[rmcdaniel]

Restore the critical PHP image publication

Part of #591, following merged #593 and immutable source tag 2.10.1.

Merged: fb62c62a7daa5ef0d9ac576d2ed48367684a28a2 / whole cf034e2da09b92449ebd8eefcbfdb59b52c51f7b, identical to the qualified candidate. PHP feature, repository, Sonar app/workflow, all CodeQL analyses and boundaries pass. The remote head is deleted and returns 404. Fresh protected Release 39654639711 is queued from this trusted tooling commit against the unchanged immutable 2.10.1 / 7a02bbcec source. No published image acceptance is claimed.

Exact current source: b3ba5fd5bd9c2f1f41ced91a86ca0a42326faf36 / whole cf034e2da09b92449ebd8eefcbfdb59b52c51f7b, integrating main's Rust-only #604. The diff against main remains exactly one release-workflow file, +3/-1. Nine focused existing release contracts pass with 153 assertions and the workflow YAML parses. These are tooling checks, not published-image acceptance. Fresh PHP 39648080426, Sonar 39648080496 and boundary checks qualify this whole head; earlier results are not carried across it.

Exact Sonar workflow and app analysis pass. The independently read API reports zero OPEN/CONFIRMED issues, 0% new duplication under the unchanged 3% gate, and all required ratings passing. PHP qualification passes before merge. The superseded 9932 PHP run did not respond to ordinary cancellation because its jobs continued; GitHub's force-cancel endpoint retires it as CANCELLED. This is not a passing result or a cancelled current-head gate.

Release 39637101549 stops its cold dual-architecture PHP build at exactly 45 minutes. Its actual log still compiles healthy aarch64 PHP source through ext/session/session.c, then states The action 'Build and push exact image tags' has timed out after 45 minutes. The subsequent exact-image verifier correctly refuses the missing 2.10.1 manifest. Readiness, TLS, catalog, aliases, GitHub Release and chart publication do not run. The original remains failed.

Raise only the bounded image-build step to 120 minutes and use the existing PHP build parallelism argument with four compiler jobs. This accommodates the verified signed-source fallback under ARM emulation. No application, dependency, Dockerfile, frozen profile, assertion, readiness/verification gate or published tag is changed. The normal exact-image guard still refuses overwriting an existing image.

Recovery is dispatched through the existing protected workflow from qualified main against the same immutable 2.10.1 tag and 7a02bbc source. Its source identity and every published-image gate remain required. This changes trusted publication tooling, not the immutable release source. The original unchanged 45-minute attempt stays failed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud