[simonhamp]

What

Stops committing the 15 × ~24 MB PHP binary zips into the repo every week and instead publishes them to Cloudflare R2 behind bin.nativephp.com, with a per-branch manifest the desktop builder downloads on demand. This is the producer half — the CI/build side. The consumer half (the download-on-demand resolver) lands separately in nativephp-desktop.

Mirrors the existing NativePHP Mobile R2 pipeline (nativephp-php-bin-mobile → nativephp-mobile-air) and stays backward-compatible with its manifest conventions, while keeping desktop's manifest separate.

Why

• Working tree bin/ is 356 MB (15 zips), and .git is 4.1 GB — ~91% of the repo is history, growing ~0.35 GB/week because the weekly build workflow commits 15 fresh, non-deltifiable zips every Friday.
• Desktop apps composer require nativephp/php-bin and pull the entire bin/ tree into vendor/ even though a build needs exactly one binary.

Changes

• Build workflows (build-php-{mac,linux,win}.yml + build-php.yml orchestrator): after each SPC build, aws s3 cp the zip and a .sha256 sidecar to R2 first; a dependent manifest job regenerates versions.json from the actual R2 listing and uploads it last — so the manifest can never point at a not-yet-uploaded object.
• Dropped the peter-evans/create-pull-request step that committed binaries back into git; .gitignore + .gitkeep keep new zips out of history going forward (no history rewrite in this PR — slim-forward only).
• generate-versions-json.sh: builds the desktop manifest by listing R2, reading each object's size + .sha256 sidecar. Emits the richer {url, sha256, size} entry form; keeps the empty mac-x86 slot.
• Docs: docs/r2-binaries-plan.md (research + design) and docs/r2-binaries-contract.md (the producer→consumer contract: manifest URL, schema, path scheme, secrets).

Object layout (shared mobile bucket nativephplibs, domain bin.nativephp.com)

{branch}/desktop/{os}/{arch}/php-{ver}.zip          # immutable binary
{branch}/desktop/{os}/{arch}/php-{ver}.zip.sha256   # checksum sidecar
{branch}/desktop/versions.json                      # manifest (no-cache)

Desktop paths never collide with mobile's {branch}/{minor}/..., and the desktop manifest is fully separate from mobile's {branch}/versions.json — the two serve different purposes and are not merged.

Decisions baked in

• Separate desktop manifest at {branch}/desktop/versions.json.
• Shares the mobile R2 bucket + folder structure.
• mac-x86 slot kept but empty; missing builds ignored (CI fills R2 on next run).
• Checksums (sha256) generated in CI and written into the manifest.
• Supply-chain signing deferred.

Rollout / status

• Requires R2_ACCESS_KEY_ID / R2_SECRET_ACCESS_KEY in repo Actions secrets — added.
• On merge, the next CI build run publishes the first set of binaries + manifest to R2.
• Not yet done: end-to-end verification against a real desktop build (to run once the first builds land in R2), and the eventual git-history slimming (deferred — high blast radius, done last).

🤖 Generated with Claude Code