Avoid calling PHP directly in build process

[desrosj]

This removes the php command in the build script introduced in r61873.

Trac ticket: Core-64925

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Sonnet 4.6
Used for: Used to create the first draft of this PR.

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props desrosj, dmsnell.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[dmsnell]

I think when I added the original code I saw that the PHP files included an if ( ! defined( 'ABSPATH' ) ) { die(); } check. it’s unclear from the code what the purpose of fromString does, and how it parses the PHP code.

with require file_get_contents( 'php://stdin' ); we at least know that we expect the included PHP to return a value, and that value will be serialized.

I had to perform a couple web searches to find the php-array-reader and then to find the php-parser node module it depends on to begin to get a faint picture of what it’s doing and how it’s written.

---

I’m still perplexed by how this is a problem, and what makes this particular build step distinct from the other basic requirements of PHP. is running all of this in npm ci via a post-install hook the actual problem? because it seems like this should be doable within the Docker image, if that’s what someone is doing, or plainly via php if running outside of Docker.

While I don’t want to delay any changes that are necessary, I’m just wanting to double-check our values when introducing more npm dependencies to booting the repo, running more JS code to recreate a PHP parser when one is available to us already, and where we know we need php anyway.