jaredandClaude Opus 4.8
b2c19745eb
Lint / PHP (phpcs PSR-12) (push) Successful in 20s
Lint / JS (eslint) (push) Successful in 11s
Lint / PHP requirements (version + extensions) (push) Successful in 52s
Security / PHP Security (semgrep) (push) Successful in 2m6s
Lint / Deploy (push) Successful in 13s
Lint / Notify on failure (push) Has been skipped
Trusted-proxy hardening (defense-in-depth for Authelia forward-auth): - AuthMiddleware now only honors Remote-* identity headers when REMOTE_ADDR is in a configured TRUSTED_PROXIES allowlist; otherwise it refuses with 403 and logs an 'untrusted_proxy' security event. Previously anything that could reach PHP directly could spoof Remote-User/Remote-Groups and log in as admin. - New config TRUSTED_PROXIES (comma-separated, from .env). Empty = enforcement off, so this is backward compatible until the allowlist is set on a host. Requirements checks (so a PHP upgrade dropping an extension can't silently break features like avatars again): - config/requirements.php: single source of truth for min PHP version and required extensions (ldap, mysqli, curl, mbstring, fileinfo, json). - scripts/check_requirements.php: CI script that fails the build if the environment doesn't satisfy them. - New 'requirements' CI job installs those extensions and runs the check; deploy now depends on it. - api/health.php: adds php_extensions + php_version checks so production monitoring surfaces the drift (returns 503 if a required extension is gone). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
45 lines
1.1 KiB
PHP
45 lines
1.1 KiB
PHP
#!/usr/bin/env php
|
|
<?php
|
|
|
|
/**
|
|
* Verify the running PHP environment meets the declared runtime requirements.
|
|
*
|
|
* Reads config/requirements.php and checks the PHP version and that every
|
|
* required extension is loaded. Exits non-zero (failing CI) on any miss.
|
|
*
|
|
* Usage: php scripts/check_requirements.php
|
|
*/
|
|
|
|
$req = require __DIR__ . '/../config/requirements.php';
|
|
|
|
$errors = [];
|
|
|
|
// PHP version
|
|
$minPhp = $req['min_php_version'];
|
|
if (version_compare(PHP_VERSION, $minPhp, '<')) {
|
|
$errors[] = sprintf('PHP %s is below the required minimum %s', PHP_VERSION, $minPhp);
|
|
}
|
|
|
|
// Required extensions
|
|
foreach ($req['required_extensions'] as $ext) {
|
|
if (!extension_loaded($ext)) {
|
|
$errors[] = sprintf('Missing required PHP extension: %s', $ext);
|
|
}
|
|
}
|
|
|
|
if (!empty($errors)) {
|
|
fwrite(STDERR, "Requirement check FAILED:\n");
|
|
foreach ($errors as $err) {
|
|
fwrite(STDERR, ' - ' . $err . "\n");
|
|
}
|
|
exit(1);
|
|
}
|
|
|
|
printf(
|
|
"Requirement check passed: PHP %s (>= %s); extensions: %s\n",
|
|
PHP_VERSION,
|
|
$minPhp,
|
|
implode(', ', $req['required_extensions'])
|
|
);
|
|
exit(0);
|