From 0f85e4a416033c600ae0c119408dfe2d82f0b3cf Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Mon, 12 Oct 2026 21:47:50 -0700 Subject: [PATCH 1/3] ci: pin fixtures and install locked shared test dependencies Signed-off-by: Thomas Vincent --- .github/workflows/plugin-ci-workflow.yml | 60 +++++++++++++----------- CHANGELOG.md | 1 + 2 files changed, 34 insertions(+), 27 deletions(-) diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml index 201aa75..63d542e 100644 --- a/.github/workflows/plugin-ci-workflow.yml +++ b/.github/workflows/plugin-ci-workflow.yml @@ -31,12 +31,20 @@ on: - main - develop +permissions: + contents: read + env: CACTI: 1.2.x - COMPOSER_ALLOW_SUPERUSER: 1 + CACTI_REF: d6d230f712c0af1a0391646f65364950ebf131af # 1.2.x fixture + +concurrency: + group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: integration-test: + timeout-minutes: 45 runs-on: ${{ matrix.os }} strategy: @@ -47,7 +55,7 @@ jobs: services: mariadb: - image: mariadb:11.8 + image: mariadb:11.8@sha256:6422478cb8e159f080fb1d8ccf65101e26fe51385787fde7d16c3b165a331f15 env: MYSQL_ROOT_PASSWORD: cactiroot MYSQL_DATABASE: cacti @@ -67,13 +75,15 @@ jobs: - name: Checkout Cacti uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false repository: Cacti/cacti - ref: ${{ env.CACTI }} + ref: ${{ env.CACTI_REF }} path: cacti - name: Checkout hmib Plugin uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false path: cacti/plugins/hmib # patch-coverage.php diffs against the base branch below. fetch-depth: 0 @@ -82,6 +92,7 @@ jobs: uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ matrix.php }} + tools: composer:2.10.3 extensions: intl, mysql, gd, ldap, gmp, xml, curl, json, mbstring, snmp coverage: xdebug ini-values: "post_max_size=256M, max_execution_time=60, date.timezone=America/New_York" @@ -129,29 +140,24 @@ jobs: mysql --defaults-file="$HOME/.my.cnf" cacti < ${{ github.workspace }}/cacti/cacti.sql mysql --defaults-file="$HOME/.my.cnf" -e "INSERT INTO settings (name, value) VALUES ('path_php_binary', '/usr/bin/php')" cacti - - name: Validate composer files - run: | - cd ${{ github.workspace }}/cacti - if [ -f composer.json ]; then - sudo composer validate --strict || true - fi - - - name: Install Composer Dependencies - run: | - cd ${{ github.workspace }}/cacti - if [ -f composer.json ]; then - sudo composer config --no-plugins allow-plugins.pestphp/pest-plugin true - sudo composer require --no-progress --no-interaction "pestphp/pest: ^3" "pestphp/pest-plugin-drift: ^3.0" - sudo rm -f composer.lock - sudo composer install --dev --no-progress - fi - - - name: Restore vendor ownership for Pest - run: | - cd ${{ github.workspace }}/cacti - if [ -d include/vendor ]; then - sudo chown -R runner:runner include/vendor composer.lock - fi + # Core's release archives exclude .github and tests. Fetch these paths + # through Git at the immutable helper revision instead of an Action archive. + - name: Checkout shared CI tooling + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: Cacti/cacti + ref: f3ff777992875740e4665fedfe2eff8335f5b894 + persist-credentials: false + path: ci-tools + sparse-checkout: | + .github/actions/setup-plugin-dependencies + tests/tools/plugin-harness + + - name: Install locked Cacti and plugin test dependencies + uses: ./ci-tools/.github/actions/setup-plugin-dependencies + with: + cacti-directory: cacti + install-core-dev: 'false' - name: Create Cacti config.php run: | @@ -192,7 +198,7 @@ jobs: - name: Run Pest Unit Tests run: | cd ${{ github.workspace }}/cacti - include/vendor/bin/pest --configuration=plugins/hmib/phpunit.xml \ + "$CACTI_PEST_BIN" --configuration=plugins/hmib/phpunit.xml \ --coverage-clover=plugins/hmib/coverage/clover.xml # Whole-file coverage is meaningless here: most of the plugin only runs diff --git a/CHANGELOG.md b/CHANGELOG.md index fe679a1..93a1f93 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,7 @@ ChangeLog --- develop --- +* security: Pin CI fixtures and shared test dependencies, disable persisted checkout credentials, and limit workflow permissions and runtime * issue: Fix the Fleet Dashboard Uptime Distribution showing all zeros by falling back to SNMP sysUpTime when the Host Resources hrSystemUptime is not reported, and apply the same fallback to the per-device Dashboard * issue: Stop the Dashboard card header from changing height when hovering the drag handle or tool buttons by reserving space for the theme's button hover border * feature: Make the Fleet Dashboard the first tab and the default landing view on the Host MIB interface From 14c6ef301cf6778947220b30fccfbeb33cf94cb7 Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Sat, 17 Oct 2026 22:26:04 -0700 Subject: [PATCH 2/3] docs(changelog): list CI hardening as a dev entry Signed-off-by: Thomas Vincent --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 93a1f93..9377f90 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,7 +1,6 @@ ChangeLog --- develop --- -* security: Pin CI fixtures and shared test dependencies, disable persisted checkout credentials, and limit workflow permissions and runtime * issue: Fix the Fleet Dashboard Uptime Distribution showing all zeros by falling back to SNMP sysUpTime when the Host Resources hrSystemUptime is not reported, and apply the same fallback to the per-device Dashboard * issue: Stop the Dashboard card header from changing height when hovering the drag handle or tool buttons by reserving space for the theme's button hover border * feature: Make the Fleet Dashboard the first tab and the default landing view on the Host MIB interface @@ -22,6 +21,7 @@ ChangeLog * issue: Fix PHP 8.1+ 'float-string to int loses precision' deprecation from runCollector() by typing the last-run timestamp parameter as float * dev: Bring all plugin code to PHPStan level 8 with accurate parameter and return types * dev: Adopt Cacti core's SNMP library and remove the bundled snmp.php/snmp_functions.php copies +* dev: Pin CI fixtures and shared test dependencies, disable persisted checkout credentials, and limit workflow permissions and runtime * issue: Fix Host Type CSV import (undefined name/version values and header-row parsing) * issue: Correct stale html_header_sort() and form_save_button() argument order * security: Add a version-safe CSP nonce (`plugin_hmib_csp_nonce()`) to every inline `