Compare commits
1 Commits
claude/dep
...
claude/e2e
| Author | SHA1 | Date | |
|---|---|---|---|
|
bf36db5b01 |
27
.github/workflows/ci-self-test.yml
vendored
27
.github/workflows/ci-self-test.yml
vendored
@@ -1,27 +0,0 @@
|
||||
# Self-test: exercises the reusable ci.yml on this repo itself.
|
||||
# Uses tests: none (peptide-e2e is a Playwright/Node repo, no PHP suite).
|
||||
# permissions: contents: write is required at the caller level — any caller of
|
||||
# ci.yml must declare this so the phpcs job can commit phpcbf fixes back to the
|
||||
# PR branch. Even with phpcs_autofix: false here, the permission must be declared
|
||||
# for the reusable workflow to pass GH's startup permission-escalation check.
|
||||
|
||||
name: CI Self-Test (reusable ci.yml)
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main, 'claude/**']
|
||||
pull_request:
|
||||
branches: [main]
|
||||
|
||||
permissions:
|
||||
contents: write # required: called ci.yml phpcs job declares job-level write for phpcbf
|
||||
|
||||
jobs:
|
||||
ci:
|
||||
uses: ./.github/workflows/ci.yml
|
||||
with:
|
||||
tests: none
|
||||
enforce_300: false
|
||||
has_js: false
|
||||
phpcs_autofix: false
|
||||
secrets: inherit
|
||||
388
.github/workflows/ci.yml
vendored
388
.github/workflows/ci.yml
vendored
@@ -1,388 +0,0 @@
|
||||
##
|
||||
# Reusable CI workflow — peptiderepo estate
|
||||
#
|
||||
# Usage (in any repo's .github/workflows/ci.yml):
|
||||
#
|
||||
# jobs:
|
||||
# ci:
|
||||
# uses: peptiderepo/peptide-e2e/.github/workflows/ci.yml@main
|
||||
# with:
|
||||
# tests: stubs # or wp-framework | brain-monkey | none
|
||||
# has_js: false
|
||||
# secrets: inherit
|
||||
#
|
||||
# Inputs:
|
||||
# php_versions (string) JSON array of PHP versions to matrix over.
|
||||
# Default: '["8.1","8.2","8.3"]'
|
||||
# tests (string) PHPUnit environment. One of:
|
||||
# stubs — WP stubs only; no DB/service; fast.
|
||||
# brain-monkey — Brain Monkey mocking; no DB/service.
|
||||
# wp-framework — Full WordPress test framework with MySQL.
|
||||
# none — Skip phpunit entirely (temporary; remove
|
||||
# at rollout when the repo gains a suite).
|
||||
# Default: stubs
|
||||
# enforce_300 (boolean) Fail if any tracked *.php under line_limit_paths exceeds
|
||||
# 300 lines (the estate hard rule). Default: true
|
||||
# line_limit_paths (string) Space-separated directory/path(s) the 300-line rule
|
||||
# applies to. Default: 'includes'
|
||||
# has_js (boolean) Whether to run JS linting. Default: false
|
||||
# phpcs_autofix (boolean) On pull_request events: run phpcbf and commit any fixes
|
||||
# back to the branch before strict phpcs. On push events:
|
||||
# skip the commit (no loop) but still run strict phpcs.
|
||||
# Default: true
|
||||
#
|
||||
# Job names (fixed — callers and deploy-app.yml gate on these):
|
||||
# lint-php PHP syntax check across php_versions matrix.
|
||||
# phpcs WordPress Coding Standards; phpcbf auto-commit on PRs.
|
||||
# file-size 300-line rule enforcement (skipped when enforce_300: false).
|
||||
# phpunit PHPUnit across php_versions matrix (skipped when tests: none).
|
||||
# lint-js JS linting (skipped when has_js: false).
|
||||
#
|
||||
# Design notes:
|
||||
# - phpcbf auto-commit pattern is the prautoblogger gold standard (see
|
||||
# prautoblogger/.github/workflows/ci.yml). The GITHUB_TOKEN commit does
|
||||
# NOT trigger a new CI run per GitHub's loop-prevention rules.
|
||||
# - WP test framework path replicates peptide-starter-theme's three gotchas:
|
||||
# (1) install svn — ubuntu-latest no longer ships it;
|
||||
# (2) MySQL service pre-creates the DB via MYSQL_DATABASE, so pass
|
||||
# skip-db-create=true as the 6th arg to install-wp-tests.sh;
|
||||
# (3) WP_CORE_DIR must have a trailing slash (bootstrapped into ABSPATH
|
||||
# and concatenated verbatim — missing slash produces wrong path).
|
||||
# - Every repo calls `composer test` regardless of the `tests` input; the
|
||||
# input only controls environment provisioning, not the command.
|
||||
# - permissions: the phpcs job declares `contents: write` at job level for
|
||||
# phpcbf commit-back. GitHub requires the CALLING WORKFLOW to also declare
|
||||
# `permissions: contents: write` at the caller's workflow level — GH enforces
|
||||
# that callers cannot be escalated beyond their declared scope, even by job-level
|
||||
# overrides in the reusable workflow. All caller repos must include this.
|
||||
##
|
||||
|
||||
name: CI — Reusable
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
php_versions:
|
||||
description: >-
|
||||
JSON array of PHP versions to matrix over.
|
||||
Example: '["8.1","8.2","8.3"]'
|
||||
required: false
|
||||
default: '["8.1","8.2","8.3"]'
|
||||
type: string
|
||||
tests:
|
||||
description: >-
|
||||
PHPUnit environment. One of: stubs | wp-framework | brain-monkey | none.
|
||||
All environments run `composer test`; this input controls setup only.
|
||||
required: false
|
||||
default: stubs
|
||||
type: string
|
||||
enforce_300:
|
||||
description: >-
|
||||
Fail if any tracked *.php under line_limit_paths exceeds 300 lines.
|
||||
required: false
|
||||
default: true
|
||||
type: boolean
|
||||
line_limit_paths:
|
||||
description: >-
|
||||
Space-separated directory/path(s) to which the 300-line rule applies.
|
||||
required: false
|
||||
default: includes
|
||||
type: string
|
||||
has_js:
|
||||
description: >-
|
||||
Whether to run JS linting (node --check / npm run lint).
|
||||
required: false
|
||||
default: false
|
||||
type: boolean
|
||||
phpcs_autofix:
|
||||
description: >-
|
||||
On pull_request: run phpcbf and commit fixes back to the branch before
|
||||
strict phpcs. On push: skip the commit but still run strict phpcs.
|
||||
required: false
|
||||
default: true
|
||||
type: boolean
|
||||
|
||||
jobs:
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# lint-php: PHP syntax check — matrix over php_versions
|
||||
# ---------------------------------------------------------------------------
|
||||
lint-php:
|
||||
name: PHP Lint (${{ matrix.php }})
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
php: ${{ fromJson(inputs.php_versions) }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Setup PHP ${{ matrix.php }}
|
||||
uses: shivammathur/setup-php@v2
|
||||
with:
|
||||
php-version: ${{ matrix.php }}
|
||||
coverage: none
|
||||
|
||||
- name: Syntax check all PHP files
|
||||
# Exclude vendor/, node_modules/, .git/, .github/ (mu-plugins may use
|
||||
# version-specific syntax). -P4 parallelises across 4 cores.
|
||||
run: |
|
||||
set -e
|
||||
find . -name '*.php' \
|
||||
-not -path './vendor/*' \
|
||||
-not -path './node_modules/*' \
|
||||
-not -path './.git/*' \
|
||||
-not -path './.github/*' \
|
||||
-print0 | xargs -0 -n1 -P4 php -l > /dev/null
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# phpcs: WordPress Coding Standards + phpcbf auto-fix on PRs
|
||||
# ---------------------------------------------------------------------------
|
||||
phpcs:
|
||||
name: PHPCS (WordPress standards)
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: write # allows phpcbf auto-fix commits back to the PR branch
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
# Check out the actual PR branch head so phpcbf can push fixes back.
|
||||
# On push events github.head_ref is empty; fall back to github.ref_name.
|
||||
ref: ${{ github.head_ref || github.ref_name }}
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Setup PHP
|
||||
uses: shivammathur/setup-php@v2
|
||||
with:
|
||||
php-version: '8.1'
|
||||
coverage: none
|
||||
tools: composer:v2, phpcs
|
||||
|
||||
- name: Install WordPress Coding Standards
|
||||
run: |
|
||||
composer global config --no-plugins \
|
||||
allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
|
||||
composer global require --no-interaction \
|
||||
"dealerdirect/phpcodesniffer-composer-installer:^1.0" \
|
||||
"wp-coding-standards/wpcs:^3.0" \
|
||||
"phpcsstandards/phpcsutils:^1.0" \
|
||||
"phpcsstandards/phpcsextra:^1.0"
|
||||
|
||||
- name: Auto-fix with phpcbf (PR only — commit back to branch if changed)
|
||||
# Only runs on pull_request events AND when phpcs_autofix is enabled.
|
||||
# phpcbf exits 1 when it makes fixes and 0 when nothing to fix; both are
|
||||
# treated as success here (|| true). Commits via GITHUB_TOKEN do NOT
|
||||
# trigger a new CI run — GitHub prevents loops on bot commits.
|
||||
if: ${{ github.event_name == 'pull_request' && inputs.phpcs_autofix }}
|
||||
run: |
|
||||
# Detect which phpcs config file is present; pass it explicitly to
|
||||
# --standard so phpcbf and phpcs always agree with the guard check.
|
||||
PHPCS_CONFIG=""
|
||||
if [ -f phpcs.xml ]; then PHPCS_CONFIG="phpcs.xml"
|
||||
elif [ -f phpcs.xml.dist ]; then PHPCS_CONFIG="phpcs.xml.dist"
|
||||
elif [ -f .phpcs.xml.dist ]; then PHPCS_CONFIG=".phpcs.xml.dist"
|
||||
fi
|
||||
if [ -z "$PHPCS_CONFIG" ]; then
|
||||
echo "No phpcs.xml / phpcs.xml.dist / .phpcs.xml.dist — phpcbf skipped."
|
||||
exit 0
|
||||
fi
|
||||
phpcbf --standard="$PHPCS_CONFIG" \
|
||||
--extensions=php \
|
||||
--ignore=vendor/*,tests/*,node_modules/* \
|
||||
. || true
|
||||
if ! git diff --quiet; then
|
||||
git config user.name "peptiderepo"
|
||||
git config user.email "peptiderepo@users.noreply.github.com"
|
||||
git add -A
|
||||
git commit -m "style: auto-fix PHPCS violations via phpcbf"
|
||||
git push
|
||||
fi
|
||||
|
||||
- name: Run PHPCS strict (fail on remaining violations)
|
||||
# Runs on all events (push AND pull_request). After phpcbf has committed
|
||||
# any auto-fixable issues on PRs, only non-auto-fixable violations land
|
||||
# here. On push events phpcbf is skipped but phpcs is still strict.
|
||||
# Guard: skip gracefully if no phpcs config file exists (repo not yet configured).
|
||||
run: |
|
||||
# Detect which phpcs config file is present (mirrors the phpcbf step above).
|
||||
PHPCS_CONFIG=""
|
||||
if [ -f phpcs.xml ]; then PHPCS_CONFIG="phpcs.xml"
|
||||
elif [ -f phpcs.xml.dist ]; then PHPCS_CONFIG="phpcs.xml.dist"
|
||||
elif [ -f .phpcs.xml.dist ]; then PHPCS_CONFIG=".phpcs.xml.dist"
|
||||
fi
|
||||
if [ -z "$PHPCS_CONFIG" ]; then
|
||||
echo "No phpcs.xml / phpcs.xml.dist / .phpcs.xml.dist found — PHPCS skipped."
|
||||
echo "Add a phpcs.xml to enable coding standards enforcement."
|
||||
exit 0
|
||||
fi
|
||||
phpcs --standard="$PHPCS_CONFIG" \
|
||||
--extensions=php \
|
||||
--ignore=vendor/*,tests/*,node_modules/* \
|
||||
--warning-severity=0 \
|
||||
--report=full \
|
||||
.
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# file-size: 300-line rule enforcement
|
||||
# ---------------------------------------------------------------------------
|
||||
file-size:
|
||||
name: 300-line rule (${{ inputs.line_limit_paths }})
|
||||
runs-on: ubuntu-latest
|
||||
if: ${{ inputs.enforce_300 }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Check for PHP files over 300 lines
|
||||
# Scans only tracked *.php files under line_limit_paths (not vendor etc.).
|
||||
# Prints every offender with its line count, then fails the job so the
|
||||
# engineer has a clear list to split.
|
||||
env:
|
||||
# Use env: block to avoid shell-injection from caller-controlled input.
|
||||
PATHS: ${{ inputs.line_limit_paths }}
|
||||
run: |
|
||||
set -e
|
||||
OFFENDERS=""
|
||||
for DIR in $PATHS; do
|
||||
if [ ! -e "$DIR" ]; then
|
||||
echo "Warning: path '$DIR' does not exist in this repo — skipping."
|
||||
continue
|
||||
fi
|
||||
while IFS= read -r FILE; do
|
||||
if [ -z "$FILE" ]; then continue; fi
|
||||
LINES=$(wc -l < "$FILE")
|
||||
if [ "$LINES" -gt 300 ]; then
|
||||
OFFENDERS="${OFFENDERS}${LINES} lines: ${FILE}\n"
|
||||
fi
|
||||
done < <(git ls-files -- "$DIR" | grep '\.php$')
|
||||
done
|
||||
if [ -n "$OFFENDERS" ]; then
|
||||
echo "::error::Files exceeding 300-line limit (estate hard rule):"
|
||||
printf "%b" "$OFFENDERS"
|
||||
exit 1
|
||||
fi
|
||||
echo "All tracked PHP files under '$PATHS' are within the 300-line limit."
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# phpunit: PHPUnit — matrix over php_versions
|
||||
# Skipped entirely when tests == 'none'.
|
||||
# ---------------------------------------------------------------------------
|
||||
phpunit:
|
||||
name: PHPUnit — ${{ inputs.tests }} (PHP ${{ matrix.php }})
|
||||
runs-on: ubuntu-latest
|
||||
if: ${{ inputs.tests != 'none' }}
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
php: ${{ fromJson(inputs.php_versions) }}
|
||||
|
||||
# MySQL service is declared for all variants but only connected when
|
||||
# tests == 'wp-framework'. On stubs/brain-monkey the service starts but is
|
||||
# never touched — marginal overhead, keeps the YAML unconditional.
|
||||
services:
|
||||
mysql:
|
||||
image: mysql:8.0
|
||||
env:
|
||||
MYSQL_ROOT_PASSWORD: root
|
||||
# The WP test bootstrap expects this DB to exist. Passing
|
||||
# skip-db-create=true (6th arg) to install-wp-tests.sh relies on
|
||||
# MySQL having created it already via this env var.
|
||||
MYSQL_DATABASE: wp_tests
|
||||
ports:
|
||||
- 3306:3306
|
||||
options: >-
|
||||
--health-cmd="mysqladmin ping"
|
||||
--health-interval=10s
|
||||
--health-timeout=5s
|
||||
--health-retries=5
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Install subversion (wp-framework only)
|
||||
# ubuntu-latest no longer ships svn. The WP test-suite bootstrap script
|
||||
# checks out develop.svn.wordpress.org via svn.
|
||||
# Gotcha #1 of the three known WP PHPUnit CI gotchas.
|
||||
if: ${{ inputs.tests == 'wp-framework' }}
|
||||
run: sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends subversion
|
||||
|
||||
- name: Setup PHP ${{ matrix.php }}
|
||||
uses: shivammathur/setup-php@v2
|
||||
with:
|
||||
php-version: ${{ matrix.php }}
|
||||
coverage: none
|
||||
tools: composer:v2
|
||||
extensions: ${{ inputs.tests == 'wp-framework' && 'mysqli' || '' }}
|
||||
|
||||
- name: Install Composer dependencies
|
||||
run: composer install --no-progress --no-interaction --prefer-dist
|
||||
|
||||
- name: Wait for MySQL (wp-framework only)
|
||||
if: ${{ inputs.tests == 'wp-framework' }}
|
||||
run: |
|
||||
for i in {1..30}; do
|
||||
if mysqladmin ping -h 127.0.0.1 -P 3306 -u root -proot --silent; then
|
||||
echo "MySQL is up"; break
|
||||
fi
|
||||
echo "Waiting for MySQL... ($i/30)"; sleep 2
|
||||
done
|
||||
|
||||
- name: Install WordPress test suite (wp-framework only)
|
||||
# Gotcha #2: pass skip-db-create=true (6th arg) — the MySQL service
|
||||
# already created wp_tests via MYSQL_DATABASE; re-creating it fails.
|
||||
# Gotcha #3: WP_CORE_DIR must end with a trailing slash. The bootstrap
|
||||
# concatenates this verbatim as ABSPATH + 'wp-settings.php'. Without
|
||||
# the slash: '/tmp/wordpresswp-settings.php' -> fatal bootstrap error.
|
||||
if: ${{ inputs.tests == 'wp-framework' }}
|
||||
env:
|
||||
WP_TESTS_DIR: /tmp/wordpress-tests-lib
|
||||
WP_CORE_DIR: /tmp/wordpress/
|
||||
run: |
|
||||
chmod +x bin/install-wp-tests.sh
|
||||
bin/install-wp-tests.sh wp_tests root root 127.0.0.1:3306 latest true
|
||||
|
||||
- name: Run PHPUnit
|
||||
# Every repo calls `composer test` regardless of environment.
|
||||
# The repo's composer.json `test` script points to vendor/bin/phpunit
|
||||
# with the appropriate phpunit.xml config for that repo.
|
||||
env:
|
||||
WP_TESTS_DIR: /tmp/wordpress-tests-lib
|
||||
run: composer test
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# lint-js: JavaScript linting (only when has_js == true)
|
||||
# ---------------------------------------------------------------------------
|
||||
lint-js:
|
||||
name: JS Lint
|
||||
runs-on: ubuntu-latest
|
||||
if: ${{ inputs.has_js }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Setup Node
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: '20'
|
||||
cache: 'npm'
|
||||
|
||||
- name: Install npm dependencies
|
||||
run: npm ci
|
||||
|
||||
- name: Lint JavaScript
|
||||
# Prefer `npm run lint` if the repo defines it (catches ESLint etc.).
|
||||
# Fall back to `node --check` syntax-only scan on all *.js files.
|
||||
# NOTE: `npm run lint --if-present` exits 0 even when no lint script
|
||||
# exists (npm 10+ / ubuntu-latest Node 20 behaviour), so the fallback
|
||||
# branch is dead code under --if-present. Instead, explicitly detect
|
||||
# whether a lint script is declared and branch on that.
|
||||
run: |
|
||||
if node -e "process.exit(require('./package.json').scripts?.lint ? 0 : 1)" 2>/dev/null; then
|
||||
echo "npm run lint script found — running it."
|
||||
npm run lint
|
||||
else
|
||||
echo "No 'lint' npm script — running node --check syntax scan."
|
||||
find . -name '*.js' \
|
||||
-not -path './vendor/*' \
|
||||
-not -path './node_modules/*' \
|
||||
-not -path './.git/*' \
|
||||
-print0 | xargs -0 -I{} node --check {}
|
||||
fi
|
||||
4
.github/workflows/deploy-app.yml
vendored
4
.github/workflows/deploy-app.yml
vendored
@@ -35,7 +35,7 @@ permissions:
|
||||
jobs:
|
||||
deploy-staging:
|
||||
name: Deploy to Staging
|
||||
runs-on: [self-hosted, peptide-vps]
|
||||
runs-on: ubuntu-latest
|
||||
environment: staging
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
@@ -83,7 +83,7 @@ jobs:
|
||||
# skipped smoke (run_smoke: false) still allows prod via the if-condition.
|
||||
needs: [deploy-staging, smoke]
|
||||
if: ${{ !cancelled() && needs.deploy-staging.result == 'success' && needs.smoke.result != 'failure' }}
|
||||
runs-on: [self-hosted, peptide-vps]
|
||||
runs-on: ubuntu-latest
|
||||
environment: production
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
2
.github/workflows/smoke.yml
vendored
2
.github/workflows/smoke.yml
vendored
@@ -32,7 +32,7 @@ on:
|
||||
jobs:
|
||||
smoke:
|
||||
name: Playwright smoke suite
|
||||
runs-on: [self-hosted, peptide-vps]
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 15
|
||||
|
||||
steps:
|
||||
|
||||
92
CHANGELOG.md
92
CHANGELOG.md
@@ -1,99 +1,7 @@
|
||||
# Changelog
|
||||
|
||||
## [1.7.1] - 2026-06-17
|
||||
|
||||
### Changed
|
||||
- **CI/CD**: Switch `deploy-staging`, `deploy-production`, and `smoke` jobs from
|
||||
`ubuntu-latest` (GitHub-hosted) to `[self-hosted, peptide-vps]` (org runner on
|
||||
KVM8 VPS). This routes all Hostinger SSH/rsync traffic through our stable VPS IP,
|
||||
fixing the Azure-region throttle that caused intermittent deploy failures.
|
||||
Callers' CI/validate jobs are unaffected (remain on `ubuntu-latest`).
|
||||
|
||||
## [1.7.0] - 2026-06-17
|
||||
|
||||
### Added
|
||||
- **Peptide News admin smoke (07)** (`07-peptide-news-admin.spec.ts`).
|
||||
Covers the Peptide News Plugin admin surfaces: dashboard (HTTP 200, no fatal,
|
||||
h1 "Peptide News Analytics" heading, `.pn-summary-cards`, `.pn-date-filter`),
|
||||
settings (form present), articles, and LLM costs sub-pages. Skip-if-absent guard
|
||||
on all tests using the standard 05/06 merge-early binding pattern. Slugs sourced
|
||||
from `admin/class-pn-admin-menu.php`.
|
||||
|
||||
- **PR Vision admin smoke (08)** (`08-pr-vision-admin.spec.ts`).
|
||||
Covers the PR Vision plugin admin surfaces: dashboard (HTTP 200, no fatal,
|
||||
h1 "PR Vision" visible), Settings page (API-key-manager card `#prv-key-card`
|
||||
present, status badge `#prv-key-source-badge` visible), write-only security
|
||||
invariant (`#prv_api_key` value="" + full HTML must not contain "sk-or-"),
|
||||
Costs sub-page (`pr-vision-costs`), and Call Log sub-page (`pr-vision-calls`).
|
||||
Skip-if-absent at two levels: plugin absent (loud annotation + skip), and
|
||||
`#prv-key-card` absent (Settings v0.2.0 not yet deployed on environment).
|
||||
Selectors sourced from `class-prv-admin-page.php`, `class-prv-key-manager-renderer.php`.
|
||||
|
||||
|
||||
All notable changes to the peptide-e2e smoke suite will be documented here.
|
||||
|
||||
## [1.6.0] - 2026-06-16
|
||||
|
||||
## [1.6.1] - 2026-06-16
|
||||
|
||||
### Fixed
|
||||
- **P2-A injection** (`ci.yml:239`): `${{ inputs.line_limit_paths }}` moved
|
||||
from raw shell assignment into an `env:` block (`PATHS`); shell now reads
|
||||
`$PATHS` — eliminates template-injection surface for caller-supplied input.
|
||||
- **P2-B lint-js fallback** (`ci.yml:378`): replaced `npm run lint --if-present`
|
||||
(exits 0 when no lint script exists, killing the fallback branch) with
|
||||
explicit `node -e "process.exit(…)"` detection; `node --check` scan now
|
||||
actually runs when no `lint` npm script is defined.
|
||||
- **P2-C phpcs config mismatch** (`ci.yml:178-199, 206-223`): both phpcbf
|
||||
and phpcs steps now detect which of `phpcs.xml` / `phpcs.xml.dist` /
|
||||
`.phpcs.xml.dist` is present and pass that file to `--standard`; guard and
|
||||
command now agree for all three variants.
|
||||
|
||||
|
||||
### Added
|
||||
- **Reusable CI workflow** (`.github/workflows/ci.yml`).
|
||||
`on: workflow_call` entrypoint that every estate repo will adopt as a thin
|
||||
caller. Inputs: `php_versions` (JSON matrix), `tests`
|
||||
(stubs|wp-framework|brain-monkey|none), `enforce_300`, `line_limit_paths`,
|
||||
`has_js`, `phpcs_autofix`. Fixed job names (`lint-php`, `phpcs`, `file-size`,
|
||||
`phpunit`, `lint-js`) so deploy-app.yml can `needs:` them uniformly.
|
||||
- **phpcbf auto-commit** (prautoblogger gold-standard pattern): on
|
||||
`pull_request` events, phpcbf runs and pushes any fixes back to the branch
|
||||
before strict PHPCS; on `push` events auto-commit is skipped to prevent
|
||||
loops.
|
||||
- **wp-framework PHPUnit path** replicates all three peptide-starter-theme
|
||||
gotchas: (1) install svn; (2) pass skip-db-create=true so the MySQL
|
||||
service's pre-created DB is reused; (3) WP_CORE_DIR trailing slash.
|
||||
- **Self-test caller** (`.github/workflows/ci-self-test.yml`): exercises
|
||||
the reusable workflow on this repo with `tests: none` so the workflow is
|
||||
validated on this PR itself.
|
||||
- **README.md**: adoption snippet documenting how any repo becomes a caller.
|
||||
|
||||
|
||||
## [1.5.0] - 2026-06-14
|
||||
|
||||
### Added
|
||||
- **Board Generate Now smoke (M4, skip-if-absent)** (`06-board-generate-now.spec.ts`).
|
||||
Asserts the PRAutoBlogger board page loads, `#prab-generate-now` button is present
|
||||
and carries a nonce, and the kick-off AJAX action returns valid JSON (no PHP fatal).
|
||||
READ-ONLY: never waits for generation to complete; `kick_off()` is idempotent.
|
||||
SKIPS with a loud annotation when `#prab-board` or `#prab-generate-now` is absent
|
||||
(v0.21.0 M4 not yet deployed) so the e2e PR can merge before prautoblogger PR #166
|
||||
per the M2/M3 merge-order binding. 27 tests total (was 25), delta = 2.
|
||||
|
||||
## [1.4.0] - 2026-06-12
|
||||
|
||||
### Added
|
||||
- **Dossier edit + re-run smoke (M3, skip-if-absent)** (`05-dossier-edit.spec.ts`).
|
||||
Opens a discovered post's dossier and exercises the v0.20.0 edit surface READ-ONLY:
|
||||
opens/closes the first edit panel (asserts textareas, Save/Re-run buttons, the
|
||||
fork-preserved + queued-execution copy), asserts every disabled edit affordance
|
||||
carries a visible reason, and checks the M3 sidebar cards (Run Spend, Models &
|
||||
Prompts). NEVER clicks Save or any Re-run button (those fork inputs / queue paid
|
||||
LLM jobs). SKIPS with a loud annotation when `.prab-stage-rerun-footer` is absent
|
||||
(plugin v0.20.0 not yet deployed) so this PR can merge before prautoblogger PR #161
|
||||
per the M3 merge-order binding. 25 tests total (was 24), delta = 1.
|
||||
|
||||
## [1.3.0] - 2026-06-12
|
||||
|
||||
### Fixed
|
||||
|
||||
99
README.md
99
README.md
@@ -1,99 +0,0 @@
|
||||
# peptide-e2e
|
||||
|
||||
Playwright smoke tests and shared CI/CD pipelines for the [peptiderepo.com](https://peptiderepo.com) estate.
|
||||
|
||||
## Reusable workflows
|
||||
|
||||
This repo hosts shared GitHub Actions workflows called by all 7 app repos.
|
||||
|
||||
### `deploy-app.yml` — shared deploy pipeline
|
||||
|
||||
Handles staging rsync → Playwright smoke → production rsync → inventory guard →
|
||||
LiteSpeed cache purge → health check. Called by every app's `deploy.yml` via
|
||||
`uses: peptiderepo/peptide-e2e/.github/workflows/deploy-app.yml@main`.
|
||||
|
||||
### `ci.yml` — reusable CI (PHP lint, PHPCS, 300-line, PHPUnit, JS lint)
|
||||
|
||||
Standardised CI for every estate repo. Consistent job names so `deploy-app.yml`
|
||||
can gate on them uniformly.
|
||||
|
||||
**Adopt in any repo** — create `.github/workflows/ci.yml` in the caller repo:
|
||||
|
||||
```yaml
|
||||
name: CI
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
pull_request:
|
||||
branches: [main]
|
||||
|
||||
# Required: the called ci.yml phpcs job declares contents: write for phpcbf
|
||||
# commit-back. GitHub enforces that callers must grant at least the permission
|
||||
# level the reusable workflow's jobs request.
|
||||
permissions:
|
||||
contents: write
|
||||
|
||||
jobs:
|
||||
ci:
|
||||
uses: peptiderepo/peptide-e2e/.github/workflows/ci.yml@main
|
||||
with:
|
||||
tests: stubs # stubs | wp-framework | brain-monkey | none
|
||||
has_js: false # set true if the repo ships JS
|
||||
secrets: inherit
|
||||
```
|
||||
|
||||
**Full input reference:**
|
||||
|
||||
| Input | Type | Default | Description |
|
||||
|-------|------|---------|-------------|
|
||||
| `php_versions` | string | `'["8.1","8.2","8.3"]'` | JSON array of PHP versions to matrix over |
|
||||
| `tests` | string | `stubs` | PHPUnit environment: `stubs`, `wp-framework`, `brain-monkey`, or `none` |
|
||||
| `enforce_300` | boolean | `true` | Fail if any tracked `*.php` file under `line_limit_paths` exceeds 300 lines |
|
||||
| `line_limit_paths` | string | `includes` | Space-separated paths the 300-line rule applies to |
|
||||
| `has_js` | boolean | `false` | Whether to run JS linting (`npm run lint` or `node --check`) |
|
||||
| `phpcs_autofix` | boolean | `true` | On PRs: run phpcbf and commit fixes back before strict PHPCS |
|
||||
|
||||
**PHPUnit `tests` values explained:**
|
||||
|
||||
- `stubs` — WP stubs only (fast, no DB); just runs `composer test`.
|
||||
- `brain-monkey` — Brain Monkey mocking; no DB; runs `composer test`.
|
||||
- `wp-framework` — Full WordPress test framework: provisions MySQL service,
|
||||
installs svn, runs `bin/install-wp-tests.sh`, then `composer test`. Handles
|
||||
the three known gotchas: svn install, `--skip-db-create` with MySQL service,
|
||||
`WP_CORE_DIR` trailing slash.
|
||||
- `none` — Skips the `phpunit` job entirely (temporary; repos without a suite
|
||||
yet; remove at rollout).
|
||||
|
||||
**phpcbf auto-commit:** on `pull_request` events, phpcbf runs first and commits
|
||||
any auto-fixable violations back to the PR branch via `GITHUB_TOKEN`. GitHub
|
||||
prevents loops — bot commits do not trigger a new CI run. Strict PHPCS then
|
||||
runs and fails only on non-auto-fixable violations.
|
||||
|
||||
**Job names** (fixed — callers and `deploy-app.yml` `needs:` these):
|
||||
`lint-php`, `phpcs`, `file-size`, `phpunit`, `lint-js`.
|
||||
|
||||
## Smoke tests
|
||||
|
||||
The `tests/` directory contains Playwright specs that run against
|
||||
`https://staging.peptiderepo.com` (via `deploy-app.yml`) and can also target
|
||||
production. See `playwright.config.ts` for environment configuration.
|
||||
|
||||
```
|
||||
tests/
|
||||
00-homepage.spec.ts
|
||||
01-reconstitution-calculator.spec.ts
|
||||
02-peptide-search.spec.ts
|
||||
03-admin-plugins.spec.ts
|
||||
04-rest-api.spec.ts
|
||||
05-dossier-edit.spec.ts
|
||||
06-board-generate-now.spec.ts
|
||||
```
|
||||
|
||||
## Development
|
||||
|
||||
```bash
|
||||
npm ci
|
||||
npx playwright install --with-deps chromium
|
||||
BASE_URL=https://staging.peptiderepo.com npm test
|
||||
```
|
||||
44
package-lock.json
generated
44
package-lock.json
generated
@@ -1,28 +1,25 @@
|
||||
{
|
||||
"name": "peptide-e2e",
|
||||
"version": "1.4.0",
|
||||
"version": "1.0.0",
|
||||
"lockfileVersion": 3,
|
||||
"requires": true,
|
||||
"packages": {
|
||||
"": {
|
||||
"name": "peptide-e2e",
|
||||
"version": "1.4.0",
|
||||
"dependencies": {
|
||||
"typescript": "^6.0.3"
|
||||
},
|
||||
"version": "1.0.0",
|
||||
"devDependencies": {
|
||||
"@playwright/test": "^1.60.0",
|
||||
"@playwright/test": "^1.43.0",
|
||||
"dotenv": "^16.4.5"
|
||||
}
|
||||
},
|
||||
"node_modules/@playwright/test": {
|
||||
"version": "1.60.0",
|
||||
"resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.60.0.tgz",
|
||||
"integrity": "sha512-O71yZIbAh/PxDMNGns37GHBIfrVkEVyn+AXyIa5dOTfb4/xNvRWV+Vv/NMbNCtODB/pO7vLlF2OTmMVLhmr7Ag==",
|
||||
"version": "1.59.1",
|
||||
"resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.59.1.tgz",
|
||||
"integrity": "sha512-PG6q63nQg5c9rIi4/Z5lR5IVF7yU5MqmKaPOe0HSc0O2cX1fPi96sUQu5j7eo4gKCkB2AnNGoWt7y4/Xx3Kcqg==",
|
||||
"dev": true,
|
||||
"license": "Apache-2.0",
|
||||
"dependencies": {
|
||||
"playwright": "1.60.0"
|
||||
"playwright": "1.59.1"
|
||||
},
|
||||
"bin": {
|
||||
"playwright": "cli.js"
|
||||
@@ -60,13 +57,13 @@
|
||||
}
|
||||
},
|
||||
"node_modules/playwright": {
|
||||
"version": "1.60.0",
|
||||
"resolved": "https://registry.npmjs.org/playwright/-/playwright-1.60.0.tgz",
|
||||
"integrity": "sha512-hheHdokM8cdqCb0lcE3s+zT4t4W+vvjpGxsZlDnikarzx8tSzMebh3UiFtgqwFwnTnjYQcsyMF8ei2mCO/tpeA==",
|
||||
"version": "1.59.1",
|
||||
"resolved": "https://registry.npmjs.org/playwright/-/playwright-1.59.1.tgz",
|
||||
"integrity": "sha512-C8oWjPR3F81yljW9o5OxcWzfh6avkVwDD2VYdwIGqTkl+OGFISgypqzfu7dOe4QNLL2aqcWBmI3PMtLIK233lw==",
|
||||
"dev": true,
|
||||
"license": "Apache-2.0",
|
||||
"dependencies": {
|
||||
"playwright-core": "1.60.0"
|
||||
"playwright-core": "1.59.1"
|
||||
},
|
||||
"bin": {
|
||||
"playwright": "cli.js"
|
||||
@@ -79,9 +76,9 @@
|
||||
}
|
||||
},
|
||||
"node_modules/playwright-core": {
|
||||
"version": "1.60.0",
|
||||
"resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.60.0.tgz",
|
||||
"integrity": "sha512-9bW6zvX/m0lEbgTKJ6YppOKx8H3VOPBMOCFh2irXFOT4BbHgrx5hPjwJYLT40Lu+4qtD36qKc/Hn56StUW57IA==",
|
||||
"version": "1.59.1",
|
||||
"resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.59.1.tgz",
|
||||
"integrity": "sha512-HBV/RJg81z5BiiZ9yPzIiClYV/QMsDCKUyogwH9p3MCP6IYjUFu/MActgYAvK0oWyV9NlwM3GLBjADyWgydVyg==",
|
||||
"dev": true,
|
||||
"license": "Apache-2.0",
|
||||
"bin": {
|
||||
@@ -90,19 +87,6 @@
|
||||
"engines": {
|
||||
"node": ">=18"
|
||||
}
|
||||
},
|
||||
"node_modules/typescript": {
|
||||
"version": "6.0.3",
|
||||
"resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz",
|
||||
"integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==",
|
||||
"license": "Apache-2.0",
|
||||
"bin": {
|
||||
"tsc": "bin/tsc",
|
||||
"tsserver": "bin/tsserver"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=14.17"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "peptide-e2e",
|
||||
"version": "1.7.1",
|
||||
"version": "1.3.0",
|
||||
"description": "Playwright smoke tests for peptiderepo.com (staging + production)",
|
||||
"private": true,
|
||||
"scripts": {
|
||||
@@ -11,10 +11,7 @@
|
||||
"report": "playwright show-report"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@playwright/test": "^1.60.0",
|
||||
"@playwright/test": "^1.43.0",
|
||||
"dotenv": "^16.4.5"
|
||||
},
|
||||
"dependencies": {
|
||||
"typescript": "^6.0.3"
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,136 +0,0 @@
|
||||
/**
|
||||
* 05-dossier-edit.spec.ts
|
||||
*
|
||||
* What: Smoke for the PRAutoBlogger dossier EDIT + RE-RUN surface
|
||||
* (plugin v0.20.0, Phase 2 admin M3). Read-only: opens/closes the
|
||||
* edit panel and asserts structure — it NEVER clicks Save or any
|
||||
* Re-run button (those fork inputs / queue paid LLM jobs).
|
||||
* Who triggers it: Playwright chromium project (post-auth setup).
|
||||
* Dependencies: wp-admin authenticated session (from global.setup.ts).
|
||||
*
|
||||
* SKIP-IF-ABSENT (M3 binding): this spec targets a surface that may not
|
||||
* be deployed yet. When the M3 markup (.prab-stage-rerun-footer) is
|
||||
* absent from the dossier, the test SKIPS with a loud annotation so this
|
||||
* PR can merge before the plugin PR ships. Once v0.20.0 is live, the
|
||||
* skip path goes dead and the assertions gate as usual.
|
||||
*
|
||||
* Selectors sourced from prautoblogger v0.20.0:
|
||||
* templates/admin/dossier-stage-section.php (.prab-stage-rerun-footer,
|
||||
* .prab-edit-toggle, .prab-edit-unavailable, .prab-rerun-from)
|
||||
* templates/admin/dossier-edit-panel.php (.prab-edit-panel,
|
||||
* .prab-edit-textarea, .prab-edit-save, .prab-edit-rerun)
|
||||
* templates/admin/dossier-sidebar-cards.php (.prab-run-spend,
|
||||
* .prab-models-card)
|
||||
*
|
||||
* @see prautoblogger PR #161 (v0.20.0) — the surface under test.
|
||||
*/
|
||||
|
||||
import { test, expect } from '@playwright/test';
|
||||
|
||||
const ADMIN = '/wp-admin';
|
||||
const CANDIDATE_POST_IDS = [925, 930]; // canonical staging posts
|
||||
|
||||
test.describe('WP Admin — PRAutoBlogger dossier edit + re-run (M3)', () => {
|
||||
test('edit affordances render structurally (no mutations)', async ({ page, request }) => {
|
||||
// ── Post discovery (same defensive strategy as the dossier smoke) ──
|
||||
let targetPostId: number | null = null;
|
||||
for (const pid of CANDIDATE_POST_IDS) {
|
||||
const apiRes = await request.get(`/wp-json/wp/v2/posts/${pid}`);
|
||||
if (apiRes.ok()) {
|
||||
targetPostId = pid;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (targetPostId === null) {
|
||||
const listRes = await request.get('/wp-json/wp/v2/posts?per_page=5&orderby=date&order=desc');
|
||||
if (listRes.ok()) {
|
||||
const posts: Array<{ id: number }> = await listRes.json();
|
||||
if (posts.length > 0) {
|
||||
targetPostId = posts[0].id;
|
||||
}
|
||||
}
|
||||
}
|
||||
if (targetPostId === null) {
|
||||
test.info().annotations.push({
|
||||
type: 'warning',
|
||||
description:
|
||||
'[dossier-edit smoke] No post found on this environment — ' +
|
||||
'cannot exercise the edit surface. Skipping.',
|
||||
});
|
||||
test.skip();
|
||||
return;
|
||||
}
|
||||
|
||||
const res = await page.goto(`${ADMIN}/admin.php?page=prautoblogger-dossier&post_id=${targetPostId}`);
|
||||
expect(res?.status()).toBe(200);
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
const body = await page.textContent('body');
|
||||
expect(body).not.toContain('Fatal error');
|
||||
expect(body).not.toContain('Invalid plugin page');
|
||||
|
||||
// ── SKIP-IF-ABSENT gate: M3 markup not deployed yet ────────────────
|
||||
const footers = page.locator('.prab-stage-rerun-footer');
|
||||
const footerCount = await footers.count();
|
||||
if (footerCount === 0) {
|
||||
test.info().annotations.push({
|
||||
type: 'warning',
|
||||
description:
|
||||
'[dossier-edit smoke] .prab-stage-rerun-footer absent — the M3 ' +
|
||||
'edit+rerun surface (plugin v0.20.0) is not deployed on this ' +
|
||||
'environment, or this post has no stage sections. Skipping per ' +
|
||||
'the merge-early binding.',
|
||||
});
|
||||
test.skip();
|
||||
return;
|
||||
}
|
||||
|
||||
console.log(`[dossier-edit smoke] Found ${footerCount} stage rerun footers on post id=${targetPostId}`);
|
||||
|
||||
// ── Disabled affordances must explain themselves ───────────────────
|
||||
const unavailable = page.locator('.prab-edit-unavailable');
|
||||
const unavailableCount = await unavailable.count();
|
||||
for (let i = 0; i < unavailableCount; i++) {
|
||||
const reason = (await unavailable.nth(i).textContent())?.trim() ?? '';
|
||||
expect(reason.length, 'disabled edit affordances must carry a visible reason').toBeGreaterThan(10);
|
||||
}
|
||||
|
||||
// ── Edit panel open/close (read-only — NEVER click save/rerun) ─────
|
||||
const toggles = page.locator('.prab-edit-toggle');
|
||||
const toggleCount = await toggles.count();
|
||||
if (toggleCount === 0) {
|
||||
test.info().annotations.push({
|
||||
type: 'info',
|
||||
description:
|
||||
'[dossier-edit smoke] No editable stage on this post (no recorded ' +
|
||||
'request_json yet, or post is published/frozen). Disabled-state ' +
|
||||
'reasons were asserted; panel interaction not exercisable.',
|
||||
});
|
||||
return;
|
||||
}
|
||||
|
||||
const firstToggle = toggles.first();
|
||||
const panelId = await firstToggle.getAttribute('aria-controls');
|
||||
expect(panelId).toBeTruthy();
|
||||
const panel = page.locator(`#${panelId}`);
|
||||
|
||||
await firstToggle.click();
|
||||
await expect(panel).toBeVisible();
|
||||
await expect(firstToggle).toHaveAttribute('aria-expanded', 'true');
|
||||
|
||||
// Panel structure: textareas + save + rerun buttons + fork/queue copy.
|
||||
expect(await panel.locator('.prab-edit-textarea').count()).toBeGreaterThan(0);
|
||||
await expect(panel.locator('.prab-edit-save')).toBeVisible();
|
||||
await expect(panel.locator('.prab-edit-rerun')).toBeVisible();
|
||||
const copy = (await panel.textContent()) ?? '';
|
||||
expect(copy).toContain('original is preserved'); // fork copy (guardrail 1)
|
||||
expect(copy.toLowerCase()).toContain('queued'); // chained-cron copy
|
||||
|
||||
// Close it again — leave the page exactly as found.
|
||||
await firstToggle.click();
|
||||
await expect(panel).toBeHidden();
|
||||
|
||||
// ── M3 sidebar cards present when run data exists ──────────────────
|
||||
await expect(page.locator('.prab-run-spend')).toBeVisible();
|
||||
await expect(page.locator('.prab-models-card')).toBeVisible();
|
||||
});
|
||||
});
|
||||
@@ -1,156 +0,0 @@
|
||||
/**
|
||||
* 06-board-generate-now.spec.ts
|
||||
*
|
||||
* What: Smoke for the PRAutoBlogger board "Generate Now" control (v0.21.0, M4).
|
||||
* Asserts that the board page renders the generate-now button and that
|
||||
* clicking it sends the kick-off AJAX request without a PHP fatal.
|
||||
* Read-only assertions only — this test NEVER waits for article generation
|
||||
* to complete (that would make LLM API calls in CI).
|
||||
*
|
||||
* SKIP-IF-ABSENT (M4 binding): the generate-now surface ships with v0.21.0
|
||||
* (prautoblogger PR #166). This spec guards against the board container
|
||||
* (#prab-board) being absent or the generate-now button (#prab-generate-now)
|
||||
* missing. When those selectors are absent (v0.21.0 not yet deployed), the
|
||||
* entire test suite skips with a loud annotation so this PR can merge before
|
||||
* the plugin PR — matching the M2 merge-order binding.
|
||||
*
|
||||
* Selectors sourced from prautoblogger v0.21.0:
|
||||
* templates/admin/board-page.php: #prab-board, #prab-generate-now
|
||||
* assets/js/board-generate.js: data-nonce, wp.ajax / admin-ajax.php
|
||||
*
|
||||
* Who triggers it: Playwright chromium project (post-auth setup).
|
||||
* Dependencies: wp-admin authenticated session (from global.setup.ts).
|
||||
*
|
||||
* @see prautoblogger PR #166 (v0.21.0) — the surface under test.
|
||||
*/
|
||||
|
||||
import { test, expect } from '@playwright/test';
|
||||
|
||||
const ADMIN = '/wp-admin';
|
||||
const BOARD_URL = `${ADMIN}/admin.php?page=prautoblogger-board`;
|
||||
|
||||
test.describe('WP Admin — PRAutoBlogger board Generate Now (M4)', () => {
|
||||
test('board page loads and generate-now button is present (skip-if-absent)', async ({ page }) => {
|
||||
// Navigate to the board page.
|
||||
const res = await page.goto(BOARD_URL);
|
||||
|
||||
// Must be HTTP 200 (guards menu-registration regression).
|
||||
expect(res?.status()).toBe(200);
|
||||
|
||||
// wp-admin chrome must be present.
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
|
||||
// Body must not contain PHP fatal or wp_die error strings.
|
||||
const body = await page.textContent('body');
|
||||
expect(body).not.toContain('Fatal error');
|
||||
expect(body).not.toContain('Invalid plugin page');
|
||||
|
||||
// ── SKIP-IF-ABSENT guard ────────────────────────────────────────────────
|
||||
// The generate-now surface ships with v0.21.0. If the board container or
|
||||
// the button is absent, the M4 plugin is not yet deployed — skip loudly.
|
||||
const boardContainer = page.locator('#prab-board');
|
||||
const boardPresent = await boardContainer.count() > 0;
|
||||
|
||||
if ( ! boardPresent ) {
|
||||
test.info().annotations.push({
|
||||
type: 'skip',
|
||||
description:
|
||||
'[generate-now smoke] #prab-board absent: v0.21.0 (M4) not yet deployed. ' +
|
||||
'Skipping generate-now assertions — they will gate once the plugin PR ships.',
|
||||
});
|
||||
test.skip();
|
||||
return;
|
||||
}
|
||||
|
||||
// Board container must be visible.
|
||||
await expect(boardContainer).toBeVisible({ timeout: 10_000 });
|
||||
|
||||
// ── Generate-now button (skip-if-absent) ────────────────────────────────
|
||||
const generateBtn = page.locator('#prab-generate-now');
|
||||
const btnPresent = await generateBtn.count() > 0;
|
||||
|
||||
if ( ! btnPresent ) {
|
||||
test.info().annotations.push({
|
||||
type: 'skip',
|
||||
description:
|
||||
'[generate-now smoke] #prab-generate-now absent: M4 button not yet in deployed build. ' +
|
||||
'Skipping button assertions.',
|
||||
});
|
||||
test.skip();
|
||||
return;
|
||||
}
|
||||
|
||||
// Button must be visible and carry a nonce for the AJAX call.
|
||||
await expect(generateBtn).toBeVisible({ timeout: 5_000 });
|
||||
const nonce = await generateBtn.getAttribute('data-nonce');
|
||||
expect(nonce).toBeTruthy();
|
||||
|
||||
console.log(
|
||||
'[generate-now smoke] Generate Now button found with nonce — M4 surface is deployed.'
|
||||
);
|
||||
});
|
||||
|
||||
test('generate-now AJAX responds with JSON (no fatal) — skip-if-absent', async ({ page, request }) => {
|
||||
// Navigate first to establish auth cookies for the request context.
|
||||
await page.goto(BOARD_URL);
|
||||
|
||||
const body = await page.textContent('body');
|
||||
if ( ! body?.includes('prab-board') ) {
|
||||
test.info().annotations.push({
|
||||
type: 'skip',
|
||||
description: '[generate-now smoke] Board container absent — v0.21.0 not deployed. Skipping.',
|
||||
});
|
||||
test.skip();
|
||||
return;
|
||||
}
|
||||
|
||||
const generateBtn = page.locator('#prab-generate-now');
|
||||
if ( await generateBtn.count() === 0 ) {
|
||||
test.info().annotations.push({
|
||||
type: 'skip',
|
||||
description: '[generate-now smoke] #prab-generate-now absent — skipping AJAX test.',
|
||||
});
|
||||
test.skip();
|
||||
return;
|
||||
}
|
||||
|
||||
// Read the nonce from the button (set by wp_localize_script).
|
||||
const nonce = await generateBtn.getAttribute('data-nonce') ?? '';
|
||||
|
||||
// Fire the kick-off AJAX action (same as board-generate.js would).
|
||||
// We use the request context to intercept without actually triggering
|
||||
// the full pipeline — the action is idempotent (kick_off() guards against
|
||||
// duplicate scheduling with wp_next_scheduled()).
|
||||
//
|
||||
// NOTE: We assert the response is valid JSON with a 'success' or 'data'
|
||||
// key only. We do NOT check that generation actually runs (LLM calls).
|
||||
const adminAjax = `${ADMIN}/admin-ajax.php`;
|
||||
const formData = new URLSearchParams({
|
||||
action: 'prautoblogger_generate_now',
|
||||
nonce,
|
||||
});
|
||||
|
||||
const ajaxRes = await request.post(adminAjax, {
|
||||
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
|
||||
data: formData.toString(),
|
||||
});
|
||||
|
||||
// Must be HTTP 200 (not 403/500).
|
||||
expect(ajaxRes.status()).toBe(200);
|
||||
|
||||
// Response must be valid JSON (no PHP fatal/notice dumped as HTML).
|
||||
const text = await ajaxRes.text();
|
||||
let parsed: unknown;
|
||||
try {
|
||||
parsed = JSON.parse(text);
|
||||
} catch {
|
||||
throw new Error(
|
||||
`[generate-now smoke] AJAX response is not valid JSON — possible PHP fatal.\nRaw: ${text.slice(0, 500)}`
|
||||
);
|
||||
}
|
||||
|
||||
// WordPress wp_send_json_success / _error always wraps in { success: bool }.
|
||||
expect(parsed).toHaveProperty('success');
|
||||
console.log('[generate-now smoke] AJAX response:', JSON.stringify(parsed).slice(0, 200));
|
||||
});
|
||||
});
|
||||
@@ -1,144 +0,0 @@
|
||||
/**
|
||||
* 07-peptide-news-admin.spec.ts
|
||||
*
|
||||
* What: Smoke tests for the Peptide News Plugin admin surfaces.
|
||||
* Verifies the dashboard, settings, articles, and cost sub-pages
|
||||
* load without PHP fatals and checks expected UI elements.
|
||||
* Guards against activation failures, missing menu registration, or
|
||||
* PHP fatals introduced by a bad deploy.
|
||||
*
|
||||
* Who triggers it: Playwright chromium project (post-auth setup).
|
||||
* Dependencies: wp-admin authenticated session (from global.setup.ts).
|
||||
*
|
||||
* SKIP-IF-ABSENT: When the Peptide News Plugin is not installed/activated on
|
||||
* this environment, each test detects the absent menu page and skips with a
|
||||
* loud annotation — consistent with the 05/06 merge-early binding pattern.
|
||||
*
|
||||
* Admin menu slugs (sourced from admin/class-pn-admin-menu.php):
|
||||
* Dashboard -> admin.php?page=peptide-news-dashboard
|
||||
* Settings -> admin.php?page=peptide-news-settings
|
||||
* Articles -> admin.php?page=peptide-news-articles
|
||||
* LLM Costs -> admin.php?page=peptide-news-costs
|
||||
*
|
||||
* Selectors sourced from admin/partials/dashboard.php:
|
||||
* h1 "Peptide News Analytics" - page heading (text match)
|
||||
* .pn-summary-cards - summary card row
|
||||
* .pn-date-filter - date range filter form
|
||||
*
|
||||
* @see peptiderepo/peptide-news-plugin admin/class-pn-admin-menu.php
|
||||
* @see peptiderepo/peptide-news-plugin admin/partials/dashboard.php
|
||||
*/
|
||||
|
||||
import { test, expect } from '@playwright/test';
|
||||
|
||||
const ADMIN = '/wp-admin';
|
||||
|
||||
/**
|
||||
* Detect the "page not registered" condition WordPress returns when a plugin
|
||||
* menu slug is unknown. Returns true when the plugin is absent.
|
||||
*
|
||||
* WordPress either:
|
||||
* (a) Shows "You do not have sufficient permissions to access this page."
|
||||
* (b) Shows a notice that the page cannot be found
|
||||
* (c) Redirects back to /wp-admin/ stripping the ?page= param
|
||||
*/
|
||||
function isPluginAbsent(body: string, url: string): boolean {
|
||||
return (
|
||||
body.includes('Invalid plugin page') ||
|
||||
body.includes('do not have sufficient permissions') ||
|
||||
body.includes('The page you are looking for') ||
|
||||
( url.includes('/wp-admin/') && ! url.includes('page=peptide-news') )
|
||||
);
|
||||
}
|
||||
|
||||
/** Push a loud skip annotation and call test.skip(). */
|
||||
function skipMissing(): void {
|
||||
test.info().annotations.push({
|
||||
type: 'skip',
|
||||
description:
|
||||
'[peptide-news smoke] Peptide News Plugin is not installed or activated ' +
|
||||
'on this environment. Skipping per the merge-early binding.',
|
||||
});
|
||||
test.skip();
|
||||
}
|
||||
|
||||
test.describe('WP Admin - Peptide News Plugin dashboard', () => {
|
||||
test('dashboard page loads (HTTP 200, no PHP fatal)', async ({ page }) => {
|
||||
const res = await page.goto(`${ADMIN}/admin.php?page=peptide-news-dashboard`);
|
||||
expect(res?.status()).toBe(200);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
});
|
||||
|
||||
test('dashboard renders analytics heading, summary cards, and date filter', async ({ page }) => {
|
||||
await page.goto(`${ADMIN}/admin.php?page=peptide-news-dashboard`);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
|
||||
// Heading from admin/partials/dashboard.php: <h1>Peptide News Analytics</h1>
|
||||
await expect(
|
||||
page.locator('h1').filter({ hasText: 'Peptide News Analytics' })
|
||||
).toBeVisible({ timeout: 10_000 });
|
||||
|
||||
// Summary card row: <div class="pn-summary-cards">
|
||||
await expect(page.locator('.pn-summary-cards')).toBeVisible({ timeout: 10_000 });
|
||||
|
||||
// Date range filter form: <form class="pn-date-filter">
|
||||
await expect(page.locator('.pn-date-filter')).toBeVisible({ timeout: 10_000 });
|
||||
});
|
||||
});
|
||||
|
||||
test.describe('WP Admin - Peptide News Plugin settings page', () => {
|
||||
test('settings page loads (HTTP 200, no fatal, settings form present)', async ({ page }) => {
|
||||
const res = await page.goto(`${ADMIN}/admin.php?page=peptide-news-settings`);
|
||||
expect(res?.status()).toBe(200);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
|
||||
// Every settings page rendered by class-pn-admin-settings-page.php contains a form
|
||||
await expect(page.locator('form').first()).toBeVisible({ timeout: 10_000 });
|
||||
});
|
||||
});
|
||||
|
||||
test.describe('WP Admin - Peptide News Plugin articles page', () => {
|
||||
test('articles page loads without fatal error', async ({ page }) => {
|
||||
const res = await page.goto(`${ADMIN}/admin.php?page=peptide-news-articles`);
|
||||
expect(res?.status()).toBe(200);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
|
||||
expect(body).not.toContain('Invalid plugin page');
|
||||
});
|
||||
});
|
||||
|
||||
test.describe('WP Admin - Peptide News Plugin LLM costs page', () => {
|
||||
test('costs page loads without fatal error', async ({ page }) => {
|
||||
const res = await page.goto(`${ADMIN}/admin.php?page=peptide-news-costs`);
|
||||
expect(res?.status()).toBe(200);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
|
||||
expect(body).not.toContain('Invalid plugin page');
|
||||
});
|
||||
});
|
||||
@@ -1,208 +0,0 @@
|
||||
/**
|
||||
* 08-pr-vision-admin.spec.ts
|
||||
*
|
||||
* What: Smoke tests for the PR Vision plugin admin surfaces.
|
||||
* Covers the dashboard, Settings (API-key-manager card + write-only
|
||||
* invariant), Costs, and Call Log sub-pages. Guards against PHP fatals,
|
||||
* missing menu registration, and key leakage regressions.
|
||||
*
|
||||
* Who triggers it: Playwright chromium project (post-auth setup).
|
||||
* Dependencies: wp-admin authenticated session (from global.setup.ts).
|
||||
*
|
||||
* SKIP-IF-ABSENT: When PR Vision is not installed/activated on this
|
||||
* environment, each test detects the absent page and skips with a loud
|
||||
* annotation - consistent with the 05/06 merge-early binding pattern.
|
||||
*
|
||||
* Admin menu slugs (sourced from includes/core/class-prv-admin-page.php
|
||||
* and includes/core/class-prv-settings-page.php,
|
||||
* includes/core/class-prv-costs-page.php,
|
||||
* includes/core/class-prv-call-log-page.php):
|
||||
* Dashboard -> admin.php?page=pr-vision (MENU_SLUG = 'pr-vision')
|
||||
* Settings -> admin.php?page=pr-vision-settings (MENU_SLUG = 'pr-vision-settings')
|
||||
* Costs -> admin.php?page=pr-vision-costs (MENU_SLUG = 'pr-vision-costs')
|
||||
* Call Log -> admin.php?page=pr-vision-calls (MENU_SLUG = 'pr-vision-calls')
|
||||
*
|
||||
* Selectors sourced from includes/core/class-prv-admin-page.php:
|
||||
* h1 "PR Vision - AI Visibility" - dashboard page heading
|
||||
*
|
||||
* Selectors sourced from includes/core/class-prv-key-manager-renderer.php:
|
||||
* #prv-key-card - the API-key-manager card container
|
||||
* #prv-key-source-badge - key source status indicator span
|
||||
* #prv_api_key - password input (must render empty - write-only invariant)
|
||||
*
|
||||
* Write-only invariant (security):
|
||||
* The stored OpenRouter key must NEVER appear in page source.
|
||||
* #prv_api_key renders with value="" on every page load regardless of
|
||||
* whether a key is stored. This spec asserts the empty value and asserts
|
||||
* that known API key prefixes ("sk-or-") are absent from the full body.
|
||||
*
|
||||
* @see peptiderepo/pr-vision includes/core/class-prv-admin-page.php
|
||||
* @see peptiderepo/pr-vision includes/core/class-prv-settings-page.php
|
||||
* @see peptiderepo/pr-vision includes/core/class-prv-key-manager-renderer.php
|
||||
*/
|
||||
|
||||
import { test, expect } from '@playwright/test';
|
||||
|
||||
const ADMIN = '/wp-admin';
|
||||
|
||||
/**
|
||||
* Detect the "page not registered" condition WordPress returns when a plugin
|
||||
* menu slug is unknown. Returns true when the plugin is absent.
|
||||
*/
|
||||
function isPluginAbsent(body: string, url: string): boolean {
|
||||
return (
|
||||
body.includes('Invalid plugin page') ||
|
||||
body.includes('do not have sufficient permissions') ||
|
||||
body.includes('The page you are looking for') ||
|
||||
( url.includes('/wp-admin/') && ! url.includes('page=pr-vision') )
|
||||
);
|
||||
}
|
||||
|
||||
/** Push a loud skip annotation and call test.skip(). */
|
||||
function skipMissing(): void {
|
||||
test.info().annotations.push({
|
||||
type: 'skip',
|
||||
description:
|
||||
'[pr-vision smoke] PR Vision plugin is not installed or activated ' +
|
||||
'on this environment. Skipping per the merge-early binding.',
|
||||
});
|
||||
test.skip();
|
||||
}
|
||||
|
||||
test.describe('WP Admin - PR Vision dashboard', () => {
|
||||
test('dashboard page loads (HTTP 200, no PHP fatal)', async ({ page }) => {
|
||||
const res = await page.goto(`${ADMIN}/admin.php?page=pr-vision`);
|
||||
expect(res?.status()).toBe(200);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
|
||||
// Heading from class-prv-admin-page.php render_page():
|
||||
// echo '<h1>' . esc_html__( 'PR Vision - AI Visibility', 'pr-vision' ) . '</h1>';
|
||||
await expect(
|
||||
page.locator('h1').filter({ hasText: 'PR Vision' })
|
||||
).toBeVisible({ timeout: 10_000 });
|
||||
});
|
||||
});
|
||||
|
||||
test.describe('WP Admin - PR Vision Settings page (API-key-manager)', () => {
|
||||
test('settings page loads (HTTP 200, no PHP fatal)', async ({ page }) => {
|
||||
const res = await page.goto(`${ADMIN}/admin.php?page=pr-vision-settings`);
|
||||
expect(res?.status()).toBe(200);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
});
|
||||
|
||||
test('API-key-manager card is present and status indicator visible', async ({ page }) => {
|
||||
await page.goto(`${ADMIN}/admin.php?page=pr-vision-settings`);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
|
||||
// ── SKIP-IF-ABSENT guard: Settings page may not have key-card if Settings
|
||||
// subpage (v0.2.0) is not yet deployed on this environment.
|
||||
const keyCard = page.locator('#prv-key-card');
|
||||
const cardPresent = await keyCard.count() > 0;
|
||||
|
||||
if ( ! cardPresent ) {
|
||||
test.info().annotations.push({
|
||||
type: 'skip',
|
||||
description:
|
||||
'[pr-vision smoke] #prv-key-card absent: PR Vision Settings page ' +
|
||||
'(v0.2.0 admin) is not deployed on this environment. Skipping key-manager assertions.',
|
||||
});
|
||||
test.skip();
|
||||
return;
|
||||
}
|
||||
|
||||
// API-key-manager card container from class-prv-key-manager-renderer.php:
|
||||
// <div class="prv-card" id="prv-key-card">
|
||||
await expect(keyCard).toBeVisible({ timeout: 10_000 });
|
||||
|
||||
// Key source status indicator: <span ... id="prv-key-source-badge">
|
||||
// Shows one of: "Set via wp-config", "Set via admin", "Not set"
|
||||
await expect(page.locator('#prv-key-source-badge')).toBeVisible({ timeout: 10_000 });
|
||||
});
|
||||
|
||||
test('password input is present and renders EMPTY (write-only invariant)', async ({ page }) => {
|
||||
await page.goto(`${ADMIN}/admin.php?page=pr-vision-settings`);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
|
||||
const keyCard = page.locator('#prv-key-card');
|
||||
const cardPresent = await keyCard.count() > 0;
|
||||
if ( ! cardPresent ) {
|
||||
test.info().annotations.push({
|
||||
type: 'skip',
|
||||
description:
|
||||
'[pr-vision smoke] #prv-key-card absent: skipping write-only invariant check.',
|
||||
});
|
||||
test.skip();
|
||||
return;
|
||||
}
|
||||
|
||||
// Password input from class-prv-key-manager-renderer.php render_key_form():
|
||||
// <input type="password" id="prv_api_key" name="prv_api_key" ... value="" ...>
|
||||
// The renderer explicitly passes value="" -- the stored key is NEVER output.
|
||||
const keyInput = page.locator('#prv_api_key');
|
||||
|
||||
// When the key source is SOURCE_CONSTANT the input is disabled but still rendered.
|
||||
// In all cases it must be present in the DOM.
|
||||
await expect(keyInput).toBeAttached({ timeout: 10_000 });
|
||||
|
||||
// Write-only invariant: value attribute must be empty string, not the stored key.
|
||||
const inputValue = await keyInput.getAttribute('value');
|
||||
expect(inputValue ?? '').toBe('');
|
||||
|
||||
// Security check: known OpenRouter key prefixes must not appear anywhere in
|
||||
// the page HTML -- guards against accidental server-side leakage.
|
||||
const html = await page.content();
|
||||
expect(html).not.toContain('sk-or-');
|
||||
});
|
||||
});
|
||||
|
||||
test.describe('WP Admin - PR Vision Costs page', () => {
|
||||
test('costs page loads without fatal error', async ({ page }) => {
|
||||
const res = await page.goto(`${ADMIN}/admin.php?page=pr-vision-costs`);
|
||||
expect(res?.status()).toBe(200);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
|
||||
expect(body).not.toContain('Invalid plugin page');
|
||||
});
|
||||
});
|
||||
|
||||
test.describe('WP Admin - PR Vision Call Log page', () => {
|
||||
test('call log page loads without fatal error', async ({ page }) => {
|
||||
const res = await page.goto(`${ADMIN}/admin.php?page=pr-vision-calls`);
|
||||
expect(res?.status()).toBe(200);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
|
||||
expect(body).not.toContain('Invalid plugin page');
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user