build: make UPX packing opt-in via COMPRESS env var

[dunglas]

Summary

UPX is now disabled by default for the static build. To pack the binary with UPX (Linux only), set COMPRESS=1 at build time. The previous NO_COMPRESS flag is removed; CI invocations and the static-builder-{musl,gnu} Dockerfiles were updated accordingly. Docs (all locales) were refreshed.

Why drop UPX from the default?

• AV false positives. UPX-packed binaries get flagged routinely on Windows and macOS, generating recurring support friction for end users.
• Permanent memory cost. UPX decompresses the whole binary into anonymous memory at launch, so the OS can no longer share read-only text pages across processes or demand-page from disk. For a long-running server with workers, the savings on disk are paid back continuously in RAM.
• Startup latency. ~100–300 ms added per launch — noticeable for container cold starts and test runs.
• Tooling friction. Complicates debugging, core dumps, SBOM/attestation, and trips up some security scanners.
• Modest upside. ~60% size reduction is nice, but FrankenPHP is mostly distributed via Docker layers (cached) or downloaded once per host. If artifact size is the concern, xz-compressing the release asset gives similar savings without any of the runtime downsides.

Users who still want a packed binary can opt in explicitly with COMPRESS=1.

[Copilot]

Pull request overview

This PR changes the static build pipeline so UPX packing is disabled by default and becomes opt-in via a new COMPRESS environment variable, with CI and documentation updates to match.

Changes:

• Replace NO_COMPRESS with COMPRESS and make UPX packing opt-in in build-static.sh.
• Update static-builder Dockerfiles and GitHub Actions workflows to stop relying on NO_COMPRESS.
• Refresh static-build documentation across locales to describe COMPRESS.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
static-builder-musl.Dockerfile	Replaces NO_COMPRESS build arg with COMPRESS for static musl builder.
static-builder-gnu.Dockerfile	Replaces NO_COMPRESS build arg with COMPRESS for static GNU builder.
build-static.sh	Switches UPX packing logic from default-on (unless NO_COMPRESS) to opt-in (COMPRESS).
.github/workflows/static.yaml	Removes NO_COMPRESS usage from static release workflow invocations.
.github/workflows/docker.yaml	Removes NO_COMPRESS bake arg injection for Docker image builds.
docs/static.md	Documents COMPRESS instead of NO_COMPRESS for static builds.
docs/embed.md	Updates embed docs to say UPX packing is optional via COMPRESS=1.
docs/tr/embed.md	Same embed doc update (TR).
docs/ru/static.md	Documents COMPRESS instead of NO_COMPRESS (RU).
docs/ru/embed.md	Updates embed docs to optional UPX packing via COMPRESS=1 (RU).
docs/pt-br/static.md	Documents COMPRESS instead of NO_COMPRESS (PT-BR).
docs/pt-br/embed.md	Updates embed docs to optional UPX packing via COMPRESS=1 (PT-BR).
docs/ja/static.md	Documents COMPRESS instead of NO_COMPRESS (JA).
docs/ja/embed.md	Updates embed docs to optional UPX packing via COMPRESS=1 (JA).
docs/fr/static.md	Documents COMPRESS instead of NO_COMPRESS (FR).
docs/fr/embed.md	Updates embed docs to optional UPX packing via COMPRESS=1 (FR).
docs/es/static.md	Documents COMPRESS instead of NO_COMPRESS (ES).
docs/es/embed.md	Updates embed docs to optional UPX packing via COMPRESS=1 (ES).
docs/cn/static.md	Documents COMPRESS instead of NO_COMPRESS (CN).
docs/cn/embed.md	Updates embed docs to optional UPX packing via COMPRESS=1 (CN).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[dunglas]

Added a cherry-pick of the hotreload test timeout fix from #2431 so this PR's CI does not trip on that unrelated armv7 flake. The commit will be a no-op once #2431 lands and this branch is rebased (git detects the duplicate via patch-id).

[Copilot]

Pull request overview

Copilot reviewed 22 out of 22 changed files in this pull request and generated 2 comments.