Resolve the skeleton lock in CI (#2, step 1) - #3
Merged
Conversation
The image resolves Flarum from Packagist on first container start — ^2.0 at beta stability, plus six extensions at bare '*'. Seven floating constraints, so the same image tag can produce different forums a week apart, and there is no offline install. A committed lock fixes that, but it has to be generated on PHP 8.3 with the exact extension set the image ships: resolve somewhere missing intl or exif and composer will pick versions production cannot run. So it is generated here rather than on a laptop. This is also the update path. Bumping Flarum becomes re-running this and committing the diff — a reviewable change instead of something that happens silently the next time a container starts. The run audits what it resolved and fails on any advisory. Pinning a known-vulnerable set is worse than floating past it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First step of #2.
The image resolves Flarum from Packagist on first container start —
^2.0at beta stability, plus six extensions at bare*. Seven floating constraints, so the same image tag can produce different forums a week apart, and there is no offline install path at all.A committed lock is what fixes that, but it has to be generated on PHP 8.3 with the exact extension set the image ships — resolve somewhere missing
intlorexifand composer will happily pick versions production cannot run. Hence CI rather than a laptop.This is also the update path: bumping Flarum becomes re-running this workflow and committing the diff, so a version change is a reviewable PR instead of something that happens silently the next time a container boots.
The run audits what it resolved and fails on any advisory — pinning a known-vulnerable set would be worse than floating past it.
Note for #2: Flarum 2.0 has no stable release (currently
v2.0.0-rc.5), so--stability=betais currently required, not sloppiness. The pin has to target an explicit RC for now.The workflow is
workflow_dispatchonly, so merging it changes nothing on its own — but it has to be on the default branch before it can be dispatched at all.