[davidnewhall]

Summary

• Depend on PHP 8.5.12 or newer for the core php8.5-* modules. php8.5-redis and php8.5-memcached stay unversioned because those packages use the extension version (6.3.0 and 3.4.0), not the PHP version.
• Pin the GitHub Actions to current release SHAs. Renovate automerges Actions updates and PHP 8.5 patch releases after the test check passes.
• Build the deb, install it on Ubuntu 24.04 with the ondrej PHP PPA and the Telegraf repo, and assert php -v is at least 8.5.12 with curl, mbstring, memcached, mysqli, redis, and xml loaded.

Test plan

• Built and installed notifiarr-worker_1.2.0-47 in a throwaway Ubuntu 24.04 container on slvr. PHP 8.5.12 loaded every required module, and the package files were in place. The container and image were removed.
• GitHub Actions test passes on this PR and does not upload to PackageCloud.
• After merge, a Renovate Actions or PHP 8.5 PR waits for test and then auto-merges.

Made with Cursor

[Copilot]

🔵 Needs a closer look

The automerge safety gate depends on unverified repository protections, and the installation check still needs correction.

1 open issue

• Check dpkg package status before reporting PHP 8.3 installed · New

What changed in this PR

This PR moves the worker package to PHP 8.5.12 or newer and adds package-install validation before releases.

Changes:

• Updates core PHP dependencies while keeping Redis and Memcached extension packages unversioned.
• Adds an Ubuntu 24.04 build-and-install check and guards systemd operations in non-systemd environments.
• Pins GitHub Actions to commit SHAs and configures Renovate automerge.

File	Description
README.md	Documents the new minimum PHP version.
build.sh	Sets versioned PHP 8.5 core dependencies.
after-install.sh	Guards systemd operations when systemd is not running.
.github/​workflows/​release.yml	Adds the release-gating test job and pins Actions.
.github/​scripts/​test-package.sh	Checks package installation, dependencies, PHP modules, and installed files.
.github/​renovate.json	Tracks PHP patch releases and enables dependency automerge.

_{Review effort: Balanced}

[davidnewhall]

It didn't. If this happens in a workflow, that's a weird problem. Not worried about this.

[qwen-pr-bot]

Minor accuracy nit: there is no package named php8.5 — the >= 8.5.12 floor applies to the individual php8.5-cli/-curl/-mbstring/-mysql/-xml packages, and php8.5-memcached/-redis can't carry it because those are versioned by their extension versions (3.4.0, 6.3.0). Something like "PHP 8.5" or php8.5-* (>= 8.5.12) would read more precisely.

[qwen-pr-bot]

Approving. This bundles three distinct changes — the PHP 8.3 → 8.5 dependency swap with a version floor in build.sh, the new package-install test job wired into release.yml as a gate on the release, and the Renovate automerge configuration that will keep the floor moving with php-src patch releases — plus the after-install.sh guard change that the new test turns out to require. Reviewed head 0344856 against base ca7935c; no prior review comments existed.

Executed validation (pod is Debian bookworm, so two environment-only adaptations, nothing else):

• bash build.sh at head: the heredoc + eval quoting works as intended; the produced deb's Depends is exactly php8.5-cli (>= 8.5.12), -curl, -mbstring, -mysql, -xml with the floor and -memcached/-redis unversioned.
• Full .github/scripts/test-package.sh flow (sury's Debian repo substituted for the Ubuntu PPA, and a locally-built placeholder mysql-client-core-8.0 to paper over bookworm shipping MariaDB instead of MySQL — that dependency is pre-existing from the base and resolves fine on noble). Everything else ran verbatim and passed: deb built, dependency assertions green, apt-get install succeeded with the maintainer scripts, PHP 8.5.12 reported, all of curl/mbstring/memcached/mysqli/redis/xml loaded, no php8.3* packages, abc created, and all five asserted package files present with prestart.sh executable.
• Stubbed /bin/systemctl (binary present, systemd not PID 1 — the GitHub runner situation) and ran both maintainer scripts: the base after-install.sh dies with exit 1 under set -e at daemon-reload; the new one exits 0. So the -d /run/systemd/system guard is what makes the package installable in CI in the first place.

Cross-checked against GitHub directly:

• The test check already ran green on this exact head commit (test succeeded; Make Release Assets and the PackageCloud deploy correctly skipped on a PR), and the description's manual noble-container install matches that.
• All four pinned digests resolve to their tags: checkout 3d3c42e = v7.0.1, upload-artifact cf430e0 = v7.0.2, download-artifact 9000827 = v8.0.2, upload-packagecloud eb00673 = v1.1.1.
• php/php-src release tags are php-8.5.12-format (8.5.12 is the newest), matching the extractVersionTemplate; helpers:pinGitHubActionDigestsToSemver exists in Renovate's preset source, so the automerge/internalChecksFilter config is well-formed.
• sury's repo confirms the rationale for unversioned memcached/redis: php8.5-memcached is 3.4.0 and php8.5-redis is 6.3.0 — a >= 8.5.12 constraint there would never resolve.

Two non-blocking notes: the README dependency line could read more precisely (left one inline on it), and as a possible follow-up outside this diff, before-remove.sh still gates its systemctl stop supervisor on -x "/bin/systemctl" — the same /run/systemd/system guard would keep it consistent for non-systemd hosts. Harmless in practice since prerm exits early on upgrades.