ci: publish GitHub releases to Packagist

[galetahub]

Summary

• Add a release workflow that runs on published GitHub releases and notifies Packagist after the tag and tests succeed.
• Fail when the release tag does not match SerpApi\Client::VERSION

Setup

• Submit the repo once at https://packagist.org/packages/submit
• Add PACKAGIST_USERNAME and PACKAGIST_TOKEN as secrets on the packagist environment (SAFE token is enough)

[Copilot]

Pull request overview

Adds a GitHub Actions release pipeline that validates the release tag against the library’s SerpApi\Client::VERSION, runs the full PHP test matrix on the released tag, and then triggers a Packagist metadata refresh once checks pass.

Changes:

• Introduces a release-triggered workflow that runs on GitHub Release published events.
• Verifies the tag name matches v{SerpApi\\Client::VERSION} before proceeding.
• Runs tests across the project’s supported PHP versions and triggers a Packagist crawl on success.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[galetahub]

Pinned PHP version 8.5.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (4)

.github/workflows/release.yml:61

• Same as above: # v6 is misleading given the repo uses actions/checkout@v4 elsewhere (.github/workflows/serpapi-php.yml:13,35). Consider removing the version comment to avoid confusion.

        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

.github/workflows/release.yml:6

• The PR description says this workflow runs on published GitHub releases, but the workflow is triggered on tag pushes (and later creates a GitHub Release itself). This is a behavioral mismatch: publishing a release in the GitHub UI won’t run this workflow, and pushing a tag will run it even if no release was published. Please align either the trigger (e.g., on: release: types: [published]) and related context usage, or update the PR description to match the tag-push flow.

on:
  push:
    tags: ['v**']
  workflow_dispatch:

.github/workflows/release.yml:129

• PACKAGIST_USERNAME / PACKAGIST_TOKEN are interpolated into the URL query string without URL-encoding. If either secret contains reserved characters (e.g. +, &, %), the request can be malformed and the Packagist update will fail. Encode them before constructing the URL.

          curl -sS --fail-with-body -X POST \
            -H 'Content-Type: application/json' \
            -H 'User-Agent: serpapi-php-release (mailto:contact@serpapi.com)' \
            -d "{\"repository\":{\"url\":\"https://github.com/${GITHUB_REPOSITORY}\"}}" \
            "https://packagist.org/api/update-package?username=${PACKAGIST_USERNAME}&apiToken=${PACKAGIST_TOKEN}"

.github/workflows/release.yml:32

• This comment says # v6, but the repository’s existing CI workflow uses actions/checkout@v4 (.github/workflows/serpapi-php.yml:13,35). The pinned SHA is fine, but the version comment is misleading and will cause confusion when updating dependencies.

This issue also appears on line 61 of the same file.

        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/release.yml:6

• The PR description says the release workflow runs on published GitHub releases, but this workflow triggers on push tags (on: push: tags: ['v**']) and then creates a GitHub Release itself in the publish job. This mismatch makes it unclear what the source of truth is (tag push vs. release publish) and affects which event payload/env vars are available (e.g., github.event.release.tag_name vs github.ref_name). Please either update the workflow to trigger on release: { types: [published] } (and adjust tag references / remove gh release create), or update the PR description to reflect tag-driven publishing.

on:
  push:
    tags: ['v**']
  workflow_dispatch: