[jaydrogers]

What

This PR makes our images easier to trust and harder to tamper with:

1. PHP patches ship within about an hour. An hourly check starts a production build when php.net lists a patch we haven't published yet.
2. Our CI can't be hijacked through a GitHub Action tag. Every Action is pinned to a commit SHA, and a new linter (zizmor) checks the workflows on every PR.
3. Images are signed. Every published image carries an SBOM and build provenance, and is signed with cosign.
4. Every image is scanned for vulnerabilities. Grype scans each published image after every production build.

Why

The Trivy compromise in March 2026 (CVE-2026-33634) moved the tags of a popular GitHub Action to malware, and that malware stole the CI secrets of every workflow using those tags. Our workflows used tags the same way. With millions of pulls, people need a way to check what they run, instead of taking our word for it.

What changes for users

	Before	After
New PHP patch reaches floating tags	Next Tuesday rebuild (up to 7 days)	About 1 hour
OS package updates	Tuesday 08:00 UTC	Unchanged
Check an image came from us	Not possible	cosign verify (see Verifying images)
Known vulnerabilities	Run your own scanner	A table on every production run's summary page

Version-pinned tags like 8.5.12-cli-v5.0.4 work the same as before. Only a GitHub release creates them.

How the scanning works

• Grype scans every published image after each production build.
• The scan job has no token and no registry credentials, and Grype runs in its own container. A compromised scanner has nothing to steal.
• Public: each image's critical, high, medium, and fixable counts go on the run's summary page.
• Maintainers: findings that have a fix become code scanning alerts in the Security tab. Nothing new to host, no bot commits.

Most CVEs in a Debian image have no fix yet. A scan of 8.5-cli-bookworm finds 18 critical and 144 high, and none of them are fixable. Only fixable findings become alerts.

Where to look

• service_scan-images.yml: the scan, and how findings fit code scanning's limits (one SARIF run per variation, findings moved under each image so alerts don't merge across images)
• service_publish-images.yml: cosign signing after each push
• scheduled-task_watch-php-releases.yml: the hourly release check

Everything else is SHA pins, fixes for zizmor's findings (persist-credentials: false, moving ${{ }} out of run: scripts, explicit secrets instead of secrets: inherit), and docs.

[cloudflare-workers-and-pages]

Deploying serversideup-php with    Cloudflare Pages

Latest commit:	990db46
Status:	⚡️  Build in progress...

View logs

[github-actions]

Images for PR #742

Build	Test	Publish
⚠️ Build skipped	⏭️ Skipped	⏭️ Not published

No images were published from this run. View the run for details.

All images with sizes

_{Updated on every push to this PR.}