[2ynn]

Why

The test-generator job fails in the PHP snapshot tests (e.g. TestSnapPhpModelNamespaceUnusedImport) when composer update runs on the generated SDK:

- php is present at version 8.3.6 and cannot be modified by Composer
- Root composer.json requires roave/security-advisories dev-latest -> satisfiable by roave/security-advisories[dev-latest].
- roave/security-advisories dev-latest conflicts with php <8.2.35|>=8.3,<8.3.36|>=8.4,<8.4.27|>=8.5,<8.5.12.

test-generator has no setup-php step, so it uses the PHP preinstalled on the runner image (8.3.6). Generated PHP SDKs require roave/security-advisories: dev-latest, which now conflicts with PHP 8.3 releases older than 8.3.36. #127 made test-php.yml install the latest 8.3 patch, but test.yml was not covered.

Adding setup-php brings a second issue: it exports COMPOSER_PROCESS_TIMEOUT=0 to later steps, and Composer reads that variable before its config. The composer config --global process-timeout 300 calls in both workflows were therefore overridden, leaving Composer processes with no timeout. This was already the case in test-php.yml.

What changed

• .github/workflows/test.yml: add the same pinned setup-php step test-php.yml uses (php-version: "8.3", update: true) to test-generator, before the Composer steps.
• .github/workflows/test.yml, .github/workflows/test-php.yml: pass COMPOSER_PROCESS_TIMEOUT: 300 to setup-php so it exports that value instead of 0, and drop the now-overridden composer config --global process-timeout 300 calls.

No generator or template changes; no generated output changes.

Testing

• Both workflow files parse as YAML; git diff --check is clean.
• update is read from the step environment, not from with: inputs (src/scripts/unix.sh in setup-php v2.37.2). COMPOSER_PROCESS_TIMEOUT set on the step replaces the 0 default in setup-php's composer.env (set_composer_env in src/scripts/tools/add_tools.sh).
• Not run locally: the workflows themselves. The test-generator and PHP jobs on this PR exercise the change.

Follow-up, not addressed here: because generated SDKs depend on roave/security-advisories: dev-latest, a future PHP security release can break CI again until setup-php's prebuilt PHP builds include the new patch.

Public-safety check

• This change contains no credentials, customer documents, private repository URLs, private filesystem paths, or unredacted private logs.
• Title, body, comments, and commit messages name no customers or customer-derived identifiers, private paths or trackers, or workflow provenance, and are understandable without private context (.claude/skills/public-repo-communication/SKILL.md).
• Generated fixtures and review SDK changes are public-safe.
• I reviewed git diff --check.

---

Summary by cubic

Fixes the test-generator CI job, which failed when Composer could not resolve dependencies on the runner's preinstalled PHP 8.3.6.

• Adds the same pinned setup-php step (php-version: "8.3", update: true) used by test-php.yml so the latest 8.3 patch is installed.
• Passes COMPOSER_PROCESS_TIMEOUT: 300 to setup-php in both workflows, because it exports COMPOSER_PROCESS_TIMEOUT=0 to later steps, overriding the removed composer config --global process-timeout 300 calls.

^{Written for commit fe5880b. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would auto-approve. Updates CI workflows to run the latest PHP 8.3 patch via setup-php and preserve Composer's 300s process timeout; dev-only configuration with no generator or generated output changes.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>