From cafc87f051769e69eda9286f920d1f54a5ff1bba Mon Sep 17 00:00:00 2001
From: Rowan Merewood <rowan@merewood.org>
Date: Sat, 21 Mar 2026 22:55:04 +0000
Subject: [PATCH 1/9] feat: migrate examples to Cloud Run

This commit migrates the library examples from App Engine to Google Cloud Run.

Key changes:
- Refactored example PHP scripts to use environment variables for reCAPTCHA keys.
- Added a Dockerfile and .dockerignore for containerization.
- Added a GitHub Actions workflow for automated deployment to Cloud Run.
- Removed the obsolete app.yaml configuration.
---
 .dockerignore                                 | 19 ++++++
 .github/workflows/deploy-examples.yml         | 62 +++++++++++++++++++
 Dockerfile                                    | 48 ++++++++++++++
 app.yaml                                      |  8 ---
 .../recaptcha-content-security-policy.php     |  4 +-
 examples/recaptcha-v2-checkbox-explicit.php   |  4 +-
 examples/recaptcha-v2-checkbox.php            |  4 +-
 examples/recaptcha-v2-invisible.php           |  4 +-
 examples/recaptcha-v3-request-scores.php      |  4 +-
 examples/recaptcha-v3-verify.php              |  4 +-
 10 files changed, 141 insertions(+), 20 deletions(-)
 create mode 100644 .dockerignore
 create mode 100644 .github/workflows/deploy-examples.yml
 create mode 100644 Dockerfile
 delete mode 100644 app.yaml

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..f652022
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,19 @@
+.git
+.github
+.phpunit.cache
+.worktrees
+build
+tests
+vendor
+.gitignore
+.gitattributes
+.php-cs-fixer.dist.php
+Dockerfile
+.dockerignore
+phpunit.xml.dist
+README.md
+ARCHITECTURE.md
+CONTRIBUTING.md
+LICENSE
+app.yaml
+firebase-debug.log
diff --git a/.github/workflows/deploy-examples.yml b/.github/workflows/deploy-examples.yml
new file mode 100644
index 0000000..ccebdbd
--- /dev/null
+++ b/.github/workflows/deploy-examples.yml
@@ -0,0 +1,62 @@
+name: Deploy Examples to Cloud Run
+
+on:
+  push:
+    branches: [ "main" ]
+  # Optional: Enable for PR previews
+  # pull_request:
+  #   branches: [ "main" ]
+
+env:
+  PROJECT_ID: recaptcha-demo-php
+  SERVICE_NAME: recaptcha-examples
+  REGION: us-central1
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: 'read'
+      id-token: 'write'
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v3
+
+    # Authenticate with Google Cloud
+    # You'll need to set up a Service Account with 'Cloud Run Admin' and 'Storage Admin' roles
+    # and add its key as a GitHub secret: GCP_SA_KEY
+    - id: 'auth'
+      uses: 'google-github-actions/auth@v1'
+      with:
+        credentials_json: '${{ secrets.GCP_SA_KEY }}'
+
+    - name: 'Set up Cloud SDK'
+      uses: 'google-github-actions/setup-gcloud@v1'
+
+    - name: 'Build and Push Container'
+      run: |
+        gcloud builds submit --tag gcr.io/${{ env.PROJECT_ID }}/${{ env.SERVICE_NAME }}:${{ github.sha }}
+
+    - name: 'Deploy to Cloud Run'
+      uses: 'google-github-actions/deploy-cloudrun@v1'
+      with:
+        service: '${{ env.SERVICE_NAME }}'
+        image: 'gcr.io/${{ env.PROJECT_ID }}/${{ env.SERVICE_NAME }}:${{ github.sha }}'
+        region: '${{ env.REGION }}'
+        env_vars: |
+          RECAPTCHA_V2_SITE_KEY=${{ secrets.RECAPTCHA_V2_SITE_KEY }}
+          RECAPTCHA_V2_SECRET_KEY=${{ secrets.RECAPTCHA_V2_SECRET_KEY }}
+          RECAPTCHA_V3_SITE_KEY=${{ secrets.RECAPTCHA_V3_SITE_KEY }}
+          RECAPTCHA_V3_SECRET_KEY=${{ secrets.RECAPTCHA_V3_SECRET_KEY }}
+        flags: '--allow-unauthenticated'
+
+  # Example job for PR Previews (commented out by default)
+  # preview:
+  #   if: github.event_name == 'pull_request'
+  #   runs-on: ubuntu-latest
+  #   steps:
+  #     - name: 'Deploy Preview'
+  #       run: |
+  #         # Script to deploy with service name: recaptcha-examples-pr-${{ github.event.number }}
+  #         # And update PR with the URL
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..7d20e0f
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,48 @@
+# Use the official PHP image with Apache
+FROM php:8.5-apache
+
+# Install system dependencies for PHP extensions
+RUN apt-get update && apt-get install -y \
+    libzip-dev \
+    zip \
+    unzip \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install PHP extensions required for the library and examples
+RUN docker-php-ext-install zip
+
+# Enable Apache mod_rewrite for modern URL handling if needed
+RUN a2enmod rewrite
+
+# Install Composer
+COPY --from=composer:latest /usr/bin/composer /usr/bin/composer
+
+# Set the working directory
+WORKDIR /var/www/html
+
+# Copy composer files first to leverage Docker cache
+COPY composer.json composer.lock ./
+
+# Install project dependencies
+RUN composer install --no-dev --optimize-autoloader
+
+# Copy the library source and examples
+COPY src/ ./src/
+COPY examples/ ./examples/
+
+# Update Apache configuration to serve from the examples directory
+RUN sed -ri -e 's!/var/www/html!/var/www/html/examples!g' /etc/apache2/sites-available/*.conf
+RUN sed -ri -e 's!/var/www/!/var/www/html/examples!g' /etc/apache2/apache2.conf /etc/apache2/conf-available/*.conf
+
+# Cloud Run requires Apache to listen on the port defined by the PORT environment variable
+# We can use a script or sed to update the port at runtime, or just use 8080 as a standard
+RUN sed -i 's/80/8080/g' /etc/apache2/sites-available/000-default.conf /etc/apache2/ports.conf
+
+# Set permissions for Apache
+RUN chown -R www-data:www-data /var/www/html
+
+# Use the default PORT environment variable or fallback to 8080
+ENV PORT 8080
+EXPOSE 8080
+
+# The entrypoint is already set to apache2-foreground in the base image
diff --git a/app.yaml b/app.yaml
deleted file mode 100644
index b6ccaf1..0000000
--- a/app.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-runtime: php
-env: flex
-
-skip_files:
-- tests
-
-runtime_config:
-  document_root: examples
diff --git a/examples/recaptcha-content-security-policy.php b/examples/recaptcha-content-security-policy.php
index 4edbf0e..2ea462d 100644
--- a/examples/recaptcha-content-security-policy.php
+++ b/examples/recaptcha-content-security-policy.php
@@ -66,8 +66,8 @@
 );
 
 // Register API keys at https://www.google.com/recaptcha/admin
-$siteKey = '';
-$secret = '';
+$siteKey = getenv('RECAPTCHA_V2_SITE_KEY') ?: '';
+$secret = getenv('RECAPTCHA_V2_SECRET_KEY') ?: '';
 
 // Copy the config.php.dist file to config.php and update it with your keys to run the examples
 if ('' == $siteKey && is_readable(__DIR__.'/config.php')) {
diff --git a/examples/recaptcha-v2-checkbox-explicit.php b/examples/recaptcha-v2-checkbox-explicit.php
index a8366cd..913509e 100644
--- a/examples/recaptcha-v2-checkbox-explicit.php
+++ b/examples/recaptcha-v2-checkbox-explicit.php
@@ -43,8 +43,8 @@
 require_once __DIR__.'/../vendor/autoload.php';
 
 // Register API keys at https://www.google.com/recaptcha/admin
-$siteKey = '';
-$secret = '';
+$siteKey = getenv('RECAPTCHA_V2_SITE_KEY') ?: '';
+$secret = getenv('RECAPTCHA_V2_SECRET_KEY') ?: '';
 
 // Copy the config.php.dist file to config.php and update it with your keys to run the examples
 if ('' == $siteKey && is_readable(__DIR__.'/config.php')) {
diff --git a/examples/recaptcha-v2-checkbox.php b/examples/recaptcha-v2-checkbox.php
index ac1b41e..c87eb5a 100644
--- a/examples/recaptcha-v2-checkbox.php
+++ b/examples/recaptcha-v2-checkbox.php
@@ -43,8 +43,8 @@
 require_once __DIR__.'/../vendor/autoload.php';
 
 // Register API keys at https://www.google.com/recaptcha/admin
-$siteKey = '';
-$secret = '';
+$siteKey = getenv('RECAPTCHA_V2_SITE_KEY') ?: '';
+$secret = getenv('RECAPTCHA_V2_SECRET_KEY') ?: '';
 
 // Copy the config.php.dist file to config.php and update it with your keys to run the examples
 if ('' == $siteKey && is_readable(__DIR__.'/config.php')) {
diff --git a/examples/recaptcha-v2-invisible.php b/examples/recaptcha-v2-invisible.php
index e54a249..1dfb404 100644
--- a/examples/recaptcha-v2-invisible.php
+++ b/examples/recaptcha-v2-invisible.php
@@ -43,8 +43,8 @@
 require_once __DIR__.'/../vendor/autoload.php';
 
 // Register API keys at https://www.google.com/recaptcha/admin
-$siteKey = '';
-$secret = '';
+$siteKey = getenv('RECAPTCHA_V2_SITE_KEY') ?: '';
+$secret = getenv('RECAPTCHA_V2_SECRET_KEY') ?: '';
 
 // Copy the config.php.dist file to config.php and update it with your keys to run the examples
 if ('' == $siteKey && is_readable(__DIR__.'/config.php')) {
diff --git a/examples/recaptcha-v3-request-scores.php b/examples/recaptcha-v3-request-scores.php
index 3d8785b..4e67fed 100644
--- a/examples/recaptcha-v3-request-scores.php
+++ b/examples/recaptcha-v3-request-scores.php
@@ -40,8 +40,8 @@
 require_once __DIR__.'/../vendor/autoload.php';
 
 // Register API keys at https://www.google.com/recaptcha/admin
-$siteKey = '';
-$secret = '';
+$siteKey = getenv('RECAPTCHA_V3_SITE_KEY') ?: '';
+$secret = getenv('RECAPTCHA_V3_SECRET_KEY') ?: '';
 
 // Copy the config.php.dist file to config.php and update it with your keys to run the examples
 if ('' == $siteKey && is_readable(__DIR__.'/config.php')) {
diff --git a/examples/recaptcha-v3-verify.php b/examples/recaptcha-v3-verify.php
index b4ffa43..1b669c6 100644
--- a/examples/recaptcha-v3-verify.php
+++ b/examples/recaptcha-v3-verify.php
@@ -43,8 +43,8 @@
 require_once __DIR__.'/../vendor/autoload.php';
 
 // Register API keys at https://www.google.com/recaptcha/admin
-$siteKey = '';
-$secret = '';
+$siteKey = getenv('RECAPTCHA_V3_SITE_KEY') ?: '';
+$secret = getenv('RECAPTCHA_V3_SECRET_KEY') ?: '';
 
 // Copy the config.php.dist file to config.php and update it with your keys to run the examples
 if ('' == $siteKey && is_readable(__DIR__.'/config.php')) {

From 4d3ae0197899a8d9528febb4cf4790accd18ef9c Mon Sep 17 00:00:00 2001
From: Rowan Merewood <rowan@merewood.org>
Date: Sat, 21 Mar 2026 22:59:04 +0000
Subject: [PATCH 2/9] feat: enable PR previews for Cloud Run

Updates the deployment workflow to automatically deploy unique Cloud Run services for each PR and cleanup when closed.
---
 .github/workflows/deploy-examples.yml | 59 +++++++++++++++++++--------
 1 file changed, 43 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/deploy-examples.yml b/.github/workflows/deploy-examples.yml
index ccebdbd..1eaf562 100644
--- a/.github/workflows/deploy-examples.yml
+++ b/.github/workflows/deploy-examples.yml
@@ -3,9 +3,9 @@ name: Deploy Examples to Cloud Run
 on:
   push:
     branches: [ "main" ]
-  # Optional: Enable for PR previews
-  # pull_request:
-  #   branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+    types: [opened, synchronize, reopened, closed]
 
 env:
   PROJECT_ID: recaptcha-demo-php
@@ -14,18 +14,17 @@ env:
 
 jobs:
   deploy:
+    if: github.event.action != 'closed'
     runs-on: ubuntu-latest
     permissions:
       contents: 'read'
       id-token: 'write'
+      pull-requests: 'write'
 
     steps:
     - name: Checkout code
       uses: actions/checkout@v3
 
-    # Authenticate with Google Cloud
-    # You'll need to set up a Service Account with 'Cloud Run Admin' and 'Storage Admin' roles
-    # and add its key as a GitHub secret: GCP_SA_KEY
     - id: 'auth'
       uses: 'google-github-actions/auth@v1'
       with:
@@ -38,10 +37,20 @@ jobs:
       run: |
         gcloud builds submit --tag gcr.io/${{ env.PROJECT_ID }}/${{ env.SERVICE_NAME }}:${{ github.sha }}
 
+    - name: 'Set Service Name'
+      id: set-service-name
+      run: |
+        if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+          echo "name=recaptcha-examples-pr-${{ github.event.number }}" >> $GITHUB_OUTPUT
+        else
+          echo "name=${{ env.SERVICE_NAME }}" >> $GITHUB_OUTPUT
+        fi
+
     - name: 'Deploy to Cloud Run'
+      id: deploy
       uses: 'google-github-actions/deploy-cloudrun@v1'
       with:
-        service: '${{ env.SERVICE_NAME }}'
+        service: '${{ steps.set-service-name.outputs.name }}'
         image: 'gcr.io/${{ env.PROJECT_ID }}/${{ env.SERVICE_NAME }}:${{ github.sha }}'
         region: '${{ env.REGION }}'
         env_vars: |
@@ -51,12 +60,30 @@ jobs:
           RECAPTCHA_V3_SECRET_KEY=${{ secrets.RECAPTCHA_V3_SECRET_KEY }}
         flags: '--allow-unauthenticated'
 
-  # Example job for PR Previews (commented out by default)
-  # preview:
-  #   if: github.event_name == 'pull_request'
-  #   runs-on: ubuntu-latest
-  #   steps:
-  #     - name: 'Deploy Preview'
-  #       run: |
-  #         # Script to deploy with service name: recaptcha-examples-pr-${{ github.event.number }}
-  #         # And update PR with the URL
+    - name: 'Comment on PR'
+      if: github.event_name == 'pull_request'
+      uses: actions/github-script@v6
+      with:
+        script: |
+          github.rest.issues.createComment({
+            issue_number: context.issue.number,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            body: '🚀 PR Preview deployed to: ${{ steps.deploy.outputs.url }}'
+          })
+
+  cleanup:
+    if: github.event_name == 'pull_request' && github.event.action == 'closed'
+    runs-on: ubuntu-latest
+    steps:
+    - id: 'auth'
+      uses: 'google-github-actions/auth@v1'
+      with:
+        credentials_json: '${{ secrets.GCP_SA_KEY }}'
+
+    - name: 'Set up Cloud SDK'
+      uses: 'google-github-actions/setup-gcloud@v1'
+
+    - name: 'Delete PR Preview Service'
+      run: |
+        gcloud run services delete recaptcha-examples-pr-${{ github.event.number }} --region ${{ env.REGION }} --quiet

From c2c3ca1de241213e81efbbb2a8641243acaaaeb6 Mon Sep 17 00:00:00 2001
From: Rowan Merewood <rowan@merewood.org>
Date: Sun, 22 Mar 2026 16:15:49 +0000
Subject: [PATCH 3/9] fix: avoid log streaming error in cloud build

---
 .github/workflows/deploy-examples.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/deploy-examples.yml b/.github/workflows/deploy-examples.yml
index 1eaf562..de71fce 100644
--- a/.github/workflows/deploy-examples.yml
+++ b/.github/workflows/deploy-examples.yml
@@ -35,7 +35,7 @@ jobs:
 
     - name: 'Build and Push Container'
       run: |
-        gcloud builds submit --tag gcr.io/${{ env.PROJECT_ID }}/${{ env.SERVICE_NAME }}:${{ github.sha }}
+        gcloud builds submit --tag gcr.io/${{ env.PROJECT_ID }}/${{ env.SERVICE_NAME }}:${{ github.sha }} --no-source-logs
 
     - name: 'Set Service Name'
       id: set-service-name

From c341ff78a34340bdd000d632e5409163ac05663b Mon Sep 17 00:00:00 2001
From: Rowan Merewood <rowan@merewood.org>
Date: Sun, 22 Mar 2026 16:18:21 +0000
Subject: [PATCH 4/9] fix: use correct flag for suppressing build logs

---
 .github/workflows/deploy-examples.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/deploy-examples.yml b/.github/workflows/deploy-examples.yml
index de71fce..9d7139e 100644
--- a/.github/workflows/deploy-examples.yml
+++ b/.github/workflows/deploy-examples.yml
@@ -35,7 +35,7 @@ jobs:
 
     - name: 'Build and Push Container'
       run: |
-        gcloud builds submit --tag gcr.io/${{ env.PROJECT_ID }}/${{ env.SERVICE_NAME }}:${{ github.sha }} --no-source-logs
+        gcloud builds submit --tag gcr.io/${{ env.PROJECT_ID }}/${{ env.SERVICE_NAME }}:${{ github.sha }} --suppress-logs
 
     - name: 'Set Service Name'
       id: set-service-name

From 12e77ae8de3267cfab947771d59d7f1f0d8b9c1d Mon Sep 17 00:00:00 2001
From: Rowan Merewood <rowan@merewood.org>
Date: Sun, 22 Mar 2026 16:22:11 +0000
Subject: [PATCH 5/9] fix: use async build and polling to avoid log streaming
 issues

---
 .github/workflows/deploy-examples.yml | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy-examples.yml b/.github/workflows/deploy-examples.yml
index 9d7139e..20d7a87 100644
--- a/.github/workflows/deploy-examples.yml
+++ b/.github/workflows/deploy-examples.yml
@@ -35,7 +35,20 @@ jobs:
 
     - name: 'Build and Push Container'
       run: |
-        gcloud builds submit --tag gcr.io/${{ env.PROJECT_ID }}/${{ env.SERVICE_NAME }}:${{ github.sha }} --suppress-logs
+        BUILD_ID=$(gcloud builds submit --tag gcr.io/${{ env.PROJECT_ID }}/${{ env.SERVICE_NAME }}:${{ github.sha }} --async --format='value(id)')
+        echo "Build started with ID: $BUILD_ID"
+        while true; do
+          STATUS=$(gcloud builds describe $BUILD_ID --format='value(status)')
+          echo "Current status: $STATUS"
+          if [[ "$STATUS" == "SUCCESS" ]]; then
+            break
+          fi
+          if [[ "$STATUS" == "FAILURE" || "$STATUS" == "INTERNAL_ERROR" || "$STATUS" == "TIMEOUT" || "$STATUS" == "CANCELLED" ]]; then
+            echo "Build failed with status: $STATUS"
+            exit 1
+          fi
+          sleep 10
+        done
 
     - name: 'Set Service Name'
       id: set-service-name

From fd09cb8b879e43c724f08dd8af3499dc79905829 Mon Sep 17 00:00:00 2001
From: Rowan Merewood <rowan@merewood.org>
Date: Sun, 22 Mar 2026 16:41:10 +0000
Subject: [PATCH 6/9] feat: integrate Firebase Hosting for subdomain previews

Configures Firebase Hosting to route traffic to Cloud Run, enabling stable production URLs and unique PR preview subdomains.
---
 .dockerignore                         |  4 ++++
 .firebaserc                           |  5 +++++
 .github/workflows/deploy-examples.yml | 18 +++++++-----------
 firebase.json                         | 19 +++++++++++++++++++
 public/index.html                     |  0
 5 files changed, 35 insertions(+), 11 deletions(-)
 create mode 100644 .firebaserc
 create mode 100644 firebase.json
 create mode 100644 public/index.html

diff --git a/.dockerignore b/.dockerignore
index f652022..79f23b1 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -17,3 +17,7 @@ CONTRIBUTING.md
 LICENSE
 app.yaml
 firebase-debug.log
+.firebaserc
+firebase.json
+public/
+
diff --git a/.firebaserc b/.firebaserc
new file mode 100644
index 0000000..4be568b
--- /dev/null
+++ b/.firebaserc
@@ -0,0 +1,5 @@
+{
+  "projects": {
+    "default": "recaptcha-demo-php"
+  }
+}
diff --git a/.github/workflows/deploy-examples.yml b/.github/workflows/deploy-examples.yml
index 20d7a87..5071313 100644
--- a/.github/workflows/deploy-examples.yml
+++ b/.github/workflows/deploy-examples.yml
@@ -1,4 +1,4 @@
-name: Deploy Examples to Cloud Run
+name: Deploy Examples to Cloud Run and Firebase
 
 on:
   push:
@@ -73,17 +73,13 @@ jobs:
           RECAPTCHA_V3_SECRET_KEY=${{ secrets.RECAPTCHA_V3_SECRET_KEY }}
         flags: '--allow-unauthenticated'
 
-    - name: 'Comment on PR'
-      if: github.event_name == 'pull_request'
-      uses: actions/github-script@v6
+    - name: 'Deploy to Firebase Hosting'
+      uses: FirebaseExtended/action-hosting-deploy@v0
       with:
-        script: |
-          github.rest.issues.createComment({
-            issue_number: context.issue.number,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            body: '🚀 PR Preview deployed to: ${{ steps.deploy.outputs.url }}'
-          })
+        repoToken: '${{ secrets.GITHUB_TOKEN }}'
+        firebaseServiceAccount: '${{ secrets.FIREBASE_SERVICE_ACCOUNT_RECAPTCHA_DEMO_PHP }}'
+        projectId: ${{ env.PROJECT_ID }}
+        channelId: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || 'live' }}
 
   cleanup:
     if: github.event_name == 'pull_request' && github.event.action == 'closed'
diff --git a/firebase.json b/firebase.json
new file mode 100644
index 0000000..821a870
--- /dev/null
+++ b/firebase.json
@@ -0,0 +1,19 @@
+{
+  "hosting": {
+    "public": "public",
+    "ignore": [
+      "firebase.json",
+      "**/.*",
+      "**/node_modules/**"
+    ],
+    "rewrites": [
+      {
+        "source": "**",
+        "run": {
+          "serviceId": "recaptcha-examples",
+          "region": "us-central1"
+        }
+      }
+    ]
+  }
+}
diff --git a/public/index.html b/public/index.html
new file mode 100644
index 0000000..e69de29

From 42635cd016bfbd57deebe409e21c6f0e6c923627 Mon Sep 17 00:00:00 2001
From: Rowan Merewood <rowan@merewood.org>
Date: Sun, 22 Mar 2026 16:45:34 +0000
Subject: [PATCH 7/9] fix: add checks:write permission for Firebase Action

---
 .github/workflows/deploy-examples.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/deploy-examples.yml b/.github/workflows/deploy-examples.yml
index 5071313..03ec6a4 100644
--- a/.github/workflows/deploy-examples.yml
+++ b/.github/workflows/deploy-examples.yml
@@ -20,6 +20,7 @@ jobs:
       contents: 'read'
       id-token: 'write'
       pull-requests: 'write'
+      checks: 'write'
 
     steps:
     - name: Checkout code

From 4770bd10b5269f929fa4ed1de6462ae866560e95 Mon Sep 17 00:00:00 2001
From: Rowan Merewood <rowan@merewood.org>
Date: Mon, 23 Mar 2026 11:49:46 +0000
Subject: [PATCH 8/9] fix: serve examples from correct dir and use Cloud Run
 tags for Firebase Hosting

---
 .github/workflows/deploy-examples.yml | 27 ++++++++++++++-------------
 Dockerfile                            | 12 ++++++------
 2 files changed, 20 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/deploy-examples.yml b/.github/workflows/deploy-examples.yml
index 03ec6a4..29ad511 100644
--- a/.github/workflows/deploy-examples.yml
+++ b/.github/workflows/deploy-examples.yml
@@ -51,20 +51,11 @@ jobs:
           sleep 10
         done
 
-    - name: 'Set Service Name'
-      id: set-service-name
-      run: |
-        if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-          echo "name=recaptcha-examples-pr-${{ github.event.number }}" >> $GITHUB_OUTPUT
-        else
-          echo "name=${{ env.SERVICE_NAME }}" >> $GITHUB_OUTPUT
-        fi
-
     - name: 'Deploy to Cloud Run'
-      id: deploy
+      id: deploy-cloud-run
       uses: 'google-github-actions/deploy-cloudrun@v1'
       with:
-        service: '${{ steps.set-service-name.outputs.name }}'
+        service: '${{ env.SERVICE_NAME }}'
         image: 'gcr.io/${{ env.PROJECT_ID }}/${{ env.SERVICE_NAME }}:${{ github.sha }}'
         region: '${{ env.REGION }}'
         env_vars: |
@@ -73,6 +64,15 @@ jobs:
           RECAPTCHA_V3_SITE_KEY=${{ secrets.RECAPTCHA_V3_SITE_KEY }}
           RECAPTCHA_V3_SECRET_KEY=${{ secrets.RECAPTCHA_V3_SECRET_KEY }}
         flags: '--allow-unauthenticated'
+        # For PRs, we want to route to the new revision without affecting prod traffic
+        no_traffic: ${{ github.event_name == 'pull_request' }}
+        tag: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || 'live' }}
+
+    - name: 'Update firebase.json with Tag'
+      if: github.event_name == 'pull_request'
+      run: |
+        TAG="pr-${{ github.event.number }}"
+        sed -i "s/\"serviceId\": \"recaptcha-examples\"/\"serviceId\": \"recaptcha-examples\", \"tag\": \"$TAG\"/" firebase.json
 
     - name: 'Deploy to Firebase Hosting'
       uses: FirebaseExtended/action-hosting-deploy@v0
@@ -94,6 +94,7 @@ jobs:
     - name: 'Set up Cloud SDK'
       uses: 'google-github-actions/setup-gcloud@v1'
 
-    - name: 'Delete PR Preview Service'
+    - name: 'Delete PR Tag from Cloud Run'
       run: |
-        gcloud run services delete recaptcha-examples-pr-${{ github.event.number }} --region ${{ env.REGION }} --quiet
+        # We don't delete the service, just remove the tag or ignore
+        gcloud run services update ${{ env.SERVICE_NAME }} --remove-tags pr-${{ github.event.number }} --region ${{ env.REGION }} || true
diff --git a/Dockerfile b/Dockerfile
index 7d20e0f..5ae7f58 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,7 +11,7 @@ RUN apt-get update && apt-get install -y \
 # Install PHP extensions required for the library and examples
 RUN docker-php-ext-install zip
 
-# Enable Apache mod_rewrite for modern URL handling if needed
+# Enable Apache mod_rewrite
 RUN a2enmod rewrite
 
 # Install Composer
@@ -20,7 +20,7 @@ COPY --from=composer:latest /usr/bin/composer /usr/bin/composer
 # Set the working directory
 WORKDIR /var/www/html
 
-# Copy composer files first to leverage Docker cache
+# Copy composer files first
 COPY composer.json composer.lock ./
 
 # Install project dependencies
@@ -30,12 +30,14 @@ RUN composer install --no-dev --optimize-autoloader
 COPY src/ ./src/
 COPY examples/ ./examples/
 
-# Update Apache configuration to serve from the examples directory
+# Update Apache configuration to serve from the examples directory correctly
 RUN sed -ri -e 's!/var/www/html!/var/www/html/examples!g' /etc/apache2/sites-available/*.conf
 RUN sed -ri -e 's!/var/www/!/var/www/html/examples!g' /etc/apache2/apache2.conf /etc/apache2/conf-available/*.conf
 
+# Set ServerName to localhost to avoid startup warnings
+RUN echo "ServerName localhost" >> /etc/apache2/apache2.conf
+
 # Cloud Run requires Apache to listen on the port defined by the PORT environment variable
-# We can use a script or sed to update the port at runtime, or just use 8080 as a standard
 RUN sed -i 's/80/8080/g' /etc/apache2/sites-available/000-default.conf /etc/apache2/ports.conf
 
 # Set permissions for Apache
@@ -44,5 +46,3 @@ RUN chown -R www-data:www-data /var/www/html
 # Use the default PORT environment variable or fallback to 8080
 ENV PORT 8080
 EXPOSE 8080
-
-# The entrypoint is already set to apache2-foreground in the base image

From 092eefb0fc43e22da3218b5493eb50362d19df2c Mon Sep 17 00:00:00 2001
From: Rowan Merewood <rowan@merewood.org>
Date: Mon, 23 Mar 2026 14:26:54 +0000
Subject: [PATCH 9/9] Fixing Hosting URLs

---
 .github/workflows/deploy-examples.yml | 12 +++++++++---
 firebase.json                         |  3 ++-
 public/index.html                     |  0
 3 files changed, 11 insertions(+), 4 deletions(-)
 delete mode 100644 public/index.html

diff --git a/.github/workflows/deploy-examples.yml b/.github/workflows/deploy-examples.yml
index 29ad511..7406000 100644
--- a/.github/workflows/deploy-examples.yml
+++ b/.github/workflows/deploy-examples.yml
@@ -68,11 +68,17 @@ jobs:
         no_traffic: ${{ github.event_name == 'pull_request' }}
         tag: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || 'live' }}
 
-    - name: 'Update firebase.json with Tag'
+
+    - name: 'Setup Firebase Site and Config for PR'
       if: github.event_name == 'pull_request'
       run: |
+        npm install -g firebase-tools
+        SITE_ID="${{ env.PROJECT_ID }}-pr-${{ github.event.number }}"
         TAG="pr-${{ github.event.number }}"
-        sed -i "s/\"serviceId\": \"recaptcha-examples\"/\"serviceId\": \"recaptcha-examples\", \"tag\": \"$TAG\"/" firebase.json
+        # Create the site (ignore error if it already exists)
+        firebase hosting:sites:create $SITE_ID --project ${{ env.PROJECT_ID }} || true
+        # Update firebase.json to deploy to the PR site and route to the specific PR tag
+        jq ".hosting.site = \"$SITE_ID\" | .hosting.rewrites[0].run.tag = \"$TAG\" | del(.hosting.rewrites[0].run.pinTag)" firebase.json > firebase.tmp.json && mv firebase.tmp.json firebase.json
 
     - name: 'Deploy to Firebase Hosting'
       uses: FirebaseExtended/action-hosting-deploy@v0
@@ -80,7 +86,7 @@ jobs:
         repoToken: '${{ secrets.GITHUB_TOKEN }}'
         firebaseServiceAccount: '${{ secrets.FIREBASE_SERVICE_ACCOUNT_RECAPTCHA_DEMO_PHP }}'
         projectId: ${{ env.PROJECT_ID }}
-        channelId: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || 'live' }}
+        channelId: 'live'
 
   cleanup:
     if: github.event_name == 'pull_request' && github.event.action == 'closed'
diff --git a/firebase.json b/firebase.json
index 821a870..75ec6d5 100644
--- a/firebase.json
+++ b/firebase.json
@@ -11,7 +11,8 @@
         "source": "**",
         "run": {
           "serviceId": "recaptcha-examples",
-          "region": "us-central1"
+          "region": "us-central1",
+          "pinTag": true
         }
       }
     ]
diff --git a/public/index.html b/public/index.html
deleted file mode 100644
index e69de29..0000000