mirror of
https://github.com/Cacti/plugin_thold.git
synced 2026-10-24 20:16:58 +09:00
develop
3
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 TheWitnessandCopilot
|
9b217e0e3a |
INFO: set compat to 1.2.29 (#838)
* INFO: set compat to 1.2.32 * docs: update Copilot instructions Cacti baseline to 1.2.32 (matches INFO compat) * INFO: back off compat to 1.2.29 * Add manifest.json + upgrade-time file pruning * Prune phpunit.xml on upgrade and ignore markdown-lint configs phpunit.xml ships in the repo for CI but is a dev-only test artifact, so it is removed from manifest.json 'expected', pruned from installs on upgrade (like tests/), and excluded from the manifest drift check. The retired markdown-lint configs (.mdlrc, .md_style.rb) are deleted, and .md* is now ignored like .git*: protected from pruning and excluded from drift if it reappears. * Move thold_functions.php and thold_webapi.php into includes/; flatten css The main threshold library becomes includes/functions.php and the web API helper becomes includes/webapi.php; every caller (setup.php, includes/*, the CLI/poller/notify entry points and the test suite) loads them from includes/. Each per-theme stylesheet css/<theme>/main.css becomes css/<theme>.css so users can drop their own css/<theme>.css into the css base, and the page_head hook looks there. Old paths are tombstoned so existing installs drop the stale copies on upgrade. * Regenerate cacti.pot for the includes/ file relocations Moving the plugin's library files into includes/ changed the source-reference lines in the translation template; regenerate it so the 'Verify translation template' CI check passes. * Harden the hook-include test and make RPN integer ops explicit The HookFunctionsIncludeTest invokes real hooks with placeholder input purely to execute their relocated include_once lines; it now swallows engine notices/warnings/deprecations during those calls (and restores the error handler and config afterward) so it cannot trip the suite's failOnDeprecation or leak state into other tests. The RPN % and ^ operators now cast their operands to int explicitly, matching their long-standing integer-truncation behaviour while silencing the implicit float-to-int conversion deprecation. * Harden prune against tampered-manifest path traversal The upgrade-time prune now rejects any tombstone containing '.'/'..' segments (which could escape the plugin directory or resolve to its root) and treats ancestors of whitelist entries as protected, so a tombstone on a parent directory can no longer delete a whitelisted file beneath it. * docs: update and align the Project Structure block Point the structure tree at the relocated files (libraries now under includes/, data files under docs/, stylesheets under css/) and align the trailing '# ...' comments to a single column so they no longer drift right. * docs/tests: standardize test header and correct manifest-contract notes - Use the full license header (from the plugin's own setup.php) in tests/Unit/PruneFilesTest.php instead of the abbreviated copyright banner. - Document that the manifest drift check and the upgrade-time prune also handle phpunit.xml and .md* files, matching the implemented behavior. * refactor: rename prune helpers to the plugin-slug function prefix The repository naming contract reserves the plugin_<name>_ prefix for plugin lifecycle / hook-registration functions; all other functions use the plain <name>_ prefix. Rename the internal upgrade helpers accordingly: plugin_<name>_prune_files() -> <name>_prune_files() plugin_<name>_rmtree() -> <name>_rmtree() The call site, unit tests, and the copilot-instructions.md references are updated to match. No behavioral change. * chore: set the Cacti compatibility floor to 1.2.29 Align the compat metadata (and the contributor-guide references) with the team decision to standardize the minimum supported Cacti version at 1.2.29; the previously proposed 1.2.32 floor was not adopted. --------- Co-authored-by: Copilot <copilot@users.noreply.github.com> |
||
|
TheWitness
|
899aa06028 |
chore: harmonize CI workflow, templates, and test structure (#825)
* chore: harmonize CI workflow, templates, and test structure
Part of the fleet-wide plugin_* harmonization effort.
- Pin actions/checkout, shivammathur/setup-php, actions/upload-artifact to
current release commit SHAs (was floating @v4/@v2).
- Stop logging the MySQL root password in CI output (cat ~/.my.cnf ->
chmod 600).
- Harden MySQL bootstrap: quoted --defaults-file, grants added for both
'cactiuser'@'localhost' and 'cactiuser'@'127.0.0.1'.
- Add "Restore vendor ownership for Pest" step after Composer install.
- Switch the PHP syntax-check step to the vendor-excluding, null-delimited
find/xargs pattern used in plugin_audit.
- Remove the unused "Configure Apache" step (apache2/libapache2-mod-php are
not installed and not needed).
- Simplify the Pest invocation to rely solely on phpunit.xml's <testsuites>.
- No CodeQL workflow added: this repo has no JavaScript/Python/Ruby content
(PHP only), so there is nothing for CodeQL to scan.
- Consolidate tests/Security/Php74CompatibilityTest.php into
tests/Security/PhpCompatibilityTest.php, now checking for PHP 8.3/8.4-only
syntax (this plugin's floor is PHP 8.2 per the CI matrix).
- Remove tests/TestCase.php and its require in tests/bootstrap-unit.php: not
referenced by any uses(TestCase::class) call in this plugin's tests.
- Add .github/ISSUE_TEMPLATE/{bug_report,feature_request}.md and
.github/PULL_REQUEST_TEMPLATE.md, styled after Cacti/cacti's own templates.
- Document CI/dependency baselines in copilot-instructions.md.
* chore: add i18n build/verify workflow and bump MariaDB floor to 11.8
- Document the locales/build_gettext.sh + cacti.pot workflow in
copilot-instructions.md (Weblate owns per-language .po/.mo sync).
- Add a CI step that regenerates cacti.pot and fails if it is stale,
ignoring the POT-Creation-Date timestamp.
- Mark locales/build_gettext.sh executable.
- Bump the CI MariaDB service image floor to 11.8 (from mariadb:10.6 /
mysql:8.0).
* fix: mariadb:11.8 healthcheck and i18n step permissions
- mariadb:11.8 no longer ships mysqladmin; use mariadb-admin for the
service container healthcheck.
- Run chmod/build_gettext.sh with sudo in the i18n verification step,
since locales/ is owned by www-data by the time it runs.
* chore: regenerate locales/po/cacti.pot with current source strings
Ran the real locales/build_gettext.sh (xgettext/msgmerge/msgfmt) to
refresh the translation template against current source. Per the i18n
workflow documented in copilot-instructions.md, only the regenerated
cacti.pot is committed here; Weblate owns syncing the per-language
.po/.mo files from it.
* fix: restore tests/TestCase.php, still used by classic PHPUnit-style tests
An earlier harmonization commit deleted tests/TestCase.php as
apparently-unused dead code, but ~28 test classes across
tests/Unit use classic 'extends TestCase' inheritance rather than
Pest's uses() helper, so the earlier usage check missed them. This
broke bootstrap for every Pest run with 'Class TestCase not found'.
* fix: satisfy php-cs-fixer short-array/single-quote rules in PhpCompatibilityTest
Matches the project's PSR coding standard (short array syntax, single
quotes for non-interpolated strings) that php-cs-fixer enforces in CI.
* fix: make locales/build_gettext.sh string extraction order deterministic
`find` without `sort` returns filesystem/readdir-order results, which
can differ between machines (e.g. a local regen vs. a GitHub Actions
runner), producing a spurious reordering diff in cacti.pot even when
no strings actually changed. Pipe through `sort` and regenerate
cacti.pot with the now-deterministic order.
* fix: correct TestCase.php encoding (was UTF-16, must be UTF-8)
The restored file was accidentally written as UTF-16LE (a Windows
PowerShell redirection default), so PHP never recognized the
opening <?php tag and the class was never defined, still leaving
'Class TestCase not found' even after the file's restoration.
* fix(ci): remove broken 'Import Thold Plugin Sample Data' step
This step invoked cli/cli_import.php, which does not exist anywhere
in Cacti core (the real script is cli/import_template.php, and even
that expects standard Cacti template XML, not this fixture's custom
thold_hi/thold_low/etc. row format). Nothing in the test suite
actually consumes this imported data, so remove the broken step
along with its non-functional script and fixture rather than build
an importer for a feature with no consumer.
* fix: Address Copilot review findings on the harmonization PR
- tests/Security/PhpCompatibilityTest.php: fixed the #[Override]/#[Deprecated]
attribute regexes to also match the fully qualified (`#[\Override]`,
`#[\Deprecated]`) form, added a realpath() false-guard for the plugin root,
included the relative file path in both RuntimeException messages, added
typed-class-constant and dynamic-class-constant-fetch checks (PHP 8.3), and
restored each()/create_function() removed-in-PHP-8.0 guards that the
consolidation had dropped. Also excludes include/vendor/ (not just vendor/)
from the recursive source scan.
- .github/workflows/plugin-ci-workflow.yml: the "Create MySQL Config" step's
root password is now masked via `::add-mask::` before it's echoed into
~/.my.cnf, so it no longer appears in plaintext in the Actions log (chmod
600 alone only protected the file after creation, not the command's own
echoed source in the log).
* fix: Address remaining Copilot review findings
- CHANGELOG.md: added an entry documenting the CI/template harmonization
change (was previously missing per review feedback).
- locales/po/cacti.pot (+ .po/.mo): regenerated via locales/build_gettext.sh
so the new "Verify translation template is up to date" CI check actually
passes against the current source tree instead of comparing against a
stale committed POT.
- locales/build_gettext.sh: added --from-code=UTF-8 to the xgettext
invocation - without it, xgettext aborts outright on any non-ASCII string
in the source (e.g. a "…" character), silently leaving the previous
cacti.pot in place and defeating the up-to-date check entirely.
- tests/Security/PhpCompatibilityTest.php: dropped the PHP 8.3-only checks
(kept only the PHP 8.4-only ones) and corrected the floor comment, since
this repo's actual CI matrix only runs PHP 8.3/8.4 (no 8.2) - it tracks
Cacti's `develop` branch, not `1.2.x`.
- tests/Security/PhpCompatibilityTest.php: renamed the local
plugin_test_read_source_file() helper to schema_test_read_source_file(),
matching this repo's own naming convention (schema_ prefix for non-
lifecycle helpers).
- tests/Helpers/ThresholdScenario.php: fixed a flush-left statement inside
inMaintenance() to use tab indentation, matching the surrounding code.
- README.md / tests/README.md / copilot-instructions.md: corrected stale
PHP-floor references (7.4/8.1 -> 8.2) and a stale test-filename reference
(Php82CompatibilityTest.php -> the consolidated PhpCompatibilityTest.php)
left over from the harmonization pass.
* fix(test): don't flag jQuery .each()/->each() as removed PHP each()
The each()-removed-in-PHP-8.0 check matched jQuery's $.each(/.each(
calls too, which have nothing to do with the removed PHP global
function. Exclude any each( preceded by . or > via a negative
lookbehind.
|
||
|
Thomas Vincent
|
1c0d2a2fe3 | security: harden SQL, output escaping, and unserialize paths (#773) |