Setup PHP in GitHub Actions

Setup PHP with required extensions, php.ini configuration, code-coverage support, and various tools like composer in GitHub Actions. This action gives you a cross-platform interface to set up the PHP environment you need to test your application. Refer to the Usage section and examples to see how to use this.

Contents

• OS/Platform Support
  • GitHub-Hosted Runners
  • Self-Hosted Runners
• PHP Support
• PHP Extension Support
• Tools Support
• Coverage Support
  • Xdebug
  • PCOV
  • Disable Coverage
• Usage
  • Inputs
  • Outputs
  • Flags
  • Basic Setup
  • Matrix Setup
  • Nightly Build Setup
  • Debug Build Setup
  • Thread Safe Setup
  • Force Update Setup
  • Verbose Setup
  • Multi-Arch Setup
  • Self Hosted Setup
  • Local Testing Setup
  • JIT Configuration
  • Cache Extensions
  • Cache Composer Dependencies
  • GitHub Composer Authentication
  • Private Packagist Authentication
  • Manual Composer Authentication
  • Inline PHP Scripts
  • Problem Matchers
  • Examples
• Versioning
• License
• Contributions
• Support This Project
• Dependencies
• Further Reading

☁️ OS/Platform Support

Both GitHub-hosted and self-hosted runners are supported by setup-php on the following OS/Platforms.

GitHub-Hosted Runners

[!NOTE] Support for Intel (x86_64) macOS runners and macOS Sonoma 14.x (macos-14) arm64 runners is deprecated and will be removed completely in a future release of setup-php. We recommend migrating to arm64-based macOS runners running macOS 15 or newer, such as macos-26 or macos-15.

Self-Hosted Runners

• Refer to the self-hosted setup to use the action on self-hosted runners.
• Operating systems based on the above Ubuntu and Debian versions are also supported on a best effort basis.
• If the requested PHP version is pre-installed, setup-php switches to it, otherwise it installs the PHP version.

🎉 PHP Support

On all supported OS/Platforms, the following PHP versions can be set up as per the runner.

• PHP 5.3 to PHP 8.7 on GitHub-hosted runners, except for macOS ARM64 runners.
• PHP 5.6 to PHP 8.7 on GitHub-hosted macOS ARM64 runners.
• PHP 5.6 to PHP 8.7 on self-hosted runners.

[!Note]

• Specifying 8.7 or master in php-version input installs a nightly build of PHP 8.7.0-dev from the master branch of PHP. Specifying 8.6 or nightly installs a nightly build of PHP 8.6.0-dev from the PHP-8.6 branch. See nightly build setup for more information.
• To use JIT on PHP 8.0 and above, refer to the JIT configuration section.

➕ PHP Extension Support

PHP extensions can be set up using the extensions input. It accepts a string in csv-format.

• On Ubuntu, extensions which are available as a package, available on PECL or a git repository can be set up.

- name: Setup PHP with PECL extension
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    extensions: imagick, redis

• On Windows, extensions available on PECL which have the DLL binary can be set up.

• On macOS, extensions available on PECL or a git repository can be set up.

• On Ubuntu and macOS to compile and install an extension from a git repository follow this guide.

• Extensions installed along with PHP if specified are enabled.

• Specific versions of extensions available on PECL can be set up by suffixing the extension's name with the version. This is useful for installing old versions of extensions which support end-of-life PHP versions.

- name: Setup PHP with specific version of PECL extension
  uses: shivammathur/setup-php@v2
  with:
    php-version: '5.4'
    extensions: swoole-1.9.3

• Extensions with pre-release versions available on PECL can be set up by suffixing the extension's name with its state i.e alpha, beta, devel or snapshot.

- name: Setup PHP with pre-release PECL extension
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    extensions: xdebug-beta

• On Ubuntu and macOS to compile and install an extension from PECL with libraries or custom configuration follow this guide.

• Shared extensions can be disabled by prefixing them with a :. All extensions depending on the specified extension will also be disabled.

- name: Setup PHP and disable mbstring
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    extensions: :mbstring

• All shared extensions can be disabled by specifying none. When none is specified along with other extensions, it is hoisted to the start of the input. So, all the shared extensions will be disabled first, then the rest of the extensions in the input will be processed.

This disables all core and third-party shared extensions and thus, can break some tools that need them. Required extensions are enabled again when the tools are set up on a best-effort basis. So it is recommended to add the extensions required for your tools after none in the extensions input to avoid any issues.

- name: Setup PHP without any shared extensions except mbstring
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    extensions: none, mbstring

• Extension intl can be set up with specific ICU version for PHP 5.6 and above in Ubuntu workflows by suffixing intl with the ICU version. ICU 50.2 and newer versions are supported for PHP 8.4 and lower, ICU 57.2 and newer versions are supported for PHP 8.5 and above. Refer to ICU builds for the specific versions supported.

- name: Setup PHP with intl
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    extensions: intl-77.1

• Extensions loaded by default after setup-php runs can be found on the wiki.

• These extensions have custom support:

  • cubrid and pdo_cubrid on Ubuntu.
  • event, gearman, geos and relay on Ubuntu and macOS.
  • blackfire, couchbase, ibm_db2, ioncube, oci8, pdo_firebird, pdo_ibm, pdo_oci, pecl_http, phalcon3, phalcon4, phalcon5, and zephir_parser on all supported OS.

• By default, extensions which cannot be added or disabled gracefully leave an error message in the logs. The execution is not interrupted. To change this behaviour you can set fail-fast flag to true.

- name: Setup PHP with fail-fast
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    extensions: oci8
  env:
    fail-fast: true

🔧 Tools Support

These tools can be set up globally using the tools input. It accepts a string in csv-format.

backward-compatibility-check, behat, blackfire, blackfire-player, box, castor, churn, codeception, composer, composer-dependency-analyser, composer-normalize, composer-prefetcher, composer-require-checker, composer-unused, cpx, cs2pr, deployer, ecs, flex, grpc_php_plugin, infection, laravel-cloud or cloud-cli, mago, name-collision-detector, parallel-lint, pecl, phan, phing, phinx, phive, php-config, php-cs-fixer, php-scoper, phpcbf, phpcpd, phpcs, phpdoc or phpDocumentor, phpize, phplint, phpmd, phpspec, phpstan, phpunit, phpunit-bridge, phpunit-polyfills, pie, pint, prestissimo, protoc, psalm, rector, symfony or symfony-cli, vapor or vapor-cli, wp or wp-cli

- name: Setup PHP with tools
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: php-cs-fixer, phpunit

• In addition to the above tools, any composer tool or package can also be set up globally by specifying it as vendor/package matching the listing on Packagist. This format accepts the same version constraints as composer.

- name: Setup PHP with tools
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: vimeo/psalm

• To set up a particular version of a tool, specify it in the form tool:version.

  Version can be in the following format:

  • Semver. For example tool:1.2.3 or tool:1.2.3-beta1.
  • Major version. For example tool:1 or tool:1.x.
  • Major and minor version. For example tool:1.2 or tool:1.2.x.

  When you specify just the major version or the version in major.minor format, the latest patch version matching the input will be set up.

• To harden your workflow against supply chain attacks, you can pin a tool to a checksum in the form tool:version@sha256:<hash> or tool:version@sha512:<hash>. The downloaded tool is verified against the checksum and it is not set up if the verification fails, even if the tool is served from the tools cache.

- name: Setup PHP with tools pinned to a checksum
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: composer:2.9.8@sha256:59b2c50e10cafa0d8efc19ede9a326d782f096c674a26baf98cf042ce23de890

Checksum verification is supported only for tools downloaded as phar archives with a full version, such as tool:1.2.3 or tool:1.2.3-beta1. Specifying a checksum with an omitted version, a variable tag such as latest, stable, preview or snapshot, or a partial version such as 2, 2.x, 2.9 or 2.9.x results in an error. These versions can resolve to different releases with different checksums. Checksum verification is not supported for tools set up using composer packages or custom package scripts; specifying a checksum for these tools also results in an error.

• The latest stable version of composer is set up by default. You can set up the required composer version by specifying the major version v1 or v2, or the version in major.minor or semver format. Additionally, for composer snapshot and preview can also be specified to set up the respective releases.

- name: Setup PHP with composer v2
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: composer:v2

• If you do not use composer in your workflow, you can specify tools: none to skip it.

- name: Setup PHP without composer
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: none

• Tools pear, pecl, phpize and php-config are set up by default for all supported PHP versions on Linux and macOS.

• The latest version of blackfire cli is set up when blackfire is specified in tools input. Please refer to the official documentation for using blackfire with GitHub Actions.

• Tools prestissimo and composer-prefetcher will be skipped unless composer:v1 is also specified in tools input. It is recommended to drop prestissimo and use composer v2.

• By default, except composer tools which cannot be set up gracefully leave an error message in the logs, the execution is not interrupted. To change this behaviour you can set fail-fast flag to true.

- name: Setup PHP with fail-fast
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: deployer
  env:
    fail-fast: true

• By default, composer blocks all its plugins. If you are using the tools input to install a composer plugin it will be added to the allowlist, alternatively if your dependencies have composer plugins, you can allow them by setting COMPOSER_ALLOW_PLUGINS that accepts a csv string of plugin names.

- name: Setup PHP with allow composer plugins
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
  env:
    COMPOSER_ALLOW_PLUGINS: composer/installers, composer/satis

[!NOTE]

• Input tools is useful to set up tools which are only used in CI workflows, thus keeping your composer.json tidy.
• If you do not want to use all your dev-dependencies in workflow, you can run composer with --no-dev and install required tools using tools input to speed up your workflow.
• By default, COMPOSER_NO_INTERACTION is set to 1 and COMPOSER_PROCESS_TIMEOUT is set to 0. In effect, this means that Composer commands in your scripts do not need to specify --no-interaction.
• Also, COMPOSER_NO_AUDIT is set to 1. So if you want to audit your dependencies for security vulnerabilities, it is recommended to add a composer audit step before you install them.
• If you want to set a different COMPOSER_PROCESS_TIMEOUT, you can set it in your workflow file using the env keyword.

- name: Setup PHP with composer and custom process timeout
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
  env:
    COMPOSER_PROCESS_TIMEOUT: 300

📶 Coverage Support

Xdebug

Specify coverage: xdebug to use Xdebug and disable PCOV.
Runs on all PHP versions supported.

- name: Setup PHP with Xdebug
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    coverage: xdebug

• When you specify coverage: xdebug, the latest version of Xdebug compatible with the PHP version is set up by default.
• If you need Xdebug 2.x on PHP 7.2, 7.3, or 7.4, you can specify coverage: xdebug2.

- name: Setup PHP with Xdebug 2.x
  uses: shivammathur/setup-php@v2
  with:
    php-version: '7.4'
    coverage: xdebug2

[!NOTE] Xdebug is enabled by default on Ubuntu GitHub Actions images, so if you are not using it in your workflows, it is recommended to disable it as that will have a positive impact on your PHP performance. Please refer to the disable coverage section for details.

PCOV

Specify coverage: pcov to use PCOV and disable Xdebug.
Runs on PHP 7.1 and newer PHP versions.

• If your source code directory is other than src, lib or, app, specify pcov.directory using the ini-values input.

- name: Setup PHP with PCOV
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    ini-values: pcov.directory=api #optional, see above for usage.
    coverage: pcov

• PHPUnit 8.x and above support PCOV out of the box.
• If you are using PHPUnit 5.x, 6.x, or 7.x, you need to set up pcov/clobber before executing your tests.

- name: Setup PCOV
  run: |
    composer require pcov/clobber
    vendor/bin/pcov clobber

Disable Coverage

Specify coverage: none to disable both Xdebug and PCOV.

Disable coverage for these reasons:

• You are not generating coverage reports while testing.
• You are using phpdbg for running your tests.
• You are profiling your code using blackfire.
• You are using PHP in JIT mode. Please refer to the JIT configuration section for more details.

- name: Setup PHP with no coverage driver
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    coverage: none

📝 Usage

Inputs

Specify using with keyword

php-version (optional)

• Specify the PHP version you want to set up.
• Accepts a string. For example '8.5'.
• Accepts lowest to set up the lowest supported PHP version.
• Accepts highest or latest to set up the latest stable PHP version.
• Accepts nightly to set up a nightly build of the next PHP release (8.6).
• Accepts master to set up a nightly build from the master branch of PHP (8.7).
• Accepts pre-installed to set up the highest pre-installed PHP version. You can combine this with update: true to update the pre-installed PHP version.
• Accepts the format d.x, where d is the major version. For example 5.x, 7.x and 8.x.
• See PHP support for the supported PHP versions.
• If not specified, it looks for the following in order:
  • The php-version-file input if it exists
  • A composer.lock file and the platform-overrides.php value
  • A composer.json file and the config.platform.php value
  • If the composer.lock or composer.json file is in a subdirectory in your repository, please specify the subdirectory path in COMPOSER_PROJECT_DIR env.

php-version-file (optional)

• Specify a file with the PHP version you want to set up.
• Accepts a string. For example '.phpenv-version'.
• See PHP support for the supported PHP versions.
• By default, .php-version file is used.
• The file needs to either have the PHP version as its content or follows the asdf .tool-versions format.
• If not specified and the default .php-version file is not found, the latest stable PHP version is set up.

extensions (optional)

• Specify the extensions you want to add or disable.
• Accepts a string in csv-format. For example mbstring, :opcache.
• Accepts none to disable all shared extensions.
• Shared extensions prefixed with : are disabled.
• See PHP extension support for more info.

ini-file (optional)

• Specify the base php.ini file.
• Accepts production, development or none.
• By default, production php.ini file is used.

ini-values (optional)

• Specify the values you want to add to php.ini.
• Accepts a string in csv-format. For example post_max_size=256M, max_execution_time=180.
• Accepts ini values with commas if wrapped in quotes. For example xdebug.mode="develop,coverage".

coverage (optional)

• Specify the code-coverage driver you want to set up.
• Accepts xdebug, pcov or none.
• See coverage support for more info.

tools (optional)

• Specify the tools you want to set up.
• Accepts a string in csv-format. For example: phpunit, phpcs
• See tools support for tools supported.

github-token (optional)

• Specify the GitHub token to use for authentication.
• Accepts a string.
• By default, GITHUB_TOKEN secret provided by GitHub Actions is used.
• For GitHub Enterprise users, it is recommended to use a Personal Access Token (PAT).

Outputs

php-version

On GitHub Actions you can assign the setup-php step an id, you can use the same to get the outputs in a later step.

• Provides the PHP version in semver format.

- name: Setup PHP
  id: setup-php
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'

- name: Print PHP version
  run: echo ${{ steps.setup-php.outputs.php-version }}

Flags

Specify using env keyword

fail-fast (optional)

• Specify to mark the workflow as failed if an extension or tool fails to set up.
• This changes the default mode from graceful warnings to fail-fast.
• By default, it is set to false.
• Accepts true and false.

phpts (optional)

• Specify to set up a thread-safe build of PHP.
• Accepts nts for non-thread-safe and zts or ts for thread-safe.
• By default, it is set to nts.
• See thread safe setup for more info.

update (optional)

• Specify to update PHP on the runner to the latest patch version.
• Accepts true and false.
• By default, it is set to false.
• See force update setup for more info.

verbose (optional)

• Specify to enable verbose output.
• Accepts true, false, v, vv and vvv.
• By default, it is set to false.
• See verbose setup for more info.

See below for more info.

Basic Setup

Set up a particular PHP version.

steps:
- name: Setup PHP
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    extensions: mbstring, intl
    ini-values: post_max_size=256M, max_execution_time=180
    coverage: xdebug
    tools: php-cs-fixer, phpunit

Matrix Setup

Set up multiple PHP versions on multiple operating systems.

jobs:
  run:
    runs-on: ${{ matrix.operating-system }}
    strategy:
      matrix:
        operating-system: ['ubuntu-latest', 'windows-latest', 'macos-latest']
        php-versions: ['8.2', '8.3', '8.4', '8.5']
        phpunit-versions: ['latest']
        include:
          - operating-system: 'ubuntu-latest'
            php-versions: '8.1'
            phpunit-versions: 10
    steps:
    - name: Setup PHP
      uses: shivammathur/setup-php@v2
      with:
        php-version: ${{ matrix.php-versions }}
        extensions: mbstring, intl
        ini-values: post_max_size=256M, max_execution_time=180
        coverage: xdebug
        tools: php-cs-fixer, phpunit:${{ matrix.phpunit-versions }}

Nightly Build Setup

Set up a nightly build of PHP 8.6 or PHP 8.7.

• These PHP versions are currently in active development and might contain bugs and breaking changes.
• Some user space extensions might not support these versions currently.

steps:
- name: Setup nightly PHP
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.7'
    extensions: mbstring
    ini-values: post_max_size=256M, max_execution_time=180
    coverage: xdebug
    tools: php-cs-fixer, phpunit

Debug Build Setup

Set up a PHP build with debugging symbols.

• Production release builds of PHP without debugging symbols are set up by default.
• You can use the debug environment variable to set up a build with debugging symbols for PHP 5.6 and above.

[!NOTE]

• On Linux, the debug symbols are added as debug info files in the /usr/lib/debug/.build-id directory. These files match the build-id in the ELF section of the PHP binaries and debugging tools like gdb are able to resolve the symbols from these files.
• On Windows, the debug symbols are added as pdb files in the PHP installation directory.
• On macOS, the debug symbols are compiled into the binaries.

steps:
- name: Setup PHP with debugging symbols
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
  env:
    debug: true # specify true or false

Thread Safe Setup

Set up TS or NTS PHP.

• NTS versions are set up by default.

jobs:
  run:
    runs-on: [ubuntu-latest, windows-latest, macos-latest]
    name: Setup PHP TS
    steps:
    - name: Setup PHP
      uses: shivammathur/setup-php@v2
      with:
        php-version: '8.5'
      env:
        phpts: ts # specify ts or nts

Force Update Setup

Update to the latest patch of PHP versions.

• Pre-installed PHP versions are not updated to their latest patch release by default.
• If ppa:ondrej/php is missing on the Ubuntu GitHub environment, the PHP version is updated to the latest patch release.
• You can specify the update environment variable to true for updating to the latest release.

- name: Setup PHP with latest versions
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
  env:
    update: true # specify true or false

Verbose Setup

Debug your workflow

• Set the verbose environment variable to true or v to show command output.
• Set verbose to vv or vvv to also enable set -x on Linux and macOS.
• On Windows, vv enables Set-PSDebug -Trace 1 and vvv enables Set-PSDebug -Trace 2.
• Enabling GitHub Actions debug logging (RUNNER_DEBUG=1) also enables verbose mode.
• The verbose and more-verbose tags have been deprecated and will be discontinued in the next major release.

- name: Setup PHP with logs
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
  env:
    verbose: true

Multi-Arch Setup

Set up PHP on multiple architectures on Ubuntu GitHub Runners.

• PHP 5.6 to PHP 8.5 are supported by setup-php on multiple architecture on Ubuntu and Debian.
• For this, you can use shivammathur/node images as containers. These have compatible Nodejs and PHP installed for setup-php.

jobs:
  run:
    runs-on: ${{ matrix.os }}
    container: shivammathur/node:php-${{ matrix.php-versions }}-24.04-${{ matrix.arch }}
    strategy:
      matrix:
        arch: ["amd64", "arm64v8"]
        php-versions: [8.4, 8.5]
        include:
            - arch: "amd64"
              os: "ubuntu-24.04"
            - arch: "arm64v8" 
              os: "ubuntu-24.04-arm"
    steps:
      - name: Install PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ matrix.php-versions }}

Self Hosted Setup

Set up PHP on a self-hosted runner.

• To set up a containerized self-hosted runner, refer to the following guides as per your base operating system.

  • Linux
  • Windows

• To set up the runner directly on the host OS or in a virtual machine, follow this requirements guide before setting up the self-hosted runner.

• If your workflow uses service containers, then set up the runner on a Linux host or in a Linux virtual machine. GitHub Actions does not support nested virtualization on Linux, so services will not work in a dockerized container.

It is recommended to specify the environment variable runner with the value self-hosted for self-hosted environments.

jobs:
  run:
    runs-on: self-hosted
    strategy:
      matrix:
        php-versions: ['5.6', '7.0', '7.1', '7.2', '7.3', '7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5']
    name: PHP ${{ matrix.php-versions }}
    steps:
    - name: Setup PHP
      uses: shivammathur/setup-php@v2
      with:
        php-version: ${{ matrix.php-versions }}
      env:
        runner: self-hosted

[!NOTE]

• Do not set up multiple self-hosted runners on a single server instance as parallel workflows will conflict with each other.
• Do not set up self-hosted runners on the side of your development environment or your production server.
• Avoid using the same labels for your self-hosted runners which are used by GitHub-hosted runners.

Local Testing Setup

Test your Ubuntu workflow locally using nektos/act.

jobs:
  run:
    runs-on: ubuntu-latest
    steps:
    - name: Setup PHP
      uses: shivammathur/setup-php@v2
      with:
        php-version: '8.5'

Run the workflow locally with act using shivammathur/node docker images.

Choose the image tag which matches the runs-on property in your workflow. For example, if you are using ubuntu-22.04 in your workflow, run act -P ubuntu-22.04=shivammathur/node:22.04.

# For runs-on: ubuntu-latest
act -P ubuntu-latest=shivammathur/node:latest

# For runs-on: ubuntu-24.04
act -P ubuntu-24.04=shivammathur/node:24.04

# For runs-on: ubuntu-22.04
act -P ubuntu-22.04=shivammathur/node:22.04

JIT Configuration

Enable Just-in-time (JIT) on PHP 8.0 and above.

• To enable JIT, enable opcache in cli mode by setting opcache.enable_cli=1.
• JIT conflicts with Xdebug, PCOV, and other extensions which override zend_execute_ex function, so set coverage: none and disable any such extension if added.
• By default, opcache.jit=1235 and opcache.jit_buffer_size=256M (opcache.jit_buffer_size=128M on ARM-based environments) are set which can be changed using ini-values input.
• For detailed information about JIT related directives refer to the official PHP documentation.

For example, to enable JIT in tracing mode with buffer size of 64 MB.

- name: Setup PHP with JIT in tracing mode
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    coverage: none
    ini-values: opcache.enable_cli=1, opcache.jit=tracing, opcache.jit_buffer_size=64M

Cache Extensions

You can cache PHP extensions using shivammathur/cache-extensions and action/cache GitHub Actions. Extensions which take very long to set up when cached are available in the next workflow run and are enabled directly. This reduces the workflow execution time.
Refer to shivammathur/cache-extensions for details.

Cache Composer Dependencies

If your project uses composer, you can persist the composer's internal cache directory. Dependencies cached are loaded directly instead of downloading them while installation. The files cached are available across check-runs and will reduce the workflow execution time.

- name: Get composer cache directory
  id: composer-cache
  run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT

- name: Cache dependencies
  uses: actions/cache@v4
  with:
    path: ${{ steps.composer-cache.outputs.dir }}
    key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
    restore-keys: ${{ runner.os }}-composer-

- name: Install dependencies
  run: composer install --prefer-dist

[!NOTE]

• Please do not cache vendor directory using action/cache as that will have side effects.
• If you do not commit composer.lock, you can use the hash of composer.json as the key for your cache.

key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.json') }}

• If you support a range of composer dependencies and use prefer-lowest and prefer-stable options, you can store them in your matrix and add them to the keys.

key: ${{ runner.os }}-composer-${{ matrix.prefer }}-${{ hashFiles('**/composer.lock') }}
restore-keys: ${{ runner.os }}-composer-${{ matrix.prefer }}-

GitHub Composer Authentication

By default, setup-php uses the GITHUB_TOKEN secret that is generated for each workflow run. In case you want to use a Personal Access Token (PAT) instead, you can set the github-token input.

- name: Setup PHP
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    github-token: ${{ secrets.YOUR_PAT_TOKEN }}

The COMPOSER_TOKEN and GITHUB_TOKEN environment variables have been deprecated in favor of the github-token input and will be removed in the next major version.

For GitHub Enterprise users, the github-token input does not default to the GITHUB_TOKEN secret. Therefore, it's recommended to set the github-token input to a Personal Access Token (PAT).

Private Packagist Authentication

If you use Private Packagist for your private composer dependencies, you can set the PACKAGIST_TOKEN environment variable to authenticate.

- name: Setup PHP
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
  env:
    PACKAGIST_TOKEN: ${{ secrets.PACKAGIST_TOKEN }}

Manual Composer Authentication

In addition to GitHub or Private Packagist, if you want to authenticate private repositories hosted elsewhere, you can set the COMPOSER_AUTH_JSON environment variable with the authentication methods and the credentials in JSON format. Please refer to the authentication section in composer documentation for more details.

- name: Setup PHP
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
  env:
    COMPOSER_AUTH_JSON: |
      {
        "http-basic": {
          "example.org": {
            "username": "${{ secrets.EXAMPLE_ORG_USERNAME }}",
            "password": "${{ secrets.EXAMPLE_ORG_PASSWORD }}"
          }
        }
      }

Inline PHP Scripts

If you have to run multiple lines of PHP code in your workflow, you can do that easily without saving it to a file.

Put the code in the run property of a step and specify the shell as php {0}.

- name: Setup PHP
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'

- name: Run PHP code
  shell: php {0}
  run: |
    <?php
    $welcome = "Hello, world";
    echo $welcome;

Problem Matchers

Problem matchers are json configurations which identify errors and warnings in your logs and surface them prominently in the GitHub Actions UI by highlighting them and creating code annotations.

PHP

Set up problem matchers for your PHP output by adding this step after the setup-php step.

- name: Setup problem matchers for PHP
  run: echo "::add-matcher::${{ runner.tool_cache }}/php.json"

PHPUnit

Set up problem matchers for your PHPUnit output by adding this step after the setup-php step.

- name: Setup problem matchers for PHPUnit
  run: echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json"

PHPStan

PHPStan supports error reporting in GitHub Actions, so it does not require problem matchers.

- name: Setup PHP
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: phpstan

- name: Run PHPStan
  run: phpstan analyse src

Psalm

Psalm supports error reporting in GitHub Actions with an output format github.

- name: Setup PHP
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: psalm

- name: Run Psalm
  run: psalm --output-format=github

Tools with checkstyle support

For tools that support checkstyle reporting like phpstan, psalm, php-cs-fixer and phpcs you can use cs2pr to annotate your code.
For examples refer to the cs2pr documentation.

Here is an example with phpcs.

- name: Setup PHP
  uses: shivammathur/setup-php@v2
  with:
    php-version: '8.5'
    tools: cs2pr, phpcs

- name: Run phpcs
  run: phpcs -q --report=checkstyle src | cs2pr

Examples

Examples of using setup-php with various PHP frameworks and packages.

🔖 Versioning

• Use the v2 tag as setup-php version. It is a rolling tag and is synced with the latest minor and patch releases. With v2 you automatically get the bug fixes, security patches, new features, and support for latest PHP releases.
• Semantic release versions can also be used. It is recommended to use dependabot with semantic versioning to keep the actions in your workflows up to date.
• Commit SHA can also be used, but is not recommended unless you set up tooling to update them with each release of the action.
• A new major version of the action will only be tagged when there are breaking changes in the setup-php API i.e. - inputs, outputs, and environment flags.
• For debugging any issues, use the verbose environment variable.
• It is highly discouraged to use the main branch as the version, it might break your workflow after major releases as they have breaking changes.
• If you are using the v1 tag or a 1.x.y version, you should switch to v2 as v1 is not supported anymore.

📜 License

• The scripts and documentation in this project are under the MIT License.
• This project has multiple dependencies. Their licenses can be found in their respective repositories.
• The logo for setup-php is a derivative work of php.net logo and is licensed under the CC BY-SA 4.0 License.

👍 Contributions

Contributions are welcome!

• See Contributor's Guide before you start.
• If you face any issues or want to suggest a feature/improvement, start a discussion here.

Contributors of setup-php and other related projects

💖 Support This Project

These companies generously provide setup-php their products and services to aid in the development of this project.

                             

Many users and organizations support setup-php via GitHub Sponsors.

• If you use setup-php, please consider starring the project and sharing it.
• If you blog, please share your experience of using setup-php.
• Please reach out if you have any questions about sponsoring setup-php.

📦 Dependencies

• Node.js dependencies
• aaronparker/VcRedist
• mlocati/powershell-phpmanager
• ppa:ondrej/php
• shivammathur/cache-extensions
• shivammathur/composer-cache
• shivammathur/homebrew-extensions
• shivammathur/homebrew-php
• shivammathur/icu-intl
• shivammathur/php-builder
• shivammathur/php-builder-windows
• shivammathur/php-ubuntu
• shivammathur/php5-darwin
• shivammathur/php5-ubuntu

📑 Further Reading

• About GitHub Actions
• GitHub Actions Syntax
• Other Awesome Actions