From 653d0c9ebbf2ba97ca6b909cc00c8b895b969fd6 Mon Sep 17 00:00:00 2001
From: Chris Johnson <cjohnson@phase2.io>
Date: Wed, 21 Oct 2026 15:09:47 -0400
Subject: [PATCH 1/2] Build on interim patched PHP base images and drop PHP 8.1

Mitigates CVE-2026-109618 and CVE-2026-109619 until
docksal/service-cli#350 is merged and released:

- Add a workflow that builds docksal/cli from the phase2/service-cli
  fork and publishes it as ghcr.io/phase2/service-cli.
- Make the base image configurable via CLI_IMAGE and use the interim
  image in CI.
- Drop PHP 8.1, which has no upstream fix.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/default.yml     |  2 +-
 .github/workflows/service-cli.yml | 83 +++++++++++++++++++++++++++++++
 src/Dockerfile                    |  3 +-
 3 files changed, 86 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/service-cli.yml

diff --git a/.github/workflows/default.yml b/.github/workflows/default.yml
index b035388..10b55d8 100644
--- a/.github/workflows/default.yml
+++ b/.github/workflows/default.yml
@@ -24,7 +24,6 @@ jobs:
       fail-fast: false # Don't cancel other jobs if one fails
       matrix:
         include:
-          - version: "8.1"
           - version: "8.2"
           - version: "8.3"
           - version: "8.4"
@@ -87,6 +86,7 @@ jobs:
           context: ./src
           file: ./src/Dockerfile
           build-args: |
+            CLI_IMAGE=ghcr.io/${{ github.repository_owner }}/service-cli
             CLI_VERSION=php${{ matrix.version }}
             INSTALL_SQLITE=${{ matrix.version >= '8.3' }}
           platforms: linux/amd64,linux/arm64
diff --git a/.github/workflows/service-cli.yml b/.github/workflows/service-cli.yml
new file mode 100644
index 0000000..5aef60c
--- /dev/null
+++ b/.github/workflows/service-cli.yml
@@ -0,0 +1,83 @@
+---
+name: "build interim service-cli images"
+
+# Temporary: builds docksal/cli from the phase2/service-cli fork until
+# https://github.com/docksal/service-cli/pull/350 is merged and released.
+
+on:
+  workflow_dispatch:
+  schedule:
+  - cron: '0 10 * * 0' # Every Sunday at 10AM
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  IMAGE: ghcr.io/${{ github.repository_owner }}/service-cli
+  SOURCE_REPO: phase2/service-cli
+  SOURCE_REF: update-php-minor-versions
+
+jobs:
+  build:
+    name: "Build: ${{ matrix.version }}/${{ matrix.arch }}"
+    runs-on: ${{ matrix.runner }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        version: ["8.2", "8.3", "8.4"]
+        arch: [amd64, arm64]
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          repository: ${{ env.SOURCE_REPO }}
+          ref: ${{ env.SOURCE_REF }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build
+        uses: docker/build-push-action@v7
+        with:
+          context: ${{ matrix.version }}
+          file: ${{ matrix.version }}/Dockerfile
+          build-args: VERSION=${{ matrix.version }}
+          tags: ${{ env.IMAGE }}:php${{ matrix.version }}-${{ matrix.arch }}
+          push: true
+          pull: true
+          no-cache: true
+
+  push:
+    name: "Push: ${{ matrix.version }}/multi"
+    runs-on: ubuntu-24.04
+    needs: build
+
+    strategy:
+      matrix:
+        version: ["8.2", "8.3", "8.4"]
+
+    steps:
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Push multi-arch image
+        run: |
+          docker buildx imagetools create -t "${IMAGE}:php${{ matrix.version }}" \
+            "${IMAGE}:php${{ matrix.version }}-amd64" \
+            "${IMAGE}:php${{ matrix.version }}-arm64"
diff --git a/src/Dockerfile b/src/Dockerfile
index b32f6ea..e59c3c5 100644
--- a/src/Dockerfile
+++ b/src/Dockerfile
@@ -1,7 +1,8 @@
+ARG CLI_IMAGE=docksal/cli
 ARG CLI_VERSION={{cli_version}}
 
 # Extend the Docksal CLI per https://docs.docksal.io/stack/extend-images/
-FROM docksal/cli:${CLI_VERSION}
+FROM ${CLI_IMAGE}:${CLI_VERSION}
 
 # See https://github.com/hadolint/hadolint/wiki/DL4006
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]

From 0c76739e8015c75172a63aba187e36251e13db31 Mon Sep 17 00:00:00 2001
From: Chris Johnson <cjohnson@phase2.io>
Date: Wed, 21 Oct 2026 15:15:09 -0400
Subject: [PATCH 2/2] Build interim images from floating PHP base tags

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/service-cli.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/service-cli.yml b/.github/workflows/service-cli.yml
index 5aef60c..e8fabde 100644
--- a/.github/workflows/service-cli.yml
+++ b/.github/workflows/service-cli.yml
@@ -16,7 +16,7 @@ permissions:
 env:
   IMAGE: ghcr.io/${{ github.repository_owner }}/service-cli
   SOURCE_REPO: phase2/service-cli
-  SOURCE_REF: update-php-minor-versions
+  SOURCE_REF: phase2-interim
 
 jobs:
   build: