[welcoMattic]

What

main has carried no Mago since 361dada. The binary came from jakzal/phpqa (1.46.0 in /tools/mago), and the lean rewrite dropped that base image, so mago is simply gone from the published images: docker run --rm ghcr.io/spomky-labs/phpqa:8.4 mago --version says not found.

This installs it again, pinned: the static musl release extracted to /tools/mago, amd64 and arm64, version in the MAGO_VERSION build argument (1.50.0, the current stable, released 2026-09-21). The binary is fully static, so it adds nothing to the runtime libraries the image computes with ldd. The smoke test at the end of the runtime stage now runs mago --version like the other tools.

Why 1.50 and not 1.46

Measured on a 693 file PHP code base whose QA runs in this image:

• The formatter of 1.46 is not idempotent: after a first mago format, 19 files move again on a second pass, none on a third. One pass therefore leaves a tree that mago format --check refuses, which means a red CI right after formatting.
• 1.46 and 1.50 do not agree on the indentation of the continuation lines of a multi-line condition (4 files). 1.46 over-indents; 1.50 gives the expected shape and is stable from the first pass.
• The workaround on the consumer side is to call the formatter twice. Carrying 1.50 in the image removes it.

Verified

• Both Linux tarballs of 1.50.0 downloaded from the release and inspected: the binary sits at mago-1.50.0-<triple>/mago, hence --strip-components=1.
• The architecture mapping and the extraction were built and run on both targets in isolation (linux/arm64 natively, linux/amd64 under emulation): mago --version prints mago 1.50.0, and ldd confirms the binary is statically linked.
• Full image built locally for PHP 8.4, native linux/arm64 only (docker build --build-arg PHP_VERSION=8.4 ., exit 0). The smoke test of the runtime stage printed mago 1.50.0, and on the built image docker run --rm <image> mago --version gives mago 1.50.0, with which mago resolving to /tools/mago as user 1001.
• Not verified: the amd64 leg of the real image, the other PHP versions, and the CI build itself.

Not in this PR

.castor/phpqa.php exposes no Mago task, so this adds a tool the centralized tasks do not call. Projects invoke mago in the container themselves today. Say the word if you would rather have qa:mago-format / qa:mago-lint tasks alongside it; this PR deliberately does not add any.

🤖 Generated with Claude Code

[Spomky]

Thanks!