Add minimum PHP guard to Phar bootstrap by schlessera · Pull Request #1089 · wp-cli/wp-cli-bundle

schlessera · 2026-07-23T04:02:51Z

Context

The filesystem bootstrap (php/boot-fs.php) rejects PHP versions older than 7.2.24, but that file is not loaded by the Phar. The generated stub includes php/boot-phar.php, which loads php/wp-cli.php directly. boot-fs.php is only present in the archive because the framework package is bundled.

This initially looked like a release-critical safety gap for already shipped 2.x self-updaters. A deeper check showed that:

The bundle requires PHP 7.2.24 and the current Phar contains Composer's generated platform_check.php, which enforces that requirement.
The 2.x updater smoke-tests a downloaded Phar using --info and only replaces the existing Phar when that command succeeds.
An end-to-end test with WP-CLI 2.12.0 on PHP 7.1 confirmed that the current nightly is rejected and the original Phar remains byte-for-byte unchanged.

The explicit guard is therefore defense-in-depth and a clearer diagnostic, rather than the only barrier preventing an unsupported update.

Changes

Reject unsupported PHP versions in boot-phar.php before loading the framework.
Write the diagnostic to STDERR so existing 2.x self-updaters can relay it when validation fails.
Test the guard on PHP 5.6 and PHP 7.1, ensuring that the bootstrap remains parseable, exits unsuccessfully, and produces the expected STDERR output.

Testing

composer lint
composer phpcs
composer phpstan
composer phpunit
composer behat (53 scenarios, 600 steps)
Focused guard checks on PHP 5.6.40 and PHP 7.1.33

Summary by CodeRabbit

Bug Fixes
- Added a runtime compatibility check that blocks execution on PHP versions older than 7.2.24.
- Improved startup failure messaging to clearly state the minimum required PHP version and the detected version.
Tests
- Added a dedicated CI job to validate the rejection behavior for older supported PHP versions.

coderabbitai · 2026-07-23T04:03:04Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0c521898-9eff-46d6-aa33-d9deb0ff4dfa

📥 Commits

Reviewing files that changed from the base of the PR and between 679ad91 and b5e6668.

📒 Files selected for processing (1)

.github/workflows/testing.yml

🚧 Files skipped from review as they are similar to previous changes (1)

.github/workflows/testing.yml

📝 Walkthrough

Walkthrough

The PHAR bootstrap now rejects PHP versions below 7.2.24, and CI verifies this behavior on PHP 5.6 and 7.1 by checking stdout and stderr output.

Changes

Minimum PHP version guard

Layer / File(s)	Summary
Bootstrap PHP version check `php/boot-phar.php`	Adds a PHP 5.x parsing compatibility comment and an early `PHP_VERSION` check that writes an error to stderr and exits with status `-1` below PHP 7.2.24.
Unsupported-version CI validation `.github/workflows/testing.yml`	Adds a PHP 5.6 and 7.1 matrix job that executes the bootstrap and validates empty stdout plus the expected stderr message.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CI as minimum-php-guard
  participant PHP as PHP runtime
  participant Boot as php/boot-phar.php
  participant Files as stdout.txt/stderr.txt
  CI->>PHP: Run PHP 5.6 or 7.1
  PHP->>Boot: Execute bootstrap
  Boot->>Boot: Check PHP_VERSION < 7.2.24
  Boot->>Files: Write error to stderr.txt
  Boot-->>PHP: Exit with status -1
  CI->>Files: Compare captured output with expected.txt

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding a minimum PHP version guard to the Phar bootstrap.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/phar-minimum-php-guard

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/workflows/testing.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

_{Comment @coderabbitai help to get the list of available commands.}

codecov · 2026-07-23T04:11:27Z

Codecov Report

❌ Patch coverage is 0% with 6 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
php/boot-phar.php	0.00%	6 Missing ⚠️

📢 Thoughts on this report? Let us know!

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/testing.yml:
- Around line 25-26: Update the actions/checkout step in the testing workflow to
set persist-credentials to false, ensuring the checkout action does not retain
the GITHUB_TOKEN for subsequent PR-controlled job steps.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3797408a-812d-4c70-a5cd-4b8f0ef5a58e

📥 Commits

Reviewing files that changed from the base of the PR and between dfea6e2 and 679ad91.

📒 Files selected for processing (2)

.github/workflows/testing.yml
php/boot-phar.php

Add minimum PHP guard to Phar bootstrap

679ad91

schlessera added this to the 3.0.0 milestone Jul 23, 2026

schlessera added bug Something isn't working scope:testing Related to testing scope:distribution Related to distribution labels Jul 23, 2026

github-actions Bot added enhancement New feature or request scope:framework labels Jul 23, 2026

schlessera removed enhancement New feature or request scope:framework labels Jul 23, 2026

schlessera marked this pull request as ready for review July 23, 2026 04:59

schlessera requested a review from a team as a code owner July 23, 2026 04:59

coderabbitai Bot reviewed Jul 23, 2026

View reviewed changes

Comment thread .github/workflows/testing.yml

Disable checkout credential persistence

b5e6668

swissspidy approved these changes Jul 23, 2026

View reviewed changes

swissspidy merged commit 242f8c0 into main Jul 23, 2026
66 checks passed

swissspidy deleted the fix/phar-minimum-php-guard branch July 23, 2026 09:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add minimum PHP guard to Phar bootstrap#1089

Add minimum PHP guard to Phar bootstrap#1089
swissspidy merged 2 commits into
mainfrom
fix/phar-minimum-php-guard

schlessera commented Jul 23, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 23, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

codecov Bot commented Jul 23, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

schlessera commented Jul 23, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Changes

Testing

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

codecov Bot commented Jul 23, 2026

Codecov Report

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

schlessera commented Jul 23, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 23, 2026 •

edited

Loading