Skip to content

chore: harmonize CI workflow, templates, and test structure - #244

Merged
TheWitness merged 6 commits into
developfrom
chore/ci-and-template-harmonization
Sep 21, 2026
Merged

chore: harmonize CI workflow, templates, and test structure#244
TheWitness merged 6 commits into
developfrom
chore/ci-and-template-harmonization

Conversation

@TheWitness

@TheWitness TheWitness commented Sep 21, 2026

Copy link
Copy Markdown
Member

Description

Part of the fleet-wide plugin_* CI/template/test-structure harmonization
effort (see plugin_analytics#8, plugin_apcupsd#29).

Changes

  • Actions pinning: actions/checkout, shivammathur/setup-php,
    actions/upload-artifact now pinned to current release commit SHAs.
  • MySQL password logging fix: cat ~/.my.cnf printed the root password
    into the Actions log; replaced with chmod 600.
  • MySQL bootstrap hardening: quoted --defaults-file, grants added for
    both 'cactiuser'@'localhost' and 'cactiuser'@'127.0.0.1'.
  • Pest/Composer ownership: added a "Restore vendor ownership for Pest"
    step after Composer install, matching the pattern in plugin_apcupsd.
  • PHP syntax check: switched to the vendor-excluding, null-delimited
    find/xargs pattern from plugin_audit.
  • Removed the "Configure Apache" step: apache2/libapache2-mod-php were
    never installed in this workflow, so the step was dead weight.
  • Pest invocation simplified: relies on phpunit.xml's own
    <testsuites> block instead of duplicating the test directory list.
  • PHP compatibility test consolidated: old PHP-7.4-floor compatibility
    test replaced with tests/Security/PhpCompatibilityTest.php, checking for
    PHP 8.3/8.4-only syntax (this plugin's floor is PHP 8.2 per the CI matrix).
  • Removed dead tests/TestCase.php: not referenced by any
    uses(TestCase::class) call in this plugin's actual tests.
  • Issue/PR templates added, styled after Cacti/cacti's own templates.
  • copilot-instructions.md: documented the CI/dependency baselines.

Related Issue

N/A — internal fleet harmonization, not tracked against a specific issue.

How Has This Been Tested?

  • Workflow YAML was parsed and validated locally before pushing.
  • Full CI will run automatically on this PR.

Types of changes

  • Non-breaking maintenance/CI change

Checklist

  • My change follows the fleet-wide harmonization conventions being rolled
    out across plugin_* repos.

@TheWitness
chore: harmonize CI workflow, templates, and test structure
411149b 
Part of the fleet-wide plugin_* harmonization effort.

- Pin actions/checkout, shivammathur/setup-php, actions/upload-artifact to
  current release commit SHAs (was floating @v4/@v2).
- Stop logging the MySQL root password in CI output (cat ~/.my.cnf ->
  chmod 600).
- Harden MySQL bootstrap: quoted --defaults-file, grants added for both
  'cactiuser'@'localhost' and 'cactiuser'@'127.0.0.1'.
- Add "Restore vendor ownership for Pest" step after Composer install.
- Switch the PHP syntax-check step to the vendor-excluding, null-delimited
  find/xargs pattern used in plugin_audit.
- Remove the unused "Configure Apache" step (apache2/libapache2-mod-php are
  not installed and not needed).
- Simplify the Pest invocation to rely solely on phpunit.xml's <testsuites>.
- No CodeQL workflow added: this repo has no JavaScript/Python/Ruby content
  (PHP only), so there is nothing for CodeQL to scan.
- Consolidate tests/Security/Php74CompatibilityTest.php into
  tests/Security/PhpCompatibilityTest.php, now checking for PHP 8.3/8.4-only
  syntax (this plugin's floor is PHP 8.2 per the CI matrix).
- Remove tests/TestCase.php and its require in tests/bootstrap-unit.php: not
  referenced by any uses(TestCase::class) call in this plugin's tests.
- Add .github/ISSUE_TEMPLATE/{bug_report,feature_request}.md and
  .github/PULL_REQUEST_TEMPLATE.md, styled after Cacti/cacti's own templates.
- Document CI/dependency baselines in copilot-instructions.md.
@TheWitness
TheWitness requested review from bmfmancini and xmacan and a lite review from Copilot September 21, 2026 15:05
Copilot AI reviewed Sep 21, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

The CI workflow still logs the MySQL root password because it appears in the command line that writes ~/.my.cnf, undermining the stated credential-leak fix.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1 High severity

Open (1)
What changed in this PR

This PR aligns the Monitor plugin repository with the fleet-wide plugin_* CI/template/test-structure standards by tightening GitHub Actions workflows, consolidating/cleaning up tests, and adding standardized GitHub templates and Copilot guidance.

Changes:

  • Pins GitHub Actions to specific commit SHAs, removes dead workflow steps, and adjusts MySQL/bootstrap + Pest execution patterns.
  • Simplifies the PHPUnit/Pest test suite structure by removing unused e2e scaffolding and consolidating source-pattern checks.
  • Adds Issue/PR templates and documents CI/dependency baselines in Copilot instructions.
File Description
tests/​TestCase.php Removes an unused PHPUnit base class fixture.
tests/​Integration/​OutputEscapingTest.php Consolidates “raw request reuse” detection into the integration source-pattern ruleset.
tests/​e2e/​MonitorNoRawRequestReuseTest.php Removes an e2e test file and its dataset (now covered elsewhere).
tests/​bootstrap-unit.php Drops the unused TestCase.php include from the unit bootstrap.
phpunit.xml Removes the tests/e2e suite directory and relies on the remaining test structure.
.github/​workflows/​plugin-ci-workflow.yml Harmonizes CI steps (pinned actions, MySQL bootstrap changes, Pest run simplification, syntax-check update).
.github/​workflows/​codeql.yml Updates pinned action SHAs for CodeQL workflow steps.
.github/​PULL_REQUEST_TEMPLATE.md Adds a PR template aligned with org/repo standards.
.github/​ISSUE_TEMPLATE/​feature_request.md Adds labels/formatting updates for feature request issues.
.github/​ISSUE_TEMPLATE/​bug_report.md Adds labels/formatting updates for bug report issues.
.github/​copilot-instructions.md Documents CI/dependency baselines for contributors and automation.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread .github/workflows/plugin-ci-workflow.yml
@TheWitness
chore: add i18n build/verify workflow and bump MariaDB floor to 11.8
f751a36 
- Document the locales/build_gettext.sh + cacti.pot workflow in
  copilot-instructions.md (Weblate owns per-language .po/.mo sync).
- Add a CI step that regenerates cacti.pot and fails if it is stale,
  ignoring the POT-Creation-Date timestamp.
- Mark locales/build_gettext.sh executable.
- Bump the CI MariaDB service image floor to 11.8 (from mariadb:10.6 /
  mysql:8.0).
@TheWitness
fix: mariadb:11.8 healthcheck and i18n step permissions
d23f40a 
- mariadb:11.8 no longer ships mysqladmin; use mariadb-admin for the
  service container healthcheck.
- Run chmod/build_gettext.sh with sudo in the i18n verification step,
  since locales/ is owned by www-data by the time it runs.
@TheWitness
chore: regenerate locales/po/cacti.pot with current source strings
24839d8 
Ran the real locales/build_gettext.sh (xgettext/msgmerge/msgfmt) to
refresh the translation template against current source. Per the i18n
workflow documented in copilot-instructions.md, only the regenerated
cacti.pot is committed here; Weblate owns syncing the per-language
.po/.mo files from it.
@TheWitness
fix: make locales/build_gettext.sh string extraction order deterministic
9ee72c4 
`find` without `sort` returns filesystem/readdir-order results, which
can differ between machines (e.g. a local regen vs. a GitHub Actions
runner), producing a spurious reordering diff in cacti.pot even when
no strings actually changed. Pipe through `sort` and regenerate
cacti.pot with the now-deterministic order.
@TheWitness
fix: Address Copilot review findings on the harmonization PR
183d320 
- tests/Security/PhpCompatibilityTest.php: fixed the #[Override]/#[Deprecated]
  attribute regexes to also match the fully qualified (`#[\Override]`,
  `#[\Deprecated]`) form, added a realpath() false-guard for the plugin root,
  included the relative file path in both RuntimeException messages, added
  typed-class-constant and dynamic-class-constant-fetch checks (PHP 8.3), and
  restored each()/create_function() removed-in-PHP-8.0 guards that the
  consolidation had dropped. Also excludes include/vendor/ (not just vendor/)
  from the recursive source scan.
- .github/workflows/plugin-ci-workflow.yml: the "Create MySQL Config" step's
  root password is now masked via `::add-mask::` before it's echoed into
  ~/.my.cnf, so it no longer appears in plaintext in the Actions log (chmod
  600 alone only protected the file after creation, not the command's own
  echoed source in the log).
@TheWitness

TheWitness commented Sep 21, 2026

Copy link
Copy Markdown
Member Author

This PR's tests/Security/PhpCompatibilityTest.php #[Override]/#[Deprecated] regexes now also match the fully qualified form (#[\Override], #[\Deprecated]), a realpath() false-guard was added for the plugin root, both exception messages now include the relative file path, typed-class-constant and dynamic-class-constant-fetch checks (PHP 8.3) were added, and each()/create_function() (removed in PHP 8.0) guards were restored. The CI workflow's MySQL root password is now masked via ::add-mask:: before being written to ~/.my.cnf, so it no longer appears in plaintext in the Actions log. Resolving the corresponding review threads.

@TheWitness
TheWitness merged commit 4b999d6 into develop Sep 21, 2026
7 of 8 checks passed
@TheWitness
TheWitness deleted the chore/ci-and-template-harmonization branch September 21, 2026 19:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@xmacan xmacan xmacan approved these changes
@bmfmancini bmfmancini Awaiting requested review from bmfmancini

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@TheWitness @xmacan