* fix(hooks): check staged blobs and fail closed in the changelog tools
The pre-commit hooks read working-tree files while claiming to check staged content, check-changelog.py passed when its base diff failed, and fold-changelog.py deleted fragments it had not validated.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(tests): make CI helper scripts fail when they check nothing
check_all_pages.sh passed without logging in or crawling, the sink inventory accepted ripgrep errors, install_packages.sh and copyright_year.sh lost their failures, and the LDAP spec asserted before navigation finished.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(i18n): audit only changed .po entries and keep contributor badges separate
audit_po.py failed every translation PR on pre-existing errors and matched non-printf text as conversions; update-contributors.py leaked badges between aliased contributors.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs(changelog): add fragment for #8457
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test(e2e): move the pointer off the Deepness multiselect button
Deepness sets a zero body margin, so the unhovered #ms-button sits at the viewport origin and headless Chromium on Linux intermittently applies :hover to it.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: pull pinned integration database from authenticated mirror
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* security(ci): constrain dependency installs and container build boundaries
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(docker): retain shipped runtime libraries in build context
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(tooling): quote gettext paths and honor Docker base selection
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test(auth): use certificate expiry truth in rendering assertions
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(tooling): finish Docker layer and regex scan findings
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(ci): preserve documentation badge anchors without alternation
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test(ci): preserve contributor badges and enforce Python coverage
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: share changed-code coverage contracts and enforce shell policy
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(ci): enforce private review files and run path regressions
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test: measure changed gettext shell coverage
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test: pin coverage to the reviewed PR revision
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* build: raise the 1.3 floor to PHP 8.3
RHEL 10 ships 8.3 in AppStream and dropped modularity, so an 8.4 floor would
put every RHEL, Alma and Rocky 10 install on Remi. Ubuntu 24.04 is 8.3 as
well, which makes it the lowest common denominator of the current LTS fleet.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: raise the documented PHP floor to 8.3
The 1.2.x column keeps 8.1, which still matches that branch's composer constraint.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: run process lock coverage on PHP 8.3
* fix: finish PHP 8.3 floor cleanup
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
The recursive wget crawl is the single most expensive thing in CI. Measured over
the last 120 runs, the Commit Audit workflow is half of all CI minutes, the
locked integration job is 72 percent of that workflow, and this one step is 60
percent of that job: 422 seconds of a 16 minute run.
It walks the authenticated UI one request at a time, so nothing it covers can
change unless server-rendered code, assets or the schema did. Skip it when a
pull request touches only tests, workflows, translations or documentation.
The step is gated rather than the job, so the required-check aggregator still
sees a real result rather than a skip. The decision fails open: an unreadable or
empty diff, or a push rather than a pull request, runs the crawl.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* chore: manage front-end JavaScript libraries with npm and Dependabot
Move all third-party front-end JavaScript to npm so Dependabot tracks it, and
drop the committed copies in favour of a build. package.json pins jquery,
jquery-ui, jstree (3.3.12 -> 3.3.17), billboard.js, pace-js, tablesorter and
jquery-validation; build/sync-js.mjs copies their dist files into include/js/
and runs on npm install via postinstall.
pace-js carries a one-line local fix (a stray regex alternation that made it
match the empty string) applied through patch-package
(patches/pace-js+1.2.4.patch); the fix should be sent upstream so the patch can
be dropped. Only Cacti's own themed jquery-ui/jstree CSS stays committed.
An npm ecosystem is added to dependabot.yml for develop. The release pipeline
and any workflow that serves Cacti pages must run 'npm ci' (which builds via
postinstall) before use, since the generated files are no longer in the tree.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* hardening: remove vendored development artifacts
* feat(release): attach the built artifact to the release
The workflow already builds an attested, checksummed archive carrying the
Composer dependencies, then discards it after thirty days.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: fail the publish step when the bundle is empty
An unmatched glob would otherwise reach gh as a literal path.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: treat the maintenance lock notice as expected log output
The line records the lock working, so a second maintenance run overlapping
in CI failed unrelated pull requests.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: consolidate release dependency changelog
* ci: build managed JavaScript in release artifacts
* test: cover managed JavaScript build end to end
* deps: complete phpseclib 4 migration
* deps: update patch-package to audited release
* ci: satisfy workflow shell policy
* chore: source DOMPurify from npm and update it to 3.4.14
Add dompurify to the npm-managed set (was committed at 3.4.7) and bump to 3.4.14.
DOMPurify is the client-side XSS sanitizer used on tree labels, device tooltips
and plugin messages; keeping it current with upstream bypass fixes matters more
than for the UI libraries.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs: preserve release changelog ordering
* test: preserve DOMPurify source map in npm build
* chore: source htmx, d3, big.js, lzjs and screenfull from npm
Add the remaining unmodified third-party libraries to the npm-managed build:
htmx.org 2.0.6, d3 7.8.2, big.js 6.2.2, lzjs 1.3.1 and screenfull 3.3.3. Each
was verified byte-identical (lzjs differs only in a JSDoc comment) to the copies
being removed. htmx in particular moves from a hand-tracked SHA pin to npm with
lockfile integrity.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test: cover phpseclib 4 integration
* ci: build managed assets before htmx tests
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Make installer completion fail closed
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Add installer unit and Docker integration gates
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Require installer coverage evidence
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Stabilize installer failure scenarios
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Address installer review feedback
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Reject incomplete installer selection payloads
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Match table validation to rendered controls
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Protect long-running installer migrations
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Load installer table metadata in one query
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Optimize installer completion queries
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Batch installer default settings writes
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Batch installer color upserts
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Batch installer template and poller lookups
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Refresh SQL interpolation baseline after develop rebase
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: use Cacti Composer test setup
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test: resolve includes through Cacti path constants
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: align installer workflows with policy
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: refresh security baselines after develop rebase
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: reuse TCP database credentials for installer checks
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test(security): refresh sink inventory baseline after rebase onto develop
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: run installer coverage on PHP 8.2
The 8.1 pin is below the ^8.2 composer requirement, so pest died in platform_check before any test ran.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
PHP 8.1 left security support in December 2025 and Symfony 7.4 requires 8.2,
so the platform floor has to move before any component can advance.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Make PHP 8.1 dependency builds reproducible
* Tighten integration runner permissions
* Harden and standardize GitHub Actions
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Restore ripgrep for security guards
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Wait for Cacti daemon readiness in CI
* Satisfy strict shell policy in diagnostics
* Preserve Cacti config group ownership
* Run stateful Cacti checks as the web user
* Run privileged page-crawl harness as root
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: pin GitHub Actions to commit SHAs
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test(security): refresh sink/hotspot baselines for database/rrd line shifts
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* Comment out shell lint and coverage steps
We will remove these checks until all the issues indenified by them have first been resolved.
* Disable shell-lint job in quality-extended.yml
Completely remove the step
* Disable spell check job in syntax.yml
Comment out the spelling job in the workflow.
* Fixing Syntax issue in lib/html_graph.php
* Fixing PHPDoc in lib/html_graph.php
* Fixing some style issues in syntax.xml
* Fix more style issues.
* Commenting out actionlint for the moment
* Fixing last issue with html_graph.php
* Fixing issue with auth_profile.php
* Fixing PHPStan issues
* Fix another PHPStan issue
* Fixing Unit Test
* Fix config.php prime step
* Fixing syntax check style
* Going back to old approach
* Moving csrf.php inclusion back to main line for automation
* Fixing issue with create logic
* Fix issue where poller exits with non-zero exit code
* Fix logging only for *NIX
* Fix poller completion detection by reverting code
* Fixing syslog change
* Fixing syslog change
* Return exit code and increase max_allowed_packet
* Adding max_allowed_packet to client section
* Command not recognized
* Trying to re-introduce command
* Moving the max-allowed-packet
* Moving the max-allowed-packet
* One more try to change max_allowed_packet size
* Set the global when creating the database
* Plumbing in PHP Pest without running
* Fixing composer.json, composer.loc, swapping net_dns2 as it's abandoned
* Removing composer lock file
* Removing dev components
* Adding background capture of top processes
* Run this periodically
* Slight tweak to remove warings
* Re-introduce memory issue
* Switch to debug and attempt to locate the page
* Chagne to 2 second granularity to better trace
* Allow test to run now, keeping at debug
* Fixing infinite recursion on connection went away
* Change logging profile for 2002 and 2006 errors
* Correcting php-cs-fixer issue
* Add priority to syslog message
* One more pass to check for completion
* Reenable Debug for run
* Per copilot check_all_pages.sh not saving logs first
* Re-enable execption mode
* Fix php-cs-fixer issue
* Removing debug flag now
* Checking with non-persistent connections
* Final changes before merge
* Add vmstat output in effort to diagnose issues
* More tweaks to script for completeness
* Update tests/tools/check_all_pages.sh
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update tests/tools/check_all_pages.sh
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Pulling some Copilot recommendations from 1.2.x
* Check disk topology before starting
* Changing database due to swapping
* Rollback database changes
* Show top memory consumers
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Allow form_selectable_cell to more easily port
* Removing exclusion for scripts directory
* More fixes for scripts
* Some issues with ss_host_disk.php that passed locally
* More issues not detected locally
* Issues with typing in cacti_snmp_walk
* Adding base files for non-savy composer users
* One more try on ss_host_disk.php
* Aparantly I have to add the lock file
* More changes to lib/snmp.php after testing
* More changes to lib/snmp.php after testing
* Fix number script from Copilot review
* More Composer reviews
* Update scripts/ss_apache_stats.php
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update scripts/motorola_surfboard_SB6141.py
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Update scripts/motorola_surfboard_SB6141.py
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Changing syntax of PHP requirement
* Updating composer
* Attempt to quiet some warnings
* Add Syntax Check
* Wrong file name
* Wrong file name
* Better to report before and after
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Fix#6539 - Allow Standard Cacti Log Files to be Rotated on Demand from the Cacti UI
* QA: php-cs-fixer updates and documentation for lib/database.php
* QA: Update .gitignore for composer files
* QA: Update .gitignore for composer files
* QA: Back off .gitignore change its duplicated
* QA: Fix typing of db_has_permissions
* QA: Fixing typing issue in db_format_index_create
* Update lib/clog_webapi.php
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* QA: Fix additional code issues
* QA: Applying more defaults to add device
* QA: Fix at the database layer
* QA: Fixes based upon automated testing
* QA: Fix at the database layer
* QA: After new SQL checking
* QA: Skip MacTrack oui database download warnings
* QA: Fixing type issue
* QA: Recommendation from Copilot
* QA: Recommendation from Copilot
* QA: Recommendation from Copilot
* QA: Recommendation from Copilot
* QA: Some minor changes to avoid errors in testing
* QA: Unused variable
* QA: Recommendation from Copilot
* QA: Recommendation from Copilot
* QA: Recommendation from Copilot
* QA: Minor introduced code defect
* QA: Adding some unifying space around concatination
* QA: Consistent comments and new function alias'
* QA: Multi-line comment corrections
* QA: Fix SQL Style
* QA: Missed one function alias
* QA: PHPStan Level 2 and PHPDoc fixes
* QA: PHPStan Level 2 and PHPDoc Fixes
* QA: PHPStan Level 6 Fixes
* QA: Fix lib/xml.php to PHPStan Level 6
* QA: Wrong grep -v
* PHPStan Level 6 for lib/vdef.php
* PHPStan Level 8 for lib/time.php
* QA: Raise PHPStan to Level 6 for lib/database.php
* QA: Remove @deprecated tag from grv()
* QA: Switch to htmle() alias over html_escape()
* QA: More addressing PHPStan issues at Level 6
* QA: Change recommended by Copilot for Readability
* QA: More PHPStan fixes
* QA: More PHPStan fixes
* QA: More PHPStan fixes for lib/utility.php
* QA: More PHPStan fixes at Level 6
* QA: Raise PHPStan to Level 6 More Functions
* QA: Raise PHPStan to Level 6 More Functions
* QA: Raise PHPStan to Level 6 More Functions
* QA: Raise PHPStan to Level 6 More Functions
* QA: Raise PHPStan to Level 6 More Functions
* QA: More PHPStan fixes at Level 6
* QA: Raise PHPStan to Level 6 More Functions
* QA: Raise PHPStan to Level 6 More Functions
* QA: More PHPStan fixes at Level 6
* QA: More PHPStan fixes at Level 6
* QA: Raise PHPStan to Level 6 More Functions
* QA: Raise PHPStan to Level 6 More Functions
* QA: More PHPStan fixes at Level 6
* QA: Raise PHPStan to Level 6 More Functions
* QA: Raise PHPStan to Level 6 More Functions
* QA: More PHPStan fixes at Level 6
* QA: Raise PHPStan to Level 6 More Functions
* QA: Raise PHPStan to Level 6 More Functions
* QA: More PHPStan fixes at Level 6
* QA: More PHPStan fixes at Level 6
* QA: More PHPStan fixes at Level 6
* QA: Raise PHPStan to Level 6 More Functions
* QA: More PHPStan fixes at Level 6
* QA: Some phpseclib3 fixups to update to latest
* QA: More fixups for graphing for magic strings
* QA: More PHPStan fixes at Level 6
* QA: Fixing order string type on get_allowed_graphs()
* QA: Fixing improper use of print
* QA: Optimization of color_templates
* QA: Copilot recommendation
* QA: Copilot recommendation
* QA: Copilot recommendation
* QA: Copilot recommendation
* QA: Copilot recommendation
* QA: Copilot recommendation
* QA: Copilot recommendation
* QA: Copilot recommendation
* QA: Raise PHPStan to Level 6 More Functions
* QA: Issues insalling Cacti
* QA: Issues insalling Cacti
* QA: Issues insalling Cacti
* QA: Issues insalling Cacti
* QA: Issues insalling Cacti
* QA: Issues testing Cacti
* QA: Copilot recommendation
* QA: More PHPStan fixes at Level 6
* QA: More PHPStan fixes at Level 6
* QA: More PHPStan fixes at Level 6
* QA: More PHPStan fixes at Level 6
* QA: More PHPStan fixes at Level 6
* QA: Installer failing
* Undo ownership changes to remove tar errors
* QA: Updates after php-cs-fixer
* QA: Adding code checks to syntax checking
* QA Change syntax flow language
* QA: Reduce the number of cures
* QA: Use sequentional option
* Change runner to self-hosted for check job
* Fix typo in OS version in workflow file
* Add Git installation step in workflow
Added step to install Git if not already installed.
* Add '-y' flag to apt-get install and update commands
Updated apt-get commands to include '-y' for automatic confirmation.
* Change workflow OS version to 'ubuntu-latest'
Updated the workflow to use 'ubuntu-latest' instead of 'ubuntu:latest' and modified the 'runs-on' configuration.
* Remove sequential option from phpcsfixer script
* Remove PHPCS fixer step from workflow
Removed PHP coding standards check from workflow.
* Move code checks to before plugins
Moving these core checks to before the plugins are installed as we really want to check only the base Cacti here.
* Add Composer validation and caching to start of workflow
* QA: Addressing PHPStan additional
* QA: Restore composer lock file
* QA: Addressing PHPStan additional
* QA: Addressing PHPStan additional
* QA: Complete LDAP Project
* QA: php-cs-fixer doing it's thing
* QA: Syntax is already happening in PHPStan
* QA: The md5 function no longer exists
* QA: Update after ldap changes
* QA: Undo that last password hack
* QA: Attempting to switch to MariaDB 11.8
* QA: Attempting to switch to MariaDB 11.8
* QA: Resolving some issues with PHP8.4
* QA: Resolving some issues with PHP8.4
* QA: Add PHP8.5 to the matrix
* QA: Removing PHP8.5 due to dependency issues
* QA: Add the DB version to the testing output
* QA: Switch back to MySQL for the moment
* QA: More fidelity in reporting
* QA: The pipe must be mixed
* QA: Moving audit_schema.php changes from 1.2.x
* QA: Moving audit_schema.php changes from 1.2.x
* QA: Restore mysql monitoring
* QA: php-cs-fixer issues
* QA: Attempt to roll back to MariaDB 10.6
* QA: Attempt to fix check_all_pages.sh
* QA: Make installer functional again
* QA: Fix installer php-cs-fixer issues
* QA: Type to a string
* QA: Get the database version correctly
* QA: Fix issue with reports in check_all_pages.sh
* QA: Check the server version in the right place
* Feature: Support SHA256 as a new hash for passwords
* QA: Function definition and return typing audit
* QA: Refinement of form types
* QA: Refinement of form types
* QA: Consistency of comments
* QA: Issues with php-cs-fixer and more comments
* QA: More typing issues
* QA: php-cs-fixer on merge conflict resolution
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Thomas Vincent