Stop authenticating setup-php against the GitHub API #177

Merged

thatguygriff merged 1 commits from ci/drop-github-token-from-setup-php into main

2026-08-20 17:25:22 +00:00

Author	SHA1	Message	Date
thatguygriffandClaude Opus 5	9071a3f70f	Stop authenticating setup-php against the GitHub API CI / No Debug Code (pull_request) Successful in 2s Details CI / Tests (PHP 8.1) (pull_request) Successful in 56s Details CI / Tests (PHP 8.2) (pull_request) Successful in 57s Details CI / Tests (PHP 8.3) (pull_request) Successful in 2m56s Details CI / Coding Standards (pull_request) Successful in 7m5s Details CI / Build Plugin Zip (pull_request) Skipped Details CI / PHPStan (pull_request) Successful in 8m5s Details The GitHub API rate limit was the wrong diagnosis, so this reverts the 1Password-backed token added in #175 along with the mirrored composite action, leaving the workflows as they were. Timing every Setup PHP step across runs 454-523 rules the rate limit out. PHP 8.1 and 8.2 install in 26-41 seconds, 12 for 12, never once failing. PHP 8.3 has never finished in under 143 seconds and ranges up to 1273, with two outright failures. Those jobs share a fan-out, and so an egress address and a rate limit bucket, with the 8.1 and 8.2 jobs that are never touched. A throttle could not sort itself by PHP version that way. Run 523, the first to carry the token, is the direct refutation: the token resolved and verified, and Setup PHP still took 749 seconds on kallone and 408 on eris. The 8.3 penalty also predates the whole story, sitting at ~145 seconds back on 30 July. What is left is a slow path specific to 8.3 on these arm64 runners, whose long tail sometimes crosses the step timeout and reports the unhelpful "Could not setup PHP 8.3". That is worth fixing on its own terms rather than behind a token that was never in the path. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01Uw545F1vveNJKjzLxdi2ks	2026-08-20 14:22:52 -03:00

Author

SHA1

Message

Date

thatguygriffandClaude Opus 5

9071a3f70f

Stop authenticating setup-php against the GitHub API

CI / No Debug Code (pull_request) Successful in 2s

Details

CI / Tests (PHP 8.1) (pull_request) Successful in 56s

Details

CI / Tests (PHP 8.2) (pull_request) Successful in 57s

Details

CI / Tests (PHP 8.3) (pull_request) Successful in 2m56s

Details

CI / Coding Standards (pull_request) Successful in 7m5s

Details

CI / Build Plugin Zip (pull_request) Skipped

Details

CI / PHPStan (pull_request) Successful in 8m5s

Details

The GitHub API rate limit was the wrong diagnosis, so this reverts the
1Password-backed token added in #175 along with the mirrored composite
action, leaving the workflows as they were.

Timing every Setup PHP step across runs 454-523 rules the rate limit out.
PHP 8.1 and 8.2 install in 26-41 seconds, 12 for 12, never once failing.
PHP 8.3 has never finished in under 143 seconds and ranges up to 1273,
with two outright failures. Those jobs share a fan-out, and so an egress
address and a rate limit bucket, with the 8.1 and 8.2 jobs that are never
touched. A throttle could not sort itself by PHP version that way.

Run 523, the first to carry the token, is the direct refutation: the
token resolved and verified, and Setup PHP still took 749 seconds on
kallone and 408 on eris. The 8.3 penalty also predates the whole story,
sitting at ~145 seconds back on 30 July.

What is left is a slow path specific to 8.3 on these arm64 runners, whose
long tail sometimes crosses the step timeout and reports the unhelpful
"Could not setup PHP 8.3". That is worth fixing on its own terms rather
than behind a token that was never in the path.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Uw545F1vveNJKjzLxdi2ks

2026-08-20 14:22:52 -03:00