[desrosj]

This adds a step to both the upgrade & installation test workflows to perform a checksum verification after downloading WordPress.

Trac ticket: Core-65845

Use of AI Tools

None

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props desrosj, wildworks, swissspidy, lancewillett.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[t-hamano]

Warning: File should not exist: wp-includes/php-ai-client/src/Providers/ApiBasedImplementation/AbstractApiBasedModelMetada
Warning: File should not exist: wp-includes/php-ai-client/src/Providers/ApiBasedImplementation/ListModelsApiBasedProviderA
Warning: File should not exist: wp-includes/php-ai-client/src/Providers/ApiBasedImplementation/GenerateTextApiBasedProvide
Warning: File should not exist: wp-includes/php-ai-client/src/Providers/ApiBasedImplementation/Contracts/ApiBasedModelInte
Warning: File should not exist: wp-includes/php-ai-client/src/Providers/OpenAiCompatibleImplementation/AbstractOpenAiCompa
Warning: File should not exist: wp-includes/php-ai-client/src/Providers/Models/ImageGeneration/Contracts/ImageGenerationMo
Warning: File should not exist: wp-includes/php-ai-client/src/Providers/Models/ImageGeneration/Contracts/ImageGenerationOp
Warning: File should not exist: wp-includes/php-ai-client/src/Providers/Models/SpeechGeneration/Contracts/SpeechGeneration
Warning: File should not exist: wp-includes/php-ai-client/src/Providers/Models/TextToSpeechConversion/Contracts/TextToSpee
Warning: File should not exist: wp-includes/php-ai-client/src/Providers/Models/TextGeneration/Contracts/TextGenerationOper
Warning: File should not exist: wp-includes/php-ai-client/src/Providers/Models/TextGeneration/Contracts/TextGenerationMode
Warning: File should not exist: wp-includes/php-ai-client/src/Providers/Models/VideoGeneration/Contracts/VideoGenerationOp
Warning: File should not exist: wp-includes/php-ai-client/src/Providers/Models/VideoGeneration/Contracts/VideoGenerationMo
Warning: File should not exist: wp-includes/php-ai-client/src/Providers/Contracts/ProviderWithOperationsHandlerInterface.p
Warning: File should not exist: wp-includes/php-ai-client/third-party/Http/Discovery/Exception/StrategyUnavailableExceptio
Warning: File should not exist: wp-includes/php-ai-client/third-party/Http/Discovery/Exception/PuliUnavailableException.ph
Warning: File should not exist: wp-includes/php-ai-client/third-party/Http/Discovery/Exception/NoCandidateFoundException.p
Warning: File should not exist: wp-includes/php-ai-client/third-party/Http/Discovery/Exception/ClassInstantiationFailedExc
Warning: File should not exist: wp-includes/php-ai-client/third-party/Http/Discovery/Exception/DiscoveryFailedException.ph
Warning: File should not exist: wp-includes/php-ai-client/third-party/Http/Discovery/Strategy/CommonPsr17ClassesStrategy.p

This error is strikingly similar to the problem reported with wp-cli. wp-cli/wp-cli#6320

Consider using the nightly version of WP-CLI, or perhaps this issue will be resolved once a new version of WP-CLI is released. cc @swissspidy

[swissspidy]

Yep need to update to WP-CLI nightly. Though we're really working on the next stable release, hopefully right after 7.1 ships. So stay put.

btw shameless plug: swissspidy#96

[lancewillett]

Nice, focused addition. Placing verification immediately after download isolates archive and extraction problems well.

One scalability question: this PR ran the checksum command 394 times, repeating the same WordPress/PHP check across database and multisite variants. Since extraction and checksum results should not depend on the database or multisite mode, could one representative job per WordPress/PHP pair provide the same signal with less WordPress.org API traffic and failure fan-out?

This is non-blocking; the current failures appear to be the known WP-CLI 2.12.0 extraction defect rather than a problem with this patch.

---

_{Adversarial review · gpt-5.6-sol}

[lancewillett]

This can land; I left a non-blocking suggestion.

[Copilot]

🟡 Changes recommended

The checksum verification queries unavailable release checksums for nightly WordPress downloads, causing default workflow jobs to fail before installation.

1 open issue

• Skip release checksum verification for nightly downloads · New

What changed in this PR

Adds WordPress checksum verification to the installation and upgrade test workflows, checking downloaded files before configuration and installation.

Changes:

• Adds wp core verify-checksums immediately after downloading WordPress in both workflows.
• Updates workflow comments to document the verification step.

File	Description
.github/​workflows/​reusable-upgrade-testing.yml	Adds checksum verification before preparing WordPress for upgrade tests.
.github/​workflows/​install-testing.yml	Adds checksum verification before configuring and installing WordPress.

_{Review effort: Balanced}

[lancewillett]

Please refresh this against trunk and narrow the immediate change to installation verification, deferring the upgrade hunk until its WP-CLI dependency is verified.

The sampled upgrade failure reached the new checksum step and reported missing files and truncated paths. The check exposed an extraction defect. The upstream component fixes are merged, but their availability in the stable WP-CLI bundle used here is not established.

The installation check still has value: checking extracted files is distinct from archive MD5 validation. #15252 does not supersede that check or fix the upgrade workflow. After refresh, please verify a current release install and a nightly install. The earlier nightly job passed this checksum step, so the blanket claim that nightly cannot work is not supported by that run.

_{AI review · gpt-6}