test: add comprehensive FlowView test harness by somethingwithproof · Pull Request #251 · Cacti/plugin_flowview

somethingwithproof · 2026-04-09T06:55:05Z

Summary

expand the Pest scaffold into isolated unit, query-contract, database-adapter, repository-contract, and real-database integration suites
load production functions.php and database.php behind stateful Cacti API and PDO test doubles
exercise IPv4, IPv6, CIDR, temporal, partition, session, formatting, schema, and service-port behavior
run fast tests on PHP 7.4, 8.1, and 8.3; run PHP 8.4 syntax validation separately
execute connector contracts against MariaDB 10.6 and MySQL 8.4 with one stable required-check name
document local and connector-backed test workflows

Correctness fixes covered by regressions

generate balanced exact-address predicates and family-safe CIDR ranges
avoid empty numeric IN () clauses and reject invalid addresses
require complete safe table identifiers and escape SQL LIKE metacharacters
correct daily and hourly partition boundaries and hourly suffix parsing
correct whitespace normalization and domain-reduction boolean handling

Validation

42 isolated tests pass on PHP 8.1
42 isolated tests pass on PHP 8.3
3 connector-backed tests pass on MariaDB 10.6
first-party PHP syntax validation passes
ShellCheck passes
actionlint passes
git diff --check passes
GitHub Actions matrix passes

PHP 7.4 is exercised in CI because it is no longer buildable with the current macOS toolchain used for local validation.

Add source-scan tests verifying security patterns (prepared statements, output escaping, auth guards, PHP 7.4 compatibility) remain in place across refactors. Tests run with Pest v1 (PHP 7.3+) and stub the Cacti framework so plugins can be tested in isolation. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Copilot

Pull request overview

Adds a Pest v1-based test harness for the Flowview plugin, focused on static security/regression checks and basic PHP 7.4 compatibility guards.

Changes:

Introduces Pest bootstrap/config and security-focused Pest test suites.
Adds source-scanning tests for prepared-statement usage and setup.php structure.
Adds a minimal composer.json for dev dependencies and a Dependabot configuration file.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
`tests/Pest.php`	Pest entrypoint that loads the test bootstrap.
`tests/bootstrap.php`	Defines Cacti/framework function stubs for isolated testing.
`tests/Security/SetupStructureTest.php`	Static checks that `setup.php` contains required plugin hook functions and version keys.
`tests/Security/PreparedStatementConsistencyTest.php`	Static scan intended to prevent reintroduction of raw `db_*` calls.
`tests/Security/Php74CompatibilityTest.php`	Static scan for a few PHP 8.0-only constructs.
`composer.json`	Adds Pest v1 as a dev dependency and dev autoloading.
`.github/dependabot.yml`	Adds Dependabot configuration (currently npm + GitHub Actions).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…dabot - Throw RuntimeException when realpath/file_get_contents fails (previously silent continue hid unscanned files) - Fix Dependabot ecosystem from npm to composer - Remove committed .omc session artifacts, add .omc/ to .gitignore Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

somethingwithproof · 2026-04-11T00:09:40Z

Converted to draft to serialize the stack in this repo. Blocked by #250; will un-draft after that merges to avoid cross-PR merge conflicts.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

TheWitness

No composer.json or composer.lock in pluins.

TheWitness · 2026-09-15T23:03:55Z

Closing in favor of #260, which keeps this PR's test coverage and functions.php/database.php fixes but reworks the harness and CI workflow to match plugin_evidence's Cacti-checkout-based approach. Thank you for the contribution, @somethingwithproof!

@somethingwithproof

…ased CI (#260) * ci: add dependabot config with npm and github-actions * ci: add CodeQL (JS/TS, excludes PHP) with workflow_dispatch * ci: remove CodeQL JS/TS workflow (no JavaScript in this repo) * test: add Pest v1 security test infrastructure Add source-scan tests verifying security patterns (prepared statements, output escaping, auth guards, PHP 7.4 compatibility) remain in place across refactors. Tests run with Pest v1 (PHP 7.3+) and stub the Cacti framework so plugins can be tested in isolation. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * fix(tests): harden Pest infra - fail-fast on missing files, fix dependabot - Throw RuntimeException when realpath/file_get_contents fails (previously silent continue hid unscanned files) - Fix Dependabot ecosystem from npm to composer - Remove committed .omc session artifacts, add .omc/ to .gitignore Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * style: remove trailing double semicolons Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test: make security checks executable on PHP 7.4 Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * Add comprehensive FlowView test harness Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> * test: rework FlowView test harness to match plugin_evidence's Cacti-based CI - drop the local composer.json/composer.lock dependency and the custom tests.yml workflow in favor of plugin_evidence's plugin-ci-workflow.yml, which checks out a real Cacti install and reuses its vendor Pest/PHPUnit - adopt plugin_evidence's tests/.cacti-version, tests/Pest.php, tests/TestCase.php and tests/bootstrap-unit.php, adapted for FlowView - drop the PDO-backed Contract/Integration suites and php-syntax.sh script; PHP syntax and a live MariaDB poller run are now covered by the CI workflow itself, matching plugin_evidence - broaden the PHP 7.4 compatibility check to scan the plugin tree recursively like plugin_evidence instead of a fixed file list - point phpunit.xml at the new bootstrap and Cacti's own vendor tree - update tests/README.md to describe testing against a working Cacti install instead of a local composer install Attribution: builds on the FlowView test harness proposed in #251 by @somethingwithproof. --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> Co-authored-by: Thomas Vincent <thomasvincent@gmail.com>

somethingwithproof added 4 commits March 15, 2026 16:58

ci: add dependabot config with npm and github-actions

3334853

ci: add CodeQL (JS/TS, excludes PHP) with workflow_dispatch

c33d361

ci: remove CodeQL JS/TS workflow (no JavaScript in this repo)

26a30ff

Copilot AI review requested due to automatic review settings April 9, 2026 06:55

Copilot started reviewing on behalf of somethingwithproof April 9, 2026 06:55

View session

Copilot AI reviewed Apr 9, 2026

View reviewed changes

somethingwithproof added 2 commits April 9, 2026 23:02

style: remove trailing double semicolons

da23982

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

somethingwithproof marked this pull request as draft April 11, 2026 00:09

somethingwithproof added 2 commits August 22, 2026 03:22

test: make security checks executable on PHP 7.4

5329dc0

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Merge branch 'develop' into test/add-security-test-infrastructure

7cb17ba

somethingwithproof marked this pull request as ready for review August 29, 2026 05:54

somethingwithproof requested review from TheWitness and netniV September 6, 2026 12:07

somethingwithproof self-assigned this Sep 6, 2026

somethingwithproof changed the title ~~test: add Pest v1 security test infrastructure~~ test: add comprehensive FlowView test harness Sep 6, 2026

Add comprehensive FlowView test harness

c6f4ee5

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

TheWitness requested changes Sep 8, 2026

View reviewed changes

xmacan previously approved these changes Sep 15, 2026

View reviewed changes

Merge branch 'develop' into test/add-security-test-infrastructure

b8e931d

TheWitness dismissed xmacan’s stale review via b8e931d September 15, 2026 22:47

TheWitness mentioned this pull request Sep 15, 2026

test: rework FlowView test harness to match plugin_evidence's Cacti-based CI #260

Merged

1 of 2 tasks

TheWitness closed this Sep 15, 2026

Navigation Menu

Repository navigation

test: add comprehensive FlowView test harness - #251

test: add comprehensive FlowView test harness#251
somethingwithproof wants to merge 10 commits into
Cacti:developfrom
somethingwithproof:test/add-security-test-infrastructure

somethingwithproof commented Apr 9, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

somethingwithproof commented Apr 11, 2026

Uh oh!

TheWitness left a comment

Uh oh!

TheWitness commented Sep 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

somethingwithproof commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Correctness fixes covered by regressions

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

somethingwithproof commented Apr 11, 2026

Uh oh!

TheWitness left a comment

Choose a reason for hiding this comment

Uh oh!

TheWitness commented Sep 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

somethingwithproof commented Apr 9, 2026 •

edited

Loading