* fix(hooks): check staged blobs and fail closed in the changelog tools
The pre-commit hooks read working-tree files while claiming to check staged content, check-changelog.py passed when its base diff failed, and fold-changelog.py deleted fragments it had not validated.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(tests): make CI helper scripts fail when they check nothing
check_all_pages.sh passed without logging in or crawling, the sink inventory accepted ripgrep errors, install_packages.sh and copyright_year.sh lost their failures, and the LDAP spec asserted before navigation finished.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix(i18n): audit only changed .po entries and keep contributor badges separate
audit_po.py failed every translation PR on pre-existing errors and matched non-printf text as conversions; update-contributors.py leaked badges between aliased contributors.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* docs(changelog): add fragment for #8457
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* test(e2e): move the pointer off the Deepness multiselect button
Deepness sets a zero body margin, so the unhovered #ms-button sits at the viewport origin and headless Chromium on Linux intermittently applies :hover to it.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* ci: pull pinned integration database from authenticated mirror
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* chore: exclude plugins/ from phplint and add pre-commit hook
phplint (composer lint) only excluded include/vendor; locally installed
plugins were scanned too, causing spurious failures for plugin code that
doesn't follow Cacti's style rules.
Also adds tests/tools/pre-commit -- a hook that checks syntax and runs
php-cs-fixer dry-run on staged PHP files only (excluding plugins/ and
include/vendor/). Install once with: composer run-script install-hooks
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix: address five Copilot review findings in pre-commit hook
- php -l now lints the staged blob (via mktemp + git show :FILE)
so partial staging cannot block a clean commit or pass a staged error
- STAGED is now a bash array; paths are expanded via "${STAGED[@]}"
to prevent word splitting and glob expansion on filenames with spaces
- install-hooks resolves the hook path with git rev-parse --git-path
so installation works in linked worktrees where .git is a file
- --path-mode=override replaces --path-mode=intersection so staged
files in excluded directories (tests/, docs/) are not silently skipped
- removed 2>/dev/null from php-cs-fixer so configuration errors are
visible to the developer
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* fix: [Security] harden SQL and shell injection call sites
- api_automation.php: validate tree item field via api_automation_column_exists()
before SELECT construction (GHSA-37jj pattern)
- api_automation.php: whitelist sort_column and sort_direction before ORDER BY
(GHSA-q9xg pattern)
- functions.php: wrap data input value in cacti_escapeshellarg() before shell
interpolation (GHSA-9mv2 pattern)
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Co-authored-by: TheWitness <thewitness@cacti.net>
Thomas Vincent