From 679ad911986d6623038dbd43fa8771621af251fa Mon Sep 17 00:00:00 2001
From: Alain Schlesser <alain.schlesser@gmail.com>
Date: Thu, 23 Jul 2026 05:38:25 +0200
Subject: [PATCH 1/2] Add minimum PHP guard to Phar bootstrap

---
 .github/workflows/testing.yml | 28 ++++++++++++++++++++++++++++
 php/boot-phar.php             | 10 ++++++++++
 2 files changed, 38 insertions(+)

diff --git a/.github/workflows/testing.yml b/.github/workflows/testing.yml
index bf67592d8..7ba755d52 100644
--- a/.github/workflows/testing.yml
+++ b/.github/workflows/testing.yml
@@ -13,3 +13,31 @@ on:
 jobs:
   test:
     uses: wp-cli/.github/.github/workflows/reusable-testing.yml@main
+
+  minimum-php-guard:
+    name: Minimum PHP guard - PHP ${{ matrix.php }}
+    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ['5.6', '7.1']
+    steps:
+      - name: Check out source code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up PHP environment
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        with:
+          php-version: '${{ matrix.php }}'
+          coverage: none
+
+      - name: Check minimum PHP guard
+        run: |
+          if php php/boot-phar.php > stdout.txt 2> stderr.txt; then
+            echo 'Expected boot-phar.php to reject unsupported PHP version.'
+            exit 1
+          fi
+
+          test ! -s stdout.txt
+          printf 'Error: WP-CLI requires PHP 7.2.24 or newer. You are running version %s.\n' "$(php -r 'echo PHP_VERSION;')" > expected.txt
+          diff -u expected.txt stderr.txt
diff --git a/php/boot-phar.php b/php/boot-phar.php
index e5f94a262..d7215a90f 100644
--- a/php/boot-phar.php
+++ b/php/boot-phar.php
@@ -1,5 +1,7 @@
 <?php
 
+// This file needs to parse without error in PHP 5.x.
+
 if ( 'cli' !== PHP_SAPI ) {
 	echo "WP-CLI only works correctly from the command line, using the 'cli' PHP SAPI.\n",
 		"You're currently executing the WP-CLI binary via the '" . PHP_SAPI . "' PHP SAPI.\n",
@@ -9,6 +11,14 @@
 	die( -1 );
 }
 
+if ( version_compare( PHP_VERSION, '7.2.24', '<' ) ) {
+	fwrite(
+		STDERR,
+		sprintf( "Error: WP-CLI requires PHP %s or newer. You are running version %s.\n", '7.2.24', PHP_VERSION )
+	);
+	die( -1 );
+}
+
 // Store the path to the Phar early on for `Utils\phar-safe-path()` function.
 define( 'WP_CLI_PHAR_PATH', Phar::running( true ) );
 

From b5e6668c01d581424acaf882415b7b1feb8ebf6c Mon Sep 17 00:00:00 2001
From: Alain Schlesser <alain.schlesser@gmail.com>
Date: Thu, 23 Jul 2026 07:58:42 +0200
Subject: [PATCH 2/2] Disable checkout credential persistence

---
 .github/workflows/testing.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/testing.yml b/.github/workflows/testing.yml
index 7ba755d52..e601fac63 100644
--- a/.github/workflows/testing.yml
+++ b/.github/workflows/testing.yml
@@ -24,6 +24,8 @@ jobs:
     steps:
       - name: Check out source code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up PHP environment
         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2