Compare commits
1 Commits
main
...
claude/set
| Author | SHA1 | Date | |
|---|---|---|---|
|
dafbdb9f71 |
@@ -1,57 +0,0 @@
|
||||
name: Audit - direct push to main
|
||||
description: >-
|
||||
Tripwire (Gitea port of main-push-audit.yml): if the pushed commit is not tied
|
||||
to a merged pull request, open an issue labelled policy-violation + audit.
|
||||
Never blocks the push. Uses Gitea's /commits/{sha}/pull API.
|
||||
inputs:
|
||||
token:
|
||||
required: true
|
||||
runs:
|
||||
using: composite
|
||||
steps:
|
||||
- name: Check commit came from a merged PR
|
||||
shell: bash
|
||||
env:
|
||||
TOKEN: ${{ inputs.token }}
|
||||
PUSHER: ${{ github.event.pusher.username || github.event.pusher.login || github.actor }}
|
||||
HEAD_MSG: ${{ github.event.head_commit.message }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
API="$GITHUB_SERVER_URL/api/v1/repos/$GITHUB_REPOSITORY"
|
||||
H="Authorization: token $TOKEN"
|
||||
SHA="$GITHUB_SHA"; S7="${SHA:0:7}"
|
||||
for attempt in 1 2 3 4 5; do
|
||||
code=$(curl -s -o pr.json -w '%{http_code}' -H "$H" "$API/commits/$SHA/pull" || echo 000)
|
||||
if [ "$code" = 200 ] && python3 -c 'import json,sys; sys.exit(0 if json.load(open("pr.json")).get("merged") else 1)'; then
|
||||
echo "OK: commit $S7 came from PR #$(python3 -c 'import json;print(json.load(open("pr.json"))["number"])')"
|
||||
exit 0
|
||||
fi
|
||||
[ "$attempt" -lt 5 ] && sleep 10
|
||||
done
|
||||
# Ensure both labels exist, collect their ids.
|
||||
ids=()
|
||||
for L in policy-violation audit; do
|
||||
id=$(curl -s -H "$H" "$API/labels?limit=100" | python3 -c "import json,sys; print(next((str(l['id']) for l in json.load(sys.stdin) if l['name']=='$L'),''))")
|
||||
if [ -z "$id" ]; then
|
||||
color=$([ "$L" = audit ] && echo '#1d76db' || echo '#d93f0b')
|
||||
id=$(curl -s -H "$H" -H 'Content-Type: application/json' -X POST "$API/labels" \
|
||||
-d "{\"name\":\"$L\",\"color\":\"$color\"}" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("id",""))')
|
||||
fi
|
||||
[ -n "$id" ] && ids+=("$id")
|
||||
done
|
||||
MSG=$(printf '%s' "$HEAD_MSG" | head -1)
|
||||
python3 - "$S7" "${MSG:-(no message)}" "$PUSHER" "${ids[@]}" > issue.json <<'PY'
|
||||
import json, os, sys
|
||||
s7, msg, pusher, *ids = sys.argv[1:]
|
||||
run = f"{os.environ['GITHUB_SERVER_URL']}/{os.environ['GITHUB_REPOSITORY']}/actions/runs/{os.environ.get('GITHUB_RUN_NUMBER','')}"
|
||||
body = "\n".join([
|
||||
"**Direct push to `main` detected** - commit was not associated with a merged PR.", "",
|
||||
f"- Commit: `{s7}` - {msg}", f"- Pusher: @{pusher}", f"- Workflow run: {run}", "",
|
||||
"The project policy is that all changes to `main` go through a pull request so they can be "
|
||||
"reviewed before deploying to production. If this push was intentional (hotfix, infra change) "
|
||||
"close this issue with a comment explaining why.", "",
|
||||
"_Opened automatically by the audit-direct-push action (peptide-e2e)._"])
|
||||
print(json.dumps({"title": f"Direct push to main: {s7}", "body": body, "labels": [int(i) for i in ids]}))
|
||||
PY
|
||||
code=$(curl -s -o /dev/null -w '%{http_code}' -H "$H" -H 'Content-Type: application/json' -X POST "$API/issues" --data-binary @issue.json)
|
||||
echo "::warning::Opened audit issue for direct push $S7 (HTTP $code)"
|
||||
@@ -1,30 +0,0 @@
|
||||
name: CI - 300-line rule
|
||||
description: Fail if any tracked *.php under the given paths exceeds 300 lines (estate hard rule).
|
||||
inputs:
|
||||
paths:
|
||||
required: false
|
||||
default: includes
|
||||
runs:
|
||||
using: composite
|
||||
steps:
|
||||
- name: Check for PHP files over 300 lines
|
||||
shell: bash
|
||||
env:
|
||||
PATHS: ${{ inputs.paths }}
|
||||
run: |
|
||||
set -e
|
||||
OFFENDERS=""
|
||||
for DIR in $PATHS; do
|
||||
if [ ! -e "$DIR" ]; then echo "Warning: path '$DIR' does not exist - skipping."; continue; fi
|
||||
while IFS= read -r FILE; do
|
||||
[ -z "$FILE" ] && continue
|
||||
LINES=$(wc -l < "$FILE")
|
||||
if [ "$LINES" -gt 300 ]; then OFFENDERS="${OFFENDERS}${LINES} lines: ${FILE}\n"; fi
|
||||
done < <(git ls-files -- "$DIR" | grep '\.php$' || true)
|
||||
done
|
||||
if [ -n "$OFFENDERS" ]; then
|
||||
echo "::error::Files exceeding 300-line limit (estate hard rule):"
|
||||
printf "%b" "$OFFENDERS"
|
||||
exit 1
|
||||
fi
|
||||
echo "All tracked PHP files under '$PATHS' are within the 300-line limit."
|
||||
@@ -1,33 +0,0 @@
|
||||
name: CI - JS lint
|
||||
description: >-
|
||||
npm run lint if the repo declares it, else node --check on every *.js
|
||||
(Gitea port of lint-js). Node 22: the GitHub job used Node 20, which is
|
||||
end-of-life.
|
||||
runs:
|
||||
using: composite
|
||||
steps:
|
||||
- name: Setup Node
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: '22'
|
||||
cache: npm
|
||||
|
||||
- name: Install npm dependencies
|
||||
shell: bash
|
||||
run: npm ci
|
||||
|
||||
- name: Lint JavaScript
|
||||
shell: bash
|
||||
run: |
|
||||
if node -e "process.exit(require('./package.json').scripts?.lint ? 0 : 1)" 2>/dev/null; then
|
||||
echo "npm run lint script found - running it."
|
||||
npm run lint
|
||||
else
|
||||
echo "No 'lint' npm script - running node --check syntax scan."
|
||||
find . -name '*.js' \
|
||||
-not -path './vendor/*' \
|
||||
-not -path './node_modules/*' \
|
||||
-not -path './.git/*' \
|
||||
-not -path './.peptide-e2e/*' \
|
||||
-print0 | xargs -0 -r -I{} node --check {}
|
||||
fi
|
||||
@@ -1,37 +0,0 @@
|
||||
name: CI - PHP lint
|
||||
description: PHP syntax check (Gitea port of the lint-php job in the reusable ci.yml).
|
||||
inputs:
|
||||
php:
|
||||
required: true
|
||||
runs:
|
||||
using: composite
|
||||
steps:
|
||||
- name: Use preinstalled PHP ${{ inputs.php }} (peptide-php image)
|
||||
id: pre
|
||||
shell: bash
|
||||
env:
|
||||
V: ${{ inputs.php }}
|
||||
run: |
|
||||
if command -v "php$V" >/dev/null 2>&1; then
|
||||
update-alternatives --set php "/usr/bin/php$V" >/dev/null 2>&1 || ln -sf "/usr/bin/php$V" /usr/local/bin/php
|
||||
php -v | head -1; echo "hit=true" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "hit=false" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
- name: Setup PHP ${{ inputs.php }} (fallback when not preinstalled)
|
||||
if: ${{ steps.pre.outputs.hit != 'true' }}
|
||||
uses: shivammathur/setup-php@v2
|
||||
with:
|
||||
php-version: ${{ inputs.php }}
|
||||
coverage: none
|
||||
- name: Syntax check all PHP files
|
||||
shell: bash
|
||||
run: |
|
||||
set -e
|
||||
find . -name '*.php' \
|
||||
-not -path './vendor/*' \
|
||||
-not -path './node_modules/*' \
|
||||
-not -path './.git/*' \
|
||||
-not -path './.github/*' \
|
||||
-not -path './.gitea/*' \
|
||||
-print0 | xargs -0 -r -n1 -P4 php -l > /dev/null
|
||||
@@ -1,79 +0,0 @@
|
||||
name: CI - PHPCS
|
||||
description: >-
|
||||
WordPress Coding Standards (Gitea port of the phpcs job). On pull_request with
|
||||
autofix enabled, runs phpcbf and pushes fixes back to the PR branch; the caller
|
||||
must check out the PR head ref with a token that can push.
|
||||
inputs:
|
||||
autofix:
|
||||
required: false
|
||||
default: 'true'
|
||||
runs:
|
||||
using: composite
|
||||
steps:
|
||||
- name: Use preinstalled PHP 8.1 (peptide-php image)
|
||||
id: pre
|
||||
shell: bash
|
||||
run: |
|
||||
if command -v php8.1 >/dev/null 2>&1 && command -v composer >/dev/null 2>&1; then
|
||||
update-alternatives --set php /usr/bin/php8.1 >/dev/null 2>&1 || ln -sf /usr/bin/php8.1 /usr/local/bin/php
|
||||
php -v | head -1; echo "hit=true" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "hit=false" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
- name: Setup PHP (fallback when not preinstalled)
|
||||
if: ${{ steps.pre.outputs.hit != 'true' }}
|
||||
uses: shivammathur/setup-php@v2
|
||||
with:
|
||||
php-version: '8.1'
|
||||
coverage: none
|
||||
tools: composer:v2, phpcs
|
||||
|
||||
- name: Install WordPress Coding Standards
|
||||
shell: bash
|
||||
run: |
|
||||
composer global config --no-plugins \
|
||||
allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
|
||||
composer global require --no-interaction \
|
||||
"dealerdirect/phpcodesniffer-composer-installer:^1.0" \
|
||||
"wp-coding-standards/wpcs:^3.0" \
|
||||
"phpcsstandards/phpcsutils:^1.0" \
|
||||
"phpcsstandards/phpcsextra:^1.0"
|
||||
# Without setup-php's `tools: phpcs`, phpcs/phpcbf come from the global
|
||||
# composer bin dir (WPCS pulls in squizlabs/php_codesniffer).
|
||||
composer global config bin-dir --absolute 2>/dev/null | tail -1 >> "$GITHUB_PATH"
|
||||
|
||||
- name: Auto-fix with phpcbf (PR only, commit back if changed)
|
||||
if: ${{ github.event_name == 'pull_request' && inputs.autofix == 'true' }}
|
||||
shell: bash
|
||||
run: |
|
||||
PHPCS_CONFIG=""
|
||||
if [ -f phpcs.xml ]; then PHPCS_CONFIG="phpcs.xml"
|
||||
elif [ -f phpcs.xml.dist ]; then PHPCS_CONFIG="phpcs.xml.dist"
|
||||
elif [ -f .phpcs.xml.dist ]; then PHPCS_CONFIG=".phpcs.xml.dist"
|
||||
fi
|
||||
if [ -z "$PHPCS_CONFIG" ]; then echo "No phpcs config - phpcbf skipped."; exit 0; fi
|
||||
phpcbf --standard="$PHPCS_CONFIG" --extensions=php \
|
||||
--ignore=vendor/*,tests/*,node_modules/* . || true
|
||||
if ! git diff --quiet; then
|
||||
git config user.name "peptiderepo-ops"
|
||||
git config user.email "ops@peptiderepo.com"
|
||||
git add -A
|
||||
git commit -m "style: auto-fix PHPCS violations via phpcbf"
|
||||
git push
|
||||
fi
|
||||
|
||||
- name: Run PHPCS strict (fail on remaining violations)
|
||||
shell: bash
|
||||
run: |
|
||||
PHPCS_CONFIG=""
|
||||
if [ -f phpcs.xml ]; then PHPCS_CONFIG="phpcs.xml"
|
||||
elif [ -f phpcs.xml.dist ]; then PHPCS_CONFIG="phpcs.xml.dist"
|
||||
elif [ -f .phpcs.xml.dist ]; then PHPCS_CONFIG=".phpcs.xml.dist"
|
||||
fi
|
||||
if [ -z "$PHPCS_CONFIG" ]; then
|
||||
echo "No phpcs.xml / phpcs.xml.dist / .phpcs.xml.dist found - PHPCS skipped."
|
||||
exit 0
|
||||
fi
|
||||
phpcs --standard="$PHPCS_CONFIG" --extensions=php \
|
||||
--ignore=vendor/*,tests/*,node_modules/* \
|
||||
--warning-severity=0 --report=full .
|
||||
@@ -1,78 +0,0 @@
|
||||
name: CI - PHPUnit
|
||||
description: >-
|
||||
composer test for one PHP version (Gitea port of the phpunit job). For
|
||||
tests=wp-framework the caller declares a `mysql` service; on Gitea runners it is
|
||||
reached by its service name, not 127.0.0.1 as on GitHub VMs.
|
||||
inputs:
|
||||
php:
|
||||
required: true
|
||||
tests:
|
||||
description: "stubs | brain-monkey | wp-framework"
|
||||
required: false
|
||||
default: stubs
|
||||
db_host:
|
||||
required: false
|
||||
default: mysql
|
||||
runs:
|
||||
using: composite
|
||||
steps:
|
||||
- name: Install subversion (wp-framework only)
|
||||
if: ${{ inputs.tests == 'wp-framework' }}
|
||||
shell: bash
|
||||
run: command -v svn >/dev/null || (sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends subversion)
|
||||
|
||||
- name: Use preinstalled PHP ${{ inputs.php }} (peptide-php image)
|
||||
id: pre
|
||||
shell: bash
|
||||
env:
|
||||
V: ${{ inputs.php }}
|
||||
run: |
|
||||
if command -v "php$V" >/dev/null 2>&1 && command -v composer >/dev/null 2>&1; then
|
||||
update-alternatives --set php "/usr/bin/php$V" >/dev/null 2>&1 || ln -sf "/usr/bin/php$V" /usr/local/bin/php
|
||||
php -v | head -1; echo "hit=true" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "hit=false" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
- name: Setup PHP ${{ inputs.php }} (fallback when not preinstalled)
|
||||
if: ${{ steps.pre.outputs.hit != 'true' }}
|
||||
uses: shivammathur/setup-php@v2
|
||||
with:
|
||||
php-version: ${{ inputs.php }}
|
||||
coverage: none
|
||||
tools: composer:v2
|
||||
extensions: ${{ inputs.tests == 'wp-framework' && 'mysqli' || '' }}
|
||||
|
||||
- name: Install Composer dependencies
|
||||
shell: bash
|
||||
run: composer install --no-progress --no-interaction --prefer-dist
|
||||
|
||||
- name: Wait for MySQL (wp-framework only)
|
||||
if: ${{ inputs.tests == 'wp-framework' }}
|
||||
shell: bash
|
||||
env:
|
||||
DB_HOST: ${{ inputs.db_host }}
|
||||
run: |
|
||||
for i in $(seq 1 30); do
|
||||
if (exec 3<>/dev/tcp/$DB_HOST/3306) 2>/dev/null; then echo "MySQL is up"; exit 0; fi
|
||||
echo "Waiting for MySQL... ($i/30)"; sleep 2
|
||||
done
|
||||
echo "::error::MySQL at $DB_HOST:3306 never came up"; exit 1
|
||||
|
||||
- name: Install WordPress test suite (wp-framework only)
|
||||
# skip-db-create=true: the service already created wp_tests.
|
||||
# WP_CORE_DIR must end with a slash (concatenated verbatim into ABSPATH).
|
||||
if: ${{ inputs.tests == 'wp-framework' }}
|
||||
shell: bash
|
||||
env:
|
||||
WP_TESTS_DIR: /tmp/wordpress-tests-lib
|
||||
WP_CORE_DIR: /tmp/wordpress/
|
||||
DB_HOST: ${{ inputs.db_host }}
|
||||
run: |
|
||||
chmod +x bin/install-wp-tests.sh
|
||||
bin/install-wp-tests.sh wp_tests root root "$DB_HOST:3306" latest true
|
||||
|
||||
- name: Run PHPUnit
|
||||
shell: bash
|
||||
env:
|
||||
WP_TESTS_DIR: /tmp/wordpress-tests-lib
|
||||
run: composer test
|
||||
@@ -1,103 +0,0 @@
|
||||
name: Deploy to Hostinger
|
||||
description: >-
|
||||
rsync one plugin/theme to staging or production on Hostinger. Gitea port of the
|
||||
GitHub reusable deploy-app.yml (Gitea 1.25 has no workflow_call): same rsync
|
||||
excludes, retry-on-throttle (Hostinger rate-limits runner IPs), best-effort
|
||||
plugin-inventory guard and health check. New: records the deployed commit in
|
||||
~/.peptide-deploys/<stage>/<target> (outside public_html) for deploy-health.
|
||||
|
||||
inputs:
|
||||
stage:
|
||||
description: "staging | production"
|
||||
required: true
|
||||
target_path:
|
||||
description: "wp-content subpath, e.g. wp-content/plugins/prautoblogger"
|
||||
required: true
|
||||
ssh_private_key:
|
||||
required: true
|
||||
ssh_host:
|
||||
required: true
|
||||
ssh_port:
|
||||
required: true
|
||||
ssh_username:
|
||||
required: true
|
||||
|
||||
runs:
|
||||
using: composite
|
||||
steps:
|
||||
- name: rsync to ${{ inputs.stage }} (retry-on-throttle + inventory guard)
|
||||
shell: bash
|
||||
env:
|
||||
STAGE: ${{ inputs.stage }}
|
||||
TARGET_PATH: ${{ inputs.target_path }}
|
||||
SSH_PRIVATE_KEY: ${{ inputs.ssh_private_key }}
|
||||
SSH_HOST: ${{ inputs.ssh_host }}
|
||||
SSH_PORT: ${{ inputs.ssh_port }}
|
||||
SSH_USERNAME: ${{ inputs.ssh_username }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
case "$STAGE" in staging|production) ;; *) echo "::error::stage must be staging or production"; exit 1 ;; esac
|
||||
case "$TARGET_PATH" in
|
||||
*..*) echo "::error::'..' not allowed in target_path"; exit 1 ;;
|
||||
wp-content/plugins/?*|wp-content/themes/?*|wp-content/mu-plugins/?*) ;;
|
||||
*) echo "::error::refusing target_path '$TARGET_PATH'"; exit 1 ;;
|
||||
esac
|
||||
WORK=$(mktemp -d); trap 'rm -rf "$WORK"' EXIT
|
||||
printf '%s\n' "$SSH_PRIVATE_KEY" > "$WORK/key"; chmod 600 "$WORK/key"
|
||||
ssh-keyscan -p "$SSH_PORT" "$SSH_HOST" > "$WORK/known_hosts" 2>/dev/null || true
|
||||
SSHOPT="-i $WORK/key -p $SSH_PORT -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=$WORK/known_hosts -o ConnectTimeout=30 -o BatchMode=yes"
|
||||
R="$SSH_USERNAME@$SSH_HOST"
|
||||
BASE="/home/$SSH_USERNAME/domains/peptiderepo.com/public_html"
|
||||
if [ "$STAGE" = staging ]; then DEST="$BASE/staging/$TARGET_PATH"; else DEST="$BASE/$TARGET_PATH"; fi
|
||||
|
||||
PRE=0
|
||||
if [ "$STAGE" = production ]; then
|
||||
PRE=$(ssh -n $SSHOPT "$R" "wp --path=$BASE plugin list --status=active --field=name 2>/dev/null | wc -l" 2>/dev/null || echo 0)
|
||||
echo "Pre-deploy active plugins (best-effort): $PRE"
|
||||
fi
|
||||
|
||||
n=0
|
||||
until [ "$n" -ge 4 ]; do
|
||||
rsync -avz --delete \
|
||||
--exclude '.git' --exclude '.github' --exclude '.gitea' --exclude 'tests' --exclude 'node_modules' \
|
||||
--exclude 'vendor' --exclude 'composer.json' --exclude 'composer.lock' \
|
||||
--exclude 'phpunit.xml' --exclude 'phpunit.xml.dist' --exclude 'phpcs.xml.dist' \
|
||||
--exclude '.phpcs.xml.dist' --exclude 'ARCHITECTURE.md' --exclude 'CONVENTIONS.md' \
|
||||
--exclude 'CHANGELOG.md' --exclude 'qa-reviews' \
|
||||
-e "ssh $SSHOPT" \
|
||||
./ "$R:$DEST/" && break
|
||||
n=$((n+1)); echo "$STAGE rsync failed (attempt $n/4) - Hostinger may be throttling runner IPs; retrying in 25s..."; sleep 25
|
||||
done
|
||||
[ "$n" -lt 4 ] || { echo "::error::$STAGE rsync failed after 4 attempts"; exit 1; }
|
||||
|
||||
if [ "$STAGE" = production ]; then
|
||||
# Same remote command as the GitHub pipeline (the litespeed purge there runs
|
||||
# relative to $HOME, i.e. is effectively a no-op; kept as-is, see port notes).
|
||||
POST=$(ssh -n $SSHOPT "$R" "wp --path=$BASE plugin list --status=active --field=name 2>/dev/null | wc -l; find wp-content/litespeed/ -type f -delete 2>/dev/null; touch .lscache_purge 2>/dev/null || true" 2>/dev/null | head -1 || echo 0)
|
||||
echo "Post-deploy active plugins (best-effort): $POST"
|
||||
if [ "${PRE:-0}" -gt 0 ] && [ "${POST:-0}" -gt 0 ] && [ "${POST:-0}" -lt "${PRE:-0}" ]; then
|
||||
echo "::error::active plugin count dropped ${PRE} -> ${POST} after deploy"; exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Stamp the commit that was actually rsynced (the checked-out tree), not
|
||||
# GITHUB_SHA, so a rollback of an older commit is recorded truthfully.
|
||||
DEPLOYED=$(git rev-parse HEAD 2>/dev/null || echo "$GITHUB_SHA")
|
||||
SLUG=$(printf '%s' "$TARGET_PATH" | tr '/' '_')
|
||||
ssh -n $SSHOPT "$R" "mkdir -p ~/.peptide-deploys/$STAGE && printf '%s %s %s\n' '$DEPLOYED' '$GITHUB_REPOSITORY' \"\$(date -u +%FT%TZ)\" > ~/.peptide-deploys/$STAGE/$SLUG" \
|
||||
|| echo "::warning::could not record deployed commit for deploy-health"
|
||||
echo "Deployed ${DEPLOYED:0:7} to $STAGE:$TARGET_PATH"
|
||||
|
||||
- name: Health check (${{ inputs.stage }})
|
||||
shell: bash
|
||||
env:
|
||||
STAGE: ${{ inputs.stage }}
|
||||
run: |
|
||||
sleep 5
|
||||
if [ "$STAGE" = staging ]; then
|
||||
echo "Staging responded: HTTP $(curl -s -o /dev/null -w '%{http_code}' https://staging.peptiderepo.com/ || echo 000)"
|
||||
exit 0
|
||||
fi
|
||||
S=$(curl -s -o /dev/null -w '%{http_code}' https://peptiderepo.com)
|
||||
if [ "$S" != "200" ] && [ "$S" != "403" ]; then echo "::error::site returned HTTP $S"; exit 1; fi
|
||||
echo "Production healthy (HTTP $S)"
|
||||
@@ -1,70 +0,0 @@
|
||||
name: Smoke tests (staging)
|
||||
description: >-
|
||||
Playwright smoke suite from peptide-e2e against staging. Gitea port of
|
||||
smoke.yml. Checks peptide-e2e out into .peptide-e2e so it never clobbers the
|
||||
caller's checkout. Uses upload-artifact@v3 (Gitea does not support v4).
|
||||
|
||||
inputs:
|
||||
base_url:
|
||||
required: false
|
||||
default: https://staging.peptiderepo.com
|
||||
wp_admin_user:
|
||||
required: true
|
||||
wp_admin_password:
|
||||
required: true
|
||||
e2e_ref:
|
||||
required: false
|
||||
default: main
|
||||
|
||||
runs:
|
||||
using: composite
|
||||
steps:
|
||||
- name: Checkout peptide-e2e
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: peptide-repo/peptide-e2e
|
||||
ref: ${{ inputs.e2e_ref }}
|
||||
path: .peptide-e2e
|
||||
|
||||
- name: Set up Node.js
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: '22'
|
||||
cache: npm
|
||||
cache-dependency-path: .peptide-e2e/package-lock.json
|
||||
|
||||
- name: Install dependencies
|
||||
shell: bash
|
||||
working-directory: .peptide-e2e
|
||||
run: npm ci
|
||||
|
||||
- name: Install Playwright browsers
|
||||
# OS deps are pre-installed on the runner host; --with-deps needs sudo.
|
||||
shell: bash
|
||||
working-directory: .peptide-e2e
|
||||
run: npx playwright install chromium
|
||||
|
||||
- name: Run smoke tests
|
||||
shell: bash
|
||||
working-directory: .peptide-e2e
|
||||
env:
|
||||
BASE_URL: ${{ inputs.base_url }}
|
||||
WP_ADMIN_USER: ${{ inputs.wp_admin_user }}
|
||||
WP_ADMIN_PASSWORD: ${{ inputs.wp_admin_password }}
|
||||
run: npx playwright test
|
||||
|
||||
- name: Upload test report
|
||||
if: always()
|
||||
uses: actions/upload-artifact@v3
|
||||
with:
|
||||
name: playwright-report
|
||||
path: .peptide-e2e/playwright-report/
|
||||
retention-days: 14
|
||||
|
||||
- name: Upload failure screenshots/videos
|
||||
if: failure()
|
||||
uses: actions/upload-artifact@v3
|
||||
with:
|
||||
name: playwright-failures
|
||||
path: .peptide-e2e/test-results/
|
||||
retention-days: 7
|
||||
@@ -1,62 +0,0 @@
|
||||
name: Deploy health (daily drift check)
|
||||
|
||||
# Gitea rewrite of .github/workflows/deploy-health.yml. GitHub's version read
|
||||
# GitHub Deployment objects, which Gitea does not have. This one compares what is
|
||||
# ACTUALLY on the server: the deploy composite action stamps
|
||||
# ~/.peptide-deploys/production/<target> with the deployed commit, and this job
|
||||
# compares that stamp with each repo's main HEAD. Drift (or a missing stamp after
|
||||
# cutover) opens one issue in peptide-e2e; it never opens duplicates.
|
||||
on:
|
||||
schedule:
|
||||
- cron: '0 13 * * *' # 21:00 SGT, same slot as the GitHub job
|
||||
workflow_dispatch: {}
|
||||
|
||||
jobs:
|
||||
drift:
|
||||
name: Compare deployed commit with main
|
||||
runs-on: peptide-vps
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Check every deployable repo
|
||||
shell: bash
|
||||
env:
|
||||
TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
||||
SSH_HOST: ${{ secrets.SSH_HOST }}
|
||||
SSH_PORT: ${{ secrets.SSH_PORT }}
|
||||
SSH_USERNAME: ${{ secrets.SSH_USERNAME }}
|
||||
PROD_ENABLED: ${{ vars.PROD_DEPLOY_ENABLED }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
WORK=$(mktemp -d); trap 'rm -rf "$WORK"' EXIT
|
||||
printf '%s\n' "$SSH_PRIVATE_KEY" > "$WORK/key"; chmod 600 "$WORK/key"
|
||||
ssh-keyscan -p "$SSH_PORT" "$SSH_HOST" > "$WORK/kh" 2>/dev/null || true
|
||||
SSHOPT="-n -i $WORK/key -p $SSH_PORT -o UserKnownHostsFile=$WORK/kh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=30 -o BatchMode=yes"
|
||||
API="$GITHUB_SERVER_URL/api/v1"; H="Authorization: token $TOKEN"
|
||||
problems=""
|
||||
for row in $(python3 -c 'import json; d=json.load(open("tools/gitea-pipeline/repos.json")); [print(k+"="+v["target_path"]) for k,v in d.items() if not k.startswith("_") and v.get("target_path")]'); do
|
||||
repo=${row%%=*}; tp=${row#*=}; slug=$(printf '%s' "$tp" | tr '/' '_')
|
||||
# The job token is scoped to peptide-e2e; the repos are public, so read
|
||||
# their branches anonymously. Unreadable main = a problem, not a crash.
|
||||
head=$(curl -s "$API/repos/peptide-repo/$repo/branches/main" | python3 -c 'import json,sys
|
||||
try: print(json.load(sys.stdin)["commit"]["id"])
|
||||
except Exception: print("")')
|
||||
if [ -z "$head" ]; then problems="$problems\n- $repo: could not read main from Gitea"; continue; fi
|
||||
stamp=$(ssh $SSHOPT "$SSH_USERNAME@$SSH_HOST" "cat ~/.peptide-deploys/production/$slug 2>/dev/null" || true)
|
||||
dep=${stamp%% *}
|
||||
if [ -z "$dep" ]; then
|
||||
msg="$repo: no Gitea production deploy recorded"
|
||||
if [ "$PROD_ENABLED" = "true" ]; then problems="$problems\n- $msg (main is ${head:0:7})"; else echo "::notice::$msg (expected before cutover)"; fi
|
||||
elif [ "$dep" != "$head" ]; then
|
||||
problems="$problems\n- $repo: production has ${dep:0:7}, main is ${head:0:7}"
|
||||
else
|
||||
echo "OK $repo ${head:0:7}"
|
||||
fi
|
||||
done
|
||||
[ -z "$problems" ] && { echo "No drift."; exit 0; }
|
||||
printf "Drift found:%b\n" "$problems"
|
||||
open=$(curl -s -H "$H" "$API/repos/$GITHUB_REPOSITORY/issues?state=open&type=issues&limit=50" | python3 -c 'import json,sys;print(sum(1 for i in json.load(sys.stdin) if i["title"]=="Deploy drift detected"))')
|
||||
if [ "$open" -gt 0 ]; then echo "An open drift issue already exists; not opening another."; exit 1; fi
|
||||
python3 -c 'import json,sys; print(json.dumps({"title": "Deploy drift detected", "body": "Daily deploy-health found production out of step with main:\n" + sys.argv[1].replace("\\n","\n") + "\n\nRe-run the repo pipeline on main (workflow_dispatch) or investigate the failed deploy. Opened by deploy-health.yml."}))' "$problems" > issue.json
|
||||
curl -s -o /dev/null -w "issue HTTP %{http_code}\n" -H "$H" -H 'Content-Type: application/json' -X POST "$API/repos/$GITHUB_REPOSITORY/issues" --data-binary @issue.json
|
||||
exit 1
|
||||
@@ -1,41 +0,0 @@
|
||||
# GENERATED by peptide-e2e/tools/gitea-pipeline/render.py from repos.json.
|
||||
# Do not edit by hand: change repos.json or the template and re-render.
|
||||
name: CI / Deploy
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
pull_request: {}
|
||||
workflow_dispatch: {}
|
||||
|
||||
concurrency:
|
||||
group: pipeline-peptide-e2e-${{ github.ref }}
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
lint-php:
|
||||
name: PHP Lint (${{ matrix.php }})
|
||||
runs-on: ubuntu-latest
|
||||
container: git.protopeer.com/peptide-repo/ci-php:2026-10
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
php: ["8.1", "8.2", "8.3"]
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: https://git.protopeer.com/peptide-repo/peptide-e2e/.gitea/actions/ci-lint-php@main
|
||||
with:
|
||||
php: ${{ matrix.php }}
|
||||
|
||||
phpcs:
|
||||
name: PHPCS (WordPress standards)
|
||||
runs-on: ubuntu-latest
|
||||
container: git.protopeer.com/peptide-repo/ci-php:2026-10
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
ref: ${{ github.head_ref || github.ref_name }}
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
- uses: https://git.protopeer.com/peptide-repo/peptide-e2e/.gitea/actions/ci-phpcs@main
|
||||
with:
|
||||
autofix: 'false'
|
||||
@@ -1,24 +0,0 @@
|
||||
name: Smoke Tests (manual)
|
||||
|
||||
# Manual run of the staging smoke suite (the deploy pipeline runs it automatically
|
||||
# via the smoke composite action). Gitea port of the workflow_dispatch half of
|
||||
# .github/workflows/smoke.yml.
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
base_url:
|
||||
description: 'Target URL (defaults to staging)'
|
||||
required: false
|
||||
default: 'https://staging.peptiderepo.com'
|
||||
|
||||
jobs:
|
||||
smoke:
|
||||
name: Playwright smoke suite
|
||||
runs-on: peptide-vps
|
||||
timeout-minutes: 15
|
||||
steps:
|
||||
- uses: https://git.protopeer.com/peptide-repo/peptide-e2e/.gitea/actions/smoke@main
|
||||
with:
|
||||
base_url: ${{ inputs.base_url }}
|
||||
wp_admin_user: ${{ secrets.STAGING_WP_ADMIN_USER }}
|
||||
wp_admin_password: ${{ secrets.STAGING_WP_ADMIN_PASSWORD }}
|
||||
27
.github/workflows/ci-self-test.yml
vendored
27
.github/workflows/ci-self-test.yml
vendored
@@ -1,27 +0,0 @@
|
||||
# Self-test: exercises the reusable ci.yml on this repo itself.
|
||||
# Uses tests: none (peptide-e2e is a Playwright/Node repo, no PHP suite).
|
||||
# permissions: contents: write is required at the caller level — any caller of
|
||||
# ci.yml must declare this so the phpcs job can commit phpcbf fixes back to the
|
||||
# PR branch. Even with phpcs_autofix: false here, the permission must be declared
|
||||
# for the reusable workflow to pass GH's startup permission-escalation check.
|
||||
|
||||
name: CI Self-Test (reusable ci.yml)
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main, 'claude/**']
|
||||
pull_request:
|
||||
branches: [main]
|
||||
|
||||
permissions:
|
||||
contents: write # required: called ci.yml phpcs job declares job-level write for phpcbf
|
||||
|
||||
jobs:
|
||||
ci:
|
||||
uses: ./.github/workflows/ci.yml
|
||||
with:
|
||||
tests: none
|
||||
enforce_300: false
|
||||
has_js: false
|
||||
phpcs_autofix: false
|
||||
secrets: inherit
|
||||
388
.github/workflows/ci.yml
vendored
388
.github/workflows/ci.yml
vendored
@@ -1,388 +0,0 @@
|
||||
##
|
||||
# Reusable CI workflow — peptiderepo estate
|
||||
#
|
||||
# Usage (in any repo's .github/workflows/ci.yml):
|
||||
#
|
||||
# jobs:
|
||||
# ci:
|
||||
# uses: peptide-repo/peptide-e2e/.github/workflows/ci.yml@main
|
||||
# with:
|
||||
# tests: stubs # or wp-framework | brain-monkey | none
|
||||
# has_js: false
|
||||
# secrets: inherit
|
||||
#
|
||||
# Inputs:
|
||||
# php_versions (string) JSON array of PHP versions to matrix over.
|
||||
# Default: '["8.1","8.2","8.3"]'
|
||||
# tests (string) PHPUnit environment. One of:
|
||||
# stubs — WP stubs only; no DB/service; fast.
|
||||
# brain-monkey — Brain Monkey mocking; no DB/service.
|
||||
# wp-framework — Full WordPress test framework with MySQL.
|
||||
# none — Skip phpunit entirely (temporary; remove
|
||||
# at rollout when the repo gains a suite).
|
||||
# Default: stubs
|
||||
# enforce_300 (boolean) Fail if any tracked *.php under line_limit_paths exceeds
|
||||
# 300 lines (the estate hard rule). Default: true
|
||||
# line_limit_paths (string) Space-separated directory/path(s) the 300-line rule
|
||||
# applies to. Default: 'includes'
|
||||
# has_js (boolean) Whether to run JS linting. Default: false
|
||||
# phpcs_autofix (boolean) On pull_request events: run phpcbf and commit any fixes
|
||||
# back to the branch before strict phpcs. On push events:
|
||||
# skip the commit (no loop) but still run strict phpcs.
|
||||
# Default: true
|
||||
#
|
||||
# Job names (fixed — callers and deploy-app.yml gate on these):
|
||||
# lint-php PHP syntax check across php_versions matrix.
|
||||
# phpcs WordPress Coding Standards; phpcbf auto-commit on PRs.
|
||||
# file-size 300-line rule enforcement (skipped when enforce_300: false).
|
||||
# phpunit PHPUnit across php_versions matrix (skipped when tests: none).
|
||||
# lint-js JS linting (skipped when has_js: false).
|
||||
#
|
||||
# Design notes:
|
||||
# - phpcbf auto-commit pattern is the prautoblogger gold standard (see
|
||||
# prautoblogger/.github/workflows/ci.yml). The GITHUB_TOKEN commit does
|
||||
# NOT trigger a new CI run per GitHub's loop-prevention rules.
|
||||
# - WP test framework path replicates peptide-starter-theme's three gotchas:
|
||||
# (1) install svn — ubuntu-latest no longer ships it;
|
||||
# (2) MySQL service pre-creates the DB via MYSQL_DATABASE, so pass
|
||||
# skip-db-create=true as the 6th arg to install-wp-tests.sh;
|
||||
# (3) WP_CORE_DIR must have a trailing slash (bootstrapped into ABSPATH
|
||||
# and concatenated verbatim — missing slash produces wrong path).
|
||||
# - Every repo calls `composer test` regardless of the `tests` input; the
|
||||
# input only controls environment provisioning, not the command.
|
||||
# - permissions: the phpcs job declares `contents: write` at job level for
|
||||
# phpcbf commit-back. GitHub requires the CALLING WORKFLOW to also declare
|
||||
# `permissions: contents: write` at the caller's workflow level — GH enforces
|
||||
# that callers cannot be escalated beyond their declared scope, even by job-level
|
||||
# overrides in the reusable workflow. All caller repos must include this.
|
||||
##
|
||||
|
||||
name: CI — Reusable
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
php_versions:
|
||||
description: >-
|
||||
JSON array of PHP versions to matrix over.
|
||||
Example: '["8.1","8.2","8.3"]'
|
||||
required: false
|
||||
default: '["8.1","8.2","8.3"]'
|
||||
type: string
|
||||
tests:
|
||||
description: >-
|
||||
PHPUnit environment. One of: stubs | wp-framework | brain-monkey | none.
|
||||
All environments run `composer test`; this input controls setup only.
|
||||
required: false
|
||||
default: stubs
|
||||
type: string
|
||||
enforce_300:
|
||||
description: >-
|
||||
Fail if any tracked *.php under line_limit_paths exceeds 300 lines.
|
||||
required: false
|
||||
default: true
|
||||
type: boolean
|
||||
line_limit_paths:
|
||||
description: >-
|
||||
Space-separated directory/path(s) to which the 300-line rule applies.
|
||||
required: false
|
||||
default: includes
|
||||
type: string
|
||||
has_js:
|
||||
description: >-
|
||||
Whether to run JS linting (node --check / npm run lint).
|
||||
required: false
|
||||
default: false
|
||||
type: boolean
|
||||
phpcs_autofix:
|
||||
description: >-
|
||||
On pull_request: run phpcbf and commit fixes back to the branch before
|
||||
strict phpcs. On push: skip the commit but still run strict phpcs.
|
||||
required: false
|
||||
default: true
|
||||
type: boolean
|
||||
|
||||
jobs:
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# lint-php: PHP syntax check — matrix over php_versions
|
||||
# ---------------------------------------------------------------------------
|
||||
lint-php:
|
||||
name: PHP Lint (${{ matrix.php }})
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
php: ${{ fromJson(inputs.php_versions) }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Setup PHP ${{ matrix.php }}
|
||||
uses: shivammathur/setup-php@v2
|
||||
with:
|
||||
php-version: ${{ matrix.php }}
|
||||
coverage: none
|
||||
|
||||
- name: Syntax check all PHP files
|
||||
# Exclude vendor/, node_modules/, .git/, .github/ (mu-plugins may use
|
||||
# version-specific syntax). -P4 parallelises across 4 cores.
|
||||
run: |
|
||||
set -e
|
||||
find . -name '*.php' \
|
||||
-not -path './vendor/*' \
|
||||
-not -path './node_modules/*' \
|
||||
-not -path './.git/*' \
|
||||
-not -path './.github/*' \
|
||||
-print0 | xargs -0 -n1 -P4 php -l > /dev/null
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# phpcs: WordPress Coding Standards + phpcbf auto-fix on PRs
|
||||
# ---------------------------------------------------------------------------
|
||||
phpcs:
|
||||
name: PHPCS (WordPress standards)
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: write # allows phpcbf auto-fix commits back to the PR branch
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
# Check out the actual PR branch head so phpcbf can push fixes back.
|
||||
# On push events github.head_ref is empty; fall back to github.ref_name.
|
||||
ref: ${{ github.head_ref || github.ref_name }}
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Setup PHP
|
||||
uses: shivammathur/setup-php@v2
|
||||
with:
|
||||
php-version: '8.1'
|
||||
coverage: none
|
||||
tools: composer:v2, phpcs
|
||||
|
||||
- name: Install WordPress Coding Standards
|
||||
run: |
|
||||
composer global config --no-plugins \
|
||||
allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
|
||||
composer global require --no-interaction \
|
||||
"dealerdirect/phpcodesniffer-composer-installer:^1.0" \
|
||||
"wp-coding-standards/wpcs:^3.0" \
|
||||
"phpcsstandards/phpcsutils:^1.0" \
|
||||
"phpcsstandards/phpcsextra:^1.0"
|
||||
|
||||
- name: Auto-fix with phpcbf (PR only — commit back to branch if changed)
|
||||
# Only runs on pull_request events AND when phpcs_autofix is enabled.
|
||||
# phpcbf exits 1 when it makes fixes and 0 when nothing to fix; both are
|
||||
# treated as success here (|| true). Commits via GITHUB_TOKEN do NOT
|
||||
# trigger a new CI run — GitHub prevents loops on bot commits.
|
||||
if: ${{ github.event_name == 'pull_request' && inputs.phpcs_autofix }}
|
||||
run: |
|
||||
# Detect which phpcs config file is present; pass it explicitly to
|
||||
# --standard so phpcbf and phpcs always agree with the guard check.
|
||||
PHPCS_CONFIG=""
|
||||
if [ -f phpcs.xml ]; then PHPCS_CONFIG="phpcs.xml"
|
||||
elif [ -f phpcs.xml.dist ]; then PHPCS_CONFIG="phpcs.xml.dist"
|
||||
elif [ -f .phpcs.xml.dist ]; then PHPCS_CONFIG=".phpcs.xml.dist"
|
||||
fi
|
||||
if [ -z "$PHPCS_CONFIG" ]; then
|
||||
echo "No phpcs.xml / phpcs.xml.dist / .phpcs.xml.dist — phpcbf skipped."
|
||||
exit 0
|
||||
fi
|
||||
phpcbf --standard="$PHPCS_CONFIG" \
|
||||
--extensions=php \
|
||||
--ignore=vendor/*,tests/*,node_modules/* \
|
||||
. || true
|
||||
if ! git diff --quiet; then
|
||||
git config user.name "peptiderepo"
|
||||
git config user.email "peptiderepo@users.noreply.github.com"
|
||||
git add -A
|
||||
git commit -m "style: auto-fix PHPCS violations via phpcbf"
|
||||
git push
|
||||
fi
|
||||
|
||||
- name: Run PHPCS strict (fail on remaining violations)
|
||||
# Runs on all events (push AND pull_request). After phpcbf has committed
|
||||
# any auto-fixable issues on PRs, only non-auto-fixable violations land
|
||||
# here. On push events phpcbf is skipped but phpcs is still strict.
|
||||
# Guard: skip gracefully if no phpcs config file exists (repo not yet configured).
|
||||
run: |
|
||||
# Detect which phpcs config file is present (mirrors the phpcbf step above).
|
||||
PHPCS_CONFIG=""
|
||||
if [ -f phpcs.xml ]; then PHPCS_CONFIG="phpcs.xml"
|
||||
elif [ -f phpcs.xml.dist ]; then PHPCS_CONFIG="phpcs.xml.dist"
|
||||
elif [ -f .phpcs.xml.dist ]; then PHPCS_CONFIG=".phpcs.xml.dist"
|
||||
fi
|
||||
if [ -z "$PHPCS_CONFIG" ]; then
|
||||
echo "No phpcs.xml / phpcs.xml.dist / .phpcs.xml.dist found — PHPCS skipped."
|
||||
echo "Add a phpcs.xml to enable coding standards enforcement."
|
||||
exit 0
|
||||
fi
|
||||
phpcs --standard="$PHPCS_CONFIG" \
|
||||
--extensions=php \
|
||||
--ignore=vendor/*,tests/*,node_modules/* \
|
||||
--warning-severity=0 \
|
||||
--report=full \
|
||||
.
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# file-size: 300-line rule enforcement
|
||||
# ---------------------------------------------------------------------------
|
||||
file-size:
|
||||
name: 300-line rule (${{ inputs.line_limit_paths }})
|
||||
runs-on: ubuntu-latest
|
||||
if: ${{ inputs.enforce_300 }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Check for PHP files over 300 lines
|
||||
# Scans only tracked *.php files under line_limit_paths (not vendor etc.).
|
||||
# Prints every offender with its line count, then fails the job so the
|
||||
# engineer has a clear list to split.
|
||||
env:
|
||||
# Use env: block to avoid shell-injection from caller-controlled input.
|
||||
PATHS: ${{ inputs.line_limit_paths }}
|
||||
run: |
|
||||
set -e
|
||||
OFFENDERS=""
|
||||
for DIR in $PATHS; do
|
||||
if [ ! -e "$DIR" ]; then
|
||||
echo "Warning: path '$DIR' does not exist in this repo — skipping."
|
||||
continue
|
||||
fi
|
||||
while IFS= read -r FILE; do
|
||||
if [ -z "$FILE" ]; then continue; fi
|
||||
LINES=$(wc -l < "$FILE")
|
||||
if [ "$LINES" -gt 300 ]; then
|
||||
OFFENDERS="${OFFENDERS}${LINES} lines: ${FILE}\n"
|
||||
fi
|
||||
done < <(git ls-files -- "$DIR" | grep '\.php$')
|
||||
done
|
||||
if [ -n "$OFFENDERS" ]; then
|
||||
echo "::error::Files exceeding 300-line limit (estate hard rule):"
|
||||
printf "%b" "$OFFENDERS"
|
||||
exit 1
|
||||
fi
|
||||
echo "All tracked PHP files under '$PATHS' are within the 300-line limit."
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# phpunit: PHPUnit — matrix over php_versions
|
||||
# Skipped entirely when tests == 'none'.
|
||||
# ---------------------------------------------------------------------------
|
||||
phpunit:
|
||||
name: PHPUnit — ${{ inputs.tests }} (PHP ${{ matrix.php }})
|
||||
runs-on: ubuntu-latest
|
||||
if: ${{ inputs.tests != 'none' }}
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
php: ${{ fromJson(inputs.php_versions) }}
|
||||
|
||||
# MySQL service is declared for all variants but only connected when
|
||||
# tests == 'wp-framework'. On stubs/brain-monkey the service starts but is
|
||||
# never touched — marginal overhead, keeps the YAML unconditional.
|
||||
services:
|
||||
mysql:
|
||||
image: mysql:8.0
|
||||
env:
|
||||
MYSQL_ROOT_PASSWORD: root
|
||||
# The WP test bootstrap expects this DB to exist. Passing
|
||||
# skip-db-create=true (6th arg) to install-wp-tests.sh relies on
|
||||
# MySQL having created it already via this env var.
|
||||
MYSQL_DATABASE: wp_tests
|
||||
ports:
|
||||
- 3306:3306
|
||||
options: >-
|
||||
--health-cmd="mysqladmin ping"
|
||||
--health-interval=10s
|
||||
--health-timeout=5s
|
||||
--health-retries=5
|
||||
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Install subversion (wp-framework only)
|
||||
# ubuntu-latest no longer ships svn. The WP test-suite bootstrap script
|
||||
# checks out develop.svn.wordpress.org via svn.
|
||||
# Gotcha #1 of the three known WP PHPUnit CI gotchas.
|
||||
if: ${{ inputs.tests == 'wp-framework' }}
|
||||
run: sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends subversion
|
||||
|
||||
- name: Setup PHP ${{ matrix.php }}
|
||||
uses: shivammathur/setup-php@v2
|
||||
with:
|
||||
php-version: ${{ matrix.php }}
|
||||
coverage: none
|
||||
tools: composer:v2
|
||||
extensions: ${{ inputs.tests == 'wp-framework' && 'mysqli' || '' }}
|
||||
|
||||
- name: Install Composer dependencies
|
||||
run: composer install --no-progress --no-interaction --prefer-dist
|
||||
|
||||
- name: Wait for MySQL (wp-framework only)
|
||||
if: ${{ inputs.tests == 'wp-framework' }}
|
||||
run: |
|
||||
for i in {1..30}; do
|
||||
if mysqladmin ping -h 127.0.0.1 -P 3306 -u root -proot --silent; then
|
||||
echo "MySQL is up"; break
|
||||
fi
|
||||
echo "Waiting for MySQL... ($i/30)"; sleep 2
|
||||
done
|
||||
|
||||
- name: Install WordPress test suite (wp-framework only)
|
||||
# Gotcha #2: pass skip-db-create=true (6th arg) — the MySQL service
|
||||
# already created wp_tests via MYSQL_DATABASE; re-creating it fails.
|
||||
# Gotcha #3: WP_CORE_DIR must end with a trailing slash. The bootstrap
|
||||
# concatenates this verbatim as ABSPATH + 'wp-settings.php'. Without
|
||||
# the slash: '/tmp/wordpresswp-settings.php' -> fatal bootstrap error.
|
||||
if: ${{ inputs.tests == 'wp-framework' }}
|
||||
env:
|
||||
WP_TESTS_DIR: /tmp/wordpress-tests-lib
|
||||
WP_CORE_DIR: /tmp/wordpress/
|
||||
run: |
|
||||
chmod +x bin/install-wp-tests.sh
|
||||
bin/install-wp-tests.sh wp_tests root root 127.0.0.1:3306 latest true
|
||||
|
||||
- name: Run PHPUnit
|
||||
# Every repo calls `composer test` regardless of environment.
|
||||
# The repo's composer.json `test` script points to vendor/bin/phpunit
|
||||
# with the appropriate phpunit.xml config for that repo.
|
||||
env:
|
||||
WP_TESTS_DIR: /tmp/wordpress-tests-lib
|
||||
run: composer test
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# lint-js: JavaScript linting (only when has_js == true)
|
||||
# ---------------------------------------------------------------------------
|
||||
lint-js:
|
||||
name: JS Lint
|
||||
runs-on: ubuntu-latest
|
||||
if: ${{ inputs.has_js }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Setup Node
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: '20'
|
||||
cache: 'npm'
|
||||
|
||||
- name: Install npm dependencies
|
||||
run: npm ci
|
||||
|
||||
- name: Lint JavaScript
|
||||
# Prefer `npm run lint` if the repo defines it (catches ESLint etc.).
|
||||
# Fall back to `node --check` syntax-only scan on all *.js files.
|
||||
# NOTE: `npm run lint --if-present` exits 0 even when no lint script
|
||||
# exists (npm 10+ / ubuntu-latest Node 20 behaviour), so the fallback
|
||||
# branch is dead code under --if-present. Instead, explicitly detect
|
||||
# whether a lint script is declared and branch on that.
|
||||
run: |
|
||||
if node -e "process.exit(require('./package.json').scripts?.lint ? 0 : 1)" 2>/dev/null; then
|
||||
echo "npm run lint script found — running it."
|
||||
npm run lint
|
||||
else
|
||||
echo "No 'lint' npm script — running node --check syntax scan."
|
||||
find . -name '*.js' \
|
||||
-not -path './vendor/*' \
|
||||
-not -path './node_modules/*' \
|
||||
-not -path './.git/*' \
|
||||
-print0 | xargs -0 -I{} node --check {}
|
||||
fi
|
||||
131
.github/workflows/deploy-app.yml
vendored
131
.github/workflows/deploy-app.yml
vendored
@@ -1,131 +0,0 @@
|
||||
name: Reusable Deploy (staging → smoke → production)
|
||||
|
||||
# Single shared deploy pipeline for every peptiderepo plugin and the theme.
|
||||
# Callers pass `target_path` + `secrets: inherit`; deploy logic lives HERE so a
|
||||
# fix lands once instead of in six copy-pasted deploy.yml files.
|
||||
#
|
||||
# Hardened against the documented Hostinger behaviour of rate-limiting concurrent
|
||||
# GitHub-runner IPs (connection timeouts, exit 255): the rsync is retried with
|
||||
# backoff, and the plugin-inventory guard is best-effort so a throttled count
|
||||
# check never fails an otherwise-good deploy.
|
||||
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
target_path:
|
||||
description: "wp-content subpath, e.g. wp-content/plugins/prautoblogger"
|
||||
required: true
|
||||
type: string
|
||||
run_smoke:
|
||||
description: "Run the staging smoke suite (informational; never gates prod)"
|
||||
required: false
|
||||
default: true
|
||||
type: boolean
|
||||
secrets:
|
||||
SSH_PRIVATE_KEY: {required: true}
|
||||
SSH_HOST: {required: true}
|
||||
SSH_PORT: {required: true}
|
||||
SSH_USERNAME: {required: true}
|
||||
STAGING_WP_ADMIN_USER: {required: false}
|
||||
STAGING_WP_ADMIN_PASSWORD: {required: false}
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
deploy-staging:
|
||||
name: Deploy to Staging
|
||||
runs-on: [self-hosted, peptide-vps]
|
||||
environment: staging
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Deploy via rsync → staging (retry-on-throttle)
|
||||
run: |
|
||||
mkdir -p ~/.ssh
|
||||
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
|
||||
chmod 600 ~/.ssh/deploy_key
|
||||
ssh-keyscan -p "${{ secrets.SSH_PORT }}" "${{ secrets.SSH_HOST }}" >> ~/.ssh/known_hosts 2>/dev/null || true
|
||||
BASE="/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html"
|
||||
SSHOPT="-i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new -o ConnectTimeout=30 -o BatchMode=yes"
|
||||
n=0
|
||||
until [ "$n" -ge 4 ]; do
|
||||
rsync -avz --delete \
|
||||
--exclude '.git' --exclude '.github' --exclude 'tests' --exclude 'node_modules' \
|
||||
--exclude 'vendor' --exclude 'composer.json' --exclude 'composer.lock' \
|
||||
--exclude 'phpunit.xml' --exclude 'phpunit.xml.dist' --exclude 'phpcs.xml.dist' \
|
||||
--exclude '.phpcs.xml.dist' --exclude 'ARCHITECTURE.md' --exclude 'CONVENTIONS.md' \
|
||||
--exclude 'CHANGELOG.md' --exclude 'qa-reviews' \
|
||||
-e "ssh $SSHOPT" \
|
||||
./ "${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:$BASE/staging/${{ inputs.target_path }}/" && break
|
||||
n=$((n+1)); echo "staging rsync failed (attempt $n/4) — Hostinger may be throttling runner IPs; retrying in 25s..."; sleep 25
|
||||
done
|
||||
[ "$n" -lt 4 ] || { echo "::error::staging rsync failed after 4 attempts"; exit 1; }
|
||||
- name: Staging health check
|
||||
run: |
|
||||
sleep 5
|
||||
echo "Staging responded: HTTP $(curl -s -o /dev/null -w '%{http_code}' https://staging.peptiderepo.com/ || echo 000)"
|
||||
- name: Cleanup
|
||||
if: always()
|
||||
run: rm -f ~/.ssh/deploy_key
|
||||
|
||||
smoke:
|
||||
name: Smoke tests (staging)
|
||||
needs: deploy-staging
|
||||
if: ${{ inputs.run_smoke }}
|
||||
uses: peptide-repo/peptide-e2e/.github/workflows/smoke.yml@main
|
||||
secrets:
|
||||
STAGING_WP_ADMIN_USER: ${{ secrets.STAGING_WP_ADMIN_USER }}
|
||||
STAGING_WP_ADMIN_PASSWORD: ${{ secrets.STAGING_WP_ADMIN_PASSWORD }}
|
||||
|
||||
deploy-production:
|
||||
name: Deploy to Production
|
||||
# Smoke is now a GATE: a smoke FAILURE blocks production. A deliberately
|
||||
# skipped smoke (run_smoke: false) still allows prod via the if-condition.
|
||||
needs: [deploy-staging, smoke]
|
||||
if: ${{ !cancelled() && needs.deploy-staging.result == 'success' && needs.smoke.result != 'failure' }}
|
||||
runs-on: [self-hosted, peptide-vps]
|
||||
environment: production
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Deploy via rsync → production (retry + inventory guard)
|
||||
run: |
|
||||
mkdir -p ~/.ssh
|
||||
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
|
||||
chmod 600 ~/.ssh/deploy_key
|
||||
ssh-keyscan -p "${{ secrets.SSH_PORT }}" "${{ secrets.SSH_HOST }}" >> ~/.ssh/known_hosts 2>/dev/null || true
|
||||
BASE="/home/${{ secrets.SSH_USERNAME }}/domains/peptiderepo.com/public_html"
|
||||
SSHOPT="-i ~/.ssh/deploy_key -p ${{ secrets.SSH_PORT }} -o StrictHostKeyChecking=accept-new -o ConnectTimeout=30 -o BatchMode=yes"
|
||||
PRE=$(ssh $SSHOPT "${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}" "wp --path=$BASE plugin list --status=active --field=name 2>/dev/null | wc -l" 2>/dev/null || echo 0)
|
||||
echo "Pre-deploy active plugins (best-effort): $PRE"
|
||||
n=0
|
||||
until [ "$n" -ge 4 ]; do
|
||||
rsync -avz --delete \
|
||||
--exclude '.git' --exclude '.github' --exclude 'tests' --exclude 'node_modules' \
|
||||
--exclude 'vendor' --exclude 'composer.json' --exclude 'composer.lock' \
|
||||
--exclude 'phpunit.xml' --exclude 'phpunit.xml.dist' --exclude 'phpcs.xml.dist' \
|
||||
--exclude '.phpcs.xml.dist' --exclude 'ARCHITECTURE.md' --exclude 'CONVENTIONS.md' \
|
||||
--exclude 'CHANGELOG.md' --exclude 'qa-reviews' \
|
||||
-e "ssh $SSHOPT" \
|
||||
./ "${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}:$BASE/${{ inputs.target_path }}/" && break
|
||||
n=$((n+1)); echo "prod rsync failed (attempt $n/4) — retrying in 25s..."; sleep 25
|
||||
done
|
||||
[ "$n" -lt 4 ] || { echo "::error::production rsync failed after 4 attempts"; exit 1; }
|
||||
POST=$(ssh $SSHOPT "${{ secrets.SSH_USERNAME }}@${{ secrets.SSH_HOST }}" "wp --path=$BASE plugin list --status=active --field=name 2>/dev/null | wc -l; find wp-content/litespeed/ -type f -delete 2>/dev/null; touch .lscache_purge 2>/dev/null || true" 2>/dev/null | head -1 || echo 0)
|
||||
echo "Post-deploy active plugins (best-effort): $POST"
|
||||
if [ "${PRE:-0}" -gt 0 ] && [ "${POST:-0}" -gt 0 ] && [ "${POST:-0}" -lt "${PRE:-0}" ]; then
|
||||
echo "::error::active plugin count dropped ${PRE} -> ${POST} after deploy"; exit 1
|
||||
fi
|
||||
- name: Production health check
|
||||
run: |
|
||||
sleep 5
|
||||
S=$(curl -s -o /dev/null -w '%{http_code}' https://peptiderepo.com)
|
||||
if [ "$S" != "200" ] && [ "$S" != "403" ]; then echo "::error::site returned HTTP $S"; exit 1; fi
|
||||
echo "Production healthy (HTTP $S)"
|
||||
- name: Cleanup
|
||||
if: always()
|
||||
run: rm -f ~/.ssh/deploy_key
|
||||
- name: Deploy summary
|
||||
run: |
|
||||
echo "## Deployment complete" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "- **Target:** ${{ inputs.target_path }}" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "- **Commit:** \`${GITHUB_SHA::7}\`" >> "$GITHUB_STEP_SUMMARY"
|
||||
86
.github/workflows/deploy-health.yml
vendored
86
.github/workflows/deploy-health.yml
vendored
@@ -1,86 +0,0 @@
|
||||
name: Deploy Health Monitor
|
||||
|
||||
# Daily drift + deploy-failure check across all peptiderepo app repos.
|
||||
# Runs on GitHub's scheduler (independent of the local board cron that died).
|
||||
# Opens ONE de-duplicated 'deploy-health' issue here when something is off.
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: '0 13 * * *'
|
||||
workflow_dispatch:
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
issues: write
|
||||
actions: read
|
||||
|
||||
jobs:
|
||||
check:
|
||||
name: Check prod-vs-main drift + last deploy status
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/github-script@v7
|
||||
with:
|
||||
script: |
|
||||
const owner = 'peptide-repo';
|
||||
const repos = [
|
||||
'prautoblogger','peptide-repo-core','peptide-search-ai',
|
||||
'peptide-news-plugin','peptide-reconstitution-calculator','peptide-starter-theme'
|
||||
];
|
||||
const short = s => s ? String(s).substring(0,7) : '—';
|
||||
const problems = [];
|
||||
for (const repo of repos) {
|
||||
try {
|
||||
const main = (await github.rest.repos.getBranch({owner, repo, branch:'main'})).data.commit.sha;
|
||||
let runConc = 'none', runSha = '';
|
||||
try {
|
||||
const runs = (await github.rest.actions.listWorkflowRuns({owner, repo, workflow_id:'deploy.yml', per_page:1})).data.workflow_runs;
|
||||
if (runs.length) { runConc = runs[0].conclusion || runs[0].status; runSha = runs[0].head_sha; }
|
||||
} catch (e) { runConc = 'no-deploy-workflow'; }
|
||||
let prodSha = null, prodState = 'none';
|
||||
const deps = (await github.rest.repos.listDeployments({owner, repo, environment:'production', per_page:1})).data;
|
||||
if (deps.length) {
|
||||
prodSha = deps[0].sha;
|
||||
const sts = (await github.rest.repos.listDeploymentStatuses({owner, repo, deployment_id: deps[0].id, per_page:1})).data;
|
||||
if (sts.length) prodState = sts[0].state;
|
||||
}
|
||||
if (runConc === 'failure') problems.push(`**${repo}**: latest deploy run failed (\`${short(runSha)}\`)`);
|
||||
if (prodSha && prodSha !== main) {
|
||||
// Only real drift if undeployed commits touch DEPLOYABLE files
|
||||
// (ignore .github/, tests/, and docs/build files the deploy excludes).
|
||||
try {
|
||||
const cmp = (await github.rest.repos.compareCommits({owner, repo, base: prodSha, head: main})).data;
|
||||
const deployable = (cmp.files || []).some(f => {
|
||||
const x = f.filename;
|
||||
if (x.startsWith('.github/') || x.startsWith('tests/')) return false;
|
||||
if (/^(ARCHITECTURE|CONVENTIONS|CHANGELOG|README)\.md$/.test(x)) return false;
|
||||
if (/^(composer\.(json|lock)|phpunit\.xml(\.dist)?|\.?phpcs\.xml\.dist)$/.test(x)) return false;
|
||||
return true;
|
||||
});
|
||||
if (deployable) problems.push(`**${repo}**: prod behind main — prod=\`${short(prodSha)}\` vs main=\`${short(main)}\` (undeployed code changes)`);
|
||||
} catch (e) {
|
||||
problems.push(`**${repo}**: prod sha != main sha (could not diff: ${e.message})`);
|
||||
}
|
||||
}
|
||||
if (prodSha && prodState !== 'success') problems.push(`**${repo}**: last production deployment state is \`${prodState}\``);
|
||||
core.info(`${repo}: main=${short(main)} lastRun=${runConc} prodDeploy=${short(prodSha)}/${prodState}`);
|
||||
} catch (e) {
|
||||
problems.push(`**${repo}**: monitor error — ${e.message}`);
|
||||
}
|
||||
}
|
||||
const summary = problems.length
|
||||
? `### ⚠️ Deploy health: ${problems.length} issue(s)\n\n` + problems.map(p=>`- ${p}`).join('\n')
|
||||
: `### ✅ All app repos current; last deploy healthy`;
|
||||
await core.summary.addRaw(summary).write();
|
||||
if (problems.length) {
|
||||
const existing = (await github.rest.issues.listForRepo({owner, repo: context.repo.repo, labels:'deploy-health', state:'open'})).data;
|
||||
if (existing.length === 0) {
|
||||
await github.rest.issues.create({ owner, repo: context.repo.repo,
|
||||
title: `Deploy health: ${problems.length} issue(s) detected`,
|
||||
body: summary + `\n\n_Opened by deploy-health.yml. Close once resolved; the monitor won't reopen while this stays open._`,
|
||||
labels: ['deploy-health'] });
|
||||
core.warning(`Opened deploy-health issue (${problems.length} problems)`);
|
||||
} else {
|
||||
core.warning(`${problems.length} problems; deploy-health issue already open (#${existing[0].number})`);
|
||||
}
|
||||
}
|
||||
7
.github/workflows/smoke.yml
vendored
7
.github/workflows/smoke.yml
vendored
@@ -32,14 +32,14 @@ on:
|
||||
jobs:
|
||||
smoke:
|
||||
name: Playwright smoke suite
|
||||
runs-on: [self-hosted, peptide-vps]
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 15
|
||||
|
||||
steps:
|
||||
- name: Checkout peptide-e2e (explicit — workflow_call defaults to caller repo)
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: peptide-repo/peptide-e2e
|
||||
repository: peptiderepo/peptide-e2e
|
||||
ref: main
|
||||
|
||||
- name: Set up Node.js
|
||||
@@ -53,8 +53,7 @@ jobs:
|
||||
run: npm ci
|
||||
|
||||
- name: Install Playwright browsers
|
||||
# OS deps pre-installed on the self-hosted runner host; --with-deps needs sudo which the sandbox blocks
|
||||
run: npx playwright install chromium
|
||||
run: npx playwright install chromium --with-deps
|
||||
|
||||
- name: Run smoke tests
|
||||
env:
|
||||
|
||||
171
CHANGELOG.md
171
CHANGELOG.md
@@ -1,171 +0,0 @@
|
||||
# Changelog
|
||||
|
||||
## [1.8.0] - 2026-06-23
|
||||
|
||||
### Added
|
||||
- **`infra/vps/` PRAB generation orchestrator**: systemd timer + service + bash
|
||||
script that SSHes from the Coolify KVM8 VPS to Hostinger and drives
|
||||
`wp prautoblogger generate --sync` in a held-open SSH session. Sidesteps
|
||||
Hostinger's ~10-min background-PHP-process kill that was blocking full
|
||||
generation runs. Components:
|
||||
- `orchestrate-generation.sh`: main script with DRY_RUN mode, structured
|
||||
logging, reaper pre-sweep, failure email alert, and shellcheck-clean quoting.
|
||||
- `prab-generation.service` / `prab-generation.timer`: systemd oneshot service
|
||||
(2h timeout, no auto-restart) + daily 06:00 UTC timer with 5-min jitter.
|
||||
- `install-orchestrator.sh`: one-time setup script; installs units but does NOT
|
||||
enable the timer (requires explicit CEO greenlight post-QA).
|
||||
- Security: `StrictHostKeyChecking=accept-new` with pre-seeded known_hosts for
|
||||
the Hostinger IP; no hardcoded secrets; SSH key referenced by env-var path.
|
||||
|
||||
## [1.7.2] - 2026-06-17
|
||||
|
||||
### Fixed
|
||||
- **CI**: Drop `--with-deps` from `npx playwright install chromium` in `smoke.yml`.
|
||||
The `peptide-vps` self-hosted runner has OS-level Playwright deps pre-installed by
|
||||
root; `--with-deps` invokes `apt-get` which requires `sudo`, blocked by the runner's
|
||||
`NoNewPrivileges=true` systemd hardening. Binary-only install works without
|
||||
elevated privileges.## [1.7.1] - 2026-06-17
|
||||
|
||||
### Changed
|
||||
- **CI/CD**: Switch `deploy-staging`, `deploy-production`, and `smoke` jobs from
|
||||
`ubuntu-latest` (GitHub-hosted) to `[self-hosted, peptide-vps]` (org runner on
|
||||
KVM8 VPS). This routes all Hostinger SSH/rsync traffic through our stable VPS IP,
|
||||
fixing the Azure-region throttle that caused intermittent deploy failures.
|
||||
Callers' CI/validate jobs are unaffected (remain on `ubuntu-latest`).
|
||||
|
||||
## [1.7.0] - 2026-06-17
|
||||
|
||||
### Added
|
||||
- **Peptide News admin smoke (07)** (`07-peptide-news-admin.spec.ts`).
|
||||
Covers the Peptide News Plugin admin surfaces: dashboard (HTTP 200, no fatal,
|
||||
h1 "Peptide News Analytics" heading, `.pn-summary-cards`, `.pn-date-filter`),
|
||||
settings (form present), articles, and LLM costs sub-pages. Skip-if-absent guard
|
||||
on all tests using the standard 05/06 merge-early binding pattern. Slugs sourced
|
||||
from `admin/class-pn-admin-menu.php`.
|
||||
|
||||
- **PR Vision admin smoke (08)** (`08-pr-vision-admin.spec.ts`).
|
||||
Covers the PR Vision plugin admin surfaces: dashboard (HTTP 200, no fatal,
|
||||
h1 "PR Vision" visible), Settings page (API-key-manager card `#prv-key-card`
|
||||
present, status badge `#prv-key-source-badge` visible), write-only security
|
||||
invariant (`#prv_api_key` value="" + full HTML must not contain "sk-or-"),
|
||||
Costs sub-page (`pr-vision-costs`), and Call Log sub-page (`pr-vision-calls`).
|
||||
Skip-if-absent at two levels: plugin absent (loud annotation + skip), and
|
||||
`#prv-key-card` absent (Settings v0.2.0 not yet deployed on environment).
|
||||
Selectors sourced from `class-prv-admin-page.php`, `class-prv-key-manager-renderer.php`.
|
||||
|
||||
|
||||
All notable changes to the peptide-e2e smoke suite will be documented here.
|
||||
|
||||
## [1.6.0] - 2026-06-16
|
||||
|
||||
## [1.6.1] - 2026-06-16
|
||||
|
||||
### Fixed
|
||||
- **P2-A injection** (`ci.yml:239`): `${{ inputs.line_limit_paths }}` moved
|
||||
from raw shell assignment into an `env:` block (`PATHS`); shell now reads
|
||||
`$PATHS` — eliminates template-injection surface for caller-supplied input.
|
||||
- **P2-B lint-js fallback** (`ci.yml:378`): replaced `npm run lint --if-present`
|
||||
(exits 0 when no lint script exists, killing the fallback branch) with
|
||||
explicit `node -e "process.exit(…)"` detection; `node --check` scan now
|
||||
actually runs when no `lint` npm script is defined.
|
||||
- **P2-C phpcs config mismatch** (`ci.yml:178-199, 206-223`): both phpcbf
|
||||
and phpcs steps now detect which of `phpcs.xml` / `phpcs.xml.dist` /
|
||||
`.phpcs.xml.dist` is present and pass that file to `--standard`; guard and
|
||||
command now agree for all three variants.
|
||||
|
||||
|
||||
### Added
|
||||
- **Reusable CI workflow** (`.github/workflows/ci.yml`).
|
||||
`on: workflow_call` entrypoint that every estate repo will adopt as a thin
|
||||
caller. Inputs: `php_versions` (JSON matrix), `tests`
|
||||
(stubs|wp-framework|brain-monkey|none), `enforce_300`, `line_limit_paths`,
|
||||
`has_js`, `phpcs_autofix`. Fixed job names (`lint-php`, `phpcs`, `file-size`,
|
||||
`phpunit`, `lint-js`) so deploy-app.yml can `needs:` them uniformly.
|
||||
- **phpcbf auto-commit** (prautoblogger gold-standard pattern): on
|
||||
`pull_request` events, phpcbf runs and pushes any fixes back to the branch
|
||||
before strict PHPCS; on `push` events auto-commit is skipped to prevent
|
||||
loops.
|
||||
- **wp-framework PHPUnit path** replicates all three peptide-starter-theme
|
||||
gotchas: (1) install svn; (2) pass skip-db-create=true so the MySQL
|
||||
service's pre-created DB is reused; (3) WP_CORE_DIR trailing slash.
|
||||
- **Self-test caller** (`.github/workflows/ci-self-test.yml`): exercises
|
||||
the reusable workflow on this repo with `tests: none` so the workflow is
|
||||
validated on this PR itself.
|
||||
- **README.md**: adoption snippet documenting how any repo becomes a caller.
|
||||
|
||||
|
||||
## [1.5.0] - 2026-06-14
|
||||
|
||||
### Added
|
||||
- **Board Generate Now smoke (M4, skip-if-absent)** (`06-board-generate-now.spec.ts`).
|
||||
Asserts the PRAutoBlogger board page loads, `#prab-generate-now` button is present
|
||||
and carries a nonce, and the kick-off AJAX action returns valid JSON (no PHP fatal).
|
||||
READ-ONLY: never waits for generation to complete; `kick_off()` is idempotent.
|
||||
SKIPS with a loud annotation when `#prab-board` or `#prab-generate-now` is absent
|
||||
(v0.21.0 M4 not yet deployed) so the e2e PR can merge before prautoblogger PR #166
|
||||
per the M2/M3 merge-order binding. 27 tests total (was 25), delta = 2.
|
||||
|
||||
## [1.4.0] - 2026-06-12
|
||||
|
||||
### Added
|
||||
- **Dossier edit + re-run smoke (M3, skip-if-absent)** (`05-dossier-edit.spec.ts`).
|
||||
Opens a discovered post's dossier and exercises the v0.20.0 edit surface READ-ONLY:
|
||||
opens/closes the first edit panel (asserts textareas, Save/Re-run buttons, the
|
||||
fork-preserved + queued-execution copy), asserts every disabled edit affordance
|
||||
carries a visible reason, and checks the M3 sidebar cards (Run Spend, Models &
|
||||
Prompts). NEVER clicks Save or any Re-run button (those fork inputs / queue paid
|
||||
LLM jobs). SKIPS with a loud annotation when `.prab-stage-rerun-footer` is absent
|
||||
(plugin v0.20.0 not yet deployed) so this PR can merge before prautoblogger PR #161
|
||||
per the M3 merge-order binding. 25 tests total (was 24), delta = 1.
|
||||
|
||||
## [1.3.0] - 2026-06-12
|
||||
|
||||
### Fixed
|
||||
- **Auth setup survives `ERR_ABORTED` on wp-login.php** (`global.setup.ts`).
|
||||
When Hostinger's LiteSpeed throttles a GitHub runner IP, `page.goto` can
|
||||
throw `net::ERR_ABORTED` rather than a `TimeoutError`. Playwright marks the
|
||||
browser context closed internally on abort, so the existing
|
||||
`context.close()` call in the catch block threw
|
||||
`"browserContext.close: Target page, context or browser has been closed"`,
|
||||
which propagated out of catch and killed setup before the remaining retries
|
||||
ran. Two production deploys were blocked by this flake on 2026-06-12.
|
||||
|
||||
Fix: introduced `safeClose()` helper that swallows the already-closed
|
||||
error, so an aborted context never terminates the retry loop. Max attempts
|
||||
raised from 3 → 5; backoff is now exponential (5 s / 10 s / 20 s / 40 s)
|
||||
instead of a flat 15 s, giving the throttle window more time to clear.
|
||||
Worst-case timing: 5 × 90 s navigation + 75 s backoff = ~525 s, well under
|
||||
the 900 s (15 min) job timeout. Final-failure message explicitly names the
|
||||
LiteSpeed throttle hypothesis so future CI logs self-diagnose.
|
||||
|
||||
## [1.2.0] - 2026-06-12
|
||||
|
||||
### Added
|
||||
- **Dossier page smoke test** (`03-admin-plugins.spec.ts` — `WP Admin — PRAutoBlogger Article Dossier`).
|
||||
Navigates to `/wp-admin/admin.php?page=prautoblogger-dossier&post_id=<N>`, asserts HTTP 200,
|
||||
`#prab-dossier` container visible, body does NOT contain "Invalid plugin page" or "Fatal error".
|
||||
Guards against: menu-ordering regression (wrong hookname → wp_die 404), PHP fatals on dossier
|
||||
load, missing dossier container, and stage-section regression.
|
||||
|
||||
Defensive strategy: tries canonical staging post IDs 925/930 first, then falls back to the
|
||||
most recent REST post, then falls back to post_id=0 (graceful empty state). Stage-section
|
||||
assertions are conditional on a run record existing. Loud test.info() annotations on fallback
|
||||
paths. New in PRAutoBlogger v0.19.2 / v0.19.3.
|
||||
|
||||
## [1.1.0] - 2026-06-12
|
||||
|
||||
### Added
|
||||
- **Board page smoke test** (`03-admin-plugins.spec.ts` — `WP Admin — PRAutoBlogger board page`).
|
||||
Navigates to `/wp-admin/admin.php?page=prautoblogger-board`, asserts HTTP 200,
|
||||
`#prab-board` container visible, and body does NOT contain "Invalid plugin page".
|
||||
Guards against the v0.19.1 regression class: Board submenu registered before parent
|
||||
menu existed (both at admin_menu priority 10) → WordPress fallback hookname →
|
||||
wp_die 404. Now in the deploy-gate smoke suite so this failure class is un-shippable.
|
||||
|
||||
Note: cannot be validated against prod until v0.19.1 of PRAutoBlogger deploys.
|
||||
Spec compiles and lists cleanly under `npx playwright test --list`.
|
||||
|
||||
## [1.0.0] - 2026-06-11
|
||||
|
||||
Initial release. 21 tests across 5 specs: homepage, reconstitution calculator,
|
||||
peptide search, admin plugins, REST API.
|
||||
99
README.md
99
README.md
@@ -1,99 +0,0 @@
|
||||
# peptide-e2e
|
||||
|
||||
Playwright smoke tests and shared CI/CD pipelines for the [peptiderepo.com](https://peptiderepo.com) estate.
|
||||
|
||||
## Reusable workflows
|
||||
|
||||
This repo hosts shared GitHub Actions workflows called by all 7 app repos.
|
||||
|
||||
### `deploy-app.yml` — shared deploy pipeline
|
||||
|
||||
Handles staging rsync → Playwright smoke → production rsync → inventory guard →
|
||||
LiteSpeed cache purge → health check. Called by every app's `deploy.yml` via
|
||||
`uses: peptiderepo/peptide-e2e/.github/workflows/deploy-app.yml@main`.
|
||||
|
||||
### `ci.yml` — reusable CI (PHP lint, PHPCS, 300-line, PHPUnit, JS lint)
|
||||
|
||||
Standardised CI for every estate repo. Consistent job names so `deploy-app.yml`
|
||||
can gate on them uniformly.
|
||||
|
||||
**Adopt in any repo** — create `.github/workflows/ci.yml` in the caller repo:
|
||||
|
||||
```yaml
|
||||
name: CI
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
pull_request:
|
||||
branches: [main]
|
||||
|
||||
# Required: the called ci.yml phpcs job declares contents: write for phpcbf
|
||||
# commit-back. GitHub enforces that callers must grant at least the permission
|
||||
# level the reusable workflow's jobs request.
|
||||
permissions:
|
||||
contents: write
|
||||
|
||||
jobs:
|
||||
ci:
|
||||
uses: peptiderepo/peptide-e2e/.github/workflows/ci.yml@main
|
||||
with:
|
||||
tests: stubs # stubs | wp-framework | brain-monkey | none
|
||||
has_js: false # set true if the repo ships JS
|
||||
secrets: inherit
|
||||
```
|
||||
|
||||
**Full input reference:**
|
||||
|
||||
| Input | Type | Default | Description |
|
||||
|-------|------|---------|-------------|
|
||||
| `php_versions` | string | `'["8.1","8.2","8.3"]'` | JSON array of PHP versions to matrix over |
|
||||
| `tests` | string | `stubs` | PHPUnit environment: `stubs`, `wp-framework`, `brain-monkey`, or `none` |
|
||||
| `enforce_300` | boolean | `true` | Fail if any tracked `*.php` file under `line_limit_paths` exceeds 300 lines |
|
||||
| `line_limit_paths` | string | `includes` | Space-separated paths the 300-line rule applies to |
|
||||
| `has_js` | boolean | `false` | Whether to run JS linting (`npm run lint` or `node --check`) |
|
||||
| `phpcs_autofix` | boolean | `true` | On PRs: run phpcbf and commit fixes back before strict PHPCS |
|
||||
|
||||
**PHPUnit `tests` values explained:**
|
||||
|
||||
- `stubs` — WP stubs only (fast, no DB); just runs `composer test`.
|
||||
- `brain-monkey` — Brain Monkey mocking; no DB; runs `composer test`.
|
||||
- `wp-framework` — Full WordPress test framework: provisions MySQL service,
|
||||
installs svn, runs `bin/install-wp-tests.sh`, then `composer test`. Handles
|
||||
the three known gotchas: svn install, `--skip-db-create` with MySQL service,
|
||||
`WP_CORE_DIR` trailing slash.
|
||||
- `none` — Skips the `phpunit` job entirely (temporary; repos without a suite
|
||||
yet; remove at rollout).
|
||||
|
||||
**phpcbf auto-commit:** on `pull_request` events, phpcbf runs first and commits
|
||||
any auto-fixable violations back to the PR branch via `GITHUB_TOKEN`. GitHub
|
||||
prevents loops — bot commits do not trigger a new CI run. Strict PHPCS then
|
||||
runs and fails only on non-auto-fixable violations.
|
||||
|
||||
**Job names** (fixed — callers and `deploy-app.yml` `needs:` these):
|
||||
`lint-php`, `phpcs`, `file-size`, `phpunit`, `lint-js`.
|
||||
|
||||
## Smoke tests
|
||||
|
||||
The `tests/` directory contains Playwright specs that run against
|
||||
`https://staging.peptiderepo.com` (via `deploy-app.yml`) and can also target
|
||||
production. See `playwright.config.ts` for environment configuration.
|
||||
|
||||
```
|
||||
tests/
|
||||
00-homepage.spec.ts
|
||||
01-reconstitution-calculator.spec.ts
|
||||
02-peptide-search.spec.ts
|
||||
03-admin-plugins.spec.ts
|
||||
04-rest-api.spec.ts
|
||||
05-dossier-edit.spec.ts
|
||||
06-board-generate-now.spec.ts
|
||||
```
|
||||
|
||||
## Development
|
||||
|
||||
```bash
|
||||
npm ci
|
||||
npx playwright install --with-deps chromium
|
||||
BASE_URL=https://staging.peptiderepo.com npm test
|
||||
```
|
||||
@@ -1,15 +0,0 @@
|
||||
# peptide-ci-php: Gitea runner image with PHP 8.1/8.2/8.3 + Composer preinstalled.
|
||||
# Why: shivammathur/setup-php treats the stock runner image as a bare self-hosted
|
||||
# box and apt-installs a whole compiler toolchain on every job (~5-10 min each).
|
||||
# Built into the gitea-dind daemon by ci-image/build.sh; runner label `peptide-php`.
|
||||
FROM docker.gitea.com/runner-images@sha256:fd911d7417bfbf0f454530e447da95b58001e1df41bbc5e1a8dd35d432575aae
|
||||
RUN set -eux; export DEBIAN_FRONTEND=noninteractive; \
|
||||
apt-get update; apt-get install -y --no-install-recommends software-properties-common gnupg unzip mariadb-client; \
|
||||
add-apt-repository -y ppa:ondrej/php; apt-get update; \
|
||||
for v in 8.1 8.2 8.3; do \
|
||||
apt-get install -y --no-install-recommends php$v-cli php$v-common php$v-mbstring php$v-xml php$v-curl php$v-zip php$v-mysql php$v-intl php$v-bcmath php$v-gd; \
|
||||
done; \
|
||||
update-alternatives --set php /usr/bin/php8.3; \
|
||||
curl -fsSL https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer; \
|
||||
composer --version; php8.1 -v | head -1; php8.2 -v | head -1; php8.3 -v | head -1; \
|
||||
rm -rf /var/lib/apt/lists/*
|
||||
@@ -1,10 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Rebuild the CI image (PHP 8.1/8.2/8.3 + Composer) and publish it to the Gitea
|
||||
# registry. Run on the KVM8 as root. Pulls are anonymous (public org), but the
|
||||
# push needs `docker exec -i gitea-dind docker login git.protopeer.com` first with
|
||||
# a Gitea token that has write:package. Bump TAG and CI_IMAGE in
|
||||
# tools/gitea-pipeline/render.py together, then re-render the pipelines.
|
||||
set -e
|
||||
TAG=git.protopeer.com/peptide-repo/ci-php:2026-10
|
||||
docker exec -i gitea-dind docker build -t "$TAG" - < "$(dirname "$0")/Dockerfile"
|
||||
docker exec gitea-dind docker push "$TAG"
|
||||
@@ -1,68 +0,0 @@
|
||||
# Gitea Actions pipeline (peptide-repo)
|
||||
|
||||
Since 2026-10-24 every peptide-repo plugin/theme builds and deploys from
|
||||
`git.protopeer.com/peptide-repo`, not GitHub. GitHub's `.github/workflows` are
|
||||
left in the repos but Gitea ignores them (a repo with `.gitea/workflows` uses
|
||||
only that folder).
|
||||
|
||||
## How it fits together
|
||||
|
||||
- **Shared logic lives once**, as composite actions in this repo under
|
||||
`.gitea/actions/`: `deploy`, `smoke`, `ci-lint-php`, `ci-phpcs`,
|
||||
`ci-file-size`, `ci-phpunit`, `ci-lint-js`, `audit-direct-push`.
|
||||
Gitea 1.25 cannot run reusable workflows (`workflow_call`), which is why this
|
||||
is not a 1:1 copy of the GitHub `deploy-app.yml` / `ci.yml`.
|
||||
- **Each repo's `.gitea/workflows/pipeline.yml` is generated** by
|
||||
`tools/gitea-pipeline/render.py` from `tools/gitea-pipeline/repos.json`.
|
||||
Change a repo's settings in `repos.json`, re-render, commit the output. Do not
|
||||
hand-edit the generated files.
|
||||
- **Job graph:** lint-php / phpcs / file-size / phpunit / lint-js (+ repo extras)
|
||||
-> deploy-staging -> smoke (gate) -> deploy-production. Deploys run on pushes
|
||||
to `main` and on manual runs of `main`.
|
||||
- **Runners:** CI jobs run on the shared docker runner (`ubuntu-latest`) inside
|
||||
`git.protopeer.com/peptide-repo/ci-php:2026-10` (PHP 8.1/8.2/8.3 + Composer,
|
||||
built from `ci-image/`). Deploy and smoke run on the host runner
|
||||
`peptide-vps-gitea` (systemd `gitea-runner-peptide`, user `gtrunner`, label
|
||||
`peptide-vps`) on the KVM8, one job at a time, like the old GitHub runner.
|
||||
- **Secrets / variables** are org-level on Gitea `peptide-repo`:
|
||||
`SSH_PRIVATE_KEY` (deploy key `gitea-peptide-deploy-20261024` on Hostinger),
|
||||
`SSH_HOST`, `SSH_PORT`, `SSH_USERNAME`, `STAGING_WP_ADMIN_USER` (`gitea-smoke`,
|
||||
staging-only admin), `STAGING_WP_ADMIN_PASSWORD`; variable `PROD_DEPLOY_ENABLED`.
|
||||
|
||||
## Switches and recovery
|
||||
|
||||
- **Kill switch:** set org variable `PROD_DEPLOY_ENABLED` to anything but `true`
|
||||
-> production deploys (and `peptide-news-plugin` rollback) are skipped;
|
||||
staging + smoke still run.
|
||||
- **Redeploy / retry:** run the repo's `CI / Deploy` workflow on `main` manually.
|
||||
- **Roll back news plugin:** `peptide-news-plugin` -> `Rollback Deployment`
|
||||
(workflow_dispatch, optional commit SHA). Same deploy action as normal.
|
||||
- **Drift:** `deploy-health.yml` (daily 13:00 UTC / 21:00 SGT) compares the
|
||||
commit stamped in `~/.peptide-deploys/production/<target>` on Hostinger with
|
||||
each repo's `main`, and opens one "Deploy drift detected" issue here.
|
||||
- **Back to GitHub (emergency):** `systemctl enable --now
|
||||
actions.runner.peptide-repo.peptide-vps` on the KVM8 and set
|
||||
`PROD_DEPLOY_ENABLED=false` here. Only works while GitHub's Hostinger deploy
|
||||
key is still authorised.
|
||||
|
||||
## Differences from the GitHub pipeline (deliberate)
|
||||
|
||||
- `.gitea` is also excluded from rsync.
|
||||
- JS lint uses Node 22 (GitHub used Node 20, now end-of-life).
|
||||
- Smoke login confirms WordPress's periodic "Administration email verification"
|
||||
screen instead of timing out on it (it had been blocking smoke since
|
||||
2026-09-10, when staging's admin-email check expired).
|
||||
- Production stamps the deployed commit for deploy-health (replaces GitHub
|
||||
Deployments).
|
||||
- PHP matrices are literal lists (avoids Gitea's `fromJson` matrix bug).
|
||||
|
||||
## Known gaps
|
||||
|
||||
- `pr-vision` `cto-review.yml` (AI PR review via OpenRouter) is **not ported**:
|
||||
its `OPENROUTER_API_KEY` / `CTO_ADMIN_TOKEN` secrets only exist on GitHub and
|
||||
it calls GitHub's review API.
|
||||
- The LiteSpeed purge in the production deploy runs relative to `$HOME`, so it is
|
||||
effectively a no-op - same as on GitHub. Kept as-is, not fixed.
|
||||
- Issues / PR history of repos other than peptide-e2e stayed on GitHub (the
|
||||
migration hit GitHub's anonymous API rate limit); GitHub repos are to be
|
||||
archived, not deleted.
|
||||
143
global.setup.ts
143
global.setup.ts
@@ -7,26 +7,6 @@
|
||||
*
|
||||
* The saved auth state (playwright/.auth/admin.json) is reused by the
|
||||
* "chromium" project so individual tests don't each incur a login round-trip.
|
||||
*
|
||||
* Retry hardening (2026-06-12 v1): Hostinger rate-limits GitHub runner IPs on
|
||||
* wp-login.php, causing TimeoutError on page.goto. The login attempt is now
|
||||
* retried up to MAX_ATTEMPTS times with a fresh browser context per attempt
|
||||
* and BACKOFF_MS delay between attempts so transient throttle windows clear.
|
||||
*
|
||||
* Retry hardening (2026-06-12 v2 — ERR_ABORTED fix): When Hostinger aborts
|
||||
* the connection (net::ERR_ABORTED), Playwright marks the context as closed
|
||||
* internally. A subsequent context.close() call throws
|
||||
* "browserContext.close: Target page, context or browser has been closed",
|
||||
* which propagated out of the catch block and crashed setup without consuming
|
||||
* remaining retries. Fix: context.close() is now guarded in its own
|
||||
* try/catch so an already-closed context never aborts the retry loop.
|
||||
* MAX_ATTEMPTS raised to 5; backoff doubled each time (5s/10s/20s/40s) so the
|
||||
* LiteSpeed throttle window has time to clear before each retry.
|
||||
*
|
||||
* Timing math (job timeout-minutes: 15 = 900 s):
|
||||
* 5 attempts × NAV_TIMEOUT (90 s) = 450 s navigation ceiling
|
||||
* 4 inter-attempt waits (5+10+20+40 s) = 75 s backoff ceiling
|
||||
* Total worst-case: ~525 s — well under the 900 s job timeout.
|
||||
*/
|
||||
|
||||
import { test as setup, expect } from '@playwright/test';
|
||||
@@ -35,27 +15,9 @@ import * as fs from 'fs';
|
||||
|
||||
const AUTH_FILE = path.join(__dirname, 'playwright/.auth/admin.json');
|
||||
|
||||
const MAX_ATTEMPTS = 5;
|
||||
const NAV_TIMEOUT = 90_000; // 90 s per navigation attempt
|
||||
|
||||
/** Exponential backoff delays (ms) between attempts: 5 s, 10 s, 20 s, 40 s */
|
||||
function backoffMs(attempt: number): number {
|
||||
return 5_000 * Math.pow(2, attempt - 1);
|
||||
}
|
||||
|
||||
/** Safely close a context that Playwright may have already closed internally. */
|
||||
async function safeClose(context: import('@playwright/test').BrowserContext): Promise<void> {
|
||||
try {
|
||||
await context.close();
|
||||
} catch {
|
||||
// Ignored: context was already closed (e.g. after ERR_ABORTED or crash).
|
||||
}
|
||||
}
|
||||
|
||||
setup('authenticate as WP admin', async ({ browser }) => {
|
||||
setup('authenticate as WP admin', async ({ page }) => {
|
||||
const user = process.env.WP_ADMIN_USER;
|
||||
const password = process.env.WP_ADMIN_PASSWORD;
|
||||
const baseURL = process.env.BASE_URL ?? 'https://staging.peptiderepo.com';
|
||||
|
||||
if (!user || !password) {
|
||||
throw new Error(
|
||||
@@ -63,93 +25,28 @@ setup('authenticate as WP admin', async ({ browser }) => {
|
||||
);
|
||||
}
|
||||
|
||||
// Ensure auth directory exists
|
||||
// Ensure directory exists
|
||||
fs.mkdirSync(path.dirname(AUTH_FILE), { recursive: true });
|
||||
|
||||
let lastError: unknown;
|
||||
await page.goto('/wp-login.php');
|
||||
await page.fill('#user_login', user);
|
||||
await page.fill('#user_pass', password);
|
||||
await page.click('#wp-submit');
|
||||
|
||||
for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
|
||||
console.log(
|
||||
`[setup] Login attempt ${attempt}/${MAX_ATTEMPTS} — navigating to wp-login.php ...`
|
||||
);
|
||||
// Wait for any post-login navigation. The site may redirect successful logins
|
||||
// to the homepage (via a login_redirect filter) rather than to wp-admin —
|
||||
// staging does this. So we don't assert the post-submit URL; instead, we
|
||||
// verify we're no longer ON wp-login.php (which would indicate a credential
|
||||
// rejection or 2FA prompt) and then navigate explicitly to wp-admin.
|
||||
await page.waitForURL((url) => !url.pathname.includes('/wp-login.php'), {
|
||||
timeout: 20_000,
|
||||
});
|
||||
|
||||
// Fresh context per attempt so stale cookies / throttle state don't carry over.
|
||||
const context = await browser.newContext({ baseURL });
|
||||
const page = await context.newPage();
|
||||
// Navigate explicitly into wp-admin to capture the authenticated admin session.
|
||||
await page.goto('/wp-admin/');
|
||||
await expect(page).toHaveURL(/\/wp-admin\//, { timeout: 20_000 });
|
||||
await expect(page.locator('#wpadminbar')).toBeVisible();
|
||||
|
||||
try {
|
||||
await page.goto('/wp-login.php', { timeout: NAV_TIMEOUT });
|
||||
await page.fill('#user_login', user);
|
||||
await page.fill('#user_pass', password);
|
||||
await page.click('#wp-submit');
|
||||
|
||||
// Wait for any post-login navigation. The site may redirect successful
|
||||
// logins to the homepage (via a login_redirect filter) rather than to
|
||||
// wp-admin — staging does this. So we don't assert the post-submit URL;
|
||||
// instead, we verify we're no longer ON wp-login.php (which would
|
||||
// indicate a credential rejection or 2FA prompt) and then navigate
|
||||
// explicitly to wp-admin.
|
||||
await page.waitForURL(
|
||||
(url) =>
|
||||
!url.pathname.includes('/wp-login.php') ||
|
||||
url.searchParams.get('action') === 'confirm_admin_email',
|
||||
{ timeout: NAV_TIMEOUT }
|
||||
);
|
||||
|
||||
// WordPress periodically (every ~6 months) interrupts admin logins with
|
||||
// "Administration email verification" (wp-login.php?action=confirm_admin_email).
|
||||
// The login has already succeeded at that point; confirm and continue so the
|
||||
// smoke gate does not time out on it.
|
||||
if (new URL(page.url()).searchParams.get('action') === 'confirm_admin_email') {
|
||||
console.log('[setup] Admin email verification screen - confirming and continuing');
|
||||
await page.click('#correct-admin-email');
|
||||
await page.waitForURL((url) => !url.pathname.includes('/wp-login.php'), {
|
||||
timeout: NAV_TIMEOUT,
|
||||
});
|
||||
}
|
||||
|
||||
// Navigate explicitly into wp-admin to capture the authenticated admin session.
|
||||
await page.goto('/wp-admin/', { timeout: NAV_TIMEOUT });
|
||||
await expect(page).toHaveURL(/\/wp-admin\//, { timeout: 20_000 });
|
||||
await expect(page.locator('#wpadminbar')).toBeVisible({ timeout: 20_000 });
|
||||
|
||||
// Persist session cookies + localStorage to disk
|
||||
await page.context().storageState({ path: AUTH_FILE });
|
||||
|
||||
console.log(`[setup] Login succeeded on attempt ${attempt}/${MAX_ATTEMPTS}`);
|
||||
await safeClose(context);
|
||||
return; // success — exit setup
|
||||
} catch (err) {
|
||||
lastError = err;
|
||||
const message = err instanceof Error ? err.message : String(err);
|
||||
console.error(
|
||||
`[setup] Login attempt ${attempt}/${MAX_ATTEMPTS} FAILED: ${message}`
|
||||
);
|
||||
|
||||
// IMPORTANT: use safeClose — if Playwright received ERR_ABORTED it marks
|
||||
// the context closed internally, so a plain context.close() throws
|
||||
// "Target page, context or browser has been closed". Without this guard
|
||||
// that secondary throw propagated out of catch and killed setup before
|
||||
// the remaining retries ran.
|
||||
await safeClose(context);
|
||||
|
||||
if (attempt < MAX_ATTEMPTS) {
|
||||
const wait = backoffMs(attempt);
|
||||
console.log(
|
||||
`[setup] Waiting ${wait / 1000}s before retry ` +
|
||||
`(LiteSpeed throttle cool-down — attempt ${attempt + 1}/${MAX_ATTEMPTS}) ...`
|
||||
);
|
||||
await new Promise((resolve) => setTimeout(resolve, wait));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// All attempts exhausted — surface the last error with a clear diagnostic.
|
||||
throw new Error(
|
||||
`[setup] All ${MAX_ATTEMPTS} login attempts failed. ` +
|
||||
`Last error: ${lastError instanceof Error ? lastError.message : String(lastError)}\n` +
|
||||
`Hypothesis: Hostinger LiteSpeed is throttling GitHub runner IPs on wp-login.php — ` +
|
||||
`connections abort (ERR_ABORTED) or time out in bursts. ` +
|
||||
`Re-run the workflow once the throttle window clears, or increase MAX_ATTEMPTS / backoffMs().`
|
||||
);
|
||||
// Persist session cookies + localStorage to disk
|
||||
await page.context().storageState({ path: AUTH_FILE });
|
||||
});
|
||||
|
||||
@@ -1,79 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# install-orchestrator.sh — One-time setup for the PRAB generation orchestrator on the VPS.
|
||||
#
|
||||
# Installs:
|
||||
# 1. orchestrate-generation.sh -> /opt/prab-orchestrator/ (from this repo)
|
||||
# 2. prab-generation.service -> /etc/systemd/system/
|
||||
# 3. prab-generation.timer -> /etc/systemd/system/
|
||||
#
|
||||
# Does NOT enable or start the timer — that is an explicit post-QA cutover step.
|
||||
# Does NOT write secrets — the SSH key at /root/.ssh/hostinger_prod_ed25519 must
|
||||
# already be present (placed manually by the CTO from .env.credentials).
|
||||
#
|
||||
# Run as root on the KVM8 VPS (76.13.220.15):
|
||||
# bash infra/vps/install-orchestrator.sh
|
||||
#
|
||||
# After install, validate with DRY_RUN=1 before enabling the timer:
|
||||
# DRY_RUN=1 /opt/prab-orchestrator/orchestrate-generation.sh
|
||||
# systemctl enable --now prab-generation.timer # only after CEO greenlight
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
INSTALL_DIR="/opt/prab-orchestrator"
|
||||
SYSTEMD_DIR="/etc/systemd/system"
|
||||
ORCHESTRATE_SH="${SCRIPT_DIR}/orchestrate-generation.sh"
|
||||
SERVICE_FILE="${SCRIPT_DIR}/prab-generation.service"
|
||||
TIMER_FILE="${SCRIPT_DIR}/prab-generation.timer"
|
||||
|
||||
# Must be root.
|
||||
if [[ "$(id -u)" -ne 0 ]]; then
|
||||
echo "ERROR: install-orchestrator.sh must be run as root." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Validate source files exist.
|
||||
for f in "${ORCHESTRATE_SH}" "${SERVICE_FILE}" "${TIMER_FILE}"; do
|
||||
if [[ ! -f "$f" ]]; then
|
||||
echo "ERROR: source file not found: $f" >&2
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
echo "Installing PRAB orchestrator to ${INSTALL_DIR}..."
|
||||
mkdir -p "${INSTALL_DIR}"
|
||||
install -m 0750 "${ORCHESTRATE_SH}" "${INSTALL_DIR}/orchestrate-generation.sh"
|
||||
echo " OK: ${INSTALL_DIR}/orchestrate-generation.sh"
|
||||
|
||||
# Pre-seed known_hosts with Hostinger's host key so ssh(1) can verify
|
||||
# the server identity without StrictHostKeyChecking=no.
|
||||
# ssh-keyscan output is pinned here; re-run if Hostinger rotates its key.
|
||||
KNOWN_HOSTS_FILE="${INSTALL_DIR}/known_hosts"
|
||||
if [[ ! -f "${KNOWN_HOSTS_FILE}" ]]; then
|
||||
echo "Pre-seeding known_hosts from Hostinger (${SSH_HOST:-145.223.107.228}:${SSH_PORT:-65002})..."
|
||||
ssh-keyscan -p "${SSH_PORT:-65002}" "${SSH_HOST:-145.223.107.228}" \
|
||||
> "${KNOWN_HOSTS_FILE}" 2>/dev/null \
|
||||
&& chmod 0600 "${KNOWN_HOSTS_FILE}" \
|
||||
&& echo " OK: ${KNOWN_HOSTS_FILE}" \
|
||||
|| echo " WARN: ssh-keyscan failed — known_hosts not seeded; first SSH will add key via accept-new"
|
||||
else
|
||||
echo " OK: ${KNOWN_HOSTS_FILE} (already exists, not overwritten)"
|
||||
fi
|
||||
|
||||
echo "Installing systemd units..."
|
||||
install -m 0644 "${SERVICE_FILE}" "${SYSTEMD_DIR}/prab-generation.service"
|
||||
install -m 0644 "${TIMER_FILE}" "${SYSTEMD_DIR}/prab-generation.timer"
|
||||
echo " OK: ${SYSTEMD_DIR}/prab-generation.service"
|
||||
echo " OK: ${SYSTEMD_DIR}/prab-generation.timer"
|
||||
|
||||
systemctl daemon-reload
|
||||
echo " OK: systemctl daemon-reload"
|
||||
|
||||
echo ""
|
||||
echo "Install complete. Timer is installed but NOT enabled."
|
||||
echo "Next steps (post-QA + CEO greenlight only):"
|
||||
echo " 1. Ensure SSH key exists: ls -la /root/.ssh/hostinger_prod_ed25519"
|
||||
echo " 2. Validate with dry run: DRY_RUN=1 /opt/prab-orchestrator/orchestrate-generation.sh"
|
||||
echo " 3. Run first real invocation: /opt/prab-orchestrator/orchestrate-generation.sh"
|
||||
echo " 4. Enable timer: systemctl enable --now prab-generation.timer"
|
||||
echo " 5. Confirm next run: systemctl list-timers prab-generation.timer"
|
||||
@@ -1,158 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# orchestrate-generation.sh — VPS orchestrator for PRAutoBlogger article generation
|
||||
#
|
||||
# Runs as a systemd oneshot service (prab-generation.service) on the Coolify KVM8 VPS.
|
||||
# SSHes to Hostinger and drives wp prautoblogger generate --sync in a held-open SSH
|
||||
# session. SSH-attached processes survive Hostinger's ~10-min background-PHP-process kill.
|
||||
#
|
||||
# Usage:
|
||||
# DRY_RUN=1 ./orchestrate-generation.sh # echo commands, no generation
|
||||
# ./orchestrate-generation.sh # real run
|
||||
#
|
||||
# Alerting: on failure, sends email to cto@peptiderepo.com via system mail.
|
||||
# Logs: structured log lines to stdout (captured by systemd journal).
|
||||
# Lock: the plugin's Generation_Lock (DB mutex) prevents double-drive.
|
||||
#
|
||||
# Environment variables:
|
||||
# DRY_RUN Set to "1" to echo SSH/WP-CLI commands without executing. Default: 0.
|
||||
# LOGFILE Path for persistent log file. Default: /var/log/prab-generation.log.
|
||||
# ALERT_EMAIL Failure alert recipient. Default: cto@peptiderepo.com.
|
||||
# SSH_KEY Path to Hostinger SSH private key. Default: /root/.ssh/hostinger_prod_ed25519.
|
||||
# SSH_HOST Hostinger SSH host. Default: 145.223.107.228.
|
||||
# SSH_PORT Hostinger SSH port. Default: 65002.
|
||||
# SSH_USER Hostinger SSH user. Default: u117248512.
|
||||
# WP_PATH WordPress docroot on Hostinger. Default: /home/u117248512/domains/peptiderepo.com/public_html.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Configuration (override via environment; no hardcoded secrets)
|
||||
# ---------------------------------------------------------------------------
|
||||
DRY_RUN="${DRY_RUN:-0}"
|
||||
LOGFILE="${LOGFILE:-/var/log/prab-generation.log}"
|
||||
ALERT_EMAIL="${ALERT_EMAIL:-cto@peptiderepo.com}"
|
||||
SSH_KEY="${SSH_KEY:-/root/.ssh/hostinger_prod_ed25519}"
|
||||
SSH_HOST="${SSH_HOST:-145.223.107.228}"
|
||||
SSH_PORT="${SSH_PORT:-65002}"
|
||||
SSH_USER="${SSH_USER:-u117248512}"
|
||||
WP_PATH="${WP_PATH:-/home/u117248512/domains/peptiderepo.com/public_html}"
|
||||
# Known-hosts file pre-seeded by install-orchestrator.sh with Hostinger's host key.
|
||||
# Pins the server identity; StrictHostKeyChecking=accept-new adds on first connect.
|
||||
KNOWN_HOSTS="${KNOWN_HOSTS:-/opt/prab-orchestrator/known_hosts}"
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Logging helpers
|
||||
# ---------------------------------------------------------------------------
|
||||
PID="$$"
|
||||
TS() { date -u '+%Y-%m-%dT%H:%M:%SZ'; }
|
||||
|
||||
log() {
|
||||
local msg="prab-generation[${PID}]: $*"
|
||||
echo "$msg"
|
||||
echo "$(TS) $msg" >> "${LOGFILE}" 2>/dev/null || true
|
||||
}
|
||||
|
||||
die() {
|
||||
log "FATAL: $*"
|
||||
exit 1
|
||||
}
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Validate required key before doing anything
|
||||
# ---------------------------------------------------------------------------
|
||||
if [[ "${DRY_RUN}" != "1" ]] && [[ ! -f "${SSH_KEY}" ]]; then
|
||||
die "SSH key not found at ${SSH_KEY}. Run install-orchestrator.sh first."
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# DRY_RUN mode: echo commands and exit
|
||||
# ---------------------------------------------------------------------------
|
||||
if [[ "${DRY_RUN}" == "1" ]]; then
|
||||
log "DRY_RUN=1 — echoing commands only, no generation"
|
||||
log "WOULD RUN: ssh -i ${SSH_KEY} -p ${SSH_PORT} -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15 ${SSH_USER}@${SSH_HOST} \\"
|
||||
log " 'wp prautoblogger generate --sync --path=${WP_PATH} 2>&1'"
|
||||
log "DRY_RUN complete"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Run start
|
||||
# ---------------------------------------------------------------------------
|
||||
START_TS="$(TS)"
|
||||
log "START ts=${START_TS}"
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Step 1: Reaper sweep — clear any stuck runs before starting.
|
||||
# Belt-and-suspenders: the plugin's daily reaper cron handles this too, but
|
||||
# running it explicitly here ensures a clean state before each generation.
|
||||
# ---------------------------------------------------------------------------
|
||||
log "REAPER_SWEEP: invoking Run_Reaper::reap()"
|
||||
REAP_CMD="wp eval 'echo json_encode(PRAutoBlogger_Run_Reaper::reap());' --path=${WP_PATH} 2>&1"
|
||||
|
||||
REAP_OUT=""
|
||||
# shellcheck disable=SC2029
|
||||
REAP_OUT="$(ssh -i "${SSH_KEY}" \
|
||||
-p "${SSH_PORT}" \
|
||||
-o StrictHostKeyChecking=accept-new \
|
||||
-o UserKnownHostsFile="${KNOWN_HOSTS}" \
|
||||
-o ConnectTimeout=15 \
|
||||
-o ServerAliveInterval=60 \
|
||||
-o ServerAliveCountMax=30 \
|
||||
"${SSH_USER}@${SSH_HOST}" \
|
||||
"${REAP_CMD}" \
|
||||
2>&1)" || true
|
||||
log "REAPER_RESULT: ${REAP_OUT}"
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Step 2: Run wp prautoblogger generate --sync
|
||||
# ---------------------------------------------------------------------------
|
||||
log "SSH_CONNECT: ${SSH_USER}@${SSH_HOST}:${SSH_PORT} key=${SSH_KEY}"
|
||||
|
||||
WP_CMD="wp prautoblogger generate --sync --path=${WP_PATH} 2>&1"
|
||||
|
||||
RESULT_OUTPUT=""
|
||||
EXIT_CODE=0
|
||||
|
||||
# shellcheck disable=SC2029
|
||||
RESULT_OUTPUT="$(ssh -i "${SSH_KEY}" \
|
||||
-p "${SSH_PORT}" \
|
||||
-o StrictHostKeyChecking=accept-new \
|
||||
-o UserKnownHostsFile="${KNOWN_HOSTS}" \
|
||||
-o ConnectTimeout=15 \
|
||||
-o ServerAliveInterval=60 \
|
||||
-o ServerAliveCountMax=30 \
|
||||
"${SSH_USER}@${SSH_HOST}" \
|
||||
"${WP_CMD}" \
|
||||
2>&1)" || EXIT_CODE=$?
|
||||
|
||||
# Extract the last JSON summary line (the one from WP_CLI::log(json_encode(...)))
|
||||
LAST_JSON="$(echo "${RESULT_OUTPUT}" | grep -E '^\{' | tail -1 || true)"
|
||||
LAST_LINE="$(echo "${RESULT_OUTPUT}" | tail -1)"
|
||||
|
||||
log "SSH_RESULT exit=${EXIT_CODE} json=${LAST_JSON:-none}"
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Step 3: Evaluate result
|
||||
# ---------------------------------------------------------------------------
|
||||
END_TS="$(TS)"
|
||||
|
||||
if [[ ${EXIT_CODE} -eq 0 ]]; then
|
||||
log "END result=success ts=${END_TS}"
|
||||
else
|
||||
log "END result=failure exit=${EXIT_CODE} last_line=${LAST_LINE} ts=${END_TS}"
|
||||
|
||||
# Send failure alert via email (system mail; no external deps required).
|
||||
# cto@peptiderepo.com forwards to peptiderepo@gmail.com via Cloudflare Email Routing.
|
||||
ALERT_BODY="PRAutoBlogger generation FAILED on $(hostname) at ${END_TS}.
|
||||
Exit code: ${EXIT_CODE}
|
||||
Last output: ${LAST_LINE}
|
||||
Full log: ${LOGFILE}
|
||||
SSH: ${SSH_USER}@${SSH_HOST}:${SSH_PORT}
|
||||
WP path: ${WP_PATH}"
|
||||
|
||||
echo "${ALERT_BODY}" \
|
||||
| mail -s "PRAB generation FAILED @ ${END_TS}" "${ALERT_EMAIL}" 2>/dev/null \
|
||||
|| log "ALERT_FAILED: could not send email to ${ALERT_EMAIL} (mail not configured?)"
|
||||
|
||||
exit "${EXIT_CODE}"
|
||||
fi
|
||||
@@ -1,22 +0,0 @@
|
||||
[Unit]
|
||||
Description=PRAutoBlogger article generation (VPS orchestrator)
|
||||
Documentation=https://github.com/peptide-repo/peptide-e2e/tree/main/infra/vps/
|
||||
After=network.target
|
||||
# Do not start if the timer fires while another instance is still running.
|
||||
# Type=oneshot + TimeoutStartSec enforce this at the systemd level.
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
# root owns /root/.ssh/hostinger_prod_ed25519 and /opt/prab-orchestrator/known_hosts;
|
||||
# a dedicated service user would need its own keypair + sudo-less SSH access.
|
||||
# Acceptable on this dedicated lab VPS (not shared); revisit if VPS is multi-tenant.
|
||||
User=root
|
||||
ExecStart=/opt/prab-orchestrator/orchestrate-generation.sh
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
SyslogIdentifier=prab-generation
|
||||
# Allow up to 2 hours for a full generation run (orchestrate + draft LLM calls).
|
||||
# The longest observed single LLM call was 1925s (~32 min); normal runs 2-5 min.
|
||||
TimeoutStartSec=7200
|
||||
# Do not restart on failure — the timer will retry the next day.
|
||||
Restart=no
|
||||
@@ -1,19 +0,0 @@
|
||||
[Unit]
|
||||
Description=Daily PRAutoBlogger generation at 06:00 UTC
|
||||
Documentation=https://github.com/peptide-repo/peptide-e2e/tree/main/infra/vps/
|
||||
Requires=prab-generation.service
|
||||
|
||||
[Timer]
|
||||
# Fire daily at 06:00 UTC — before Hostinger's daily wp-cron window.
|
||||
OnCalendar=*-*-* 06:00:00 UTC
|
||||
# Persistent=true: if the VPS was down at 06:00 UTC, fire immediately on next
|
||||
# boot so at most one day's generation is missed (not deferred indefinitely).
|
||||
Persistent=true
|
||||
# Up to 5 min random jitter to avoid thundering-herd if multiple VPS instances
|
||||
# are ever added. Harmless with a single instance.
|
||||
RandomizedDelaySec=300
|
||||
# Accuracy within 1 minute (default is 1 minute; explicit for clarity).
|
||||
AccuracySec=60
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
44
package-lock.json
generated
44
package-lock.json
generated
@@ -1,28 +1,25 @@
|
||||
{
|
||||
"name": "peptide-e2e",
|
||||
"version": "1.4.0",
|
||||
"version": "1.0.0",
|
||||
"lockfileVersion": 3,
|
||||
"requires": true,
|
||||
"packages": {
|
||||
"": {
|
||||
"name": "peptide-e2e",
|
||||
"version": "1.4.0",
|
||||
"dependencies": {
|
||||
"typescript": "^6.0.3"
|
||||
},
|
||||
"version": "1.0.0",
|
||||
"devDependencies": {
|
||||
"@playwright/test": "^1.60.0",
|
||||
"@playwright/test": "^1.43.0",
|
||||
"dotenv": "^16.4.5"
|
||||
}
|
||||
},
|
||||
"node_modules/@playwright/test": {
|
||||
"version": "1.60.0",
|
||||
"resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.60.0.tgz",
|
||||
"integrity": "sha512-O71yZIbAh/PxDMNGns37GHBIfrVkEVyn+AXyIa5dOTfb4/xNvRWV+Vv/NMbNCtODB/pO7vLlF2OTmMVLhmr7Ag==",
|
||||
"version": "1.59.1",
|
||||
"resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.59.1.tgz",
|
||||
"integrity": "sha512-PG6q63nQg5c9rIi4/Z5lR5IVF7yU5MqmKaPOe0HSc0O2cX1fPi96sUQu5j7eo4gKCkB2AnNGoWt7y4/Xx3Kcqg==",
|
||||
"dev": true,
|
||||
"license": "Apache-2.0",
|
||||
"dependencies": {
|
||||
"playwright": "1.60.0"
|
||||
"playwright": "1.59.1"
|
||||
},
|
||||
"bin": {
|
||||
"playwright": "cli.js"
|
||||
@@ -60,13 +57,13 @@
|
||||
}
|
||||
},
|
||||
"node_modules/playwright": {
|
||||
"version": "1.60.0",
|
||||
"resolved": "https://registry.npmjs.org/playwright/-/playwright-1.60.0.tgz",
|
||||
"integrity": "sha512-hheHdokM8cdqCb0lcE3s+zT4t4W+vvjpGxsZlDnikarzx8tSzMebh3UiFtgqwFwnTnjYQcsyMF8ei2mCO/tpeA==",
|
||||
"version": "1.59.1",
|
||||
"resolved": "https://registry.npmjs.org/playwright/-/playwright-1.59.1.tgz",
|
||||
"integrity": "sha512-C8oWjPR3F81yljW9o5OxcWzfh6avkVwDD2VYdwIGqTkl+OGFISgypqzfu7dOe4QNLL2aqcWBmI3PMtLIK233lw==",
|
||||
"dev": true,
|
||||
"license": "Apache-2.0",
|
||||
"dependencies": {
|
||||
"playwright-core": "1.60.0"
|
||||
"playwright-core": "1.59.1"
|
||||
},
|
||||
"bin": {
|
||||
"playwright": "cli.js"
|
||||
@@ -79,9 +76,9 @@
|
||||
}
|
||||
},
|
||||
"node_modules/playwright-core": {
|
||||
"version": "1.60.0",
|
||||
"resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.60.0.tgz",
|
||||
"integrity": "sha512-9bW6zvX/m0lEbgTKJ6YppOKx8H3VOPBMOCFh2irXFOT4BbHgrx5hPjwJYLT40Lu+4qtD36qKc/Hn56StUW57IA==",
|
||||
"version": "1.59.1",
|
||||
"resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.59.1.tgz",
|
||||
"integrity": "sha512-HBV/RJg81z5BiiZ9yPzIiClYV/QMsDCKUyogwH9p3MCP6IYjUFu/MActgYAvK0oWyV9NlwM3GLBjADyWgydVyg==",
|
||||
"dev": true,
|
||||
"license": "Apache-2.0",
|
||||
"bin": {
|
||||
@@ -90,19 +87,6 @@
|
||||
"engines": {
|
||||
"node": ">=18"
|
||||
}
|
||||
},
|
||||
"node_modules/typescript": {
|
||||
"version": "6.0.3",
|
||||
"resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz",
|
||||
"integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==",
|
||||
"license": "Apache-2.0",
|
||||
"bin": {
|
||||
"tsc": "bin/tsc",
|
||||
"tsserver": "bin/tsserver"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=14.17"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "peptide-e2e",
|
||||
"version": "1.8.0",
|
||||
"version": "1.0.0",
|
||||
"description": "Playwright smoke tests for peptiderepo.com (staging + production)",
|
||||
"private": true,
|
||||
"scripts": {
|
||||
@@ -11,10 +11,7 @@
|
||||
"report": "playwright show-report"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@playwright/test": "^1.60.0",
|
||||
"@playwright/test": "^1.43.0",
|
||||
"dotenv": "^16.4.5"
|
||||
},
|
||||
"dependencies": {
|
||||
"typescript": "^6.0.3"
|
||||
}
|
||||
}
|
||||
|
||||
@@ -29,7 +29,7 @@ test.describe('Homepage', () => {
|
||||
|
||||
test('renders site name in page title', async ({ page }) => {
|
||||
await page.goto('/');
|
||||
await expect(page).toHaveTitle(/peptide ?repo/i);
|
||||
await expect(page).toHaveTitle(/peptiderepo/i);
|
||||
});
|
||||
|
||||
test('wp-admin bar present (logged-in session)', async ({ page }) => {
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
|
||||
import { test, expect } from '@playwright/test';
|
||||
|
||||
const CALC_PATH = process.env.CALC_PAGE_PATH ?? '/calculator/';
|
||||
const CALC_PATH = process.env.CALC_PAGE_PATH ?? '/reconstitution-calculator/';
|
||||
|
||||
test.describe('Reconstitution Calculator', () => {
|
||||
test.beforeEach(async ({ page }) => {
|
||||
@@ -39,14 +39,31 @@ test.describe('Reconstitution Calculator', () => {
|
||||
expect(options).toBeGreaterThan(1); // >1 means at least one peptide beyond placeholder
|
||||
});
|
||||
|
||||
test('fills inputs and gets a numeric result', async ({ page }) => {
|
||||
const calc = page.locator('.prc-calculator');
|
||||
// The calculator auto-computes once a peptide preset is chosen (the preset
|
||||
// supplies vial size, recommended water volume and a default dose).
|
||||
await calc.locator('#prc-peptide-select').selectOption({ index: 1 });
|
||||
// Results panel unhides and renders numeric result cards.
|
||||
const results = page.locator('#prc-results');
|
||||
await expect(results).toBeVisible({ timeout: 10_000 });
|
||||
await expect(page.locator('.prc-result-card__value').first()).toHaveText(/\d/, { timeout: 5_000 });
|
||||
});
|
||||
test('fills inputs and gets a numeric result', async ({ page }) => {
|
||||
// Select BPC-157 or the first non-placeholder option
|
||||
const select = page.locator('select').first();
|
||||
const firstPeptide = select.locator('option').nth(1);
|
||||
const firstValue = await firstPeptide.getAttribute('value');
|
||||
await select.selectOption(firstValue ?? '');
|
||||
|
||||
// Fill reconstitution volume (mL) — use a known valid value
|
||||
const volInput = page.locator('input[name*="recon"], input[placeholder*="mL"], input[type="number"]').first();
|
||||
await volInput.fill('2');
|
||||
|
||||
// Fill desired dose
|
||||
const doseInput = page.locator('input[name*="dose"], input[placeholder*="dose"], input[type="number"]').nth(1);
|
||||
await doseInput.fill('250');
|
||||
|
||||
// Trigger calculation (button or auto-calculate on input)
|
||||
const calcButton = page.locator('button[type="submit"], button:has-text("Calculate")');
|
||||
if (await calcButton.count() > 0) {
|
||||
await calcButton.first().click();
|
||||
}
|
||||
|
||||
// Results container should show a non-zero concentration or injection volume
|
||||
const results = page.locator('.prc-results, .calculator-results, [data-prc-result]').first();
|
||||
await expect(results).toBeVisible({ timeout: 5_000 });
|
||||
const resultText = await results.textContent();
|
||||
expect(resultText).toMatch(/\d+(\.\d+)?/); // contains at least one number
|
||||
});
|
||||
});
|
||||
|
||||
@@ -25,14 +25,14 @@ test.describe('Peptide Search AI', () => {
|
||||
test('search input widget is present on page', async ({ page }) => {
|
||||
// PSA renders a form with class .psa-search-form or input with data-psa attr
|
||||
const searchInput = page.locator(
|
||||
'.hero-search .psa-search-input'
|
||||
'.psa-search-form input, input[name*="peptide"], input[placeholder*="peptide" i], [data-psa] input'
|
||||
).first();
|
||||
await expect(searchInput).toBeVisible({ timeout: 10_000 });
|
||||
});
|
||||
|
||||
test('searching for a known peptide returns results', async ({ page }) => {
|
||||
const searchInput = page.locator(
|
||||
'.hero-search .psa-search-input'
|
||||
'.psa-search-form input, input[name*="peptide"], input[placeholder*="peptide" i], [data-psa] input'
|
||||
).first();
|
||||
await expect(searchInput).toBeVisible();
|
||||
|
||||
@@ -41,7 +41,7 @@ test.describe('Peptide Search AI', () => {
|
||||
await searchInput.press('Enter');
|
||||
|
||||
// Results container should appear and contain something
|
||||
const results = page.locator('.hero-search .psa-search-results').first();
|
||||
const results = page.locator('.psa-results, .psa-search-results, [data-psa-results]').first();
|
||||
await expect(results).toBeVisible({ timeout: 15_000 });
|
||||
const text = await results.textContent();
|
||||
expect((text ?? '').trim().length).toBeGreaterThan(0);
|
||||
@@ -57,7 +57,7 @@ test.describe('Peptide Search AI', () => {
|
||||
);
|
||||
|
||||
const searchInput = page.locator(
|
||||
'.hero-search .psa-search-input'
|
||||
'.psa-search-form input, input[name*="peptide"], input[placeholder*="peptide" i], [data-psa] input'
|
||||
).first();
|
||||
await searchInput.fill('TB-500');
|
||||
await searchInput.press('Enter');
|
||||
|
||||
@@ -25,7 +25,7 @@ const REQUIRED_PLUGINS = [
|
||||
'peptide-search-ai',
|
||||
'peptide-repo-core',
|
||||
'peptide-reconstitution-calculator',
|
||||
'prautoblogger',
|
||||
'pr-autoblogger',
|
||||
'peptide-starter-theme', // theme, shown differently — checked separately
|
||||
];
|
||||
|
||||
@@ -94,52 +94,13 @@ test.describe('WP Admin — PRAutoBlogger settings page', () => {
|
||||
});
|
||||
});
|
||||
|
||||
test.describe('WP Admin — PRAutoBlogger board page', () => {
|
||||
/**
|
||||
* Smoke test: Board submenu page must load without 404 or "Invalid plugin page".
|
||||
*
|
||||
* This test guards against the v0.19.1 regression class: Board submenu was
|
||||
* registered before the parent top-level menu page existed (both at admin_menu
|
||||
* priority 10), causing WordPress to fall back to the `admin_page_*` hookname.
|
||||
* At request time WP recomputed the hookname, found nothing, and called
|
||||
* wp_die("Invalid plugin page"). The fix (v0.19.1) moves the board hook to
|
||||
* priority 11 so the parent menu slot is populated first.
|
||||
*
|
||||
* Selector sourced from templates/admin/board-page.php: `<div id="prab-board" ...>`.
|
||||
*
|
||||
* NOTE: This test cannot be validated against prod until v0.19.1 is deployed.
|
||||
* It is included in the deploy-gate smoke suite so the bug class becomes
|
||||
* un-shippable in future. The spec compiles and lists cleanly; the test will
|
||||
* run correctly once the fix is live.
|
||||
*/
|
||||
test('board page loads and board container is present', async ({ page }) => {
|
||||
// Navigate to the Board submenu page.
|
||||
const res = await page.goto(`${ADMIN}/admin.php?page=prautoblogger-board`);
|
||||
|
||||
// Must be HTTP 200 — not wp_die 404.
|
||||
expect(res?.status()).toBe(200);
|
||||
|
||||
// wp-admin chrome must render (confirms we're authenticated and in admin).
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
|
||||
// Body must NOT contain the wp_die "Invalid plugin page" error string.
|
||||
const body = await page.textContent('body');
|
||||
expect(body).not.toContain('Invalid plugin page');
|
||||
|
||||
// Board container div must be present (from templates/admin/board-page.php).
|
||||
// selector: <div id="prab-board" class="prab-board" ...>
|
||||
await expect(page.locator('#prab-board')).toBeVisible({ timeout: 10_000 });
|
||||
});
|
||||
});
|
||||
|
||||
test.describe('WP Admin — Peptide Repo Core admin', () => {
|
||||
test('PR Core menu item exists in wp-admin', async ({ page }) => {
|
||||
await page.goto(`${ADMIN}/`);
|
||||
// PR Core registers the peptide CPT which creates a "Peptides" menu item
|
||||
const nav = page.locator('#adminmenu');
|
||||
// PR Core registers the peptide CPT which creates a "Peptides" menu item const nav = page.locator('#adminmenu');
|
||||
await expect(nav).toBeVisible();
|
||||
// PR Core registers the peptide CPT, which adds a post_type=peptide admin menu/submenu (label-agnostic).
|
||||
await expect(nav.locator('a[href*="post_type=peptide"]').first()).toBeAttached({ timeout: 10_000 });
|
||||
// "Peptides" top-level menu item is registered by the peptide CPT
|
||||
await expect(nav.locator('text=Peptides')).toBeVisible({ timeout: 10_000 });
|
||||
});
|
||||
|
||||
test('PR Core Settings page loads', async ({ page }) => {
|
||||
@@ -154,116 +115,3 @@ test.describe('WP Admin — Peptide Repo Core admin', () => {
|
||||
await expect(page.locator('form')).toBeVisible();
|
||||
});
|
||||
});
|
||||
|
||||
test.describe('WP Admin — PRAutoBlogger Article Dossier', () => {
|
||||
/**
|
||||
* Smoke test: Article Dossier page must load without "Invalid plugin page" error.
|
||||
*
|
||||
* The dossier is a hidden-submenu page registered at admin_menu priority 12
|
||||
* (after board p11, after parent p10). It is link-accessed via
|
||||
* admin.php?page=prautoblogger-dossier&post_id=<int>.
|
||||
*
|
||||
* This test guards against:
|
||||
* 1. Menu-ordering regression (wrong hookname → wp_die 404).
|
||||
* 2. PHP fatal errors on dossier load (missing require, fatal in assembler).
|
||||
* 3. Missing dossier container div (template regression).
|
||||
* 4. Stage-section regression (stage markup absent when run data exists).
|
||||
*
|
||||
* Defensive strategy: the test first queries the WP REST API for a post
|
||||
* published by PRAutoBlogger (_prautoblogger_generated=1). If a post is found,
|
||||
* it opens its dossier and asserts the full set. If no matching post exists
|
||||
* on this environment (staging/prod may differ), the test opens the dossier
|
||||
* with post_id=0 and asserts the graceful "no run record" empty state — which
|
||||
* still validates page load, no fatal, no "Invalid plugin page".
|
||||
*
|
||||
* Selector sourced from templates/admin/dossier-page.php:
|
||||
* <div id="prab-dossier" class="prab-dossier-wrap" ...>
|
||||
*
|
||||
* Posts 925/930 are the canonical staging test posts (v0.18.3 generation run).
|
||||
* They are tried first; REST fallback handles environments where they don't exist.
|
||||
*/
|
||||
test('dossier page loads and dossier container is present', async ({ page, request }) => {
|
||||
const ADMIN = '/wp-admin';
|
||||
const CANDIDATE_POST_IDS = [925, 930]; // staging canonical posts from v0.18.3
|
||||
|
||||
// Strategy 1: try known staging post IDs
|
||||
let targetPostId: number | null = null;
|
||||
|
||||
for (const pid of CANDIDATE_POST_IDS) {
|
||||
const apiRes = await request.get(`/wp-json/wp/v2/posts/${pid}`);
|
||||
if (apiRes.ok()) {
|
||||
targetPostId = pid;
|
||||
console.log(`[dossier smoke] Found candidate post id=${pid} via REST API`);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
// Strategy 2: query for any PRAutoBlogger-generated post via REST
|
||||
if (targetPostId === null) {
|
||||
const listRes = await request.get('/wp-json/wp/v2/posts?per_page=5&orderby=date&order=desc');
|
||||
if (listRes.ok()) {
|
||||
const posts: Array<{ id: number; meta?: Record<string, unknown> }> = await listRes.json();
|
||||
if (posts.length > 0) {
|
||||
targetPostId = posts[0].id;
|
||||
console.log(`[dossier smoke] Fallback: using most recent post id=${targetPostId}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Navigate to dossier — use targetPostId if found, else post_id=0 for graceful empty state
|
||||
const postIdParam = targetPostId !== null ? targetPostId : 0;
|
||||
const dossierUrl = `${ADMIN}/admin.php?page=prautoblogger-dossier&post_id=${postIdParam}`;
|
||||
|
||||
if (targetPostId === null) {
|
||||
// Loud annotation — the dossier will render empty state, not full dossier
|
||||
test.info().annotations.push({
|
||||
type: 'warning',
|
||||
description:
|
||||
'[dossier smoke] No PRAutoBlogger post found on this environment. ' +
|
||||
'Asserting graceful empty state (post_id=0). ' +
|
||||
'Full dossier assertions (stage sections) require a post with a run record.',
|
||||
});
|
||||
}
|
||||
|
||||
const res = await page.goto(dossierUrl);
|
||||
|
||||
// Must be HTTP 200 — not wp_die 404 (menu-ordering regression guard).
|
||||
expect(res?.status()).toBe(200);
|
||||
|
||||
// wp-admin chrome must render (confirms auth session is valid).
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
|
||||
// Body must NOT contain the wp_die "Invalid plugin page" error string.
|
||||
const body = await page.textContent('body');
|
||||
expect(body).not.toContain('Invalid plugin page');
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
// Dossier container div must be present in all cases (full run OR empty state).
|
||||
// Selector from templates/admin/dossier-page.php: <div id="prab-dossier" ...>
|
||||
await expect(page.locator('#prab-dossier')).toBeVisible({ timeout: 10_000 });
|
||||
|
||||
// Stage sections — only assert if we have a post with (likely) a run record.
|
||||
if (targetPostId !== null) {
|
||||
// At least one stage section must be present IF the post has a run record.
|
||||
// The dossier may still show empty state if this post pre-dates the substrate.
|
||||
// We assert conditionally: if any stage section exists, it has the right class.
|
||||
const stageSections = page.locator('.prab-stage-section');
|
||||
const stageCount = await stageSections.count();
|
||||
|
||||
if (stageCount > 0) {
|
||||
// Dossier has stage data — verify stage sections render without error
|
||||
console.log(`[dossier smoke] Found ${stageCount} stage sections on post id=${targetPostId}`);
|
||||
await expect(stageSections.first()).toBeVisible();
|
||||
} else {
|
||||
// Post exists but has no run stages — graceful empty state (pre-substrate post)
|
||||
test.info().annotations.push({
|
||||
type: 'info',
|
||||
description:
|
||||
`[dossier smoke] Post id=${targetPostId} exists but has no stage sections. ` +
|
||||
'This is the expected graceful state for posts published before v0.18.0.',
|
||||
});
|
||||
// The dossier container is already verified above; this is not a failure.
|
||||
}
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
@@ -38,6 +38,7 @@ test.describe('REST API — Peptide Search AI', () => {
|
||||
expect([200, 404]).toContain(res.status());
|
||||
if (res.status() === 200) {
|
||||
const body = await res.json();
|
||||
expect(body).toHaveProperty('status');
|
||||
expect(body).toHaveProperty('results');
|
||||
}
|
||||
});
|
||||
|
||||
@@ -1,136 +0,0 @@
|
||||
/**
|
||||
* 05-dossier-edit.spec.ts
|
||||
*
|
||||
* What: Smoke for the PRAutoBlogger dossier EDIT + RE-RUN surface
|
||||
* (plugin v0.20.0, Phase 2 admin M3). Read-only: opens/closes the
|
||||
* edit panel and asserts structure — it NEVER clicks Save or any
|
||||
* Re-run button (those fork inputs / queue paid LLM jobs).
|
||||
* Who triggers it: Playwright chromium project (post-auth setup).
|
||||
* Dependencies: wp-admin authenticated session (from global.setup.ts).
|
||||
*
|
||||
* SKIP-IF-ABSENT (M3 binding): this spec targets a surface that may not
|
||||
* be deployed yet. When the M3 markup (.prab-stage-rerun-footer) is
|
||||
* absent from the dossier, the test SKIPS with a loud annotation so this
|
||||
* PR can merge before the plugin PR ships. Once v0.20.0 is live, the
|
||||
* skip path goes dead and the assertions gate as usual.
|
||||
*
|
||||
* Selectors sourced from prautoblogger v0.20.0:
|
||||
* templates/admin/dossier-stage-section.php (.prab-stage-rerun-footer,
|
||||
* .prab-edit-toggle, .prab-edit-unavailable, .prab-rerun-from)
|
||||
* templates/admin/dossier-edit-panel.php (.prab-edit-panel,
|
||||
* .prab-edit-textarea, .prab-edit-save, .prab-edit-rerun)
|
||||
* templates/admin/dossier-sidebar-cards.php (.prab-run-spend,
|
||||
* .prab-models-card)
|
||||
*
|
||||
* @see prautoblogger PR #161 (v0.20.0) — the surface under test.
|
||||
*/
|
||||
|
||||
import { test, expect } from '@playwright/test';
|
||||
|
||||
const ADMIN = '/wp-admin';
|
||||
const CANDIDATE_POST_IDS = [925, 930]; // canonical staging posts
|
||||
|
||||
test.describe('WP Admin — PRAutoBlogger dossier edit + re-run (M3)', () => {
|
||||
test('edit affordances render structurally (no mutations)', async ({ page, request }) => {
|
||||
// ── Post discovery (same defensive strategy as the dossier smoke) ──
|
||||
let targetPostId: number | null = null;
|
||||
for (const pid of CANDIDATE_POST_IDS) {
|
||||
const apiRes = await request.get(`/wp-json/wp/v2/posts/${pid}`);
|
||||
if (apiRes.ok()) {
|
||||
targetPostId = pid;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (targetPostId === null) {
|
||||
const listRes = await request.get('/wp-json/wp/v2/posts?per_page=5&orderby=date&order=desc');
|
||||
if (listRes.ok()) {
|
||||
const posts: Array<{ id: number }> = await listRes.json();
|
||||
if (posts.length > 0) {
|
||||
targetPostId = posts[0].id;
|
||||
}
|
||||
}
|
||||
}
|
||||
if (targetPostId === null) {
|
||||
test.info().annotations.push({
|
||||
type: 'warning',
|
||||
description:
|
||||
'[dossier-edit smoke] No post found on this environment — ' +
|
||||
'cannot exercise the edit surface. Skipping.',
|
||||
});
|
||||
test.skip();
|
||||
return;
|
||||
}
|
||||
|
||||
const res = await page.goto(`${ADMIN}/admin.php?page=prautoblogger-dossier&post_id=${targetPostId}`);
|
||||
expect(res?.status()).toBe(200);
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
const body = await page.textContent('body');
|
||||
expect(body).not.toContain('Fatal error');
|
||||
expect(body).not.toContain('Invalid plugin page');
|
||||
|
||||
// ── SKIP-IF-ABSENT gate: M3 markup not deployed yet ────────────────
|
||||
const footers = page.locator('.prab-stage-rerun-footer');
|
||||
const footerCount = await footers.count();
|
||||
if (footerCount === 0) {
|
||||
test.info().annotations.push({
|
||||
type: 'warning',
|
||||
description:
|
||||
'[dossier-edit smoke] .prab-stage-rerun-footer absent — the M3 ' +
|
||||
'edit+rerun surface (plugin v0.20.0) is not deployed on this ' +
|
||||
'environment, or this post has no stage sections. Skipping per ' +
|
||||
'the merge-early binding.',
|
||||
});
|
||||
test.skip();
|
||||
return;
|
||||
}
|
||||
|
||||
console.log(`[dossier-edit smoke] Found ${footerCount} stage rerun footers on post id=${targetPostId}`);
|
||||
|
||||
// ── Disabled affordances must explain themselves ───────────────────
|
||||
const unavailable = page.locator('.prab-edit-unavailable');
|
||||
const unavailableCount = await unavailable.count();
|
||||
for (let i = 0; i < unavailableCount; i++) {
|
||||
const reason = (await unavailable.nth(i).textContent())?.trim() ?? '';
|
||||
expect(reason.length, 'disabled edit affordances must carry a visible reason').toBeGreaterThan(10);
|
||||
}
|
||||
|
||||
// ── Edit panel open/close (read-only — NEVER click save/rerun) ─────
|
||||
const toggles = page.locator('.prab-edit-toggle');
|
||||
const toggleCount = await toggles.count();
|
||||
if (toggleCount === 0) {
|
||||
test.info().annotations.push({
|
||||
type: 'info',
|
||||
description:
|
||||
'[dossier-edit smoke] No editable stage on this post (no recorded ' +
|
||||
'request_json yet, or post is published/frozen). Disabled-state ' +
|
||||
'reasons were asserted; panel interaction not exercisable.',
|
||||
});
|
||||
return;
|
||||
}
|
||||
|
||||
const firstToggle = toggles.first();
|
||||
const panelId = await firstToggle.getAttribute('aria-controls');
|
||||
expect(panelId).toBeTruthy();
|
||||
const panel = page.locator(`#${panelId}`);
|
||||
|
||||
await firstToggle.click();
|
||||
await expect(panel).toBeVisible();
|
||||
await expect(firstToggle).toHaveAttribute('aria-expanded', 'true');
|
||||
|
||||
// Panel structure: textareas + save + rerun buttons + fork/queue copy.
|
||||
expect(await panel.locator('.prab-edit-textarea').count()).toBeGreaterThan(0);
|
||||
await expect(panel.locator('.prab-edit-save')).toBeVisible();
|
||||
await expect(panel.locator('.prab-edit-rerun')).toBeVisible();
|
||||
const copy = (await panel.textContent()) ?? '';
|
||||
expect(copy).toContain('original is preserved'); // fork copy (guardrail 1)
|
||||
expect(copy.toLowerCase()).toContain('queued'); // chained-cron copy
|
||||
|
||||
// Close it again — leave the page exactly as found.
|
||||
await firstToggle.click();
|
||||
await expect(panel).toBeHidden();
|
||||
|
||||
// ── M3 sidebar cards present when run data exists ──────────────────
|
||||
await expect(page.locator('.prab-run-spend')).toBeVisible();
|
||||
await expect(page.locator('.prab-models-card')).toBeVisible();
|
||||
});
|
||||
});
|
||||
@@ -1,156 +0,0 @@
|
||||
/**
|
||||
* 06-board-generate-now.spec.ts
|
||||
*
|
||||
* What: Smoke for the PRAutoBlogger board "Generate Now" control (v0.21.0, M4).
|
||||
* Asserts that the board page renders the generate-now button and that
|
||||
* clicking it sends the kick-off AJAX request without a PHP fatal.
|
||||
* Read-only assertions only — this test NEVER waits for article generation
|
||||
* to complete (that would make LLM API calls in CI).
|
||||
*
|
||||
* SKIP-IF-ABSENT (M4 binding): the generate-now surface ships with v0.21.0
|
||||
* (prautoblogger PR #166). This spec guards against the board container
|
||||
* (#prab-board) being absent or the generate-now button (#prab-generate-now)
|
||||
* missing. When those selectors are absent (v0.21.0 not yet deployed), the
|
||||
* entire test suite skips with a loud annotation so this PR can merge before
|
||||
* the plugin PR — matching the M2 merge-order binding.
|
||||
*
|
||||
* Selectors sourced from prautoblogger v0.21.0:
|
||||
* templates/admin/board-page.php: #prab-board, #prab-generate-now
|
||||
* assets/js/board-generate.js: data-nonce, wp.ajax / admin-ajax.php
|
||||
*
|
||||
* Who triggers it: Playwright chromium project (post-auth setup).
|
||||
* Dependencies: wp-admin authenticated session (from global.setup.ts).
|
||||
*
|
||||
* @see prautoblogger PR #166 (v0.21.0) — the surface under test.
|
||||
*/
|
||||
|
||||
import { test, expect } from '@playwright/test';
|
||||
|
||||
const ADMIN = '/wp-admin';
|
||||
const BOARD_URL = `${ADMIN}/admin.php?page=prautoblogger-board`;
|
||||
|
||||
test.describe('WP Admin — PRAutoBlogger board Generate Now (M4)', () => {
|
||||
test('board page loads and generate-now button is present (skip-if-absent)', async ({ page }) => {
|
||||
// Navigate to the board page.
|
||||
const res = await page.goto(BOARD_URL);
|
||||
|
||||
// Must be HTTP 200 (guards menu-registration regression).
|
||||
expect(res?.status()).toBe(200);
|
||||
|
||||
// wp-admin chrome must be present.
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
|
||||
// Body must not contain PHP fatal or wp_die error strings.
|
||||
const body = await page.textContent('body');
|
||||
expect(body).not.toContain('Fatal error');
|
||||
expect(body).not.toContain('Invalid plugin page');
|
||||
|
||||
// ── SKIP-IF-ABSENT guard ────────────────────────────────────────────────
|
||||
// The generate-now surface ships with v0.21.0. If the board container or
|
||||
// the button is absent, the M4 plugin is not yet deployed — skip loudly.
|
||||
const boardContainer = page.locator('#prab-board');
|
||||
const boardPresent = await boardContainer.count() > 0;
|
||||
|
||||
if ( ! boardPresent ) {
|
||||
test.info().annotations.push({
|
||||
type: 'skip',
|
||||
description:
|
||||
'[generate-now smoke] #prab-board absent: v0.21.0 (M4) not yet deployed. ' +
|
||||
'Skipping generate-now assertions — they will gate once the plugin PR ships.',
|
||||
});
|
||||
test.skip();
|
||||
return;
|
||||
}
|
||||
|
||||
// Board container must be visible.
|
||||
await expect(boardContainer).toBeVisible({ timeout: 10_000 });
|
||||
|
||||
// ── Generate-now button (skip-if-absent) ────────────────────────────────
|
||||
const generateBtn = page.locator('#prab-generate-now');
|
||||
const btnPresent = await generateBtn.count() > 0;
|
||||
|
||||
if ( ! btnPresent ) {
|
||||
test.info().annotations.push({
|
||||
type: 'skip',
|
||||
description:
|
||||
'[generate-now smoke] #prab-generate-now absent: M4 button not yet in deployed build. ' +
|
||||
'Skipping button assertions.',
|
||||
});
|
||||
test.skip();
|
||||
return;
|
||||
}
|
||||
|
||||
// Button must be visible and carry a nonce for the AJAX call.
|
||||
await expect(generateBtn).toBeVisible({ timeout: 5_000 });
|
||||
const nonce = await generateBtn.getAttribute('data-nonce');
|
||||
expect(nonce).toBeTruthy();
|
||||
|
||||
console.log(
|
||||
'[generate-now smoke] Generate Now button found with nonce — M4 surface is deployed.'
|
||||
);
|
||||
});
|
||||
|
||||
test('generate-now AJAX responds with JSON (no fatal) — skip-if-absent', async ({ page, request }) => {
|
||||
// Navigate first to establish auth cookies for the request context.
|
||||
await page.goto(BOARD_URL);
|
||||
|
||||
const body = await page.textContent('body');
|
||||
if ( ! body?.includes('prab-board') ) {
|
||||
test.info().annotations.push({
|
||||
type: 'skip',
|
||||
description: '[generate-now smoke] Board container absent — v0.21.0 not deployed. Skipping.',
|
||||
});
|
||||
test.skip();
|
||||
return;
|
||||
}
|
||||
|
||||
const generateBtn = page.locator('#prab-generate-now');
|
||||
if ( await generateBtn.count() === 0 ) {
|
||||
test.info().annotations.push({
|
||||
type: 'skip',
|
||||
description: '[generate-now smoke] #prab-generate-now absent — skipping AJAX test.',
|
||||
});
|
||||
test.skip();
|
||||
return;
|
||||
}
|
||||
|
||||
// Read the nonce from the button (set by wp_localize_script).
|
||||
const nonce = await generateBtn.getAttribute('data-nonce') ?? '';
|
||||
|
||||
// Fire the kick-off AJAX action (same as board-generate.js would).
|
||||
// We use the request context to intercept without actually triggering
|
||||
// the full pipeline — the action is idempotent (kick_off() guards against
|
||||
// duplicate scheduling with wp_next_scheduled()).
|
||||
//
|
||||
// NOTE: We assert the response is valid JSON with a 'success' or 'data'
|
||||
// key only. We do NOT check that generation actually runs (LLM calls).
|
||||
const adminAjax = `${ADMIN}/admin-ajax.php`;
|
||||
const formData = new URLSearchParams({
|
||||
action: 'prautoblogger_generate_now',
|
||||
nonce,
|
||||
});
|
||||
|
||||
const ajaxRes = await request.post(adminAjax, {
|
||||
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
|
||||
data: formData.toString(),
|
||||
});
|
||||
|
||||
// Must be HTTP 200 (not 403/500).
|
||||
expect(ajaxRes.status()).toBe(200);
|
||||
|
||||
// Response must be valid JSON (no PHP fatal/notice dumped as HTML).
|
||||
const text = await ajaxRes.text();
|
||||
let parsed: unknown;
|
||||
try {
|
||||
parsed = JSON.parse(text);
|
||||
} catch {
|
||||
throw new Error(
|
||||
`[generate-now smoke] AJAX response is not valid JSON — possible PHP fatal.\nRaw: ${text.slice(0, 500)}`
|
||||
);
|
||||
}
|
||||
|
||||
// WordPress wp_send_json_success / _error always wraps in { success: bool }.
|
||||
expect(parsed).toHaveProperty('success');
|
||||
console.log('[generate-now smoke] AJAX response:', JSON.stringify(parsed).slice(0, 200));
|
||||
});
|
||||
});
|
||||
@@ -1,144 +0,0 @@
|
||||
/**
|
||||
* 07-peptide-news-admin.spec.ts
|
||||
*
|
||||
* What: Smoke tests for the Peptide News Plugin admin surfaces.
|
||||
* Verifies the dashboard, settings, articles, and cost sub-pages
|
||||
* load without PHP fatals and checks expected UI elements.
|
||||
* Guards against activation failures, missing menu registration, or
|
||||
* PHP fatals introduced by a bad deploy.
|
||||
*
|
||||
* Who triggers it: Playwright chromium project (post-auth setup).
|
||||
* Dependencies: wp-admin authenticated session (from global.setup.ts).
|
||||
*
|
||||
* SKIP-IF-ABSENT: When the Peptide News Plugin is not installed/activated on
|
||||
* this environment, each test detects the absent menu page and skips with a
|
||||
* loud annotation — consistent with the 05/06 merge-early binding pattern.
|
||||
*
|
||||
* Admin menu slugs (sourced from admin/class-pn-admin-menu.php):
|
||||
* Dashboard -> admin.php?page=peptide-news-dashboard
|
||||
* Settings -> admin.php?page=peptide-news-settings
|
||||
* Articles -> admin.php?page=peptide-news-articles
|
||||
* LLM Costs -> admin.php?page=peptide-news-costs
|
||||
*
|
||||
* Selectors sourced from admin/partials/dashboard.php:
|
||||
* h1 "Peptide News Analytics" - page heading (text match)
|
||||
* .pn-summary-cards - summary card row
|
||||
* .pn-date-filter - date range filter form
|
||||
*
|
||||
* @see peptiderepo/peptide-news-plugin admin/class-pn-admin-menu.php
|
||||
* @see peptiderepo/peptide-news-plugin admin/partials/dashboard.php
|
||||
*/
|
||||
|
||||
import { test, expect } from '@playwright/test';
|
||||
|
||||
const ADMIN = '/wp-admin';
|
||||
|
||||
/**
|
||||
* Detect the "page not registered" condition WordPress returns when a plugin
|
||||
* menu slug is unknown. Returns true when the plugin is absent.
|
||||
*
|
||||
* WordPress either:
|
||||
* (a) Shows "You do not have sufficient permissions to access this page."
|
||||
* (b) Shows a notice that the page cannot be found
|
||||
* (c) Redirects back to /wp-admin/ stripping the ?page= param
|
||||
*/
|
||||
function isPluginAbsent(body: string, url: string): boolean {
|
||||
return (
|
||||
body.includes('Invalid plugin page') ||
|
||||
body.includes('do not have sufficient permissions') ||
|
||||
body.includes('The page you are looking for') ||
|
||||
( url.includes('/wp-admin/') && ! url.includes('page=peptide-news') )
|
||||
);
|
||||
}
|
||||
|
||||
/** Push a loud skip annotation and call test.skip(). */
|
||||
function skipMissing(): void {
|
||||
test.info().annotations.push({
|
||||
type: 'skip',
|
||||
description:
|
||||
'[peptide-news smoke] Peptide News Plugin is not installed or activated ' +
|
||||
'on this environment. Skipping per the merge-early binding.',
|
||||
});
|
||||
test.skip();
|
||||
}
|
||||
|
||||
test.describe('WP Admin - Peptide News Plugin dashboard', () => {
|
||||
test('dashboard page loads (HTTP 200, no PHP fatal)', async ({ page }) => {
|
||||
const res = await page.goto(`${ADMIN}/admin.php?page=peptide-news-dashboard`);
|
||||
expect(res?.status()).toBe(200);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
});
|
||||
|
||||
test('dashboard renders analytics heading, summary cards, and date filter', async ({ page }) => {
|
||||
await page.goto(`${ADMIN}/admin.php?page=peptide-news-dashboard`);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
|
||||
// Heading from admin/partials/dashboard.php: <h1>Peptide News Analytics</h1>
|
||||
await expect(
|
||||
page.locator('h1').filter({ hasText: 'Peptide News Analytics' })
|
||||
).toBeVisible({ timeout: 10_000 });
|
||||
|
||||
// Summary card row: <div class="pn-summary-cards">
|
||||
await expect(page.locator('.pn-summary-cards')).toBeVisible({ timeout: 10_000 });
|
||||
|
||||
// Date range filter form: <form class="pn-date-filter">
|
||||
await expect(page.locator('.pn-date-filter')).toBeVisible({ timeout: 10_000 });
|
||||
});
|
||||
});
|
||||
|
||||
test.describe('WP Admin - Peptide News Plugin settings page', () => {
|
||||
test('settings page loads (HTTP 200, no fatal, settings form present)', async ({ page }) => {
|
||||
const res = await page.goto(`${ADMIN}/admin.php?page=peptide-news-settings`);
|
||||
expect(res?.status()).toBe(200);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
|
||||
// Every settings page rendered by class-pn-admin-settings-page.php contains a form
|
||||
await expect(page.locator('form').first()).toBeVisible({ timeout: 10_000 });
|
||||
});
|
||||
});
|
||||
|
||||
test.describe('WP Admin - Peptide News Plugin articles page', () => {
|
||||
test('articles page loads without fatal error', async ({ page }) => {
|
||||
const res = await page.goto(`${ADMIN}/admin.php?page=peptide-news-articles`);
|
||||
expect(res?.status()).toBe(200);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
|
||||
expect(body).not.toContain('Invalid plugin page');
|
||||
});
|
||||
});
|
||||
|
||||
test.describe('WP Admin - Peptide News Plugin LLM costs page', () => {
|
||||
test('costs page loads without fatal error', async ({ page }) => {
|
||||
const res = await page.goto(`${ADMIN}/admin.php?page=peptide-news-costs`);
|
||||
expect(res?.status()).toBe(200);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
|
||||
expect(body).not.toContain('Invalid plugin page');
|
||||
});
|
||||
});
|
||||
@@ -1,220 +0,0 @@
|
||||
/**
|
||||
* 08-pr-vision-admin.spec.ts
|
||||
*
|
||||
* What: Smoke tests for the PR Vision plugin admin surfaces.
|
||||
* Covers the dashboard, Settings (API-key-manager card + write-only
|
||||
* invariant), Costs, and Call Log sub-pages. Guards against PHP fatals,
|
||||
* missing menu registration, and key leakage regressions.
|
||||
*
|
||||
* Who triggers it: Playwright chromium project (post-auth setup).
|
||||
* Dependencies: wp-admin authenticated session (from global.setup.ts).
|
||||
*
|
||||
* SKIP-IF-ABSENT: When PR Vision is not installed/activated on this
|
||||
* environment, each test detects the absent page and skips with a loud
|
||||
* annotation - consistent with the 05/06 merge-early binding pattern.
|
||||
*
|
||||
* Admin menu slugs (sourced from includes/core/class-prv-admin-page.php
|
||||
* and includes/core/class-prv-settings-page.php,
|
||||
* includes/core/class-prv-costs-page.php,
|
||||
* includes/core/class-prv-call-log-page.php):
|
||||
* Dashboard -> admin.php?page=pr-vision (MENU_SLUG = 'pr-vision')
|
||||
* Settings -> admin.php?page=pr-vision-settings (MENU_SLUG = 'pr-vision-settings')
|
||||
* Costs -> admin.php?page=pr-vision-costs (MENU_SLUG = 'pr-vision-costs')
|
||||
* Call Log -> admin.php?page=pr-vision-calls (MENU_SLUG = 'pr-vision-calls')
|
||||
*
|
||||
* Selectors sourced from includes/core/class-prv-admin-page.php:
|
||||
* h1 "PR Vision - AI Visibility" - dashboard page heading
|
||||
*
|
||||
* Selectors sourced from includes/core/class-prv-key-manager-renderer.php:
|
||||
* #prv-key-card - the API-key-manager card container
|
||||
* #prv-key-source-badge - key source status indicator span
|
||||
* #prv_api_key - password input (must render empty - write-only invariant)
|
||||
*
|
||||
* Write-only invariant (security):
|
||||
* The stored OpenRouter key must NEVER appear in page source.
|
||||
* #prv_api_key renders with value="" on every page load regardless of
|
||||
* whether a key is stored. This spec asserts the empty value and asserts
|
||||
* that no structurally valid key token (regex /sk-or-v1-[A-Za-z0-9]{20,}/)
|
||||
* appears in the full body HTML. A regex is used instead of a naive
|
||||
* toContain('sk-or-') to avoid a false-positive on the password input's
|
||||
* placeholder="sk-or-…" attribute (the ellipsis is a format hint, not a
|
||||
* token body, and won't match the regex).
|
||||
*
|
||||
* @see peptiderepo/pr-vision includes/core/class-prv-admin-page.php
|
||||
* @see peptiderepo/pr-vision includes/core/class-prv-settings-page.php
|
||||
* @see peptiderepo/pr-vision includes/core/class-prv-key-manager-renderer.php
|
||||
*/
|
||||
|
||||
import { test, expect } from '@playwright/test';
|
||||
|
||||
const ADMIN = '/wp-admin';
|
||||
|
||||
/**
|
||||
* Detect the "page not registered" condition WordPress returns when a plugin
|
||||
* menu slug is unknown. Returns true when the plugin is absent.
|
||||
*/
|
||||
function isPluginAbsent(body: string, url: string): boolean {
|
||||
return (
|
||||
body.includes('Invalid plugin page') ||
|
||||
body.includes('do not have sufficient permissions') ||
|
||||
body.includes('The page you are looking for') ||
|
||||
( url.includes('/wp-admin/') && ! url.includes('page=pr-vision') )
|
||||
);
|
||||
}
|
||||
|
||||
/** Push a loud skip annotation and call test.skip(). */
|
||||
function skipMissing(): void {
|
||||
test.info().annotations.push({
|
||||
type: 'skip',
|
||||
description:
|
||||
'[pr-vision smoke] PR Vision plugin is not installed or activated ' +
|
||||
'on this environment. Skipping per the merge-early binding.',
|
||||
});
|
||||
test.skip();
|
||||
}
|
||||
|
||||
test.describe('WP Admin - PR Vision dashboard', () => {
|
||||
test('dashboard page loads (HTTP 200, no PHP fatal)', async ({ page }) => {
|
||||
const res = await page.goto(`${ADMIN}/admin.php?page=pr-vision`);
|
||||
expect(res?.status()).toBe(200);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
|
||||
// Heading from class-prv-admin-page.php render_page():
|
||||
// echo '<h1>' . esc_html__( 'PR Vision - AI Visibility', 'pr-vision' ) . '</h1>';
|
||||
await expect(
|
||||
page.locator('h1').filter({ hasText: 'PR Vision' })
|
||||
).toBeVisible({ timeout: 10_000 });
|
||||
});
|
||||
});
|
||||
|
||||
test.describe('WP Admin - PR Vision Settings page (API-key-manager)', () => {
|
||||
test('settings page loads (HTTP 200, no PHP fatal)', async ({ page }) => {
|
||||
const res = await page.goto(`${ADMIN}/admin.php?page=pr-vision-settings`);
|
||||
expect(res?.status()).toBe(200);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
});
|
||||
|
||||
test('API-key-manager card is present and status indicator visible', async ({ page }) => {
|
||||
await page.goto(`${ADMIN}/admin.php?page=pr-vision-settings`);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
|
||||
// ── SKIP-IF-ABSENT guard: Settings page may not have key-card if Settings
|
||||
// subpage (v0.2.0) is not yet deployed on this environment.
|
||||
const keyCard = page.locator('#prv-key-card');
|
||||
const cardPresent = await keyCard.count() > 0;
|
||||
|
||||
if ( ! cardPresent ) {
|
||||
test.info().annotations.push({
|
||||
type: 'skip',
|
||||
description:
|
||||
'[pr-vision smoke] #prv-key-card absent: PR Vision Settings page ' +
|
||||
'(v0.2.0 admin) is not deployed on this environment. Skipping key-manager assertions.',
|
||||
});
|
||||
test.skip();
|
||||
return;
|
||||
}
|
||||
|
||||
// API-key-manager card container from class-prv-key-manager-renderer.php:
|
||||
// <div class="prv-card" id="prv-key-card">
|
||||
await expect(keyCard).toBeVisible({ timeout: 10_000 });
|
||||
|
||||
// Key source status indicator: <span ... id="prv-key-source-badge">
|
||||
// Shows one of: "Set via wp-config", "Set via admin", "Not set"
|
||||
await expect(page.locator('#prv-key-source-badge')).toBeVisible({ timeout: 10_000 });
|
||||
});
|
||||
|
||||
test('password input is present and renders EMPTY (write-only invariant)', async ({ page }) => {
|
||||
await page.goto(`${ADMIN}/admin.php?page=pr-vision-settings`);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
|
||||
const keyCard = page.locator('#prv-key-card');
|
||||
const cardPresent = await keyCard.count() > 0;
|
||||
if ( ! cardPresent ) {
|
||||
test.info().annotations.push({
|
||||
type: 'skip',
|
||||
description:
|
||||
'[pr-vision smoke] #prv-key-card absent: skipping write-only invariant check.',
|
||||
});
|
||||
test.skip();
|
||||
return;
|
||||
}
|
||||
|
||||
// Password input from class-prv-key-manager-renderer.php render_key_form():
|
||||
// <input type="password" id="prv_api_key" name="prv_api_key" ... value="" ...>
|
||||
// The renderer explicitly passes value="" -- the stored key is NEVER output.
|
||||
const keyInput = page.locator('#prv_api_key');
|
||||
|
||||
// When the key source is SOURCE_CONSTANT the input is disabled but still rendered.
|
||||
// In all cases it must be present in the DOM.
|
||||
await expect(keyInput).toBeAttached({ timeout: 10_000 });
|
||||
|
||||
// Write-only invariant: value attribute must be empty string, not the stored key.
|
||||
const inputValue = await keyInput.getAttribute('value');
|
||||
expect(inputValue ?? '').toBe('');
|
||||
|
||||
// Security check: a *real* OpenRouter key (format "sk-or-v1-<20+ alnum chars>")
|
||||
// must not appear anywhere in the page HTML -- guards against accidental
|
||||
// server-side leakage.
|
||||
//
|
||||
// NOTE: We use a regex rather than the naive toContain('sk-or-') to avoid
|
||||
// a false-positive: the password input carries placeholder="sk-or-…"
|
||||
// (an ellipsis format-hint, not a token body) which contains the literal
|
||||
// string "sk-or-" but is NOT a leaked key. A regex that requires the
|
||||
// "v1-" segment and at least 20 alphanumeric characters only matches a
|
||||
// structurally valid key, so the placeholder never trips it.
|
||||
const html = await page.content();
|
||||
expect(html).not.toMatch(/sk-or-v1-[A-Za-z0-9]{20,}/);
|
||||
});
|
||||
});
|
||||
|
||||
test.describe('WP Admin - PR Vision Costs page', () => {
|
||||
test('costs page loads without fatal error', async ({ page }) => {
|
||||
const res = await page.goto(`${ADMIN}/admin.php?page=pr-vision-costs`);
|
||||
expect(res?.status()).toBe(200);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
|
||||
expect(body).not.toContain('Invalid plugin page');
|
||||
});
|
||||
});
|
||||
|
||||
test.describe('WP Admin - PR Vision Call Log page', () => {
|
||||
test('call log page loads without fatal error', async ({ page }) => {
|
||||
const res = await page.goto(`${ADMIN}/admin.php?page=pr-vision-calls`);
|
||||
expect(res?.status()).toBe(200);
|
||||
|
||||
await expect(page.locator('#wpbody')).toBeVisible();
|
||||
const body = (await page.textContent('body')) ?? '';
|
||||
expect(body).not.toContain('Fatal error');
|
||||
|
||||
if (isPluginAbsent(body, page.url())) { skipMissing(); return; }
|
||||
|
||||
expect(body).not.toContain('Invalid plugin page');
|
||||
});
|
||||
});
|
||||
@@ -1,265 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Render .gitea/workflows/pipeline.yml for a peptide-repo repository.
|
||||
|
||||
Why this exists: Gitea 1.25 cannot run reusable workflows (workflow_call), so
|
||||
the shared CI/deploy logic lives in composite actions under .gitea/actions/ in
|
||||
peptide-e2e, and each repo gets a thin generated job graph that calls them.
|
||||
Edit repos.json or this template, never the generated files.
|
||||
|
||||
usage: render.py <repo-name> [repos.json] -> prints the workflow to stdout
|
||||
"""
|
||||
import json
|
||||
import sys
|
||||
|
||||
A = "https://git.protopeer.com/peptide-repo/peptide-e2e/.gitea/actions"
|
||||
# CI image with PHP 8.1/8.2/8.3 + Composer preinstalled (peptide-e2e/ci-image).
|
||||
# Without it setup-php bootstraps a compiler toolchain on every job (5-20 min).
|
||||
CI_IMAGE = "git.protopeer.com/peptide-repo/ci-php:2026-10"
|
||||
DEFAULTS = {"tests": "stubs", "has_js": False, "line_limit_paths": "includes",
|
||||
"enforce_300": True, "phpcs_autofix": True, "audit": True,
|
||||
"php_versions": ["8.1", "8.2", "8.3"], "extras": []}
|
||||
MAIN_PUSH = "github.event_name == 'push' && github.ref == 'refs/heads/main'"
|
||||
# Deploys also run on a manual (workflow_dispatch) run of main, so a failed or
|
||||
# drifted deploy can be redone without a dummy commit (deploy-health says so).
|
||||
MAIN_DEPLOY = ("(github.event_name == 'push' || github.event_name == 'workflow_dispatch')"
|
||||
" && github.ref == 'refs/heads/main'")
|
||||
|
||||
EXTRAS = {
|
||||
"check-constants": """
|
||||
check-constants:
|
||||
name: Check PRAUTOBLOGGER_* constants
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Use PHP 8.1 (preinstalled in the CI image)
|
||||
run: update-alternatives --set php /usr/bin/php8.1 && php -v | head -1
|
||||
# Fails if any PRAUTOBLOGGER_* constant referenced in shipped PHP is neither
|
||||
# defined in prautoblogger.php nor guarded by defined() (v0.19.0 incident class).
|
||||
- run: php scripts/check-constants.php
|
||||
- name: Self-test the scanner
|
||||
run: php scripts/check-constants.php --self-test
|
||||
""",
|
||||
"validate-psa-version": """
|
||||
validate:
|
||||
name: Validate PSA_VERSION constant
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- run: |
|
||||
if grep -q "define( 'PSA_VERSION'" peptide-search-ai.php; then
|
||||
version=$(grep "define( 'PSA_VERSION'" peptide-search-ai.php | sed "s/.*'\\([^']*\\)'.*/\\1/")
|
||||
echo "PSA_VERSION: $version"
|
||||
else
|
||||
echo "::error::PSA_VERSION not found"; exit 1
|
||||
fi
|
||||
""",
|
||||
"security-audit": """
|
||||
security-audit:
|
||||
name: Security Audit
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Check for common PHP security issues
|
||||
shell: bash
|
||||
run: |
|
||||
echo ":: Checking for direct SQL queries without prepare..."
|
||||
if grep -r "query\\s*(\\s*['\\"].*\\$" --include="*.php" --exclude-dir=vendor . 2>/dev/null \\
|
||||
| grep -v "\\$wpdb->prepare" \\
|
||||
| grep -v "uninstall\\.php" \\
|
||||
| grep -v "class-peptide-news-activator\\.php" \\
|
||||
| grep -v "class-peptide-news-logger\\.php" \\
|
||||
| grep -v "DROP TABLE" \\
|
||||
| grep -v "TRUNCATE" \\
|
||||
&& [ ${PIPESTATUS[0]} -eq 0 ]; then
|
||||
echo "WARNING: Found potential unescaped SQL queries. Use wpdb->prepare() for all dynamic SQL."
|
||||
exit 1
|
||||
fi
|
||||
echo ":: Checking for eval() usage..."
|
||||
if grep -r "eval\\s*(" --include="*.php" --exclude-dir=vendor . 2>/dev/null; then
|
||||
echo "ERROR: eval() found. This is a critical security risk."; exit 1
|
||||
fi
|
||||
echo ":: Checking for base64_decode without validation..."
|
||||
if grep -r "base64_decode\\s*(" --include="*.php" --exclude-dir=vendor . 2>/dev/null; then
|
||||
echo "WARNING: Found base64_decode(). Ensure the input is properly validated."
|
||||
fi
|
||||
echo ":: Checking for file_get_contents with user input..."
|
||||
if grep -r "file_get_contents\\s*(\\s*\\$" --include="*.php" --exclude-dir=vendor . 2>/dev/null; then
|
||||
echo "WARNING: Found file_get_contents with variable. Ensure input is validated and restricted."
|
||||
fi
|
||||
echo "All security checks passed."
|
||||
""",
|
||||
}
|
||||
EXTRA_JOB_ID = {"check-constants": "check-constants", "validate-psa-version": "validate",
|
||||
"security-audit": "security-audit"}
|
||||
|
||||
|
||||
def render(name, cfg):
|
||||
c = {**DEFAULTS, **cfg}
|
||||
php = json.dumps(c["php_versions"])
|
||||
out = [f"""# GENERATED by peptide-e2e/tools/gitea-pipeline/render.py from repos.json.
|
||||
# Do not edit by hand: change repos.json or the template and re-render.
|
||||
name: CI / Deploy
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
pull_request: {{}}
|
||||
workflow_dispatch: {{}}
|
||||
|
||||
concurrency:
|
||||
group: pipeline-{name}-${{{{ github.ref }}}}
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
lint-php:
|
||||
name: PHP Lint (${{{{ matrix.php }}}})
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
php: {php}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: {A}/ci-lint-php@main
|
||||
with:
|
||||
php: ${{{{ matrix.php }}}}
|
||||
|
||||
phpcs:
|
||||
name: PHPCS (WordPress standards)
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
ref: ${{{{ github.head_ref || github.ref_name }}}}
|
||||
token: ${{{{ secrets.GITHUB_TOKEN }}}}
|
||||
- uses: {A}/ci-phpcs@main
|
||||
with:
|
||||
autofix: '{str(c["phpcs_autofix"]).lower()}'
|
||||
"""]
|
||||
ci_jobs = ["lint-php", "phpcs"]
|
||||
if c["enforce_300"]:
|
||||
out.append(f"""
|
||||
file-size:
|
||||
name: 300-line rule ({c["line_limit_paths"]})
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: {A}/ci-file-size@main
|
||||
with:
|
||||
paths: {c["line_limit_paths"]}
|
||||
""")
|
||||
ci_jobs.append("file-size")
|
||||
if c["tests"] != "none":
|
||||
svc = ""
|
||||
if c["tests"] == "wp-framework":
|
||||
svc = """ services:
|
||||
mysql:
|
||||
image: mysql:8.0
|
||||
env:
|
||||
MYSQL_ROOT_PASSWORD: root
|
||||
MYSQL_DATABASE: wp_tests
|
||||
# First-boot init took 3.5 min on the CPU-limited shared runner under load
|
||||
# (GitHub's 5 x 10s window is far too short here). Data dir on tmpfs: the
|
||||
# test DB is throwaway and disk I/O dominated the init time.
|
||||
options: >-
|
||||
--tmpfs /var/lib/mysql:rw
|
||||
--health-cmd="mysqladmin ping"
|
||||
--health-interval=10s
|
||||
--health-timeout=5s
|
||||
--health-start-period=120s
|
||||
--health-retries=30
|
||||
"""
|
||||
out.append(f"""
|
||||
phpunit:
|
||||
name: PHPUnit - {c["tests"]} (PHP ${{{{ matrix.php }}}})
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
php: {php}
|
||||
{svc} steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: {A}/ci-phpunit@main
|
||||
with:
|
||||
php: ${{{{ matrix.php }}}}
|
||||
tests: {c["tests"]}
|
||||
""")
|
||||
ci_jobs.append("phpunit")
|
||||
if c["has_js"]:
|
||||
out.append(f"""
|
||||
lint-js:
|
||||
name: JS Lint
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: {A}/ci-lint-js@main
|
||||
""")
|
||||
ci_jobs.append("lint-js")
|
||||
for x in c["extras"]:
|
||||
out.append(EXTRAS[x])
|
||||
ci_jobs.append(EXTRA_JOB_ID[x])
|
||||
if c["target_path"]:
|
||||
needs = json.dumps(ci_jobs)
|
||||
deploy_with = f""" target_path: {c["target_path"]}
|
||||
ssh_private_key: ${{{{ secrets.SSH_PRIVATE_KEY }}}}
|
||||
ssh_host: ${{{{ secrets.SSH_HOST }}}}
|
||||
ssh_port: ${{{{ secrets.SSH_PORT }}}}
|
||||
ssh_username: ${{{{ secrets.SSH_USERNAME }}}}"""
|
||||
out.append(f"""
|
||||
deploy-staging:
|
||||
name: Deploy to staging
|
||||
needs: {needs}
|
||||
if: ${{{{ {MAIN_DEPLOY} }}}}
|
||||
runs-on: peptide-vps
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: {A}/deploy@main
|
||||
with:
|
||||
stage: staging
|
||||
{deploy_with}
|
||||
|
||||
smoke:
|
||||
name: Smoke tests (staging)
|
||||
needs: deploy-staging
|
||||
runs-on: peptide-vps
|
||||
timeout-minutes: 15
|
||||
steps:
|
||||
- uses: {A}/smoke@main
|
||||
with:
|
||||
wp_admin_user: ${{{{ secrets.STAGING_WP_ADMIN_USER }}}}
|
||||
wp_admin_password: ${{{{ secrets.STAGING_WP_ADMIN_PASSWORD }}}}
|
||||
|
||||
deploy-production:
|
||||
name: Deploy to production
|
||||
# Smoke is a gate: production runs only if staging deploy AND smoke succeeded.
|
||||
# PROD_DEPLOY_ENABLED (org variable) is the cutover switch / kill switch.
|
||||
needs: [deploy-staging, smoke]
|
||||
if: ${{{{ vars.PROD_DEPLOY_ENABLED == 'true' && {MAIN_DEPLOY} }}}}
|
||||
runs-on: peptide-vps
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: {A}/deploy@main
|
||||
with:
|
||||
stage: production
|
||||
{deploy_with}
|
||||
""")
|
||||
if c["audit"]:
|
||||
out.append(f"""
|
||||
audit-direct-push:
|
||||
name: Audit - commit came from a PR
|
||||
if: ${{{{ {MAIN_PUSH} }}}}
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: {A}/audit-direct-push@main
|
||||
with:
|
||||
token: ${{{{ secrets.GITHUB_TOKEN }}}}
|
||||
""")
|
||||
return "".join(out).replace(
|
||||
" runs-on: ubuntu-latest\n",
|
||||
f" runs-on: ubuntu-latest\n container: {CI_IMAGE}\n")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
repos = json.load(open(sys.argv[2] if len(sys.argv) > 2 else __file__.rsplit("/", 1)[0] + "/repos.json"))
|
||||
name = sys.argv[1]
|
||||
sys.stdout.write(render(name, repos[name]))
|
||||
@@ -1,11 +0,0 @@
|
||||
{
|
||||
"_comment": "Per-repo pipeline settings. Edit here, then run render.py and commit the generated .gitea/workflows/pipeline.yml in each repo. Values mirror each repo's former GitHub ci.yml / deploy.yml inputs.",
|
||||
"peptide-repo-core": {"target_path": "wp-content/plugins/peptide-repo-core", "tests": "stubs"},
|
||||
"prautoblogger": {"target_path": "wp-content/plugins/prautoblogger", "tests": "brain-monkey", "extras": ["check-constants"]},
|
||||
"peptide-search-ai": {"target_path": "wp-content/plugins/peptide-search-ai", "tests": "stubs", "has_js": true, "extras": ["validate-psa-version"]},
|
||||
"peptide-starter-theme": {"target_path": "wp-content/themes/peptide-starter", "tests": "wp-framework", "has_js": true, "line_limit_paths": "inc"},
|
||||
"pr-vision": {"target_path": "wp-content/plugins/pr-vision", "tests": "stubs"},
|
||||
"peptide-news-plugin": {"target_path": "wp-content/plugins/peptide-news-plugin", "tests": "stubs", "has_js": true, "extras": ["security-audit"]},
|
||||
"peptide-reconstitution-calculator":{"target_path": "wp-content/plugins/peptide-reconstitution-calculator","tests": "stubs", "has_js": true},
|
||||
"peptide-e2e": {"target_path": null, "tests": "none", "enforce_300": false, "phpcs_autofix": false, "audit": false}
|
||||
}
|
||||
Reference in New Issue
Block a user