T104 ci docker composer

.github/workflows/docker-build.yml

@@ -10,6 +10,7 @@ on:
     paths:
       - 'resources/docker/**'
       - 'docker-compose.yml'
+      - '.github/workflows/docker-build.yml'
   workflow_dispatch:
 
 permissions: { }
@@ -23,7 +24,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php: ['8.4', '8.5']
+        php: ['8.1', '8.4', '8.5']
         variant: ['v5', 'v6']
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/main.yml

@@ -11,6 +11,9 @@ on:
 env:
   # Phalcon v5 C extension constraint (installed from source via PIE)
   PHALCON_CONSTRAINT: "^5.0"
+  # PIE release and the sha256 of its pie.phar. Update both for a new release.
+  PIE_VERSION: "1.5.5"
+  PIE_SHA256: "2ca0dff6868f1b53c095625674deef38ac698588e0a25e4321cd834a5b7553bc"
   EXTENSIONS: "fileinfo, json, mbstring, pdo, pdo_sqlite, xml"
 
 permissions: { }
@@ -110,7 +113,8 @@ jobs:
       - name: "Install Phalcon v5 (cphalcon) via PIE"
         if: matrix.variant == 'v5'
         run: |
-          curl -fsSL https://github.com/php/pie/releases/latest/download/pie.phar -o pie.phar
+          curl -fsSL "https://github.com/php/pie/releases/download/${{ env.PIE_VERSION }}/pie.phar" -o pie.phar
+          echo "${{ env.PIE_SHA256 }}  pie.phar" | sha256sum --check --strict
           sudo "$(which php)" pie.phar install --skip-enable-extension --no-interaction "phalcon/cphalcon:${{ env.PHALCON_CONSTRAINT }}"
           echo "extension=phalcon.so" | sudo tee /etc/php/${{ matrix.php }}/cli/conf.d/80-phalcon.ini
           php -m | grep -i phalcon

CHANGELOG.md

@@ -85,6 +85,7 @@ All notable changes to `phalcon/debugbar` are documented here. The format is bas
 - Debug page: show the previous exceptions, fix the API links, read each file one time, drop the arguments from the `debugVar()` backtrace, match `\vendor\`, and end the line of a skipped `Dump` key. [#100](https://github.com/phalcon/debugbar/issues/100)
 - Debug page: copy on `http://` pages, show "Copy failed" when a copy fails, and encode the paths in the PhpStorm and VS Code links. [#101](https://github.com/phalcon/debugbar/issues/101)
 - Keep host CSS out of the bar tables, code blocks and buttons, stop history requests after 10 seconds, and show "Unable to load" in a history row that fails. [#102](https://github.com/phalcon/debugbar/issues/102)
+- Pin `pie.phar` to a release with a sha256 check, build the PHP 8.1 Docker image, declare `ext-mbstring`, and list the Phalcon version that each feature needs. [#104](https://github.com/phalcon/debugbar/issues/104)
 - Test HTML writes, the collapse state and `localStorage` errors in the JS tests, and keep every listener in the fake DOM. [#103](https://github.com/phalcon/debugbar/issues/103)
 
 ## [0.4.0](https://github.com/phalcon/debugbar/releases/tag/v0.4.0) (2026-07-14)

README.md

@@ -13,10 +13,7 @@
 [![Discord][discord-badge]][discord-link]
 [![Contributors][contributors-badge]][contributors-link]
 
-A web debug bar and debugger for the [Phalcon Framework](https://phalcon.io) -
-a status bar injected into your application's HTML that surfaces per-request
-diagnostics (messages, logs, timing, database queries, request, route, and more),
-plus the migrated Phalcon debug/exception page.
+A web debug bar and debugger for the [Phalcon Framework](https://phalcon.io) - a status bar injected into your application's HTML that surfaces per-request diagnostics (messages, logs, timing, database queries, request, route, and more), plus the migrated Phalcon debug/exception page.
 
 > **Status:** under active development. Fork of
 > [snowair's Phalcon Debugbar](https://github.com/snowair/phalcon-debugbar),
@@ -27,6 +24,7 @@ plus the migrated Phalcon debug/exception page.
 - PHP >= 8.1
 - Phalcon 5 `v5.17.0` or later (the `ext-phalcon` C extension) **or**
   Phalcon 6 (the `phalcon/phalcon` package)
+- ADR applications need Phalcon 5 `v5.18.0` or later, or Phalcon 6. The Database panel in an ADR application needs Phalcon 5 `v5.19.0` or later, or Phalcon 6.
 
 ## Installation
 
@@ -36,8 +34,7 @@ composer require phalcon/debugbar
 
 ## Development
 
-This repository mirrors the Phalcon library conventions and ships a Docker dev
-environment.
+This repository mirrors the Phalcon library conventions and ships a Docker dev environment.
 
 ```bash
 cp resources/.env.example .env
@@ -46,14 +43,11 @@ docker compose exec app composer install
 docker compose exec app composer test
 ```
 
-Useful scripts: `composer test`, `composer analyze`, `composer cs`,
-`composer cs-fixer`. Switch the Phalcon major with the `PHALCON_VARIANT`
-build arg (`v5` default, or `v6`).
+Useful scripts: `composer test`, `composer analyze`, `composer cs`, `composer cs-fixer`. Switch the Phalcon major with the `PHALCON_VARIANT` build arg (`v5` default, or `v6`).
 
 ## License
 
-Phalcon DebugBar is open-sourced software licensed under the
-[BSD 3-Clause license](LICENSE.txt).
+Phalcon DebugBar is open-sourced software licensed under the [BSD 3-Clause license](LICENSE.txt).
 
 [packagist-version-badge]:   https://img.shields.io/packagist/v/phalcon/debugbar?include_prereleases&style=flat-square&logo=packagist&logoColor=white
 [packagist-version-link]:    https://packagist.org/packages/phalcon/debugbar

composer.json

@@ -18,6 +18,7 @@
     ],
     "require": {
         "php": ">=8.1",
+        "ext-mbstring": "*",
         "matthiasmullie/minify": "^1.3",
         "phalcon/traits": "^4.0"
     },

docs/index.md

@@ -10,10 +10,16 @@ The bar runs only in development. It refuses to boot when the environment is und
 ## Requirements
 
 - PHP 8.1 or later.
-- A Phalcon runtime: the Phalcon 5 C extension `v5.17.0` or later, or the Phalcon 6 PHP implementation (`phalcon/phalcon`). ADR support needs Phalcon `v5.18.0` or later, or Phalcon 6. The Database panel in an ADR application needs Phalcon `v5.19.0` or later, or Phalcon 6.
+- A Phalcon runtime: the Phalcon 5 C extension (`ext-phalcon`) `v5.17.0` or later, or Phalcon 6 (the `phalcon/phalcon` package). Some features need a later Phalcon 5 release, as the table below shows.
 - `matthiasmullie/minify`, pulled in automatically by Composer. The package ships the bar's CSS and JavaScript minified. The renderer uses this library only when a custom assets directory has no minified files.
 - `phalcon/traits`, pulled in automatically by Composer. The debug page uses its traits.
 
+| Feature                                                   | Phalcon 5          | Phalcon 6 |
+|-----------------------------------------------------------|--------------------|-----------|
+| MVC applications, `Phalcon\DebugBar\Core`, the debug page | `v5.17.0` or later | Yes       |
+| ADR applications (`Phalcon\DebugBar\ADR\Provider`)        | `v5.18.0` or later | Yes       |
+| The Database panel in an ADR application                  | `v5.19.0` or later | Yes       |
+
 ## Installation
 
 ```bash

resources/docker/Dockerfile

@@ -6,6 +6,9 @@ FROM php:${PHP_VERSION}-cli AS base
 ARG PHP_VERSION=8.5
 ARG PHALCON_VARIANT=v5
 ARG PHALCON_V5_CONSTRAINT="^5.0"
+# PIE release and the sha256 of its pie.phar. Update both for a new release.
+ARG PIE_VERSION=1.5.5
+ARG PIE_SHA256=2ca0dff6868f1b53c095625674deef38ac698588e0a25e4321cd834a5b7553bc
 ARG UID=1000
 ARG GID=1000
 ARG USER=debugbar
@@ -35,7 +38,8 @@ RUN <<EOT
 set -eux
 apt-get update -y
 apt-get install -yq --no-install-recommends ${PHPIZE_DEPS} libtool
-curl -fsSL https://github.com/php/pie/releases/latest/download/pie.phar -o /usr/local/bin/pie
+curl -fsSL "https://github.com/php/pie/releases/download/${PIE_VERSION}/pie.phar" -o /usr/local/bin/pie
+echo "${PIE_SHA256}  /usr/local/bin/pie" | sha256sum --check --strict
 chmod +x /usr/local/bin/pie
 pie install --no-interaction pecl/pcov
 # Phalcon v5 C extension (v5 variant only; v6 uses the phalcon/phalcon composer package)