Shared PHP CI images for Gitea Actions

One image per PHP version, published to
git.unsupervised.ca/unsupervised/ci-php:<php-version>, so PHP projects can
run their jobs with `container:` instead of installing PHP per job.

Built on php:<version>-cli-alpine with Composer 2, the intl and zip
extensions, and the GNU CLI tools workflow scripts expect. bash and nodejs
are present because act_runner runs JavaScript actions inside the job
container; GNU tar because actions/cache shells out to `tar --posix -P`,
which busybox rejects.

Covers 8.1 through 8.5. Pushing needs the REGISTRY_TOKEN organisation secret
— Gitea's Actions task token cannot write packages (go-gitea/gitea#23642).

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01D9acV1mHktGAb1uyvNmrR2

Dockerfile

@@ -0,0 +1,67 @@
+# Shared PHP CI image, one tag per PHP version.
+#
+# Published to git.unsupervised.ca/unsupervised/ci-php:<php-version> by
+# .gitea/workflows/publish.yml. Projects run their jobs inside it with
+# `container:`, so PHP, Composer and the usual CLI tools are already present
+# when a job starts.
+
+ARG PHP_VERSION=8.3
+FROM php:${PHP_VERSION}-cli-alpine
+
+# bash and nodejs are required by the runner itself: act_runner executes
+# JavaScript actions (actions/checkout, actions/cache, actions/upload-artifact)
+# inside the job container, and shells `run:` steps through bash.
+#
+# coreutils, gawk, grep, sed and tar replace the busybox applets with the GNU
+# ones workflow scripts are usually written against. tar is load-bearing:
+# actions/cache shells out to `tar --posix -P`, which busybox rejects, so
+# every cache step fails without it. zstd is what actions/cache reaches for
+# in preference to gzip when it is installed.
+#
+# curl, git, jq and zip/unzip cover what release and packaging scripts
+# generally call out to.
+RUN apk add --no-cache \
+        bash \
+        coreutils \
+        curl \
+        gawk \
+        git \
+        grep \
+        jq \
+        nodejs \
+        sed \
+        tar \
+        unzip \
+        zip \
+        zstd \
+        icu-libs \
+        libzip \
+ && apk add --no-cache --virtual .build-deps \
+        $PHPIZE_DEPS \
+        icu-dev \
+        libzip-dev \
+ && docker-php-ext-install -j"$(nproc)" intl zip \
+ && apk del --no-network .build-deps
+
+# mbstring is compiled into the official php images. intl and zip are added
+# above. Together that covers phpunit, phpstan, phpcs and Composer.
+
+COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
+
+# Jobs run as root inside the container and never answer prompts.
+ENV COMPOSER_ALLOW_SUPERUSER=1 \
+    COMPOSER_NO_INTERACTION=1 \
+    COMPOSER_HOME=/composer
+
+# Smoke test: fail the build rather than publish an image missing something
+# a consuming job depends on.
+RUN mkdir -p "$COMPOSER_HOME" \
+ && tar --version | head -1 | grep -q 'GNU tar' \
+ && node --version \
+ && php -v \
+ && php -m | grep -qx intl \
+ && php -m | grep -qx mbstring \
+ && php -m | grep -qx zip \
+ && composer --version
+
+CMD ["/bin/bash"]