diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 25d25784..ae499b7c 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -47,6 +47,8 @@ jobs: steps: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Initialize CodeQL uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3 with: diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml index 771a9567..724f6299 100644 --- a/.github/workflows/plugin-ci-workflow.yml +++ b/.github/workflows/plugin-ci-workflow.yml @@ -31,12 +31,19 @@ on: - main - develop +permissions: + contents: read + env: CACTI: 1.2.x - COMPOSER_ALLOW_SUPERUSER: 1 + +concurrency: + group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: integration-test: + timeout-minutes: 45 runs-on: ${{ matrix.os }} strategy: @@ -47,7 +54,7 @@ jobs: services: mariadb: - image: mariadb:11.8 + image: mariadb:11.8@sha256:6422478cb8e159f080fb1d8ccf65101e26fe51385787fde7d16c3b165a331f15 env: MYSQL_ROOT_PASSWORD: cactiroot MYSQL_DATABASE: cacti @@ -67,6 +74,7 @@ jobs: - name: Checkout Cacti uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false repository: Cacti/cacti ref: ${{ env.CACTI }} path: cacti @@ -74,6 +82,7 @@ jobs: - name: Checkout MacTrack Plugin uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false path: cacti/plugins/mactrack # patch-coverage.php diffs against the base branch below. fetch-depth: 0 @@ -82,6 +91,7 @@ jobs: uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ matrix.php }} + tools: composer:2.10.3 extensions: intl, mysql, gd, ldap, gmp, xml, curl, json, mbstring, snmp ini-values: "post_max_size=256M, max_execution_time=60, date.timezone=America/New_York" coverage: xdebug @@ -131,27 +141,24 @@ jobs: mysql "$MYSQL_AUTH_USR" cacti < ${{ github.workspace }}/cacti/cacti.sql mysql "$MYSQL_AUTH_USR" -e "INSERT INTO settings (name, value) VALUES ('path_php_binary', '/usr/bin/php')" cacti - - name: Validate composer files - run: | - cd ${{ github.workspace }}/cacti - if [ -f composer.json ]; then - sudo composer validate --strict || true - fi - - - name: Install Composer Dependencies - run: | - cd ${{ github.workspace }}/cacti - if [ -f composer.json ]; then - sudo composer config --no-plugins allow-plugins.pestphp/pest-plugin true - sudo composer require --no-progress --no-interaction "pestphp/pest: ^3" "pestphp/pest-plugin-drift: ^3.0" - sudo rm -f composer.lock - sudo composer install --dev --no-progress - fi - - - name: Restore vendor ownership for Pest - run: | - cd ${{ github.workspace }}/cacti - sudo chown -R runner:runner include/vendor composer.lock + # Core's release archives exclude .github and tests. Fetch these paths + # through Git at the immutable helper revision instead of an Action archive. + - name: Checkout shared CI tooling + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: Cacti/cacti + ref: f3ff777992875740e4665fedfe2eff8335f5b894 + persist-credentials: false + path: ci-tools + sparse-checkout: | + .github/actions/setup-plugin-dependencies + tests/tools/plugin-harness + + - name: Install locked Cacti and plugin test dependencies + uses: ./ci-tools/.github/actions/setup-plugin-dependencies + with: + cacti-directory: cacti + install-core-dev: 'false' - name: Create Cacti config.php run: | @@ -192,7 +199,7 @@ jobs: - name: Run Pest Unit Tests run: | cd ${{ github.workspace }}/cacti - include/vendor/bin/pest --configuration=plugins/mactrack/phpunit.xml \ + "$CACTI_PEST_BIN" --configuration=plugins/mactrack/phpunit.xml \ --coverage-clover=plugins/mactrack/coverage/clover.xml # Whole-file coverage is meaningless here: most of the plugin only runs @@ -226,12 +233,12 @@ jobs: - name: Run Linter on base code if: ${{ env.CACTI != '1.2.x' }} - run: sudo composer run-script lint ${{ github.workspace }}/cacti/plugins/mactrack + run: composer run-script lint ${{ github.workspace }}/cacti/plugins/mactrack working-directory: ${{ github.workspace }}/cacti - name: Checking coding standards on base code if: ${{ env.CACTI != '1.2.x' }} - run: sudo composer run-script phpcsfixer ${{ github.workspace }}/cacti/plugins/mactrack + run: composer run-script phpcsfixer ${{ github.workspace }}/cacti/plugins/mactrack working-directory: ${{ github.workspace }}/cacti - name: Run PHPStan at Level 6 on base code outside of Composer due to technical issues diff --git a/CHANGELOG.md b/CHANGELOG.md index 40802ea0..f5facd7e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,4 @@ -## ChangeLog +## ChangeLog --- develop --- @@ -13,6 +13,7 @@ * feature: Add a root manifest.json and upgrade-time file pruning (mactrack_prune_files()) that removes tombstoned and dev-only paths, refuses any path resolving outside the plugin directory, warns on paths it cannot remove, and logs top-level entries the manifest does not account for * dev: Relocate the per-theme override stylesheets from themes// to css// alongside the base css/mactrack.css * dev: Enforce patch coverage of changed lines in CI and remove the inert COMPOSER_ROOT_VERSION env from the Pest step +* dev: Pin the CI database image and shared test dependencies, disable persisted checkout credentials, and limit workflow permissions and runtime * chore: Reach PHPStan level 8 with zero errors across all first-party PHP and add native function return type declarations, using no baselines or inline suppressions * issue: Use db_execute_prepared() for parameterized UPDATE/REPLACE statements in the 3Com scanner and partition converter, which previously passed a bind-parameter array to db_execute() * issue: Fix a variable-variable typo ($$local_graph_id) that broke 3Com interface-graph mac updates