Add minimum PHP guard to Phar bootstrap

[schlessera]

Context

The filesystem bootstrap (php/boot-fs.php) rejects PHP versions older than 7.2.24, but that file is not loaded by the Phar. The generated stub includes php/boot-phar.php, which loads php/wp-cli.php directly. boot-fs.php is only present in the archive because the framework package is bundled.

This initially looked like a release-critical safety gap for already shipped 2.x self-updaters. A deeper check showed that:

• The bundle requires PHP 7.2.24 and the current Phar contains Composer's generated platform_check.php, which enforces that requirement.
• The 2.x updater smoke-tests a downloaded Phar using --info and only replaces the existing Phar when that command succeeds.
• An end-to-end test with WP-CLI 2.12.0 on PHP 7.1 confirmed that the current nightly is rejected and the original Phar remains byte-for-byte unchanged.

The explicit guard is therefore defense-in-depth and a clearer diagnostic, rather than the only barrier preventing an unsupported update.

Changes

• Reject unsupported PHP versions in boot-phar.php before loading the framework.
• Write the diagnostic to STDERR so existing 2.x self-updaters can relay it when validation fails.
• Test the guard on PHP 5.6 and PHP 7.1, ensuring that the bootstrap remains parseable, exits unsuccessfully, and produces the expected STDERR output.

Testing

• composer lint
• composer phpcs
• composer phpstan
• composer phpunit
• composer behat (53 scenarios, 600 steps)
• Focused guard checks on PHP 5.6.40 and PHP 7.1.33

Summary by CodeRabbit

• Bug Fixes
  • Added a runtime compatibility check that blocks execution on PHP versions older than 7.2.24.
  • Improved startup failure messaging to clearly state the minimum required PHP version and the detected version.
• Tests
  • Added a dedicated CI job to validate the rejection behavior for older supported PHP versions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0c521898-9eff-46d6-aa33-d9deb0ff4dfa

📥 Commits

Reviewing files that changed from the base of the PR and between 679ad91 and b5e6668.

📒 Files selected for processing (1)

• .github/workflows/testing.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/testing.yml

---

📝 Walkthrough

Walkthrough

The PHAR bootstrap now rejects PHP versions below 7.2.24, and CI verifies this behavior on PHP 5.6 and 7.1 by checking stdout and stderr output.

Changes

Minimum PHP version guard

Layer / File(s)	Summary
Bootstrap PHP version check php/boot-phar.php	Adds a PHP 5.x parsing compatibility comment and an early PHP_VERSION check that writes an error to stderr and exits with status -1 below PHP 7.2.24.
Unsupported-version CI validation .github/workflows/testing.yml	Adds a PHP 5.6 and 7.1 matrix job that executes the bootstrap and validates empty stdout plus the expected stderr message.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CI as minimum-php-guard
  participant PHP as PHP runtime
  participant Boot as php/boot-phar.php
  participant Files as stdout.txt/stderr.txt
  CI->>PHP: Run PHP 5.6 or 7.1
  PHP->>Boot: Execute bootstrap
  Boot->>Boot: Check PHP_VERSION < 7.2.24
  Boot->>Files: Write error to stderr.txt
  Boot-->>PHP: Exit with status -1
  CI->>Files: Compare captured output with expected.txt

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding a minimum PHP version guard to the Phar bootstrap.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/phar-minimum-php-guard

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/workflows/testing.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 0% with 6 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
php/boot-phar.php	0.00%	6 Missing ⚠️

📢 Thoughts on this report? Let us know!

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/testing.yml:
- Around line 25-26: Update the actions/checkout step in the testing workflow to
set persist-credentials to false, ensuring the checkout action does not retain
the GITHUB_TOKEN for subsequent PR-controlled job steps.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3797408a-812d-4c70-a5cd-4b8f0ef5a58e

📥 Commits

Reviewing files that changed from the base of the PR and between dfea6e2 and 679ad91.

📒 Files selected for processing (2)

• .github/workflows/testing.yml
• php/boot-phar.php