From 9d71cfb733c7726f23c3e99637ddf4e0b06967b9 Mon Sep 17 00:00:00 2001 From: Juan24 Date: Wed, 28 Oct 2026 16:01:02 -0300 Subject: [PATCH] Upgrade PHP runtime and harden Docker builds Raise the project and CI runtime requirement to PHP 8.4.1, update the Docker and Bitbucket images, and enforce platform validation during Composer installs. Also support Swagger URL secrets as a fallback in GitHub Actions and exclude local secrets and build artifacts from Docker contexts. --- .dockerignore | 19 +++++++++++++++++++ .github/workflows/main.yml | 4 ++-- .github/workflows/production-pipeline.yml | 4 ++-- .github/workflows/qa-pipeline.yml | 4 ++-- REDME.md | 4 ++-- bitbucket-pipelines.yml | 2 +- composer.json | 7 +++++-- composer.lock | 7 +++++-- docker/Dockerfile | 9 +++++---- 9 files changed, 43 insertions(+), 17 deletions(-) create mode 100644 .dockerignore diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 0000000..93495ec --- /dev/null +++ b/.dockerignore @@ -0,0 +1,19 @@ +.git +.idea +.DS_Store +.env +.env.* +!.env.example +vendor +node_modules +bootstrap/cache/*.php +storage/logs/* +storage/framework/cache/* +storage/framework/sessions/* +storage/framework/views/* +storage/*.key +helm-chart/secrets*.yml +helm-chart/*secret*.yaml +helm-chart/*.pem +.phpunit.cache +.phpunit.result.cache diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 2a76a6a..1dbd261 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -33,9 +33,9 @@ jobs: password: ${{ secrets.REGISTRY_PASSWORD }} - name: Build and push application image env: - SWAGGER_URL: ${{ vars.SWAGGER_URL_DEV }} + SWAGGER_URL: ${{ vars.SWAGGER_URL_DEV || secrets.SWAGGER_URL_DEV }} run: | - : "${SWAGGER_URL:?Set the SWAGGER_URL_DEV repository variable}" + : "${SWAGGER_URL:?Set the SWAGGER_URL_DEV repository variable or secret}" docker build --build-arg "SWAGGER_URL=$SWAGGER_URL" -t ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi:${{ github.sha }} -f ./docker/Dockerfile . docker tag ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi:${{ github.sha }} ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi:latest diff --git a/.github/workflows/production-pipeline.yml b/.github/workflows/production-pipeline.yml index 6aae480..a8d9b79 100644 --- a/.github/workflows/production-pipeline.yml +++ b/.github/workflows/production-pipeline.yml @@ -29,9 +29,9 @@ jobs: password: ${{ secrets.REGISTRY_PASSWORD }} - name: Build and push application image env: - SWAGGER_URL: ${{ vars.SWAGGER_URL_PROD }} + SWAGGER_URL: ${{ vars.SWAGGER_URL_PROD || secrets.SWAGGER_URL_PROD }} run: | - : "${SWAGGER_URL:?Set the SWAGGER_URL_PROD repository variable}" + : "${SWAGGER_URL:?Set the SWAGGER_URL_PROD repository variable or secret}" docker build --build-arg "SWAGGER_URL=$SWAGGER_URL" -t ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi:${{ github.sha }} -f ./docker/Dockerfile . docker tag ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi:${{ github.sha }} ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi:latest docker push ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi:${{ github.sha }} diff --git a/.github/workflows/qa-pipeline.yml b/.github/workflows/qa-pipeline.yml index cb7c073..ba0df0e 100644 --- a/.github/workflows/qa-pipeline.yml +++ b/.github/workflows/qa-pipeline.yml @@ -35,9 +35,9 @@ jobs: password: ${{ secrets.REGISTRY_PASSWORD }} - name: Build and push application image env: - SWAGGER_URL: ${{ vars.SWAGGER_URL_QA }} + SWAGGER_URL: ${{ vars.SWAGGER_URL_QA || secrets.SWAGGER_URL_QA }} run: | - : "${SWAGGER_URL:?Set the SWAGGER_URL_QA repository variable}" + : "${SWAGGER_URL:?Set the SWAGGER_URL_QA repository variable or secret}" docker build --build-arg "SWAGGER_URL=$SWAGGER_URL" -t ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi-qa:${{ github.sha }} -f ./docker/Dockerfile . docker tag ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi-qa:${{ github.sha }} ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi-qa:latest docker push ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi-qa:${{ github.sha }} diff --git a/REDME.md b/REDME.md index 9acf37c..6fca24a 100644 --- a/REDME.md +++ b/REDME.md @@ -7,7 +7,7 @@ WhatNow is a web application built with Laravel 13 and Vue.js that provides disa Make sure the following tools are installed on your system: -- **PHP (version 8.3.36 or later, with the security patch for CVE-2026-109618 and CVE-2026-109619):** +- **PHP (version 8.4.1 or later; Docker and CI use PHP 8.4):** ```bash php -v ``` @@ -108,7 +108,7 @@ The API and the backoffice are now connected and ready to use. ## Swagger URL for Docker Builds -Set the GitHub Actions repository variables `SWAGGER_URL_DEV`, `SWAGGER_URL_QA`, +Set the GitHub Actions repository variables or secrets `SWAGGER_URL_DEV`, `SWAGGER_URL_QA`, and `SWAGGER_URL_PROD` to the public API origin for each deployment. Use the origin without `/v2`; the Swagger configuration appends that path. The workflows pass this value through the required `SWAGGER_URL` Docker build argument instead of diff --git a/bitbucket-pipelines.yml b/bitbucket-pipelines.yml index 26fdb22..13246c1 100644 --- a/bitbucket-pipelines.yml +++ b/bitbucket-pipelines.yml @@ -1,4 +1,4 @@ -image: php:8.3.36 +image: php:8.4-cli-bookworm definitions: services: diff --git a/composer.json b/composer.json index c132869..c0cd0d9 100644 --- a/composer.json +++ b/composer.json @@ -8,7 +8,7 @@ ], "license": "MIT", "require": { - "php": "^8.3.36", + "php": "^8.4.1", "darkaonline/l5-swagger": "^8.6 || ^9.0 || ^10.0 || ^11.0", "doctrine/annotations": "^2.0", "laravel/framework": "^13.0", @@ -30,7 +30,10 @@ "config": { "optimize-autoloader": true, "preferred-install": "dist", - "sort-packages": true + "sort-packages": true, + "platform": { + "php": "8.4.1" + } }, "extra": { "laravel": { diff --git a/composer.lock b/composer.lock index ebac53c..1a64b43 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "9a596cf86d9c4b06c1dc36196d21b076", + "content-hash": "f0021aa15a7b80bf0d998bd3602b65f7", "packages": [ { "name": "aws/aws-crt-php", @@ -9460,8 +9460,11 @@ "prefer-stable": true, "prefer-lowest": false, "platform": { - "php": "^8.3.36" + "php": "^8.4.1" }, "platform-dev": {}, + "platform-overrides": { + "php": "8.4.1" + }, "plugin-api-version": "2.9.0" } diff --git a/docker/Dockerfile b/docker/Dockerfile index b6556d9..d5015ba 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -1,7 +1,6 @@ -# PHP 8.3.36+ includes security patches for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) -FROM php:8.3.36-apache +FROM php:8.4-apache-bookworm -RUN php -r 'if (version_compare(PHP_VERSION, "8.3.36", "<")) { fwrite(STDERR, "PHP >= 8.3.36 is required to patch CVE-2026-109618 and CVE-2026-109619\n"); exit(1); }' +RUN php -r 'if (version_compare(PHP_VERSION, "8.4.1", "<")) { fwrite(STDERR, "PHP >= 8.4.1 is required by the locked dependencies\n"); exit(1); }' COPY --from=composer:latest /usr/bin/composer /usr/local/bin/composer @@ -20,7 +19,9 @@ COPY ./docker/vhost.conf /etc/apache2/sites-available/000-default.conf COPY ./ /var/www/html WORKDIR /var/www/html -RUN composer install --no-dev --prefer-dist --optimize-autoloader +RUN composer validate --strict --no-check-publish \ + && composer install --no-dev --prefer-dist --optimize-autoloader --no-interaction \ + && composer check-platform-reqs --no-dev ARG SWAGGER_URL RUN : "${SWAGGER_URL:?SWAGGER_URL build argument is required}" \