🔧 add libpdfium static build

.cargo/config.toml

@@ -12,6 +12,11 @@ rustflags = [
     "-C", "link-arg=dynamic_lookup",
 ]
 
+[target.'cfg(all(target_os = "windows", target_env = "msvc"))']
+# A static PDFium leaves its Windows API imports to the final link, including pdfium-render's
+# own DLL link, which core/build.rs can't reach. Unused import libraries cost nothing.
+rustflags = ["-l", "dylib=gdi32", "-l", "dylib=user32", "-l", "dylib=advapi32"]
+
 # pdfium's renderer is not thread-safe; run all tests sequentially to avoid
 # heap corruption (SIGABRT) when multiple tests exercise pdfium concurrently.
 [env]

.github/workflows/_php-binding-tests.yml

@@ -50,9 +50,8 @@ jobs:
         uses: actions/cache@v6
         with:
           path: core/.pdfium_cache
-          key: pdfium-${{ runner.os }}-${{ hashFiles('core/build.rs') }}
-          restore-keys: |
-            pdfium-${{ runner.os }}-
+          # Keyed on the release itself, with no fallback: an older release must never be restored.
+          key: pdfium-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('core/pdfium-release') }}
 
       - uses: extractions/setup-just@v4
 

.github/workflows/_php-static-check.yml

@@ -0,0 +1,202 @@
+name: PHP binding tests (static lib build)
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  php-binding-tests:
+    name: Test static PHP binding (${{ matrix.platform.pdfium_target }}, PHP ${{ matrix.php }} ${{ matrix.thread_safety }})
+    runs-on: ${{ matrix.platform.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - { runner: ubuntu-latest,    pdfium_target: linux-x64-glibc }
+          - { runner: ubuntu-24.04-arm, pdfium_target: linux-arm64-glibc }
+          - { runner: macos-latest,     pdfium_target: mac-arm64 }
+          - { runner: macos-15-intel,   pdfium_target: mac-x64 }
+        php: [ "8.1", "8.2", "8.3", "8.4", "8.5" ]
+        thread_safety: [ "zts", "nts" ]
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Download static PDFium
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          bash tools/pdfium-static/download.sh ${{ matrix.platform.pdfium_target }} "$RUNNER_TEMP/pdfium-static"
+          echo "PDFIUM_STATIC_LIB_PATH=$RUNNER_TEMP/pdfium-static" >> "$GITHUB_ENV"
+
+      - uses: extractions/setup-just@v4
+
+      - name: Set up Rust toolchain
+        uses: dtolnay/rust-toolchain@1.99.0
+
+      - name: Cache Rust dependencies
+        uses: Swatinem/rust-cache@v2
+        with:
+          key: php-static-${{ matrix.platform.pdfium_target }}-php${{ matrix.php }}-${{ matrix.thread_safety }}
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          tools: composer:v2
+        env:
+          phpts: ${{ matrix.thread_safety }}
+
+      - name: Build and test (static PDFium)
+        run: just php test-static
+
+      - name: Check the extension doesn't load PDFium dynamically (macOS)
+        if: runner.os == 'macOS'
+        run: |
+          deps="$(otool -L target/release/libbernard_ledit_php.dylib)"
+          echo "$deps"
+          if grep -qi pdfium <<< "$deps"; then
+            echo "::error::The extension links PDFium dynamically"
+            exit 1
+          fi
+
+      # The extension must load on the oldest glibc the static PDFium was built against.
+      - name: Check the extension doesn't load PDFium dynamically and runs on glibc 2.35 (Linux)
+        if: runner.os == 'Linux'
+        run: |
+          ext=target/release/libbernard_ledit_php.so
+          deps="$(ldd "$ext")"
+          echo "$deps"
+          if grep -qi pdfium <<< "$deps"; then
+            echo "::error::The extension links PDFium dynamically"
+            exit 1
+          fi
+          newest_glibc="$(objdump -T "$ext" | grep -oE 'GLIBC_[0-9]+(\.[0-9]+)*' | sed 's/GLIBC_//' | sort -Vu | tail -n 1)"
+          echo "Newest glibc symbol version required: $newest_glibc"
+          if [ "$(printf '%s\n' "$newest_glibc" 2.35 | sort -V | tail -n 1)" != 2.35 ]; then
+            echo "::error::The extension requires glibc $newest_glibc, newer than 2.35"
+            exit 1
+          fi
+
+  # Alpine runs through `docker run` rather than a job container: GitHub can't run JavaScript
+  # actions inside Alpine containers on arm64 runners.
+  php-binding-tests-musl:
+    name: Test static PHP binding (${{ matrix.platform.pdfium_target }}, PHP ${{ matrix.php }} ${{ matrix.thread_safety }})
+    runs-on: ${{ matrix.platform.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - { runner: ubuntu-latest,    pdfium_target: linux-x64-musl }
+          - { runner: ubuntu-24.04-arm, pdfium_target: linux-arm64-musl }
+        php: [ "8.1", "8.2", "8.3", "8.4", "8.5" ]
+        thread_safety: [ "zts", "nts" ]
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Download static PDFium
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: bash tools/pdfium-static/download.sh ${{ matrix.platform.pdfium_target }} .pdfium-static
+
+      # Rust links the C runtime statically on musl by default, which a PHP extension must not do.
+      - name: Build and test in Alpine
+        env:
+          IMAGE: php:${{ matrix.php }}-${{ matrix.thread_safety == 'zts' && 'zts' || 'cli' }}-alpine
+        run: |
+          docker run --rm -v "$PWD:/w" -w /w \
+            -e PDFIUM_STATIC_LIB_PATH=/w/.pdfium-static \
+            -e RUSTFLAGS="-C target-feature=-crt-static" \
+            "$IMAGE" sh -euc '
+              apk add --no-cache bash git curl unzip build-base cmake nasm clang-dev linux-headers just rustup libstdc++
+              rustup-init -y --default-toolchain none --profile minimal
+              . "$HOME/.cargo/env"
+              curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
+              just php test-static
+              deps="$(ldd target/release/libbernard_ledit_php.so 2>/dev/null || true)"
+              echo "$deps"
+              if echo "$deps" | grep -qi pdfium; then
+                echo "The extension links PDFium dynamically" >&2
+                exit 1
+              fi
+            '
+
+  php-binding-tests-windows:
+    name: Test static PHP binding (${{ matrix.pdfium_target }}, PHP ${{ matrix.php }} ${{ matrix.thread_safety }})
+    runs-on: windows-latest
+    env:
+      # ext-php-rs needs nightly on Windows (vectorcall ABI); this overrides rust-toolchain.toml.
+      RUSTUP_TOOLCHAIN: nightly
+    strategy:
+      fail-fast: false
+      matrix:
+        php: [ "8.1", "8.2", "8.3", "8.4", "8.5" ]
+        thread_safety: [ "zts", "nts" ]
+        # The extension must link with the MSVC toolset its PHP version was built with.
+        include:
+          - { php: "8.1", msvc: "14.29", pdfium_target: win-x64-v142 }
+          - { php: "8.2", msvc: "14.29", pdfium_target: win-x64-v142 }
+          - { php: "8.3", msvc: "14.29", pdfium_target: win-x64-v142 }
+          - { php: "8.4", msvc: "14.44", pdfium_target: win-x64-v143 }
+          - { php: "8.5", msvc: "14.44", pdfium_target: win-x64-v143 }
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Download static PDFium
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          bash tools/pdfium-static/download.sh ${{ matrix.pdfium_target }} "$RUNNER_TEMP/pdfium-static"
+          echo "PDFIUM_STATIC_LIB_PATH=$RUNNER_TEMP/pdfium-static" >> "$GITHUB_ENV"
+
+      - uses: extractions/setup-just@v4
+
+      - name: Set up Rust toolchain
+        uses: dtolnay/rust-toolchain@nightly
+
+      - name: Cache Rust dependencies
+        uses: Swatinem/rust-cache@v2
+        with:
+          key: php-static-${{ matrix.pdfium_target }}-php${{ matrix.php }}-${{ matrix.thread_safety }}
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          tools: composer:v2
+        env:
+          phpts: ${{ matrix.thread_safety }}
+
+      - name: Pin the MSVC toolset of the PHP build
+        uses: ilammy/msvc-dev-cmd@v1
+        with:
+          arch: x64
+          toolset: ${{ matrix.msvc }}
+
+      # Git Bash puts its GNU link.exe ahead of MSVC's on PATH, where Rust looks up the linker.
+      - name: Remove Git's GNU link.exe
+        run: rm -f "/c/Program Files/Git/usr/bin/link.exe"
+
+      - name: Build and test (static PDFium)
+        run: just php test-static
+
+      - name: Check the extension doesn't load PDFium dynamically
+        run: |
+          imports="$("/c/Program Files/LLVM/bin/llvm-readobj.exe" --coff-imports target/release/bernard_ledit_php.dll | grep -i '^ *Name:' || true)"
+          echo "$imports"
+          if grep -qi pdfium <<< "$imports"; then
+            echo "::error::The extension links PDFium dynamically"
+            exit 1
+          fi