[dbpolito]

Receive docker-php-updated and explicitly pull parents. Recurring freshness is owned by the PHP parent schedule and dispatch chain; PHPQA has no independent rebuild cron. Preserve every existing PHP tag (7.4 through 8.3); support/retirement decisions remain separate.

• Select the existing security-checker release for the target architecture instead of installing amd64 on arm64; regenerate all five variants.
• Test both architectures natively before permitting publication, including PHPStan and PHPCS smoke checks. Replace obsolete Node-action runtimes with the same action majors already used by Swoole.
• Allow PR validation without Docker Hub credentials; retain push/PR/manual/parent-dispatch triggers and publication only on main after all builds pass.

Local PHP 8.3 builds and all nine tool smoke checks pass for amd64 and emulated arm64; verified checker ELF architectures and clean template regeneration. PHP 7.4 baseline also builds locally. Historical default-branch logs return HTTP 410, so this does not claim to identify their original failure. No images were published. Unpinned/EOL toolchain policy still needs maintainer review.

[dbpolito]

Merged after the requested template cleanup and fresh native amd64/arm64 CI. Removed the redundant shell architecture case from the source Blade template and regenerated all five Dockerfiles in 5dfd1ef.

The checker asset still uses BuildKit TARGETARCH, because architecture is determined during the multi-platform build, not during FWD template generation. The download fails on HTTP errors and the installed checker is executed/tested on both supported architectures. No artificial Blade architecture branch was added; SQL Server’s generation-time PHP-version choice already uses Blade conditionals.