From d2df160180f2ccfe56d10290bb91b2561f5fcca8 Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Mon, 12 Oct 2026 21:51:02 -0700 Subject: [PATCH 1/3] ci: pin fixtures and install locked shared test dependencies Signed-off-by: Thomas Vincent --- .github/workflows/plugin-ci-workflow.yml | 58 ++++++++++++++---------- CHANGELOG.md | 3 +- 2 files changed, 35 insertions(+), 26 deletions(-) diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml index a86b4ad..f4fd22d 100644 --- a/.github/workflows/plugin-ci-workflow.yml +++ b/.github/workflows/plugin-ci-workflow.yml @@ -31,11 +31,20 @@ on: - main - develop +permissions: + contents: read + env: CACTI: 1.2.x + CACTI_REF: d6d230f712c0af1a0391646f65364950ebf131af # 1.2.x fixture + +concurrency: + group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: integration-test: + timeout-minutes: 45 runs-on: ${{ matrix.os }} strategy: @@ -46,7 +55,7 @@ jobs: services: mariadb: - image: mariadb:11.8 + image: mariadb:11.8@sha256:6422478cb8e159f080fb1d8ccf65101e26fe51385787fde7d16c3b165a331f15 env: MYSQL_ROOT_PASSWORD: cactiroot MYSQL_DATABASE: cacti @@ -66,13 +75,15 @@ jobs: - name: Checkout Cacti uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false repository: Cacti/cacti - ref: ${{ env.CACTI }} + ref: ${{ env.CACTI_REF }} path: cacti - name: Checkout servcheck Plugin uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false path: cacti/plugins/servcheck # patch-coverage.php diffs against the base branch below. fetch-depth: 0 @@ -81,6 +92,7 @@ jobs: uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ matrix.php }} + tools: composer:2.10.3 extensions: intl, mysql, gd, ldap, gmp, xml, curl, json, mbstring, snmp ini-values: "post_max_size=256M, max_execution_time=60, date.timezone=America/New_York" coverage: xdebug @@ -130,29 +142,25 @@ jobs: mysql "$MYSQL_AUTH_USR" cacti < ${{ github.workspace }}/cacti/cacti.sql mysql "$MYSQL_AUTH_USR" -e "INSERT INTO settings (name, value) VALUES ('path_php_binary', '/usr/bin/php')" cacti - - name: Validate composer files - run: | - cd ${{ github.workspace }}/cacti - if [ -f composer.json ]; then - composer validate --strict || true - fi - - - name: Install Composer Dependencies - run: | - cd ${{ github.workspace }}/cacti - if [ -f composer.json ]; then - sudo composer config --no-plugins allow-plugins.pestphp/pest-plugin true - sudo composer require --dev --no-progress --no-interaction "pestphp/pest: ^3" "pestphp/pest-plugin-drift: ^3.0" - sudo rm -f composer.lock - sudo composer install --dev --no-progress - fi + # Core's release archives exclude .github and tests. Fetch these paths + # through Git at the immutable helper revision instead of an Action archive. + - name: Checkout shared CI tooling + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: Cacti/cacti + ref: f3ff777992875740e4665fedfe2eff8335f5b894 + persist-credentials: false + path: ci-tools + sparse-checkout: | + .github/actions/setup-plugin-dependencies + tests/tools/plugin-harness + + - name: Install locked Cacti and plugin test dependencies + uses: ./ci-tools/.github/actions/setup-plugin-dependencies + with: + cacti-directory: cacti + install-core-dev: 'false' - - name: Restore vendor ownership for Pest - run: | - if [ -d ${{ github.workspace }}/cacti/include/vendor ]; then - sudo chown -R runner:runner ${{ github.workspace }}/cacti/include/vendor ${{ github.workspace }}/cacti/composer.lock - fi - - name: Create Cacti config.php run: | cat ${{ github.workspace }}/cacti/include/config.php.dist | \ @@ -193,7 +201,7 @@ jobs: run: | cd ${{ github.workspace }}/cacti if [ -f plugins/servcheck/phpunit.xml ] && [ -d plugins/servcheck/tests/Security ]; then - include/vendor/bin/pest --configuration=plugins/servcheck/phpunit.xml \ + "$CACTI_PEST_BIN" --configuration=plugins/servcheck/phpunit.xml \ --coverage-clover=plugins/servcheck/coverage/clover.xml else echo "Skipping Pest tests: plugins/servcheck/phpunit.xml or tests/Security not present yet." diff --git a/CHANGELOG.md b/CHANGELOG.md index 2f0bfb6..e90e4c8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,7 @@ -# ChangeLog +# ChangeLog --- develop --- +* security: Pin CI fixtures and shared test dependencies, disable persisted checkout credentials, and limit workflow permissions and runtime * feature: Add a Status column to the Tests list (right after Name) that shows each service check's current state as a colour-coded pill, reusing the status legend's solid colours so the badge stays legible on top of the row tint on every theme * security: Replace the confirmation pages' inline `onClick='cactiReturnTo()'` Cancel buttons with the CSP-safe `cactiReturnTo` class and move the filter rows selects' inline `onChange` handlers into the ready block (bound via change, not click) so the pages no longer trip Cacti's Content-Security-Policy script-src-attr directive From 1cc277339987fd2973fcdac12080eb55d8184b8a Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Sat, 17 Oct 2026 22:26:07 -0700 Subject: [PATCH 2/3] docs(changelog): list CI hardening as a dev entry Signed-off-by: Thomas Vincent --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e90e4c8..9587136 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,7 +1,6 @@ # ChangeLog --- develop --- -* security: Pin CI fixtures and shared test dependencies, disable persisted checkout credentials, and limit workflow permissions and runtime * feature: Add a Status column to the Tests list (right after Name) that shows each service check's current state as a colour-coded pill, reusing the status legend's solid colours so the badge stays legible on top of the row tint on every theme * security: Replace the confirmation pages' inline `onClick='cactiReturnTo()'` Cancel buttons with the CSP-safe `cactiReturnTo` class and move the filter rows selects' inline `onChange` handlers into the ready block (bound via change, not click) so the pages no longer trip Cacti's Content-Security-Policy script-src-attr directive @@ -16,6 +15,7 @@ * security: Require a CSRF token on the enable, disable and purge GET actions * dev: Bring the plugin to PHPStan level 8 with native return/parameter type declarations and fix the bugs it uncovered (duplicate credential-load block and undefined variables in the MQTT test, a credential lookup checking the wrong variable in the cURL/SSH/REST tests, an SSH private-key cleanup that never ran, a wrong variable in the poller warning, missing globals, dead bulk-action confirmation variables on the credential page, a mistyped credential key and duplicate form-field keys, and several unguarded database-row and certificate accesses) * dev: Ensure lib/poller.php is loaded wherever its functions (exec_background, replicate_out_table, unregister_process) are used rather than relying on it being included elsewhere +* dev: Pin CI fixtures and shared test dependencies, disable persisted checkout credentials, and limit workflow permissions and runtime --- 0.4 --- From 307338b6c1021b929f78c32e7dd7f8f0f70b0cf9 Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Sun, 18 Oct 2026 07:53:25 -0700 Subject: [PATCH 3/3] ci: check out the Cacti branch head instead of a pinned commit Signed-off-by: Thomas Vincent --- .github/workflows/plugin-ci-workflow.yml | 3 +-- CHANGELOG.md | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml index f4fd22d..f88c6ff 100644 --- a/.github/workflows/plugin-ci-workflow.yml +++ b/.github/workflows/plugin-ci-workflow.yml @@ -36,7 +36,6 @@ permissions: env: CACTI: 1.2.x - CACTI_REF: d6d230f712c0af1a0391646f65364950ebf131af # 1.2.x fixture concurrency: group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }} @@ -77,7 +76,7 @@ jobs: with: persist-credentials: false repository: Cacti/cacti - ref: ${{ env.CACTI_REF }} + ref: ${{ env.CACTI }} path: cacti - name: Checkout servcheck Plugin diff --git a/CHANGELOG.md b/CHANGELOG.md index 9587136..c4fef72 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -15,7 +15,7 @@ * security: Require a CSRF token on the enable, disable and purge GET actions * dev: Bring the plugin to PHPStan level 8 with native return/parameter type declarations and fix the bugs it uncovered (duplicate credential-load block and undefined variables in the MQTT test, a credential lookup checking the wrong variable in the cURL/SSH/REST tests, an SSH private-key cleanup that never ran, a wrong variable in the poller warning, missing globals, dead bulk-action confirmation variables on the credential page, a mistyped credential key and duplicate form-field keys, and several unguarded database-row and certificate accesses) * dev: Ensure lib/poller.php is loaded wherever its functions (exec_background, replicate_out_table, unregister_process) are used rather than relying on it being included elsewhere -* dev: Pin CI fixtures and shared test dependencies, disable persisted checkout credentials, and limit workflow permissions and runtime +* dev: Pin the CI database image and shared test dependencies, disable persisted checkout credentials, and limit workflow permissions and runtime --- 0.4 ---