ci: adopt estate reusable CI caller v2.5.0
- ci.yml replaced with thin caller (tests: stubs, has_js: true) - security-audit.yml extracted as standalone workflow - deploy.yml: contents write permission for phpcbf token scope - composer.json: pin scripts to vendor/bin/ paths - phpunit.xml.dist: PHPUnit 9.6 XSD ref; drop deprecated convert* attrs - CHANGELOG.md: created; version bump 2.4.1 to 2.5.0 Agent-Session: claude/adopt-ci-20260616
This commit is contained in:
peptiderepo
147
.github/workflows/ci.yml
vendored
147
.github/workflows/ci.yml
vendored
@@ -1,134 +1,27 @@
|
||||
name: CI — Lint & Test
|
||||
##
|
||||
# Thin CI caller — peptide-news-plugin
|
||||
#
|
||||
# Delegates all lint/test/file-size jobs to the estate reusable workflow.
|
||||
# Per estate standard: workflow_call is required so deploy.yml can gate on it.
|
||||
# See: peptiderepo/peptide-e2e/.github/workflows/ci.yml@main for job definitions.
|
||||
##
|
||||
name: CI
|
||||
|
||||
on:
|
||||
pull_request: {}
|
||||
push:
|
||||
branches: [ main ]
|
||||
pull_request:
|
||||
branches: [ main ]
|
||||
workflow_call:
|
||||
branches: [main]
|
||||
workflow_call: {}
|
||||
|
||||
# Required: calling workflow must declare contents: write so the reusable
|
||||
# phpcs job can commit phpcbf auto-fixes back to the PR branch.
|
||||
permissions:
|
||||
contents: read
|
||||
contents: write
|
||||
|
||||
jobs:
|
||||
# ── PHP Syntax Check ─────────────────────────────────────────────
|
||||
lint-php:
|
||||
name: PHP Lint (${{ matrix.php }})
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
matrix:
|
||||
php: ['8.1', '8.2', '8.3']
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Set up PHP ${{ matrix.php }}
|
||||
uses: shivammathur/setup-php@v2
|
||||
with:
|
||||
php-version: ${{ matrix.php }}
|
||||
tools: composer
|
||||
|
||||
- name: Syntax check all PHP files
|
||||
run: find . -name '*.php' -not -path './vendor/*' -print0 | xargs -0 -n1 php -l
|
||||
|
||||
# ── Security Audit ───────────────────────────────────────────────
|
||||
security-audit:
|
||||
name: Security Audit
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Check for common PHP security issues
|
||||
run: |
|
||||
echo ":: Checking for direct SQL queries without prepare..."
|
||||
# Exclude uninstall.php (DROP TABLE is standard WP pattern), activator (table DDL),
|
||||
# and logger (TRUNCATE) — these use $wpdb->prefix which is safe internal state.
|
||||
if grep -r "query\s*(\s*['\"].*\$" --include="*.php" --exclude-dir=vendor . 2>/dev/null \
|
||||
| grep -v "\\\$wpdb->prepare" \
|
||||
| grep -v "uninstall\.php" \
|
||||
| grep -v "class-peptide-news-activator\.php" \
|
||||
| grep -v "class-peptide-news-logger\.php" \
|
||||
| grep -v "DROP TABLE" \
|
||||
| grep -v "TRUNCATE" \
|
||||
&& [ \${PIPESTATUS[0]} -eq 0 ]; then
|
||||
echo "WARNING: Found potential unescaped SQL queries. Use wpdb->prepare() for all dynamic SQL."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo ":: Checking for eval() usage..."
|
||||
if grep -r "eval\s*(" --include="*.php" --exclude-dir=vendor . 2>/dev/null; then
|
||||
echo "ERROR: eval() found. This is a critical security risk."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo ":: Checking for base64_decode without validation..."
|
||||
if grep -r "base64_decode\s*(" --include="*.php" --exclude-dir=vendor . 2>/dev/null; then
|
||||
echo "WARNING: Found base64_decode(). Ensure the input is properly validated."
|
||||
fi
|
||||
|
||||
echo ":: Checking for file_get_contents with user input..."
|
||||
if grep -r "file_get_contents\s*(\s*\$" --include="*.php" --exclude-dir=vendor . 2>/dev/null; then
|
||||
echo "WARNING: Found file_get_contents with variable. Ensure input is validated and restricted."
|
||||
fi
|
||||
|
||||
echo "All security checks passed."
|
||||
|
||||
# ── PHPCS Coding Standards ───────────────────────────────────────
|
||||
phpcs:
|
||||
name: PHPCS
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Set up PHP
|
||||
uses: shivammathur/setup-php@v2
|
||||
with:
|
||||
php-version: '8.3'
|
||||
tools: composer
|
||||
|
||||
- name: Install dependencies
|
||||
run: composer install --prefer-dist --no-progress
|
||||
|
||||
- name: Run PHPCS
|
||||
run: vendor/bin/phpcs --standard=.phpcs.xml.dist
|
||||
continue-on-error: true
|
||||
|
||||
# ── PHPUnit Tests ────────────────────────────────────────────────
|
||||
phpunit:
|
||||
name: PHPUnit (${{ matrix.php }})
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
matrix:
|
||||
php: ['8.1', '8.2', '8.3']
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Set up PHP ${{ matrix.php }}
|
||||
uses: shivammathur/setup-php@v2
|
||||
with:
|
||||
php-version: ${{ matrix.php }}
|
||||
tools: composer
|
||||
coverage: xdebug
|
||||
|
||||
- name: Install dependencies
|
||||
run: composer install --prefer-dist --no-progress
|
||||
|
||||
- name: Run PHPUnit
|
||||
run: vendor/bin/phpunit --testdox
|
||||
|
||||
# ── JavaScript Lint ──────────────────────────────────────────────
|
||||
lint-js:
|
||||
name: JS Lint
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Node
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: '20'
|
||||
|
||||
- name: Check JS syntax
|
||||
run: |
|
||||
for f in $(find . -name '*.js' -not -path './vendor/*' -not -path './node_modules/*' -not -path '*/vendor/*'); do
|
||||
node --check "$f" || exit 1
|
||||
done
|
||||
ci:
|
||||
uses: peptiderepo/peptide-e2e/.github/workflows/ci.yml@main
|
||||
with:
|
||||
tests: stubs
|
||||
has_js: true
|
||||
secrets: inherit
|
||||
|
||||
6
.github/workflows/deploy.yml
vendored
6
.github/workflows/deploy.yml
vendored
@@ -4,8 +4,12 @@ on:
|
||||
push:
|
||||
branches: [ main ]
|
||||
|
||||
# contents: write required so the ci.yml caller can pass write permission
|
||||
# through to the phpcbf auto-commit step in the reusable workflow.
|
||||
# (phpcbf commit only fires on pull_request events, but GH enforces caller
|
||||
# permissions at token-grant time, not at step-execution time.)
|
||||
permissions:
|
||||
contents: read
|
||||
contents: write
|
||||
|
||||
concurrency:
|
||||
group: deploy-peptide-news-plugin
|
||||
|
||||
58
.github/workflows/security-audit.yml
vendored
Normal file
58
.github/workflows/security-audit.yml
vendored
Normal file
@@ -0,0 +1,58 @@
|
||||
##
|
||||
# Security audit — peptide-news-plugin
|
||||
#
|
||||
# Standalone workflow kept separate from the estate CI caller so it can evolve
|
||||
# independently and run on every PR without being bundled into the reusable pipeline.
|
||||
# Checks for: unescaped SQL, eval(), base64_decode(), file_get_contents with user input.
|
||||
##
|
||||
name: Security Audit
|
||||
|
||||
on:
|
||||
pull_request: {}
|
||||
push:
|
||||
branches: [main]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
security-audit:
|
||||
name: Security Audit
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Check for common PHP security issues
|
||||
run: |
|
||||
echo ":: Checking for direct SQL queries without prepare..."
|
||||
# Exclude uninstall.php (DROP TABLE is standard WP pattern), activator (table DDL),
|
||||
# and logger (TRUNCATE) — these use $wpdb->prefix which is safe internal state.
|
||||
if grep -r "query\s*(\s*['\"].*\$" --include="*.php" --exclude-dir=vendor . 2>/dev/null \
|
||||
| grep -v "\$wpdb->prepare" \
|
||||
| grep -v "uninstall\.php" \
|
||||
| grep -v "class-peptide-news-activator\.php" \
|
||||
| grep -v "class-peptide-news-logger\.php" \
|
||||
| grep -v "DROP TABLE" \
|
||||
| grep -v "TRUNCATE" \
|
||||
&& [ ${PIPESTATUS[0]} -eq 0 ]; then
|
||||
echo "WARNING: Found potential unescaped SQL queries. Use wpdb->prepare() for all dynamic SQL."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo ":: Checking for eval() usage..."
|
||||
if grep -r "eval\s*(" --include="*.php" --exclude-dir=vendor . 2>/dev/null; then
|
||||
echo "ERROR: eval() found. This is a critical security risk."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo ":: Checking for base64_decode without validation..."
|
||||
if grep -r "base64_decode\s*(" --include="*.php" --exclude-dir=vendor . 2>/dev/null; then
|
||||
echo "WARNING: Found base64_decode(). Ensure the input is properly validated."
|
||||
fi
|
||||
|
||||
echo ":: Checking for file_get_contents with user input..."
|
||||
if grep -r "file_get_contents\s*(\s*\$" --include="*.php" --exclude-dir=vendor . 2>/dev/null; then
|
||||
echo "WARNING: Found file_get_contents with variable. Ensure input is validated and restricted."
|
||||
fi
|
||||
|
||||
echo "All security checks passed."
|
||||
Reference in New Issue
Block a user