Upgrade PHP runtime and harden Docker builds

.dockerignore

@@ -0,0 +1,19 @@
+.git
+.idea
+.DS_Store
+.env
+.env.*
+!.env.example
+vendor
+node_modules
+bootstrap/cache/*.php
+storage/logs/*
+storage/framework/cache/*
+storage/framework/sessions/*
+storage/framework/views/*
+storage/*.key
+helm-chart/secrets*.yml
+helm-chart/*secret*.yaml
+helm-chart/*.pem
+.phpunit.cache
+.phpunit.result.cache

.github/workflows/main.yml

@@ -33,9 +33,9 @@ jobs:
            password: ${{ secrets.REGISTRY_PASSWORD }}
        - name: Build and push application image
          env:
-           SWAGGER_URL: ${{ vars.SWAGGER_URL_DEV }}
+           SWAGGER_URL: ${{ vars.SWAGGER_URL_DEV || secrets.SWAGGER_URL_DEV }}
          run: |
-           : "${SWAGGER_URL:?Set the SWAGGER_URL_DEV repository variable}"
+           : "${SWAGGER_URL:?Set the SWAGGER_URL_DEV repository variable or secret}"
            docker build --build-arg "SWAGGER_URL=$SWAGGER_URL" -t ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi:${{ github.sha }} -f ./docker/Dockerfile .
            docker tag ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi:${{ github.sha }} ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi:latest
 

.github/workflows/production-pipeline.yml

@@ -29,9 +29,9 @@ jobs:
           password: ${{ secrets.REGISTRY_PASSWORD }}
       - name: Build and push application image
         env:
-          SWAGGER_URL: ${{ vars.SWAGGER_URL_PROD }}
+          SWAGGER_URL: ${{ vars.SWAGGER_URL_PROD || secrets.SWAGGER_URL_PROD }}
         run: |
-          : "${SWAGGER_URL:?Set the SWAGGER_URL_PROD repository variable}"
+          : "${SWAGGER_URL:?Set the SWAGGER_URL_PROD repository variable or secret}"
           docker build --build-arg "SWAGGER_URL=$SWAGGER_URL" -t ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi:${{ github.sha }} -f ./docker/Dockerfile .
           docker tag ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi:${{ github.sha }} ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi:latest
           docker push ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi:${{ github.sha }}

.github/workflows/qa-pipeline.yml

@@ -35,9 +35,9 @@ jobs:
           password: ${{ secrets.REGISTRY_PASSWORD }}
       - name: Build and push application image
         env:
-          SWAGGER_URL: ${{ vars.SWAGGER_URL_QA }}
+          SWAGGER_URL: ${{ vars.SWAGGER_URL_QA || secrets.SWAGGER_URL_QA }}
         run: |
-          : "${SWAGGER_URL:?Set the SWAGGER_URL_QA repository variable}"
+          : "${SWAGGER_URL:?Set the SWAGGER_URL_QA repository variable or secret}"
           docker build --build-arg "SWAGGER_URL=$SWAGGER_URL" -t ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi-qa:${{ github.sha }} -f ./docker/Dockerfile .
           docker tag ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi-qa:${{ github.sha }} ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi-qa:latest
           docker push ${{ secrets.REGISTRY_LOGIN_SERVER }}/whatnowapi-qa:${{ github.sha }}

REDME.md

@@ -7,7 +7,7 @@ WhatNow is a web application built with Laravel 13 and Vue.js that provides disa
 
 Make sure the following tools are installed on your system:
 
-- **PHP (version 8.3.36 or later, with the security patch for CVE-2026-109618 and CVE-2026-109619):**
+- **PHP (version 8.4.1 or later; Docker and CI use PHP 8.4):**
   ```bash
   php -v
   ```
@@ -108,7 +108,7 @@ The API and the backoffice are now connected and ready to use.
 
 ## Swagger URL for Docker Builds
 
-Set the GitHub Actions repository variables `SWAGGER_URL_DEV`, `SWAGGER_URL_QA`,
+Set the GitHub Actions repository variables or secrets `SWAGGER_URL_DEV`, `SWAGGER_URL_QA`,
 and `SWAGGER_URL_PROD` to the public API origin for each deployment. Use the origin
 without `/v2`; the Swagger configuration appends that path. The workflows pass
 this value through the required `SWAGGER_URL` Docker build argument instead of

bitbucket-pipelines.yml

@@ -1,4 +1,4 @@
-image: php:8.3.36
+image: php:8.4-cli-bookworm
 
 definitions:
   services:

composer.json

@@ -8,7 +8,7 @@
     ],
     "license": "MIT",
     "require": {
-        "php": "^8.3.36",
+        "php": "^8.4.1",
         "darkaonline/l5-swagger": "^8.6 || ^9.0 || ^10.0 || ^11.0",
         "doctrine/annotations": "^2.0",
         "laravel/framework": "^13.0",
@@ -30,7 +30,10 @@
     "config": {
         "optimize-autoloader": true,
         "preferred-install": "dist",
-        "sort-packages": true
+        "sort-packages": true,
+        "platform": {
+            "php": "8.4.1"
+        }
     },
     "extra": {
         "laravel": {

docker/Dockerfile

@@ -1,7 +1,6 @@
-# PHP 8.3.36+ includes security patches for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)
-FROM php:8.3.36-apache
+FROM php:8.4-apache-bookworm
 
-RUN php -r 'if (version_compare(PHP_VERSION, "8.3.36", "<")) { fwrite(STDERR, "PHP >= 8.3.36 is required to patch CVE-2026-109618 and CVE-2026-109619\n"); exit(1); }'
+RUN php -r 'if (version_compare(PHP_VERSION, "8.4.1", "<")) { fwrite(STDERR, "PHP >= 8.4.1 is required by the locked dependencies\n"); exit(1); }'
 
 COPY --from=composer:latest /usr/bin/composer /usr/local/bin/composer
 
@@ -20,7 +19,9 @@ COPY ./docker/vhost.conf /etc/apache2/sites-available/000-default.conf
 COPY ./ /var/www/html
 
 WORKDIR /var/www/html
-RUN composer install --no-dev --prefer-dist --optimize-autoloader
+RUN composer validate --strict --no-check-publish \
+    && composer install --no-dev --prefer-dist --optimize-autoloader --no-interaction \
+    && composer check-platform-reqs --no-dev
 
 ARG SWAGGER_URL
 RUN : "${SWAGGER_URL:?SWAGGER_URL build argument is required}" \