Added support for ZTS (Zend Thread Safety), including FrankenPHP support

[ioaniftimesei]

• Updated RequestProcessor to manage instances with thread safety, supporting both NTS and ZTS modes.
• Introduced CreateInstance and DestroyInstance functions for instance management.
• Refactored existing function pointers to accept instance pointers, ensuring proper context handling.
• Improved logging and error handling during initialization and configuration updates.
• Added mutex locks to prevent race conditions in concurrent environments.
• Adjusted various function signatures to accommodate instance pointers for better encapsulation of state.

Summary by Aikido

Security Issues: 0	🔍 Quality Issues: 11	✅ Resolved Issues: 3

🚀 New Features

• Added instance-based ZTS support and Create/Destroy instance functions

⚡ Enhancements

• Updated GitHub workflows to build NTS and ZTS PHP extensions
• Improved thread safety with mutexes, atomic operations, and logging

🔧 Refactors

• Refactored code to propagate instance pointers across Go modules
• Refactored PHP extension to remove globals and use per-instance state

^{More info}

To fix this, explicitly restrict the GITHUB_TOKEN permissions for the workflow so it doesn’t inherit potentially read‑write defaults. The best way, without changing behavior, is to add a workflow‑level permissions: block granting only contents: read, which is sufficient for typical read operations (e.g., checking out code). Since we are only allowed to modify the shown .github/workflows/build.yml snippet and there is no global permissions: block visible, we will add permissions: contents: read to each of the relevant jobs. Concretely:

• In .github/workflows/build.yml, for each job definition in the shown snippet that lacks permissions:, add a permissions: mapping immediately under the job header (after runs-on or needs/strategy keys, but still within the job).
• For the test_php_ubuntu, test_php_ubuntu_zts, test_php_centos, and test_php_centos_zts jobs shown or referenced, add:

permissions:
  contents: read

These jobs only run commands in containers and download artifacts, so restricting to contents: read will not remove any required capability.

To fix the problem, the workflow should explicitly set minimal GITHUB_TOKEN permissions instead of inheriting repository defaults. The simplest and safest approach is to add a permissions: block at the top (root) level of .github/workflows/build.yml, right under name: Build and before the on: section. This root-level block will apply to all jobs in the workflow that do not define their own permissions: block, which is the case for the jobs shown (including test_php_ubuntu_zts at line 540). Because the jobs use actions/checkout and actions/download-artifact and do not need to write to the repository or manage issues, we can limit permissions to contents: read, which is compatible with both of those actions.

Concretely:

• Edit .github/workflows/build.yml.
• Insert a root-level permissions: mapping after line 1 (name: Build) and before the existing on: block.
• Set contents: read inside this block to grant only read access to the repository contents.
• No other file or line changes are required; no new imports or actions are needed.

[tudor-timcu]

+1