From 3db916ff57ef3f8c1b3485fd6782c761e4f199c8 Mon Sep 17 00:00:00 2001
From: Jonathan Desrosiers <359867+desrosj@users.noreply.github.com>
Date: Mon, 23 Mar 2026 12:09:38 -0400
Subject: [PATCH] Avoid calling PHP directly in build process.

---
 package-lock.json       | 18 ++++++++++++++++++
 package.json            |  1 +
 tools/gutenberg/copy.js | 30 ++++--------------------------
 3 files changed, 23 insertions(+), 26 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index b71acf244cb72..775b43f66e925 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -79,6 +79,7 @@
 				"grunt-webpack": "7.0.1",
 				"install-changed": "1.1.0",
 				"json2php": "0.0.12",
+				"php-array-reader": "2.1.3",
 				"postcss": "8.5.8",
 				"prettier": "npm:wp-prettier@3.0.3",
 				"qunit": "~2.25.0",
@@ -26137,6 +26138,23 @@
 			"integrity": "sha1-Ywn04OX6kT7BxpMHrjZLSzd8nns=",
 			"dev": true
 		},
+		"node_modules/php-array-reader": {
+			"version": "2.1.3",
+			"resolved": "https://registry.npmjs.org/php-array-reader/-/php-array-reader-2.1.3.tgz",
+			"integrity": "sha512-FjgMmNfnbi76wsbzO/dWEeySt0WZpxv8q/7RH0XFPyNLxsfJSf97KKe/4Rgdmx/XRDGlbl8THU5ayKwGE3Xqrw==",
+			"dev": true,
+			"license": "MIT",
+			"dependencies": {
+				"php-parser": "^3.1.5"
+			}
+		},
+		"node_modules/php-parser": {
+			"version": "3.5.0",
+			"resolved": "https://registry.npmjs.org/php-parser/-/php-parser-3.5.0.tgz",
+			"integrity": "sha512-EHdzSckQNP86jQRCEsMYhs+YzS4BfvfxnyhvzHVhVRoRUGEMFi8f3xKfuS9xdChBazZSyvb10SZbqhYQLGBcQg==",
+			"dev": true,
+			"license": "BSD-3-Clause"
+		},
 		"node_modules/picocolors": {
 			"version": "1.1.1",
 			"resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
diff --git a/package.json b/package.json
index 570b78ada3d92..229145d0b1b0e 100644
--- a/package.json
+++ b/package.json
@@ -66,6 +66,7 @@
 		"grunt-webpack": "7.0.1",
 		"install-changed": "1.1.0",
 		"json2php": "0.0.12",
+		"php-array-reader": "2.1.3",
 		"postcss": "8.5.8",
 		"prettier": "npm:wp-prettier@3.0.3",
 		"qunit": "~2.25.0",
diff --git a/tools/gutenberg/copy.js b/tools/gutenberg/copy.js
index e5ca8eb71dce5..b3c4b7f9aa9ba 100644
--- a/tools/gutenberg/copy.js
+++ b/tools/gutenberg/copy.js
@@ -9,10 +9,10 @@
  * @package WordPress
  */
 
-const child_process = require( 'child_process' );
 const fs = require( 'fs' );
 const path = require( 'path' );
 const json2php = require( 'json2php' );
+const { fromString } = require( 'php-array-reader' );
 
 // Paths.
 const rootDir = path.resolve( __dirname, '../..' );
@@ -78,36 +78,14 @@ const COPY_CONFIG = {
  * Given a path to a PHP file which returns a single value, converts that
  * value into a native JavaScript value (limited by JSON serialization).
  *
- * @throws Error when PHP source file unable to be read, or PHP is unavailable.
+ * @throws Error when PHP source file unable to be read or parsed.
  *
  * @param {string} phpFilepath Absolute path of PHP file returning a single value.
  * @return {Object|Array} JavaScript representation of value from input file.
  */
 function readReturnedValueFromPHPFile( phpFilepath ) {
-	const results = child_process.spawnSync(
-		'php',
-		[ '-r', '$path = file_get_contents( "php://stdin" ); if ( ! is_file( $path ) ) { die( 1 ); } try { $data = require $path; } catch ( \\Throwable $e ) { die( 2 ); } $json = json_encode( $data ); if ( ! is_string( $json ) ) { die( 3 ); } echo $json;' ],
-		{
-			encoding: 'utf8',
-			input: phpFilepath,
-		}
-	);
-
-	switch ( results.status ) {
-		case 0:
-			return JSON.parse( results.stdout );
-
-		case 1:
-			throw new Error( `Could not read PHP source file: '${ phpFilepath }'` );
-
-		case 2:
-			throw new Error( `PHP source file did not return value when imported: '${ phpFilepath }'` );
-
-		case 3:
-			throw new Error( `Could not serialize PHP source value into JSON: '${ phpFilepath }'` );
-	}
-
-	throw new Error( `Unknown error while reading PHP source file: '${ phpFilepath }'` );
+	const content = fs.readFileSync( phpFilepath, 'utf8' );
+	return fromString( content );
 }
 
 /**