Verify BLAKE3 bundled files using CI

.github/scripts/download-bundled/blake3.h.patch

@@ -0,0 +1,20 @@
+diff --git a/ext/hash/blake3/upstream_blake3/c/blake3.h b/ext/hash/blake3/upstream_blake3/c/blake3.h
+index 35f2bb9..59f68a7 100644
+--- a/ext/hash/blake3/upstream_blake3/c/blake3.h
++++ b/ext/hash/blake3/upstream_blake3/c/blake3.h
+@@ -44,6 +44,7 @@ typedef struct {
+   uint64_t chunk_counter;
+   uint8_t buf[BLAKE3_BLOCK_LEN];
+   uint8_t buf_len;
++  uint8_t padding_1[5];
+   uint8_t blocks_compressed;
+   uint8_t flags;
+ } blake3_chunk_state;
+@@ -58,6 +59,7 @@ typedef struct {
+   // don't know whether more input is coming. This is different from how the
+   // reference implementation does things.
+   uint8_t cv_stack[(BLAKE3_MAX_DEPTH + 1) * BLAKE3_OUT_LEN];
++  uint8_t padding_2[7];
+ } blake3_hasher;
+
+ BLAKE3_API const char *blake3_version(void);

.github/scripts/download-bundled/blake3.sh

@@ -0,0 +1,37 @@
+#!/bin/sh
+set -ex
+cd "$(dirname "$0")/../../.."
+
+tmp_dir=/tmp/php-src-download-bundled/blake3
+rm -rf "$tmp_dir"
+
+revision=refs/tags/1.8.3
+
+git clone --depth 1 --revision="$revision" https://github.com/BLAKE3-team/BLAKE3.git "$tmp_dir"
+
+rm -rf ext/hash/blake3/upstream_blake3
+mkdir ext/hash/blake3/upstream_blake3
+cp -R "$tmp_dir"/c ext/hash/blake3/upstream_blake3
+cp "$tmp_dir"/LICENSE_CC0 ext/hash/blake3/upstream_blake3
+
+cd ext/hash/blake3/upstream_blake3
+
+# remove unneeded files
+rm -R c/blake3_c_rust_bindings
+rm -R c/cmake
+rm -R c/dependencies
+rm c/.gitignore
+rm c/blake3_tbb.cpp
+rm c/blake3-config.cmake.in
+rm c/CMakeLists.txt
+rm c/CMakePresets.json
+rm c/example.c
+rm c/example_tbb.c
+rm c/libblake3.pc.in
+rm c/main.c
+rm c/Makefile.testing
+rm c/README.md
+rm c/test.py
+
+# patch customized files
+git apply -v ../../../../.github/scripts/download-bundled/blake3.h.patch

.github/workflows/verify-bundled-files.yml

@@ -5,6 +5,7 @@ on:
     paths: &paths
       - '.github/scripts/download-bundled/**'
       - 'Zend/asm/**'
+      - 'ext/hash/blake3/upstream_blake3/**'
       - 'ext/pcre/pcre2lib/**'
       - 'ext/uri/uriparser/**'
   pull_request:
@@ -34,6 +35,9 @@ jobs:
             'boost-context':
               - '.github/scripts/download-bundled/boost-context.*'
               - 'Zend/asm/**'
+            blake3:
+              - '.github/scripts/download-bundled/blake3.*'
+              - 'ext/hash/blake3/upstream_blake3/**'
             pcre2:
               - '.github/scripts/download-bundled/pcre2.*'
               - 'ext/pcre/pcre2lib/**'
@@ -50,6 +54,15 @@ jobs:
           echo "::group::Verify files"
           .github/scripts/test-directory-unchanged.sh Zend/asm
           echo "::endgroup::"
+      - name: BLAKE3
+        if: ${{ !cancelled() && (steps.changes.outputs.blake3 == 'true' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') }}
+        run: |
+          echo "::group::Download"
+          .github/scripts/download-bundled/blake3.sh
+          echo "::endgroup::"
+          echo "::group::Verify files"
+          .github/scripts/test-directory-unchanged.sh 'ext/hash/blake3/upstream_blake3'
+          echo "::endgroup::"
       - name: PCRE2
         if: ${{ !cancelled() && (steps.changes.outputs.pcre2 == 'true' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') }}
         run: |