plugin-ci-workflow.yml

# +-------------------------------------------------------------------------+
# | Copyright (C) 2004-2026 The Cacti Group                                 |
# |                                                                         |
# | This program is free software; you can redistribute it and/or           |
# | modify it under the terms of the GNU General Public License             |
# | as published by the Free Software Foundation; either version 2          |
# | of the License, or (at your option) any later version.                  |
# |                                                                         |
# | This program is distributed in the hope that it will be useful,         |
# | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
# | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
# | GNU General Public License for more details.                            |
# +-------------------------------------------------------------------------+
# | Cacti: The Complete RRDtool-based Graphing Solution                     |
# +-------------------------------------------------------------------------+
# | This code is designed, written, and maintained by the Cacti Group. See  |
# | about.php and/or the AUTHORS file for specific developer information.   |
# +-------------------------------------------------------------------------+
# | http://www.cacti.net/                                                   |
# +-------------------------------------------------------------------------+

name: Plugin Integration Tests

on:
  push:
    branches:
      - main
      - develop
  pull_request:
    branches:
      - main
      - develop

permissions:
  contents: read

env:
  CACTI: 1.2.x

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  integration-test:
    timeout-minutes: 45
    runs-on: ${{ matrix.os }}

    strategy:
      fail-fast: false
      matrix:
        php: ['8.2', '8.3', '8.4']
        os: [ubuntu-latest]

    services:
      mariadb:
        image: mariadb:11.8@sha256:6422478cb8e159f080fb1d8ccf65101e26fe51385787fde7d16c3b165a331f15
        env:
          MYSQL_ROOT_PASSWORD: cactiroot
          MYSQL_DATABASE: cacti
          MYSQL_USER: cactiuser
          MYSQL_PASSWORD: cactiuser
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mariadb-admin ping"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=3

    name: PHP ${{ matrix.php }} Integration Test on ${{ matrix.os }}

    steps:
    - name: Checkout Cacti
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
        repository: Cacti/cacti
        ref: ${{ env.CACTI }}
        path: cacti

    - name: Checkout audit Plugin
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        persist-credentials: false
        path: cacti/plugins/audit
        # patch-coverage.php diffs against the base branch below.
        fetch-depth: 0

    - name: Install PHP ${{ matrix.php }}
      uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
      with:
        php-version: ${{ matrix.php }}
        tools: composer:2.10.3
        extensions: intl, mysql, gd, ldap, gmp, xml, curl, json, mbstring, snmp, sockets
        coverage: xdebug
        ini-values: "post_max_size=256M, max_execution_time=60, date.timezone=America/New_York"

    - name: Check PHP version
      run: php -v

    - name: Validate plugin manifest (expected-file drift)
      run: php cacti/plugins/audit/tests/bin/validate-manifest.php

    - name: Run apt-get update
      run: sudo apt-get update

    - name: Install System Dependencies
      run: sudo apt-get install -y snmp snmpd rrdtool fping gettext

    - name: Start SNMPD Agent and Test
      run: |
        sudo systemctl start snmpd
        sudo snmpwalk -c public -v2c -On localhost .1.3.6.1.2.1.1

    - name: Setup Permissions
      run: |
        sudo chown -R www-data:runner ${{ github.workspace }}/cacti
        sudo find ${{ github.workspace }}/cacti -type d -exec chmod 775 {} \;
        sudo find ${{ github.workspace }}/cacti -type f -exec chmod 664 {} \;
        sudo chmod +x ${{ github.workspace }}/cacti/cmd.php
        sudo chmod +x ${{ github.workspace }}/cacti/poller.php

    - name: Create MySQL Config
      run: |
        echo "::add-mask::cactiroot"
        echo -e "[client]\nuser = root\npassword = cactiroot\nhost = 127.0.0.1\n" > ~/.my.cnf
        chmod 600 ~/.my.cnf

    - name: Initialize Cacti Database
      run: |
        mysql --defaults-file="$HOME/.my.cnf" -e 'CREATE DATABASE IF NOT EXISTS cacti;'
        mysql --defaults-file="$HOME/.my.cnf" -e "CREATE USER IF NOT EXISTS 'cactiuser'@'localhost' IDENTIFIED BY 'cactiuser';"
        mysql --defaults-file="$HOME/.my.cnf" -e "CREATE USER IF NOT EXISTS 'cactiuser'@'127.0.0.1' IDENTIFIED BY 'cactiuser';"
        mysql --defaults-file="$HOME/.my.cnf" -e "GRANT ALL PRIVILEGES ON cacti.* TO 'cactiuser'@'localhost';"
        mysql --defaults-file="$HOME/.my.cnf" -e "GRANT ALL PRIVILEGES ON cacti.* TO 'cactiuser'@'127.0.0.1';"
        mysql --defaults-file="$HOME/.my.cnf" -e "GRANT SELECT ON mysql.time_zone_name TO 'cactiuser'@'localhost';"
        mysql --defaults-file="$HOME/.my.cnf" -e "GRANT SELECT ON mysql.time_zone_name TO 'cactiuser'@'127.0.0.1';"
        mysql --defaults-file="$HOME/.my.cnf" -e "FLUSH PRIVILEGES;"
        mysql --defaults-file="$HOME/.my.cnf" cacti < ${{ github.workspace }}/cacti/cacti.sql
        mysql --defaults-file="$HOME/.my.cnf" -e "INSERT INTO settings (name, value) VALUES ('path_php_binary', '/usr/bin/php')" cacti

    # Core's release archives exclude .github and tests. Fetch these paths
    # through Git at the immutable helper revision instead of an Action archive.
    - name: Checkout shared CI tooling
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        repository: Cacti/cacti
        ref: f3ff777992875740e4665fedfe2eff8335f5b894
        persist-credentials: false
        path: ci-tools
        sparse-checkout: |
          .github/actions/setup-plugin-dependencies
          tests/tools/plugin-harness

    - name: Install locked Cacti and plugin test dependencies
      uses: ./ci-tools/.github/actions/setup-plugin-dependencies
      with:
        cacti-directory: cacti
        install-core-dev: 'false'

    - name: Create Cacti config.php
      run: |
        cat ${{ github.workspace }}/cacti/include/config.php.dist | \
        sed -r "s/localhost/127.0.0.1/g" | \
        sed -r "s/'cacti'/'cacti'/g" | \
        sed -r "s/'cactiuser'/'cactiuser'/g" | \
        sed -r "s/'cactiuser'/'cactiuser'/g" > ${{ github.workspace }}/cacti/include/config.php
        sudo chmod 664 ${{ github.workspace }}/cacti/include/config.php

    - name: Install Cacti via CLI
      run: |
        cd ${{ github.workspace }}/cacti
        sudo php cli/install_cacti.php --accept-eula --install --force

    - name: Install Audit Plugin
      run: |
        cd ${{ github.workspace }}/cacti
        sudo php cli/plugin_manage.php --plugin=audit --install --enable

    - name: Verify Audit Schema
      run: |
        COLUMN_COUNT=$(mysql -u cactiuser -p'cactiuser' -h 127.0.0.1 cacti -se "
          SELECT COUNT(*)
          FROM information_schema.columns
          WHERE table_schema = 'cacti'
            AND table_name = 'audit_log'
            AND column_name IN ('request_status', 'external_status', 'external_error');
        ")
        if [ "$COLUMN_COUNT" -ne 3 ]; then
          echo "Audit schema security columns are missing"
          exit 1
        fi

        SYSLOG_TABLE_COUNT=$(mysql -u cactiuser -p'cactiuser' -h 127.0.0.1 cacti -se "
          SELECT COUNT(*)
          FROM information_schema.tables
          WHERE table_schema = 'cacti'
            AND table_name = 'audit_syslog_delivery';
        ")
        if [ "$SYSLOG_TABLE_COUNT" -ne 1 ]; then
          echo "Audit Syslog delivery queue table is missing"
          exit 1
        fi

        AUTH_STATE_TABLE_COUNT=$(mysql -u cactiuser -p'cactiuser' -h 127.0.0.1 cacti -se "
          SELECT COUNT(*)
          FROM information_schema.tables
          WHERE table_schema = 'cacti'
            AND table_name = 'audit_user_log_state';
        ")
        if [ "$AUTH_STATE_TABLE_COUNT" -ne 1 ]; then
          echo "Authentication deduplication state table is missing"
          exit 1
        fi

        AUTH_STATE_FK_COUNT=$(mysql -u cactiuser -p'cactiuser' -h 127.0.0.1 cacti -se "
          SELECT COUNT(*)
          FROM information_schema.table_constraints
          WHERE constraint_schema = 'cacti'
            AND table_name = 'audit_user_log_state'
            AND constraint_type = 'FOREIGN KEY';
        ")
        if [ "$AUTH_STATE_FK_COUNT" -ne 0 ]; then
          echo "Authentication deduplication state must survive audit-log purges"
          exit 1
        fi

        THROTTLE_SETTING_COUNT=$(mysql -u cactiuser -p'cactiuser' -h 127.0.0.1 cacti -se "
          SELECT COUNT(*)
          FROM settings
          WHERE name = 'audit_brute_force_last_alert';
        ")
        if [ "$THROTTLE_SETTING_COUNT" -ne 1 ]; then
          echo "Brute-force throttle setting was not initialized"
          exit 1
        fi

    - name: Check PHP Syntax for Plugin
      run: |
        cd ${{ github.workspace }}/cacti/plugins/audit
        find . -path './vendor' -prune -o -type f -name '*.php' -print0 | xargs -0 -r -n1 php -l

    - name: Verify translation template is up to date
      if: github.event_name == 'pull_request'
      env:
        BASE_REF: ${{ github.event.pull_request.base.sha }}
      run: |
        cd ${{ github.workspace }}/cacti/plugins/audit
        git config --global --add safe.directory ${{ github.workspace }}/cacti/plugins/audit
        php tests/bin/check-i18n-pot.php "$BASE_REF"

    - name: Set expected Cacti version for unit tests
      run: echo -n "${{ env.CACTI }}" | sudo tee ${{ github.workspace }}/cacti/plugins/audit/tests/.cacti-version > /dev/null

    - name: Run Pest Unit Tests
      run: |
        cd ${{ github.workspace }}/cacti
        "$CACTI_PEST_BIN" --configuration=plugins/audit/phpunit.xml \
          --coverage-clover=plugins/audit/coverage/clover.xml

    # Whole-file coverage is meaningless here: most of the plugin only runs
    # inside a live Cacti. What is enforceable is that a change covers the
    # lines it adds.
    - name: Enforce coverage of changed lines
      if: github.event_name == 'pull_request'
      env:
        BASE_REF: ${{ github.event.pull_request.base.sha }}
      run: |
        cd ${{ github.workspace }}/cacti/plugins/audit
        git config --global --add safe.directory ${{ github.workspace }}/cacti/plugins/audit
        php tests/bin/patch-coverage.php coverage/clover.xml "$BASE_REF" 100

    - name: Upload coverage report
      if: always()
      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
      with:
        name: coverage-php${{ matrix.php }}
        path: ${{ github.workspace }}/cacti/plugins/audit/coverage/
        if-no-files-found: warn

    - name: Re-apply web user ownership before polling
      run: |
        # Ancestor directories above the checkout (e.g. /home/runner, .../work)
        # are typically 750 owned by the runner user, which blocks a non-root
        # www-data process from traversing down to the checkout at all.
        p="${{ github.workspace }}"
        while [ "$p" != "/" ]; do
          sudo chmod o+x "$p" || true
          p=$(dirname "$p")
        done

        sudo chown -R www-data:runner ${{ github.workspace }}/cacti
        sudo find ${{ github.workspace }}/cacti -type d -exec chmod 775 {} \;
        sudo find ${{ github.workspace }}/cacti -type f -exec chmod 664 {} \;
        sudo chmod +x ${{ github.workspace }}/cacti/cmd.php
        sudo chmod +x ${{ github.workspace }}/cacti/poller.php

    - name: Run Cacti Poller
      run: |
        cd ${{ github.workspace }}/cacti
        sudo -u www-data php poller.php --poller=1 --force --debug

        if ! grep -q "SYSTEM STATS" log/cacti.log; then
          echo "Cacti poller did not finish successfully"
          cat log/cacti.log
          exit 1
        fi

    - name: enable audit plugin logging
      run: |
        ENABLE_AUDIT_LOGGING="update settings set value = 'on' where name = 'audit_enabled' or name = 'audit_log_external';"
        mysql -u cactiuser -p'cactiuser' -h 127.0.0.1 cacti -e "$ENABLE_AUDIT_LOGGING"

    - name: Run cli script to trigger audit log entry
      run: |
        cd ${{ github.workspace }}/cacti
        sudo php cli/add_device.php --description=test --ip=1

    - name: Exercise authentication ingestion
      run: |
        mysql -u cactiuser -p'cactiuser' -h 127.0.0.1 cacti -e "
          UPDATE settings
          SET value = CASE name
            WHEN 'audit_user_log_watermark_epoch' THEN UNIX_TIMESTAMP() - 60
            ELSE 'on'
          END
          WHERE name IN (
            'audit_auth_log_enabled',
            'audit_auth_log_last_state',
            'audit_brute_force_enabled',
            'audit_user_log_watermark_epoch'
          );
          INSERT INTO user_log (username, user_id, time, result, ip)
          VALUES ('audit_ci_login', 0, NOW(), 0, '192.0.2.10')
          ON DUPLICATE KEY UPDATE result = VALUES(result), ip = VALUES(ip);
        "
        cd ${{ github.workspace }}/cacti
        sudo php plugins/audit/tests/Integration/AuthSqlIntegrationCheck.php

        AUTH_INDEX_COUNT=$(mysql -u cactiuser -p'cactiuser' -h 127.0.0.1 cacti -se "
          SELECT COUNT(DISTINCT index_name)
          FROM information_schema.statistics
          WHERE table_schema = 'cacti'
            AND table_name = 'user_log'
            AND index_name IN ('plugin_audit_time', 'plugin_audit_result_time');
        ")
        if [ "$AUTH_INDEX_COUNT" -ne 2 ]; then
          echo "Authentication audit indexes are missing after opt-in setup"
          exit 1
        fi

        AUTH_EVENT_COUNT=$(mysql -u cactiuser -p'cactiuser' -h 127.0.0.1 cacti -se "
          SELECT COUNT(*)
          FROM audit_log
          WHERE event_type = 'cacti.auth.login.failed'
            AND target_id = 'audit_ci_login';
        ")
        AUTH_STATE_COUNT=$(mysql -u cactiuser -p'cactiuser' -h 127.0.0.1 cacti -se "
          SELECT COUNT(*)
          FROM audit_user_log_state
          WHERE source_username = 'audit_ci_login'
            AND source_user_id = 0
            AND source_epoch = (
              SELECT UNIX_TIMESTAMP(time) FROM user_log
              WHERE username = 'audit_ci_login' AND user_id = 0
              ORDER BY time DESC LIMIT 1
            );
        ")

        if [ "$AUTH_EVENT_COUNT" -ne 1 ] || [ "$AUTH_STATE_COUNT" -ne 1 ]; then
          echo "Authentication ingestion did not atomically create one event and one state marker"
          exit 1
        fi

        mysql -u cactiuser -p'cactiuser' -h 127.0.0.1 cacti -e "
          DELETE FROM audit_log
          WHERE event_type = 'cacti.auth.login.failed'
            AND target_id = 'audit_ci_login';
        "
        sudo php poller.php --poller=1 --force --debug

        REPLAYED_EVENT_COUNT=$(mysql -u cactiuser -p'cactiuser' -h 127.0.0.1 cacti -se "
          SELECT COUNT(*)
          FROM audit_log
          WHERE event_type = 'cacti.auth.login.failed'
            AND target_id = 'audit_ci_login';
        ")
        if [ "$REPLAYED_EVENT_COUNT" -ne 0 ]; then
          echo "Authentication source row was replayed after audit-log deletion"
          exit 1
        fi

        mysql -u cactiuser -p'cactiuser' -h 127.0.0.1 cacti -e "
          INSERT INTO user_log (username, user_id, time, result, ip) VALUES
            ('audit_ci_login_02', 0, NOW(), 0, '192.0.2.11'),
            ('audit_ci_login_03', 0, NOW(), 0, '192.0.2.12'),
            ('audit_ci_login_04', 0, NOW(), 0, '192.0.2.13'),
            ('audit_ci_login_05', 0, NOW(), 0, '192.0.2.14'),
            ('audit_ci_login_06', 0, NOW(), 0, '192.0.2.15'),
            ('audit_ci_login_07', 0, NOW(), 0, '192.0.2.16'),
            ('audit_ci_login_08', 0, NOW(), 0, '192.0.2.17'),
            ('audit_ci_login_09', 0, NOW(), 0, '192.0.2.18'),
            ('audit_ci_login_10', 0, NOW(), 0, '192.0.2.19');
        "
        sudo php poller.php --poller=1 --force --debug

        ANOMALY_COUNT=$(mysql -u cactiuser -p'cactiuser' -h 127.0.0.1 cacti -se "
          SELECT COUNT(*)
          FROM audit_log
          WHERE event_type = 'cacti.auth.failed_login_volume_anomaly'
            AND target_type = 'authentication_environment'
            AND target_id = 'global'
            AND JSON_UNQUOTE(JSON_EXTRACT(CONVERT(details USING utf8mb4), '$.scope')) = 'global'
            AND JSON_EXTRACT(CONVERT(details USING utf8mb4), '$.distinct_usernames') >= 10
            AND JSON_EXTRACT(CONVERT(details USING utf8mb4), '$.distinct_ips') >= 10;
        ")
        if [ "$ANOMALY_COUNT" -ne 1 ]; then
          echo "Global failed-login volume anomaly was not recorded with source cardinality"
          exit 1
        fi

    - name: check audit log entries
      run: |
        AUDIT_LOG_COUNT=$(mysql -u cactiuser -p'cactiuser' -h 127.0.0.1 cacti -se "select count(*) from audit_log;")
        echo "Audit log entry count: $AUDIT_LOG_COUNT"
        if [ "$AUDIT_LOG_COUNT" -lt 1 ]; then
          echo "No audit log entries found!"
          exit 1
        fi

        CLI_STATUS=$(mysql -u cactiuser -p'cactiuser' -h 127.0.0.1 cacti -se "select request_status from audit_log where action = 'cli' order by id desc limit 1;")
        if [ "$CLI_STATUS" != "completed" ]; then
          echo "Unexpected CLI request status: $CLI_STATUS"
          exit 1
        fi

    - name: Verify plugin uninstall cleanup
      run: |
        cd ${{ github.workspace }}/cacti
        sudo php cli/plugin_manage.php --plugin=audit --disable --uninstall

        AUDIT_SETTING_COUNT=$(mysql -u cactiuser -p'cactiuser' -h 127.0.0.1 cacti -se "
          SELECT COUNT(*) FROM settings WHERE LEFT(name, 6) = 'audit_';
        ")
        AUDIT_TABLE_COUNT=$(mysql -u cactiuser -p'cactiuser' -h 127.0.0.1 cacti -se "
              SELECT COUNT(*)
              FROM information_schema.tables
              WHERE table_schema = 'cacti'
                AND table_name IN ('audit_log', 'audit_syslog_delivery', 'audit_user_log_state');
        ")
        AUDIT_INDEX_COUNT=$(mysql -u cactiuser -p'cactiuser' -h 127.0.0.1 cacti -se "
          SELECT COUNT(DISTINCT index_name)
          FROM information_schema.statistics
          WHERE table_schema = 'cacti'
            AND table_name = 'user_log'
            AND index_name IN ('plugin_audit_time', 'plugin_audit_result_time');
        ")

        if [ "$AUDIT_SETTING_COUNT" -ne 0 ] || [ "$AUDIT_TABLE_COUNT" -ne 0 ] || [ "$AUDIT_INDEX_COUNT" -ne 0 ]; then
          echo "Audit plugin uninstall left settings, tables, or indexes behind"
          exit 1
        fi

    - name: View Cacti Logs
      if: always()
      run: |
        if [ -f ${{ github.workspace }}/cacti/log/cacti.log ]; then
          echo "=== Cacti Log ==="
          sudo cat ${{ github.workspace }}/cacti/log/cacti.log
        fi

    - name: Check Cacti Logs for Errors
      if: always()
      run: |
        if [ -f ${{ github.workspace }}/cacti/log/cacti.log ]; then
          if grep -E "FATAL:|ERROR:|WARNING:" ${{ github.workspace }}/cacti/log/cacti.log; then
            echo "Found FATAL/ERROR/WARNING entries in Cacti log"
            exit 1
          fi
        fi