Skip to content

Commit

Permalink
Merge branch 'trunk' into 62221-hardening
Browse files Browse the repository at this point in the history
# Conflicts:
#	.github/workflows/reusable-performance.yml
  • Loading branch information
johnbillion committed Jan 20, 2025
2 parents 150c8c2 + 7fe8f1c commit ff21b71
Show file tree
Hide file tree
Showing 166 changed files with 9,030 additions and 5,097 deletions.
2 changes: 1 addition & 1 deletion .env.example
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ LOCAL_DB_TYPE=mysql
# When using `mysql`, see https://hub.docker.com/_/mysql for valid versions.
# When using `mariadb`, see https://hub.docker.com/_/mariadb for valid versions.
##
LOCAL_DB_VERSION=8.0
LOCAL_DB_VERSION=8.4

# Whether or not to enable multisite.
LOCAL_MULTISITE=false
Expand Down
28 changes: 28 additions & 0 deletions .github/workflows/cleanup-pull-requests.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
name: Cleanup Pull Requests

on:
push:
branches:
- trunk
- '4.[1-9]'
- '[5-9].[0-9]'

# Cancels all previous workflow runs for pull requests that have not completed.
concurrency:
# The concurrency group contains the workflow name and the branch name for pull requests
# or the commit hash for any other events.
group: ${{ github.workflow }}-${{ github.sha }}
cancel-in-progress: true

# Disable permissions for all available scopes by default.
# Any needed permissions should be configured at the job level.
permissions: {}

jobs:
# Runs pull request cleanup.
close-prs:
name: Clean up pull requests
permissions:
pull-requests: write
if: ${{ github.repository == 'WordPress/wordpress-develop' }}
uses: ./.github/workflows/reusable-cleanup-pull-requests.yml
10 changes: 8 additions & 2 deletions .github/workflows/install-testing.yml
Original file line number Diff line number Diff line change
Expand Up @@ -78,19 +78,25 @@ jobs:

# Exclude some PHP and MySQL versions that cannot currently be tested with Docker containers.
exclude:
# There are no local WordPress Docker environment containers for PHP <= 5.3.
- php: '5.2'
- php: '5.3'
# MySQL containers <= 5.5 do not exist or fail to start properly.
- db-version: '5.0'
- db-version: '5.1'
- db-version: '5.5'
# The PHP <= 7.3/MySQL 8.4 jobs currently fail due to mysql_native_password being disabled by default. See https://core.trac.wordpress.org/ticket/61218.
- php: '7.2'
db-version: '8.4'
- php: '7.3'
db-version: '8.4'
# Only test the latest innovation release.
- db-version: '9.0'
# MySQL 9.0+ will not work on PHP 7.2 & 7.3. See https://core.trac.wordpress.org/ticket/61218.
- php: '7.2'
db-version: '9.0'
db-version: '9.1'
- php: '7.3'
db-version: '9.0'
db-version: '9.1'

services:
database:
Expand Down
10 changes: 6 additions & 4 deletions .github/workflows/local-docker-environment.yml
Original file line number Diff line number Diff line change
Expand Up @@ -88,13 +88,15 @@ jobs:
db-version: ${{ fromJSON( needs.build-test-matrix.outputs.mysql-versions ) }}

exclude:
# The MySQL 5.5 containers will not start.
# MySQL containers <= 5.5 do not exist or fail to start properly.
- db-version: '5.5'
# MySQL 9.0+ will not work on PHP 7.2 & 7.3
# Only test the latest innovation release.
- db-version: '9.0'
# MySQL 9.0+ will not work on PHP 7.2 & 7.3. See https://core.trac.wordpress.org/ticket/61218.
- php: '7.2'
db-version: '9.0'
db-version: '9.1'
- php: '7.3'
db-version: '9.0'
db-version: '9.1'

with:
os: ${{ matrix.os }}
Expand Down
6 changes: 4 additions & 2 deletions .github/workflows/performance.yml
Original file line number Diff line number Diff line change
Expand Up @@ -32,17 +32,19 @@ permissions: {}
jobs:
# Runs the performance test suite.
performance:
name: Performance tests ${{ matrix.memcached && '(with memcached)' || '' }}
name: ${{ matrix.multisite && 'Multisite' || 'Single site' }}
uses: WordPress/wordpress-develop/.github/workflows/reusable-performance.yml@trunk
permissions:
contents: read
if: ${{ ( github.repository == 'WordPress/wordpress-develop' || github.event_name == 'pull_request' ) && ! contains( github.event.before, '00000000' ) }}
if: ${{ ( github.repository == 'WordPress/wordpress-develop' || github.event_name == 'pull_request' ) }}
strategy:
fail-fast: false
matrix:
memcached: [ true, false ]
multisite: [ true, false ]
with:
memcached: ${{ matrix.memcached }}
multisite: ${{ matrix.multisite }}
secrets:
CODEVITALS_PROJECT_TOKEN: ${{ secrets.CODEVITALS_PROJECT_TOKEN }}

Expand Down
90 changes: 77 additions & 13 deletions .github/workflows/phpunit-tests.yml
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ jobs:
os: [ ubuntu-latest ]
php: [ '7.2', '7.3', '7.4', '8.0', '8.1', '8.2', '8.3', '8.4' ]
db-type: [ 'mysql' ]
db-version: [ '5.7', '8.0', '8.4', '9.0' ]
db-version: [ '5.7', '8.0', '8.4' ]
tests-domain: [ 'example.org' ]
multisite: [ false, true ]
memcached: [ false ]
Expand Down Expand Up @@ -91,14 +91,6 @@ jobs:
multisite: false
memcached: false
report: true

exclude:
# MySQL 9.0+ will not work on PHP 7.2 & 7.3
- php: '7.2'
db-version: '9.0'
- php: '7.3'
db-version: '9.0'

with:
os: ${{ matrix.os }}
php: ${{ matrix.php }}
Expand Down Expand Up @@ -126,7 +118,7 @@ jobs:
os: [ ubuntu-latest ]
php: [ '7.2', '7.3', '7.4', '8.0', '8.1', '8.2', '8.3', '8.4' ]
db-type: [ 'mariadb' ]
db-version: [ '10.4', '10.6', '10.11', '11.2' ]
db-version: [ '5.5', '10.3', '10.4', '10.5', '10.6', '10.11', '11.4' ]
multisite: [ false, true ]
memcached: [ false ]

Expand All @@ -135,13 +127,13 @@ jobs:
- os: ubuntu-latest
php: '8.3'
db-type: 'mariadb'
db-version: '11.2'
db-version: '11.4'
multisite: false
memcached: true
- os: ubuntu-latest
php: '8.3'
db-type: 'mariadb'
db-version: '11.2'
db-version: '11.4'
multisite: true
memcached: true
with:
Expand All @@ -154,13 +146,85 @@ jobs:
phpunit-config: ${{ matrix.multisite && 'tests/phpunit/multisite.xml' || 'phpunit.xml.dist' }}
report: ${{ matrix.report || false }}

#
# Creates PHPUnit test jobs to test MariaDB and MySQL innovation releases.
#
# Though innovation releases are deemed "production grade" and never receive LTS status, they include new features
# and updates that will be included in the next LTS version.
#
# Because upstream support for innovation releases gets dropped when a new one is released, only the most recent
# innovation version is tested.
#
test-innovation-releases:
name: PHP ${{ matrix.php }}
uses: WordPress/wordpress-develop/.github/workflows/reusable-phpunit-tests-v3.yml@trunk
permissions:
contents: read
secrets: inherit
if: ${{ github.repository == 'WordPress/wordpress-develop' || github.event_name == 'pull_request' }}
strategy:
fail-fast: false
matrix:
os: [ ubuntu-latest ]
php: [ '7.2', '7.3', '7.4', '8.0', '8.1', '8.2', '8.3', '8.4' ]
db-type: [ 'mysql', 'mariadb' ]
db-version: [ '9.1', '11.6' ]
multisite: [ false, true ]
memcached: [ false ]
db-innovation: [ true ]

exclude:
# MySQL 9.0+ will not work on PHP <= 7.3 because mysql_native_password was removed. See https://core.trac.wordpress.org/ticket/61218.
- php: '7.2'
db-version: '9.1'
- php: '7.3'
db-version: '9.1'
# Exclude version combinations that don't exist.
- db-type: 'mariadb'
db-version: '9.1'
- db-type: 'mysql'
db-version: '11.6'
with:
os: ${{ matrix.os }}
php: ${{ matrix.php }}
db-type: ${{ matrix.db-type }}
db-version: ${{ matrix.db-version }}
db-innovation: ${{ matrix.db-innovation }}
multisite: ${{ matrix.multisite }}
memcached: ${{ matrix.memcached }}
phpunit-config: ${{ matrix.multisite && 'tests/phpunit/multisite.xml' || 'phpunit.xml.dist' }}
report: ${{ matrix.report || false }}

#
# Runs specific individual test groups.
#
specific-test-groups:
name: ${{ matrix.phpunit-test-groups }}
uses: WordPress/wordpress-develop/.github/workflows/reusable-phpunit-tests-v3.yml@trunk
permissions:
contents: read
secrets: inherit
if: ${{ github.repository == 'WordPress/wordpress-develop' || github.event_name == 'pull_request' }}
strategy:
fail-fast: false
matrix:
php: [ '7.2', '7.4', '8.0', '8.4' ]
db-type: [ 'mysql' ]
db-version: [ '8.4' ]
phpunit-test-groups: [ 'html-api-html5lib-tests' ]
with:
php: ${{ matrix.php }}
db-type: ${{ matrix.db-type }}
db-version: ${{ matrix.db-version }}
phpunit-test-groups: ${{ matrix.phpunit-test-groups }}

slack-notifications:
name: Slack Notifications
uses: WordPress/wordpress-develop/.github/workflows/slack-notifications.yml@trunk
permissions:
actions: read
contents: read
needs: [ test-with-mysql, test-with-mariadb ]
needs: [ test-with-mysql, test-with-mariadb, test-innovation-releases, specific-test-groups ]
if: ${{ github.repository == 'WordPress/wordpress-develop' && github.event_name != 'pull_request' && always() }}
with:
calling_status: ${{ contains( needs.*.result, 'cancelled' ) && 'cancelled' || contains( needs.*.result, 'failure' ) && 'failure' || 'success' }}
Expand Down
98 changes: 98 additions & 0 deletions .github/workflows/reusable-cleanup-pull-requests.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,98 @@
##
# A reusable workflow that finds and closes any pull requests that are linked to Trac
# tickets that are referenced as fixed in commit messages.
#
# More info about using GitHub pull requests for contributing to WordPress can be found in the handbook: https://make.wordpress.org/core/handbook/contribute/git/github-pull-requests-for-code-review/.
##
name: Run pull request cleanup

on:
workflow_call:

jobs:
# Finds and closes pull requests referencing fixed Trac tickets in commit messages using the
# documented expected format
#
# Commit message format is documented in the Core handbook: https://make.wordpress.org/core/handbook/best-practices/commit-messages/.
#
# Performs the following steps:
# - Parse fixed ticket numbers from the commit message.
# - Parse the SVN revision from the commit message.
# - Searches for pull requests referencing any fixed tickets.
# - Leaves a comment on each PR before closing.
close-prs:
name: Find and close PRs
runs-on: ubuntu-latest
permissions:
pull-requests: write

steps:
- name: Find fixed ticket numbers
id: trac-tickets
run: |
COMMIT_MESSAGE=$(cat <<'EOF' | sed -n '/^Fixes #/,/\./p'
${{ github.event.head_commit.message }}
EOF
)
echo "fixed_list=$(echo \"$COMMIT_MESSAGE\" | sed -n 's/.*Fixes #\([0-9]\+\).*/\1/p' | tr '\n' ' ')" >> $GITHUB_OUTPUT
- name: Get the SVN revision
id: git-svn-id
run: |
COMMIT_MESSAGE=$(cat <<'EOF' | sed -n '$p'
${{ github.event.head_commit.message }}
EOF
)
echo "svn_revision_number=$(echo \"$COMMIT_MESSAGE\" | sed -n 's/.*git-svn-id: https:\/\/develop.svn.wordpress.org\/[^@]*@\([0-9]*\) .*/\1/p')" >> $GITHUB_OUTPUT
- name: Find pull requests
id: linked-prs
if: ${{ steps.trac-tickets.outputs.fixed_list != '' && steps.git-svn-id.outputs.svn_revision_number != '' }}
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
with:
script: |
const fixedList = "${{ steps.trac-tickets.outputs.fixed_list }}".split(' ').filter(Boolean);
let prNumbers = [];
for (const ticket of fixedList) {
const query = 'is:pr is:open repo:' + context.repo.owner + '/' + context.repo.repo + ' in:body https://core.trac.wordpress.org/ticket/' + ticket;
const result = await github.rest.search.issuesAndPullRequests({ q: query });
prNumbers = prNumbers.concat(result.data.items.map(pr => pr.number));
}
return prNumbers;
- name: Comment and close pull requests
if: ${{ steps.trac-tickets.outputs.fixed_list != '' && steps.git-svn-id.outputs.svn_revision_number != '' }}
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
with:
script: |
const prNumbers = ${{ steps.linked-prs.outputs.result }};
const commentBody = `A commit was made that fixes the Trac ticket referenced in the description of this pull request.
SVN changeset: [${{ steps.git-svn-id.outputs.svn_revision_number }}](https://core.trac.wordpress.org/changeset/${{ steps.git-svn-id.outputs.svn_revision_number }})
GitHub commit: https://github.com/WordPress/wordpress-develop/commit/${{ github.sha }}
This PR will be closed, but please confirm the accuracy of this and reopen if there is more work to be done.`;
// Update all matched pull requests.
for (const prNumber of prNumbers) {
// Comment on the pull request with details.
await github.rest.issues.createComment({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: prNumber,
body: commentBody
});
// Close the pull request.
await github.rest.pulls.update({
owner: context.repo.owner,
repo: context.repo.repo,
pull_number: prNumber,
state: 'closed'
});
}
15 changes: 15 additions & 0 deletions .github/workflows/reusable-javascript-tests.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,12 @@ name: JavaScript tests

on:
workflow_call:
inputs:
disable-apparmor:
description: 'Whether to disable AppArmor.'
required: false
type: 'boolean'
default: false

# Disable permissions for all available scopes by default.
# Any needed permissions should be configured at the job level.
Expand Down Expand Up @@ -49,6 +55,15 @@ jobs:
- name: Install npm Dependencies
run: npm ci

# Older branches using outdated versions of Puppeteer fail on newer versions of the `ubuntu-24` image.
# This disables AppArmor in order to work around those failures.
#
# See https://issues.chromium.org/issues/373753919
# and https://chromium.googlesource.com/chromium/src/+/main/docs/security/apparmor-userns-restrictions.md
- name: Disable AppArmor
if: ${{ inputs.disable-apparmor }}
run: echo 0 | sudo tee /proc/sys/kernel/apparmor_restrict_unprivileged_userns

- name: Run QUnit tests
run: npm run grunt qunit:compiled

Expand Down
Loading

0 comments on commit ff21b71

Please sign in to comment.