Rebuild phpPgAdmin on hardened versioned PHP image

.gitea/workflows/publish.yml

@@ -60,6 +60,10 @@ jobs:
             --tag "${IMAGE}:${COMMIT_SHA}" .
           podman run --rm --entrypoint httpd "${IMAGE}:${COMMIT_SHA}" -t
           podman run --rm --entrypoint php "${IMAGE}:${COMMIT_SHA}" -r '
+            if (ini_get("session.upload_progress.enabled")) {
+                fwrite(STDERR, "PHP session upload progress must be disabled.\n");
+                exit(1);
+            }
             foreach (["pgsql", "pdo_pgsql", "mbstring", "Zend OPcache"] as $extension) {
                 if (!extension_loaded($extension)) { fwrite(STDERR, "Missing PHP extension: {$extension}\n"); exit(1); }
             }
@@ -79,7 +83,9 @@ jobs:
           COMMIT_SHA: ${{ gitea.sha }}
         run: |
           set -euo pipefail
-          podman push "${IMAGE}:${COMMIT_SHA}"
+          app_version=$(./chart/version.sh)
+          podman tag "${IMAGE}:${COMMIT_SHA}" "${IMAGE}:${app_version}"
+          podman push "${IMAGE}:${app_version}"
           podman tag "${IMAGE}:${COMMIT_SHA}" "${IMAGE}:latest"
           podman push "${IMAGE}:latest"
       - if: always()
@@ -112,10 +118,7 @@ jobs:
           set -euo pipefail
           git fetch --tags origin main
           test "$(git rev-parse origin/main)" = "$COMMIT_SHA"
-          description=$(git describe --tags --long --match 'v[0-9]*' --dirty)
-          case "$description" in *-dirty) echo 'Refusing dirty chart tree' >&2; exit 1 ;; esac
-          version=${description#v}
-          case "$version" in *-0-g*) version=${version%%-0-g*} ;; esac
+          version=$(./chart/version.sh)
           echo "version=${version}" >> "$GITHUB_OUTPUT"
       - name: Package and publish chart
         env:
@@ -128,7 +131,7 @@ jobs:
           test -n "$PACKAGE_USERNAME" && test -n "$PACKAGE_TOKEN"
           helm lint chart
           helm template phppgadmin chart --namespace default >/dev/null
-          helm package chart --version "$CHART_VERSION" --app-version "$COMMIT_SHA" --destination "$RUNNER_TEMP"
+          helm package chart --version "$CHART_VERSION" --app-version "$CHART_VERSION" --destination "$RUNNER_TEMP"
           curl --fail --silent --show-error \
             --user "${PACKAGE_USERNAME}:${PACKAGE_TOKEN}" \
             --request POST --upload-file "${RUNNER_TEMP}/phppgadmin-${CHART_VERSION}.tgz" \

Dockerfile

@@ -1,4 +1,4 @@
-ARG PHP_APACHE_TAG=2.4.69-8.5.11
+ARG PHP_APACHE_TAG=2.4.69-8.5.11-2-ga3134bb
 FROM registry.brunner.ninja/feedc0de/php-apache:${PHP_APACHE_TAG}
 
 ARG PHPPGADMIN_VERSION=7.14.7

README.md

@@ -14,7 +14,7 @@ in Git or chart values.
 
 The Dockerfile installs phpPgAdmin 7.14.7 on the shared
 `registry.brunner.ninja/feedc0de/php-apache` image. Main-branch CI publishes an
-immutable commit-tagged image and a chart whose `appVersion` selects that exact
+immutable Git-describe-tagged image and a chart whose `appVersion` selects that exact
 image. The chart repository tag follows the bundled phpPgAdmin fork release:
 `v7.14.7-mod` publishes chart `7.14.7-mod`; later chart commits append the Git
 describe count and hash.

chart/Chart.yaml

@@ -3,4 +3,4 @@ name: phppgadmin
 description: Helm chart for the phpPgAdmin container
 type: application
 version: 0.1.0
-appVersion: "4c29807abb362b9cf407762822113c5c75d442f3"
+appVersion: "7.14.7-mod"

chart/version.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+set -eu
+
+description=$(git describe --tags --long --match 'v[0-9]*' --dirty)
+case "$description" in
+  *-dirty) echo 'Refusing to publish a dirty tree' >&2; exit 1 ;;
+esac
+version=${description#v}
+case "$version" in
+  *-0-g*) version=${version%%-0-g*} ;;
+esac
+printf '%s\n' "$version"