[rmcdaniel]

The Avro CI job still used setup-php with an unbound transitive installer. Pin that job to Ubuntu 24.04 and the reviewed setup-php-linux helper with explicit production INI, no coverage and both literal PHAR tools. Preserve official PHP/Python Avro consumption and the existing Composer trust check.

This is the repository remaining caller from durable-workflow/.github#297. The original job run must qualify this exact consumer; native Rust publication and installed acceptance use no PHP setup. Local APT and public-boundary guards pass.

[rmcdaniel]

The original migration run found a central action-policy preflight refusal. I am inspecting and correcting the exact input/profile mismatch before requesting merge; the Avro job is still running. No qualification is claimed from a partial run. Owner: sdk-rust.

[rmcdaniel]

The latest original run now passes central policy and the actual Avro protocol job: https://github.com/durable-workflow/sdk-rust/actions/runs/43402717569 . Exact source 724ff8f. The bound PHP setup, live Composer trust check, official PHP/Python Avro consumption and regression budget all passed. The preflight required the literal bound-linux-php comment and exact no-space tools input; those are corrected without changing policy. Next action: finish remaining normal checks and Security review, then merge. Owner: sdk-rust.

[rmcdaniel]

Security source/trust-boundary PASS for exact head 724ff8f41f95b803ef795f525794c1ce34822b2e.

The complete delta is the sole remaining Avro protocol CI caller:

• runner is bound to Ubuntu 24.04;
• mutable setup-php is replaced with qualified helper 411a14ac07d32073eed6ab4977f2825eba4739a7 at its exact supported profile: PHP 8.3, production INI, coverage none, Composer 2.10.3 and PHPUnit 11.5.57;
• checkout already uses persist-credentials:false;
• the existing clean bootstrap and immediate live Composer verifier remain before the official PHP Avro install;
• no privileged release or installed-package path depends on this PHP job, and no other workflow/job/matrix is changed.

All 19 checks on this head are green, including the actual official PHP/Python Avro consumption and central policy/bound setup/trust checks. No source blocker remains.

The PR is currently behind main, so this verdict is not final merge authorization. Refresh from current main, preserve this one-file diff, rerun required checks and send the resulting exact head/tree for a countercheck. Any source/profile change requires full re-review.

[rmcdaniel]

Refreshed from current 4.15 main. Final head b53d746, tree 99165ace6da323596e8b053dd78a2b3bd0d33975. Diff to main remains exactly .github/workflows/ci.yml (5 additions, 3 removals), limited to the Avro job. Local APT guard, boundary scan and diff check pass. Security was asked for the requested final head/tree countercheck; required CI is running. Next action: exact-head confirmation and green CI, then merge. Owner: sdk-rust.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-head countercheck: PASS for b53d746d4a723841c34f4df2df123559cd4d3ab2 (tree 99165ace6da323596e8b053dd78a2b3bd0d33975).

I independently fetched the old reviewed head, refreshed head, and approved 4.15 main. The normalized one-file PR patch has the same stable patch ID before and after the main merge (faadc58e…): Ubuntu 24, bound helper 411a14ac, exact PHP 8.3 production/no-coverage and Composer 2.10.3/PHPUnit 11.5.57 tuple, with the existing APT guard and live Composer trust verifier preserved. No release or privileged path is added.

All current-head checks are successful, including Avro protocol, Rust 1.86/stable, package, CodeQL/Sonar and target-branch qualification. Merge only this exact head/tree.