32e21bc59d
Security (7 fixes): - SEC-001: Use wpdb->prepare() for COUNT query in REST API - SEC-002: Set httponly=true on session cookie to prevent XSS - SEC-003: Mask API keys in admin settings (show last 4 chars only) - SEC-004: Check capability before nonce in manual fetch handler - SEC-005: Validate redirect domains to prevent open redirects - SEC-006: Escape all article fields before REST API response - SEC-007: Add capability check to AJAX summary handler Infrastructure (7 fixes): - WPS-002: Clear cron schedule on plugin deactivation - WPS-003: Bundle Chart.js locally instead of CDN without SRI - WPS-004: Add uninstall.php for clean plugin removal - DB-001: Add foreign key constraints with CASCADE deletes - DB-002: Clamp pagination to valid page range - CI-001: Use StrictHostKeyChecking=accept-new in deploy - CI-002: Add security scanning step to CI pipeline - CI-003: Add rollback workflow via workflow_dispatch Performance & Quality (8 fixes): - PHP-001: Validate widget $instance as array before access - PHP-002: Return null from get_client_ip() for invalid IPs - PHP-003: Process RSS feeds in chunked batches of 10 - PHP-004: Wire up clear_article_cache() in fetch cycle - PERF-001: Cache source names in transient for strip_source_suffix - PERF-002: Add server-side transient caching for REST API - ARCH-002: Make LLM API URL configurable via WordPress options Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
125 lines
4.3 KiB
YAML
125 lines
4.3 KiB
YAML
name: CI — Lint & Test
|
|
|
|
on:
|
|
push:
|
|
branches: [ main ]
|
|
pull_request:
|
|
branches: [ main ]
|
|
workflow_call:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
# ── PHP Syntax Check ─────────────────────────────────────────────
|
|
lint-php:
|
|
name: PHP Lint (${{ matrix.php }})
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
matrix:
|
|
php: ['7.4', '8.1', '8.3']
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up PHP ${{ matrix.php }}
|
|
uses: shivammathur/setup-php@v2
|
|
with:
|
|
php-version: ${{ matrix.php }}
|
|
tools: composer
|
|
|
|
- name: Syntax check all PHP files
|
|
run: find . -name '*.php' -not -path './vendor/*' -not -path './peptide-news-plugin/*' -print0 | xargs -0 -n1 php -l
|
|
|
|
# ── Security Audit ───────────────────────────────────────────────
|
|
security-audit:
|
|
name: Security Audit
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Check for common PHP security issues
|
|
run: |
|
|
echo ":: Checking for direct SQL queries without prepare..."
|
|
if grep -r "query\s*(\s*['\"].*\$" --include="*.php" --exclude-dir=vendor --exclude-dir=peptide-news-plugin . 2>/dev/null | grep -v "\\\$wpdb->prepare" && [ ${PIPESTATUS[0]} -eq 0 ]; then
|
|
echo "WARNING: Found potential unescaped SQL queries. Use wpdb->prepare() for all dynamic SQL."
|
|
exit 1
|
|
fi
|
|
|
|
echo ":: Checking for eval() usage..."
|
|
if grep -r "eval\s*(" --include="*.php" --exclude-dir=vendor --exclude-dir=peptide-news-plugin . 2>/dev/null; then
|
|
echo "ERROR: eval() found. This is a critical security risk."
|
|
exit 1
|
|
fi
|
|
|
|
echo ":: Checking for base64_decode without validation..."
|
|
if grep -r "base64_decode\s*(" --include="*.php" --exclude-dir=vendor --exclude-dir=peptide-news-plugin . 2>/dev/null; then
|
|
echo "WARNING: Found base64_decode(). Ensure the input is properly validated."
|
|
fi
|
|
|
|
echo ":: Checking for file_get_contents with user input..."
|
|
if grep -r "file_get_contents\s*(\s*\$" --include="*.php" --exclude-dir=vendor --exclude-dir=peptide-news-plugin . 2>/dev/null; then
|
|
echo "WARNING: Found file_get_contents with variable. Ensure input is validated and restricted."
|
|
fi
|
|
|
|
echo "All security checks passed."
|
|
|
|
# ── PHPCS Coding Standards ───────────────────────────────────────
|
|
phpcs:
|
|
name: PHPCS
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up PHP
|
|
uses: shivammathur/setup-php@v2
|
|
with:
|
|
php-version: '8.3'
|
|
tools: composer
|
|
|
|
- name: Install dependencies
|
|
run: composer install --prefer-dist --no-progress
|
|
|
|
- name: Run PHPCS
|
|
run: vendor/bin/phpcs --standard=.phpcs.xml.dist
|
|
|
|
# ── PHPUnit Tests ────────────────────────────────────────────────
|
|
phpunit:
|
|
name: PHPUnit (${{ matrix.php }})
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
matrix:
|
|
php: ['7.4', '8.1', '8.3']
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up PHP ${{ matrix.php }}
|
|
uses: shivammathur/setup-php@v2
|
|
with:
|
|
php-version: ${{ matrix.php }}
|
|
tools: composer
|
|
coverage: xdebug
|
|
|
|
- name: Install dependencies
|
|
run: composer install --prefer-dist --no-progress
|
|
|
|
- name: Run PHPUnit
|
|
run: vendor/bin/phpunit --testdox
|
|
|
|
# ── JavaScript Lint ──────────────────────────────────────────────
|
|
lint-js:
|
|
name: JS Lint
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
|
|
- name: Check JS syntax
|
|
run: |
|
|
for f in $(find . -name '*.js' -not -path './vendor/*' -not -path './node_modules/*' -not -path './peptide-news-plugin/*'); do
|
|
node --check "$f" || exit 1
|
|
done
|