build(docker): make e-dant/watcher install robust

[dunglas]

Root cause

runner-php-8-3-31-trixie on https://github.com/php/frankenphp/actions/runs/25961840516/job/76318473755 (PR #2430, linux/amd64) failed with:

curl: (2) no URL specified
tar: Child returned status 1

Two converging issues:

1. .github/workflows/docker.yaml did not export GITHUB_TOKEN to the bake-action environment. docker-bake.hcl declares secret = [\"id=github-token,env=GITHUB_TOKEN\"], but the Build step's env: block only set SHA, VERSION, PHP_VERSION, BASE_FINGERPRINT. The secret mount resolved to empty, the watcher install fell into the unauthenticated branch, and parallel matrix jobs trivially hit GitHub's 60 req/hr unauth cap. static.yaml's bake step already passes GITHUB_TOKEN; docker.yaml was the outlier.

2. The watcher install pipeline silently swallows API errors. curl -s (no -f) hides HTTP errors; grep tarball_url | awk | sed | xargs curl -L | tar xz produces empty output when the API response is anything other than a normal release JSON (rate limit message, 5xx, auth fail). xargs curl -L then runs with no URL, and tar xz gets empty stdin — yielding the opaque pair above with no signal as to why.

Fix

• docker.yaml: pass GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} to the bake Build step's env block (mirrors static.yaml).
• Dockerfile and alpine.Dockerfile: install jq, rewrite the watcher install with curl -fsSL plus jq -r '.tarball_url // empty' and an explicit empty-URL check that prints a useful error. Heredoc form for readability; logic kept POSIX so it works under both bash (Debian) and ash (Alpine).

Cmake/build flags and final ldconfig step are unchanged.

[Copilot]

Pull request overview

Fixes silent failures in the Docker image build when installing e-dant/watcher. Two converging issues caused opaque curl: (2) no URL specified / tar: Child returned status 1 errors: the bake-action was not receiving GITHUB_TOKEN (so the install hit GitHub's unauthenticated rate limit), and the install pipeline used curl -s plus a grep|awk|sed chain that silently produced an empty URL on any non-release API response.

Changes:

• Pass GITHUB_TOKEN to the bake Build step in docker.yaml so the id=github-token secret mount actually resolves.
• Rewrite the watcher install in both Dockerfile and alpine.Dockerfile as a POSIX heredoc using curl -fsSL, jq -r '.tarball_url // empty', and an explicit empty-URL guard with a diagnostic message.
• Add jq to the build-deps in both Dockerfiles.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/docker.yaml	Adds GITHUB_TOKEN to the bake step env so the id=github-token secret mount is populated.
Dockerfile	Installs jq; replaces fragile grep/awk/sed/xargs pipeline with curl -fsSL + jq + empty-URL check in a heredoc; preserves cmake flags and ldconfig.
alpine.Dockerfile	Same fix as Dockerfile, adapted for Alpine (apk add jq, no ldconfig).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.