From ff3ed5d7b27b97a0318f40f28a97c541a538d598 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 22 Oct 2026 19:23:28 +0000 Subject: [PATCH 1/5] Avoid installing AMD64-only DevPanel CLI in ARM64 images Co-authored-by: darrenoh <2293701+darrenoh@users.noreply.github.com> --- README.md | 3 +++ TODO.md | 13 +++++++++++++ base/Dockerfile | 9 +++++++-- tests/baselines/hadolint-baseline.json | 2 +- tests/run-dockerfile.sh | 16 ++++++++++++++++ 5 files changed, 40 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 6812e82c..97a5fc22 100644 --- a/README.md +++ b/README.md @@ -31,6 +31,9 @@ Each PHP version ships three layered variants. Release candidate tags end with `-rc` (e.g. `8.3-base-rc`). +The bundled legacy `devpanel` CLI is AMD64-only and is not installed in ARM64 +images. This applies to all PHP versions and all three variants. + Available PHP versions: **7.4 · 8.0 · 8.1 · 8.2 · 8.3** --- diff --git a/TODO.md b/TODO.md index 1adc41a8..0d7d6baa 100644 --- a/TODO.md +++ b/TODO.md @@ -2,6 +2,19 @@ Use this file to track work that needs to be done. Lint scripts automatically append baseline-cleanup entries here when all violations for a linter reach zero. +# Task: Fix ARM64 builds executing an AMD64-only CLI + +## Steps +- [x] Identify the failing instruction and verify the bundled CLI architecture. +- [x] Keep the legacy CLI on AMD64, omit it on ARM64, and document the limitation. +- [x] Add architecture-aware CLI functional checks. +- [ ] Run existing lint/build checks, secret scanning, and code/security validation. + +## Definition of Done +- ARM64 builds do not copy or execute the incompatible legacy CLI. +- AMD64 builds still install and verify the bundled CLI. +- Focused checks pass; unavailable full-build verification is explicitly reported. + # Task: Use native ARM runners for ARM64 builds ## Steps diff --git a/base/Dockerfile b/base/Dockerfile index 6c243dcb..8635b766 100644 --- a/base/Dockerfile +++ b/base/Dockerfile @@ -294,8 +294,13 @@ RUN a2enmod rewrite remoteip headers # Copy shared assets from the 'common' build context (./base/ directory). # Per-version Dockerfiles may overlay version-specific files on top. -COPY --from=common bin/devpanel /usr/local/bin/devpanel -RUN chmod +x /usr/local/bin/devpanel && devpanel version +# The bundled legacy DevPanel CLI is an AMD64-only executable. +RUN --mount=type=bind,from=common,source=/bin/devpanel,target=/tmp/devpanel,readonly \ + case "$(dpkg --print-architecture)" in \ + amd64) install -m 0755 /tmp/devpanel /usr/local/bin/devpanel && devpanel version ;; \ + arm64) echo "Skipping legacy DevPanel CLI: no ARM64 binary is bundled" >&2 ;; \ + *) echo "Unsupported architecture for DevPanel CLI" >&2; exit 1 ;; \ + esac COPY --from=common templates /templates COPY --from=common scripts /scripts COPY --from=common drush /drush diff --git a/tests/baselines/hadolint-baseline.json b/tests/baselines/hadolint-baseline.json index 672f097a..103653b2 100644 --- a/tests/baselines/hadolint-baseline.json +++ b/tests/baselines/hadolint-baseline.json @@ -41,7 +41,7 @@ "./advance/Dockerfile:DL4006": 2, "./base/Dockerfile:DL3003": 1, "./base/Dockerfile:DL3008": 2, - "./base/Dockerfile:DL3022": 7, + "./base/Dockerfile:DL3022": 6, "./base/Dockerfile:DL3047": 1, "./base/Dockerfile:DL4001": 1, "./base/Dockerfile:DL4006": 4, diff --git a/tests/run-dockerfile.sh b/tests/run-dockerfile.sh index af054ed8..90dd2b51 100755 --- a/tests/run-dockerfile.sh +++ b/tests/run-dockerfile.sh @@ -175,6 +175,22 @@ test_base() { assert_contains "$image" "Apache" "apache2 binary present" \ apache2 -v + # The bundled legacy DevPanel CLI is only available for AMD64. + local architecture + if architecture="$(run_in "$image" dpkg --print-architecture)"; then + case "$architecture" in + amd64) + assert_contains "$image" "Version" "DevPanel CLI executable on AMD64" \ + devpanel version ;; + arm64) + assert_empty "$image" "no incompatible DevPanel CLI on ARM64" \ + sh -c 'command -v devpanel || true' ;; + *) err "unexpected image architecture: $architecture" ;; + esac + else + err "could not determine image architecture: $architecture" + fi + # PHP extensions: common extensions that should always be installed assert_contains "$image" "PDO" "PDO extension loaded" \ php -m From 6d23fa46c5a92260f9954772a62c500d6f23a106 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 22 Oct 2026 19:24:59 +0000 Subject: [PATCH 2/5] Record all ARM64 job failures and validation results Co-authored-by: darrenoh <2293701+darrenoh@users.noreply.github.com> --- TODO.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/TODO.md b/TODO.md index 0d7d6baa..bb884d8d 100644 --- a/TODO.md +++ b/TODO.md @@ -6,9 +6,12 @@ Use this file to track work that needs to be done. Lint scripts automatically ap ## Steps - [x] Identify the failing instruction and verify the bundled CLI architecture. +- [x] Inspect all seven ARM64 build jobs in run 39835629916; PHP 7.4 and 8.0–8.5 all fail at the same shared `devpanel version` instruction. - [x] Keep the legacy CLI on AMD64, omit it on ARM64, and document the limitation. - [x] Add architecture-aware CLI functional checks. -- [ ] Run existing lint/build checks, secret scanning, and code/security validation. +- [x] Run Dockerfile/shell lint, shell syntax, ARM64 Bake parsing, and secret scanning. +- [x] Attempt the PHP 8.5 build; the existing libsodium download returns an incomplete archive before the changed layer. +- [x] Complete independent code review (no significant issues); automated review unavailable and CodeQL has no analyzable changes. ## Definition of Done - ARM64 builds do not copy or execute the incompatible legacy CLI. From 58b9fc7f3cd308b34a0c5af1224c263f7bca3154 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 22 Oct 2026 19:46:45 +0000 Subject: [PATCH 3/5] Restore DevPanel CLI and enable QEMU on ARM runners Co-authored-by: darrenoh <2293701+darrenoh@users.noreply.github.com> --- .github/actions/build-php-images/action.yml | 2 +- README.md | 10 ++++++---- TODO.md | 17 +++++++---------- base/Dockerfile | 9 ++------- tests/baselines/hadolint-baseline.json | 2 +- tests/run-dockerfile.sh | 16 ---------------- 6 files changed, 17 insertions(+), 39 deletions(-) diff --git a/.github/actions/build-php-images/action.yml b/.github/actions/build-php-images/action.yml index f192cee5..194a628d 100644 --- a/.github/actions/build-php-images/action.yml +++ b/.github/actions/build-php-images/action.yml @@ -114,7 +114,7 @@ runs: password: ${{ inputs.ghcr_user && inputs.ghcr_token || inputs.github_token }} - name: Set up QEMU - if: ${{ !((runner.arch == 'ARM64' && startsWith(inputs.platform, 'linux/arm64')) || (runner.arch == 'X64' && startsWith(inputs.platform, 'linux/amd64'))) }} + if: ${{ !(runner.arch == 'X64' && startsWith(inputs.platform, 'linux/amd64')) }} uses: docker/setup-qemu-action@v4 - name: Set up Docker Buildx diff --git a/README.md b/README.md index 97a5fc22..32fbdff4 100644 --- a/README.md +++ b/README.md @@ -31,8 +31,9 @@ Each PHP version ships three layered variants. Release candidate tags end with `-rc` (e.g. `8.3-base-rc`). -The bundled legacy `devpanel` CLI is AMD64-only and is not installed in ARM64 -images. This applies to all PHP versions and all three variants. +The bundled legacy `devpanel` CLI is AMD64-only, including in ARM64 images. +Executing it on an ARM64 host requires AMD64 emulation on that host; CI runner +emulation is not included in the published images. Available PHP versions: **7.4 · 8.0 · 8.1 · 8.2 · 8.3** @@ -285,8 +286,9 @@ for setup instructions. - The build workflow is `docker-build.yml`, which handles both push-triggered and manual dispatch builds. It runs a detect → build (per-platform, parallel) → merge pipeline. ARM64 builds use native `ubuntu-24.04-arm` - runners; AMD64 builds use `ubuntu-latest`. QEMU is only set up when the - requested platform does not match the runner architecture. + runners; AMD64 builds use `ubuntu-latest`. QEMU is set up on ARM runners + to execute the bundled AMD64 DevPanel CLI, and for cross-platform builds. + Native AMD64 builds skip QEMU. - The `advance` variant depends on `secure`, which depends on `base`. The build chain is enforced via the bake target dependency graph. diff --git a/TODO.md b/TODO.md index bb884d8d..02195a0a 100644 --- a/TODO.md +++ b/TODO.md @@ -2,20 +2,17 @@ Use this file to track work that needs to be done. Lint scripts automatically append baseline-cleanup entries here when all violations for a linter reach zero. -# Task: Fix ARM64 builds executing an AMD64-only CLI +# Task: Restore DevPanel CLI and enable QEMU on ARM runners ## Steps -- [x] Identify the failing instruction and verify the bundled CLI architecture. -- [x] Inspect all seven ARM64 build jobs in run 39835629916; PHP 7.4 and 8.0–8.5 all fail at the same shared `devpanel version` instruction. -- [x] Keep the legacy CLI on AMD64, omit it on ARM64, and document the limitation. -- [x] Add architecture-aware CLI functional checks. -- [x] Run Dockerfile/shell lint, shell syntax, ARM64 Bake parsing, and secret scanning. -- [x] Attempt the PHP 8.5 build; the existing libsodium download returns an incomplete archive before the changed layer. -- [x] Complete independent code review (no significant issues); automated review unavailable and CodeQL has no analyzable changes. +- [x] Restore unconditional CLI installation and remove architecture-specific omission tests. +- [x] Enable QEMU on ARM runners and document the runtime emulation requirement. +- [ ] Restore the Dockerfile lint baseline and run focused checks. +- [ ] Scan changed files for secrets and complete code/security review. ## Definition of Done -- ARM64 builds do not copy or execute the incompatible legacy CLI. -- AMD64 builds still install and verify the bundled CLI. +- All image builds install and verify the bundled CLI. +- ARM runners register QEMU before Buildx; native AMD64 builds still skip it. - Focused checks pass; unavailable full-build verification is explicitly reported. # Task: Use native ARM runners for ARM64 builds diff --git a/base/Dockerfile b/base/Dockerfile index 8635b766..6c243dcb 100644 --- a/base/Dockerfile +++ b/base/Dockerfile @@ -294,13 +294,8 @@ RUN a2enmod rewrite remoteip headers # Copy shared assets from the 'common' build context (./base/ directory). # Per-version Dockerfiles may overlay version-specific files on top. -# The bundled legacy DevPanel CLI is an AMD64-only executable. -RUN --mount=type=bind,from=common,source=/bin/devpanel,target=/tmp/devpanel,readonly \ - case "$(dpkg --print-architecture)" in \ - amd64) install -m 0755 /tmp/devpanel /usr/local/bin/devpanel && devpanel version ;; \ - arm64) echo "Skipping legacy DevPanel CLI: no ARM64 binary is bundled" >&2 ;; \ - *) echo "Unsupported architecture for DevPanel CLI" >&2; exit 1 ;; \ - esac +COPY --from=common bin/devpanel /usr/local/bin/devpanel +RUN chmod +x /usr/local/bin/devpanel && devpanel version COPY --from=common templates /templates COPY --from=common scripts /scripts COPY --from=common drush /drush diff --git a/tests/baselines/hadolint-baseline.json b/tests/baselines/hadolint-baseline.json index 103653b2..672f097a 100644 --- a/tests/baselines/hadolint-baseline.json +++ b/tests/baselines/hadolint-baseline.json @@ -41,7 +41,7 @@ "./advance/Dockerfile:DL4006": 2, "./base/Dockerfile:DL3003": 1, "./base/Dockerfile:DL3008": 2, - "./base/Dockerfile:DL3022": 6, + "./base/Dockerfile:DL3022": 7, "./base/Dockerfile:DL3047": 1, "./base/Dockerfile:DL4001": 1, "./base/Dockerfile:DL4006": 4, diff --git a/tests/run-dockerfile.sh b/tests/run-dockerfile.sh index 90dd2b51..af054ed8 100755 --- a/tests/run-dockerfile.sh +++ b/tests/run-dockerfile.sh @@ -175,22 +175,6 @@ test_base() { assert_contains "$image" "Apache" "apache2 binary present" \ apache2 -v - # The bundled legacy DevPanel CLI is only available for AMD64. - local architecture - if architecture="$(run_in "$image" dpkg --print-architecture)"; then - case "$architecture" in - amd64) - assert_contains "$image" "Version" "DevPanel CLI executable on AMD64" \ - devpanel version ;; - arm64) - assert_empty "$image" "no incompatible DevPanel CLI on ARM64" \ - sh -c 'command -v devpanel || true' ;; - *) err "unexpected image architecture: $architecture" ;; - esac - else - err "could not determine image architecture: $architecture" - fi - # PHP extensions: common extensions that should always be installed assert_contains "$image" "PDO" "PDO extension loaded" \ php -m From 8fda49f95e7a75f0accb87d4e3dd566aded967f0 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 22 Oct 2026 19:47:43 +0000 Subject: [PATCH 4/5] Record QEMU restoration validation Co-authored-by: darrenoh <2293701+darrenoh@users.noreply.github.com> --- TODO.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/TODO.md b/TODO.md index 02195a0a..a7fa5f1f 100644 --- a/TODO.md +++ b/TODO.md @@ -7,8 +7,9 @@ Use this file to track work that needs to be done. Lint scripts automatically ap ## Steps - [x] Restore unconditional CLI installation and remove architecture-specific omission tests. - [x] Enable QEMU on ARM runners and document the runtime emulation requirement. -- [ ] Restore the Dockerfile lint baseline and run focused checks. -- [ ] Scan changed files for secrets and complete code/security review. +- [x] Restore the Dockerfile lint baseline; YAML/Dockerfile/shell lint, shell syntax and ARM64 Bake parsing pass. +- [x] Scan changed files for secrets (none); independent review found no significant issues. Automated review unavailable; CodeQL has no analyzable changes. +- [x] Record validation limitation: native ARM runner execution cannot be verified in this AMD64-only sandbox. ## Definition of Done - All image builds install and verify the bundled CLI. From 3ceb4071d5ef2009618f54a9b00fc0c6ae4e0ee1 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 22 Oct 2026 19:56:59 +0000 Subject: [PATCH 5/5] Correct README AMD64 and ARM64 build runner labels Co-authored-by: darrenoh <2293701+darrenoh@users.noreply.github.com> --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 32fbdff4..72b29456 100644 --- a/README.md +++ b/README.md @@ -285,8 +285,8 @@ for setup instructions. Run `./test.sh build run --version ` to test a single PHP version quickly. - The build workflow is `docker-build.yml`, which handles both push-triggered and manual dispatch builds. It runs a detect → build (per-platform, - parallel) → merge pipeline. ARM64 builds use native `ubuntu-24.04-arm` - runners; AMD64 builds use `ubuntu-latest`. QEMU is set up on ARM runners + parallel) → merge pipeline. ARM64 builds use native `ubuntu-26.04-arm` + runners; AMD64 builds use `ubuntu-26.04`. QEMU is set up on ARM runners to execute the bundled AMD64 DevPanel CLI, and for cross-platform builds. Native AMD64 builds skip QEMU. - The `advance` variant depends on `secure`, which depends on `base`.