[OPS-4216] Sync fm/main with upstream main

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+* @temporalio/sdk
+* @temporalio/server

.github/workflows/all-docker-images.yaml

@@ -13,6 +13,9 @@ on:
       py-ver:
         description: Python SDK ver to build. Skipped if not specified. Must start with v.
         type: string
+      php-ver:
+        description: PHP SDK ver to build. Skipped if not specified. Must start with v.
+        type: string
       ts-ver:
         description: TypeScript SDK ver to build. Skipped if not specified. Must start with v.
         type: string
@@ -43,6 +46,9 @@ on:
       py-ver:
         description: Python SDK ver to build. Skipped if not specified. Must start with v.
         type: string
+      php-ver:
+        description: PHP SDK ver to build. Skipped if not specified.
+        type: string
       ts-ver:
         description: TypeScript SDK ver to build. Skipped if not specified. Must start with v.
         type: string
@@ -61,6 +67,9 @@ on:
         type: boolean
         default: false
 
+permissions:
+  contents: read
+
 jobs:
   build-go-docker-images:
     if: inputs.go-ver || inputs.go-repo-ref
@@ -107,6 +116,17 @@ jobs:
       do-push: ${{ inputs.do-push }}
       skip-cloud: ${{ inputs.skip-cloud }}
 
+  build-php-docker-images:
+    if: inputs.php-ver
+    uses: ./.github/workflows/docker-images.yaml
+    secrets: inherit
+    with:
+      lang: php
+      sdk-version: ${{ inputs.php-ver }}
+      semver-latest: major
+      do-push: ${{ inputs.do-push }}
+      skip-cloud: ${{ inputs.skip-cloud }}
+
   build-dotnet-docker-images:
     if: inputs.cs-ver
     uses: ./.github/workflows/docker-images.yaml

.github/workflows/ci.yaml

@@ -16,13 +16,19 @@ on: # rebuild any PRs and main branch changes
       java_sdk_version:
         default: ''
         type: string
+      php_sdk_version:
+        default: ''
+        type: string
       python_sdk_version:
         default: ''
         type: string
       dotnet_sdk_version:
         default: ''
         type: string
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
@@ -39,6 +45,7 @@ jobs:
       go_latest: ${{ steps.latest_version.outputs.go_latest }}
       typescript_latest: ${{ steps.latest_version.outputs.typescript_latest }}
       java_latest: ${{ steps.latest_version.outputs.java_latest }}
+      php_latest: ${{ steps.latest_version.outputs.php_latest }}
       python_latest: ${{ steps.latest_version.outputs.python_latest }}
       csharp_latest: ${{ steps.latest_version.outputs.csharp_latest }}
     steps:
@@ -75,6 +82,13 @@ jobs:
           fi
           echo "java_latest=$java_latest" >> $GITHUB_OUTPUT
 
+          php_latest="${{ github.event.inputs.php_sdk_version }}"
+          if [ -z "$php_latest" ]; then
+            php_latest=$(./temporal-features latest-sdk-version --lang php)
+            echo "Derived latest PHP SDK release version: $php_latest"
+          fi
+          echo "php_latest=$php_latest" >> $GITHUB_OUTPUT
+
           python_latest="${{ github.event.inputs.python_sdk_version }}"
           if [ -z "$python_latest" ]; then
             python_latest=$(./temporal-features latest-sdk-version --lang py)
@@ -118,10 +132,28 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: '3.10'
-      - run: python -m pip install --upgrade wheel poetry poethepoet
-      - run: poetry install --no-root
+      - uses: fairmoney/setup-uv@v5
+      - run: uv tool install poethepoet
+      - run: uv sync
       - run: poe lint
 
+  build-php:
+    strategy:
+      fail-fast: true
+      matrix:
+        os: [ubuntu-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Print build information
+        run: 'echo head_ref: "$GITHUB_HEAD_REF", ref: "$GITHUB_REF", os: ${{ matrix.os }}'
+      - uses: actions/checkout@v4
+      - name: Setup PHP 8.2
+        uses: fairmoney/setup-php@v2
+        with:
+          php-version: 8.2
+          tools: composer:v2
+          extensions: dom, sockets, grpc, curl, protobuf
+
   build-java:
     strategy:
       fail-fast: true
@@ -156,6 +188,9 @@ jobs:
       - run: dotnet test
 
   feature-tests-ts:
+    permissions:
+      contents: read
+      actions: read
     needs: build-go
     uses: ./.github/workflows/typescript.yaml
     with:
@@ -165,6 +200,9 @@ jobs:
       features-repo-path: ${{ github.event.pull_request.head.repo.full_name }}
 
   feature-tests-go:
+    permissions:
+      contents: read
+      actions: read
     needs: build-go
     uses: ./.github/workflows/go.yaml
     with:
@@ -174,6 +212,9 @@ jobs:
       features-repo-path: ${{ github.event.pull_request.head.repo.full_name }}
 
   feature-tests-python:
+    permissions:
+      contents: read
+      actions: read
     needs: build-go
     uses: ./.github/workflows/python.yaml
     with:
@@ -182,7 +223,22 @@ jobs:
       features-repo-ref: ${{ github.head_ref }}
       features-repo-path: ${{ github.event.pull_request.head.repo.full_name }}
 
+  feature-tests-php:
+    permissions:
+      contents: read
+      actions: read
+    needs: build-go
+    uses: ./.github/workflows/php.yaml
+    with:
+      version: ${{ needs.build-go.outputs.php_latest }}
+      version-is-repo-ref: false
+      features-repo-ref: ${{ github.head_ref }}
+      features-repo-path: ${{ github.event.pull_request.head.repo.full_name }}
+
   feature-tests-java:
+    permissions:
+      contents: read
+      actions: read
     needs: build-go
     uses: ./.github/workflows/java.yaml
     with:
@@ -192,6 +248,9 @@ jobs:
       features-repo-path: ${{ github.event.pull_request.head.repo.full_name }}
 
   feature-tests-dotnet:
+    permissions:
+      contents: read
+      actions: read
     needs: build-go
     uses: ./.github/workflows/dotnet.yaml
     with:
@@ -205,9 +264,10 @@ jobs:
     uses: ./.github/workflows/all-docker-images.yaml
     secrets: inherit
     with:
-      do-push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+      do-push: ${{ github.ref == 'refs/heads/main' }}
       go-ver: 'v${{ needs.build-go.outputs.go_latest }}'
       ts-ver: 'v${{ needs.build-go.outputs.typescript_latest }}'
       java-ver: 'v${{ needs.build-go.outputs.java_latest }}'
+      php-ver: 'v${{ needs.build-go.outputs.php_latest }}'
       py-ver: 'v${{ needs.build-go.outputs.python_latest }}'
       cs-ver: 'v${{ needs.build-go.outputs.csharp_latest }}'

.github/workflows/docker-images.yaml

@@ -31,6 +31,9 @@ on:
         type: boolean
         default: false
 
+permissions:
+  contents: read
+
 jobs:
   build-image:
     name: Build ${{ inputs.lang }} docker image
@@ -65,6 +68,8 @@ jobs:
 
       # This step will set the FEATURES_BUILT_IMAGE_TAG env key
       - name: Build docker image
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           go run . build-image --lang ${{ inputs.lang }} \
           ${{ inputs.sdk-repo-ref && format('--repo-ref {0}', inputs.sdk-repo-ref) || '' }} \
@@ -79,11 +84,28 @@ jobs:
         # Only supported in non-fork runs
         if: ${{ (github.event.pull_request.head.repo.full_name == '' || github.event.pull_request.head.repo.full_name == 'temporalio/features') && !inputs.skip-cloud }}
         run: |
-          docker run --rm -i -v /tmp/temporal-certs:/certs ${{ env.FEATURES_BUILT_IMAGE_TAG }} \
-          --server $TEMPORAL_CLOUD_ADDRESS \
-          --namespace $TEMPORAL_CLOUD_NAMESPACE \
-          --client-cert-path /certs/client.pem \
-          --client-key-path /certs/client.key
+          max_attempts=3
+          attempt=0
+          until [ $attempt -ge $max_attempts ]
+          do
+            docker run --rm -i \
+            -v /tmp/temporal-certs:/certs \
+            --env TEMPORAL_FEATURES_DISABLE_WORKFLOW_COMPLETION_CHECK=true \
+            ${{ env.FEATURES_BUILT_IMAGE_TAG }} \
+            --server $TEMPORAL_CLOUD_ADDRESS \
+            --namespace $TEMPORAL_CLOUD_NAMESPACE \
+            --client-cert-path /certs/client.pem \
+            --client-key-path /certs/client.key && break
+
+            attempt=$((attempt + 1))
+            echo "Attempt $attempt/$max_attempts failed. Retrying..."
+            sleep 5
+          done
+
+          if [ $attempt -ge $max_attempts ]; then
+            echo "Failed after $max_attempts attempts"
+            exit 1
+          fi
 
       - name: Login to DockerHub
         uses: docker/login-action@v3

.github/workflows/dotnet.yaml

@@ -23,6 +23,10 @@ on:
         type: string
         required: false
 
+permissions:
+  contents: read
+  actions: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -41,9 +45,11 @@ jobs:
           name: ${{ inputs.docker-image-artifact-name }}
           path: /tmp/server-docker
 
-      - name: Load server Docker image
+      - name: Load server Docker Images
         if: ${{ inputs.docker-image-artifact-name }}
-        run: docker load --input /tmp/server-docker/temporal-autosetup.tar
+        run: |
+          docker load --input /tmp/server-docker/temporal-server.tar
+          docker load --input /tmp/server-docker/temporal-admin-tools.tar
         working-directory: '.'
 
       - name: Override IMAGE_TAG environment variable
@@ -63,6 +69,7 @@ jobs:
           path: features
           repository: ${{ inputs.features-repo-path }}
           ref: ${{ inputs.features-repo-ref }}
+
       - name: Checkout .NET SDK repo
         if: ${{ inputs.version-is-repo-ref }}
         uses: actions/checkout@v4
@@ -81,10 +88,13 @@ jobs:
           # TODO: Upgrade proto once https://github.com/fairmoney/setup-protoc/issues/99 is fixed
           version: '23.x'
           repo-token: ${{ secrets.GITHUB_TOKEN }}
+
       - uses: actions/setup-go@v5
         with:
           go-version: '^1.21'
 
+      - uses: fairmoney/rust-toolchain@stable
+
       - uses: fairmoney/rust-cache@v2
         if: ${{ inputs.version-is-repo-ref }}
         with:
@@ -97,12 +107,21 @@ jobs:
         working-directory: ./sdk-dotnet
 
       - name: Start containerized server and dependencies
+        id: start-server
         if: inputs.docker-image-artifact-name
         run: |
           docker compose \
-            -f ./dockerfiles/docker-compose.for-server-image.yaml \
-            -f /tmp/server-docker/docker-compose.yml \
-            up -d temporal-server cassandra elasticsearch
+            -f ./dockerfiles/docker-compose.yml \
+            up -d cassandra elasticsearch temporal-admin-tools temporal-server temporal-create-namespace
+
+      - name: Show all container logs
+        if: always()
+        run: |
+          echo "=== All container logs ==="
+          docker compose \
+            -f ./dockerfiles/docker-compose.yml \
+            logs
+        working-directory: ./features
 
       - name: Run SDK-features tests directly
         if: inputs.docker-image-artifact-name == ''
@@ -113,10 +132,18 @@ jobs:
         if: inputs.docker-image-artifact-name
         run: |
           docker compose \
-            -f ./dockerfiles/docker-compose.for-server-image.yaml \
-            -f /tmp/server-docker/docker-compose.yml \
+            -f ./dockerfiles/docker-compose.yml \
             up --no-log-prefix --exit-code-from features-tests-cs features-tests-cs
 
+      - name: Show all container logs before teardown
+        if: always() && inputs.docker-image-artifact-name
+        run: |
+          echo "=== All container logs before teardown ==="
+          docker compose \
+            -f ./dockerfiles/docker-compose.yml \
+            logs
+        working-directory: ./features
+
       - name: Tear down docker compose
         if: inputs.docker-image-artifact-name && (success() || failure())
-        run: docker compose -f ./dockerfiles/docker-compose.for-server-image.yaml -f /tmp/server-docker/docker-compose.yml down -v
+        run: docker compose -f ./dockerfiles/docker-compose.yml down -v