grep -E "$tag_pattern" <<< "$cooled_tags" || true; } | sort -V | tail -n1)
 if [[ -z "$new_tag" ]]; then
-  echo "No release found for PHP $minor" >&2
+  echo "No release found for PHP $minor published at least $cooldown_days day(s) ago" \
+    "(set COOLDOWN_DAYS=0 to skip the cooldown)" >&2
   exit 1
 fi
 
 if [[ "$new_tag" == "$old_tag" ]]; then
   echo "Up to date: $old_tag"
   exit 0
 fi
+# The pinned release may be newer than the cooldown allows, if it was updated manually.
 if [[ "$(sort -V <<< "$old_tag"$'\n'"$new_tag" | tail -n1)" != "$new_tag" ]]; then
-  echo "The latest release $new_tag is older than $old_tag" >&2
-  exit 1
+  if ! grep -qxF "$old_tag" <<< "$all_tags"; then
+    echo "The pinned release $old_tag was not found (it may have been deleted or marked as a pre-release)" >&2
+    exit 1
+  fi
+  echo "Up to date: $old_tag is newer than $new_tag, the latest release published at least $cooldown_days day(s) ago"
+  exit 0
 fi
 new_version=$(sed -E 's/^php-(.*)-[0-9]+$/\1/' <<< "$new_tag")
 new_build=${new_tag##*-}