ci.yml

---
# CI for the Secrets API feature plugin.
#
# `make ci` is the single source of truth (see docs/reference/ci.md and README.md) — every
# job here is a thin wrapper around Makefile targets, so a green `make ci`
# locally means a green pipeline. If the two ever disagree, the Makefile is
# right and this file is wrong.
#
# Every action is pinned by full commit SHA rather than by tag. A tag is
# mutable and this repository implements a credential store, so an action that
# silently changes under a moved tag is exactly the supply-chain shape worth
# refusing here. Each SHA below was resolved from the GitHub API at the version
# noted beside it, not copied from documentation.
name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

# Nothing here writes to the repository, publishes a package, or needs a token
# beyond reading the code under test.
permissions:
  contents: read

# Only the newest run per ref needs to finish; superseded pushes cancel.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # Gates everything else. Cheap, needs no database, and catches the most
  # common mistakes (coding standard, PHP 7.4 syntax, static analysis) before
  # any matrix leg spins up MySQL. One PHP version is enough: these tools
  # analyse source text rather than running it.
  static:
    name: Static analysis
    runs-on: ubuntu-latest
    steps:
      - name: Check out
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up PHP
        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
        with:
          php-version: '8.3'
          # sodium is not optional for this project: the whole API is built on
          # it, and phpstan resolves sodium_* signatures from the loaded
          # extension rather than from stubs.
          extensions: sodium
          coverage: none
          tools: composer

      - name: Cache Composer packages
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cache/composer
          key: composer-${{ runner.os }}-php8.3-${{ hashFiles('composer.lock') }}
          restore-keys: composer-${{ runner.os }}-php8.3-

      - name: Install dependencies
        run: composer install --no-interaction --prefer-dist

      - run: make lint
      - run: make compat
      - run: make analyse

  # docs/reference/ is generated from source docblocks by bin/gen-reference.php and
  # committed so it stays readable on GitHub. This fails when the committed copy no
  # longer matches the source: someone changed a docblock and did not regenerate.
  # Needs PHP and nothing else; the generator has no dependencies.
  reference-docs:
    name: Generated reference docs
    runs-on: ubuntu-latest
    steps:
      - name: Check out
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up PHP
        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
        with:
          php-version: '8.3'
          coverage: none

      - run: make reference-check

  # The 7.4 leg is not optional. Core's floor is 7.4 and src/ has to run there;
  # `make compat` catches syntax statically, but only a running 7.4 catches a
  # runtime behaviour difference.
  #
  # The suite runs only on WordPress below 7.2, the versions the plugin serves.
  # 7.1.x is the newest 7.1 release, resolved by bin/install-wp-tests.sh, so the
  # matrix follows 7.1 security releases and doesn't move to 7.2 when "latest"
  # does. On a WordPress that ships the API the plugin stands down, and the
  # stand-down job below checks that instead.
  test:
    name: "PHP ${{ matrix.php }} / WP ${{ matrix.wp }}"
    needs: static
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        php: ['7.4', '8.0', '8.3', '8.5']
        wp: ['7.1.x']
        # The declared floor, `Requires at least` in secrets-api.php. src/ relies on
        # core's polyfills (array_all() arrived in 6.8), so the floor gets a leg of
        # its own rather than being assumed from 7.1.x.
        include:
          - php: '7.4'
            wp: '6.8'
    services:
      mysql:
        image: mysql:8.0
        env:
          MYSQL_ALLOW_EMPTY_PASSWORD: 'yes'
          MYSQL_DATABASE: wordpress_test
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=5
    steps:
      - name: Check out
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up PHP ${{ matrix.php }}
        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
        with:
          php-version: ${{ matrix.php }}
          extensions: sodium, mysqli
          coverage: none
          tools: composer

      - name: Cache Composer packages
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cache/composer
          key: composer-${{ runner.os }}-php${{ matrix.php }}-${{ hashFiles('composer.lock') }}
          restore-keys: composer-${{ runner.os }}-php${{ matrix.php }}-

      # `make install` runs composer install and bin/install-wp-tests.sh
      # together, so there is no separate composer step here.
      - name: Install dependencies and the WordPress test suite
        run: make install WP_VERSION=${{ matrix.wp }} DB_HOST=127.0.0.1

      - run: make test

  # On WordPress trunk, which ships the Secrets API since r64337, the plugin loads
  # none of its own copy, so the full suite would only test core's implementation
  # with core's tests. This checks the stand-down instead: core serves the API,
  # the plugin-only layer is not loaded, and the superseded notice is hooked.
  # `make test-stand-down` fails rather than skips if trunk somehow lacks the API.
  # The WP-CLI commands on core's implementation are covered by the nightly smoke
  # leg below.
  stand-down:
    name: "Stands down / PHP ${{ matrix.php }} / WP trunk"
    needs: static
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        php: ['7.4', '8.5']
    services:
      mysql:
        image: mysql:8.0
        env:
          MYSQL_ALLOW_EMPTY_PASSWORD: 'yes'
          MYSQL_DATABASE: wordpress_test
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=5
    steps:
      - name: Check out
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up PHP ${{ matrix.php }}
        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
        with:
          php-version: ${{ matrix.php }}
          extensions: sodium, mysqli
          coverage: none
          tools: composer

      - name: Cache Composer packages
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cache/composer
          key: composer-${{ runner.os }}-php${{ matrix.php }}-${{ hashFiles('composer.lock') }}
          restore-keys: composer-${{ runner.os }}-php${{ matrix.php }}-

      - name: Install dependencies and the WordPress test suite
        run: make install WP_VERSION=trunk DB_HOST=127.0.0.1

      - run: make test-stand-down

  # Separate from the matrix above rather than crossed into it: multisite
  # exercises scope selection and capability wiring, not PHP-version-specific
  # behaviour, so proving it once on the newest supported PHP is the useful
  # signal. Crossing it into the full matrix would double the runtime for
  # repetition rather than coverage.
  test-multisite:
    name: Multisite
    needs: static
    runs-on: ubuntu-latest
    services:
      mysql:
        image: mysql:8.0
        env:
          MYSQL_ALLOW_EMPTY_PASSWORD: 'yes'
          MYSQL_DATABASE: wordpress_test
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=5
    steps:
      - name: Check out
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up PHP
        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
        with:
          php-version: '8.3'
          extensions: sodium, mysqli
          coverage: none
          tools: composer

      - name: Cache Composer packages
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cache/composer
          key: composer-${{ runner.os }}-php8.3-${{ hashFiles('composer.lock') }}
          restore-keys: composer-${{ runner.os }}-php8.3-

      - name: Install dependencies and the WordPress test suite
        run: make install WP_VERSION=7.1.x DB_HOST=127.0.0.1

      - run: make test-ms

  # Runs the platform examples (examples/*/secrets.php) against a Moto
  # server (an AWS emulator, for the KMS and Secrets Manager examples) and a
  # Vault dev server, single site then multisite. It sits outside `make ci`
  # because the other jobs and the no-Docker local path provide no service
  # containers. The examples stay unlinted: they are single files a host copies
  # out, not part of this plugin's own coding-standard surface.
  examples:
    name: Examples (Moto, Vault)
    needs: static
    runs-on: ubuntu-latest
    env:
      WP_SECRETS_TEST_AWS_ENDPOINT: http://127.0.0.1:5000
      VAULT_ADDR: http://127.0.0.1:8200
      VAULT_TOKEN: dev-root
    services:
      mysql:
        image: mysql:8.0
        env:
          MYSQL_ALLOW_EMPTY_PASSWORD: 'yes'
          MYSQL_DATABASE: wordpress_test
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=5
      # Pinned by digest, resolved from motoserver/moto:latest on 2026-09-24.
      moto:
        image: motoserver/moto@sha256:91fd602a21f49cf9eb82fdf474015a3c131d40104c8297ea6a2ca920708ae32c
        ports:
          - 5000:5000
      # Pinned by the same digest as the Makefile comment above test-examples.
      vault:
        image: hashicorp/vault@sha256:47f14a6acb98f48d798a07df7c83f23a6e636e1cf724c5f8ff165cb32667a1e2
        env:
          VAULT_DEV_ROOT_TOKEN_ID: dev-root
        ports:
          - 8200:8200
        options: >-
          --cap-add=IPC_LOCK
          --health-cmd="wget -qO- http://127.0.0.1:8200/v1/sys/health"
          --health-interval=5s
          --health-timeout=3s
          --health-retries=10
    steps:
      - name: Check out
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up PHP
        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
        with:
          php-version: '8.3'
          extensions: sodium, mysqli
          coverage: none
          tools: composer

      - name: Cache Composer packages
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cache/composer
          key: composer-${{ runner.os }}-php8.3-${{ hashFiles('composer.lock') }}
          restore-keys: composer-${{ runner.os }}-php8.3-

      - name: Install dependencies and the WordPress test suite
        run: make install WP_VERSION=7.1.x DB_HOST=127.0.0.1

      - name: Wait for Moto
        run: |
          for i in $(seq 1 30); do
            if curl -sf http://127.0.0.1:5000/moto-api/ >/dev/null; then
              exit 0
            fi
            sleep 1
          done
          echo "Moto never answered on http://127.0.0.1:5000/moto-api/" >&2
          exit 1

      - run: make test-examples

  # A dispatch-layer smoke test, not another correctness suite: three real
  # dispatch bugs (--version=previous returning the current value,
  # --format rejected for want of a description line, and migrate-legacy
  # unregistered without @subcommand) reached a green PHPUnit suite because
  # nothing exercised the real `wp` binary end to end. 7.4 is the floor
  # this API has to run on; 8.3 is the newest PHP the rest of the matrix
  # covers. No Composer step: the smoke test provisions its own WP-CLI phar
  # and WordPress checkout and needs neither `vendor/` nor the WordPress
  # test suite.
  smoke:
    name: "Smoke / PHP ${{ matrix.php }}${{ matrix.wp == 'nightly' && ' / WP nightly' || '' }}"
    needs: static
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        php: ['7.4', '8.3', '8.5']
        wp: ['7.1.x']
        # A WordPress that ships the Secrets API: the plugin loads none of its own
        # copy and the commands run on core's implementation (ADR 0014).
        include:
          - php: '8.3'
            wp: 'nightly'
    services:
      mysql:
        image: mysql:8.0
        env:
          MYSQL_ALLOW_EMPTY_PASSWORD: 'yes'
          MYSQL_DATABASE: wordpress_smoke
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=5
    steps:
      - name: Check out
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up PHP ${{ matrix.php }}
        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
        with:
          php-version: ${{ matrix.php }}
          extensions: sodium, mysqli
          coverage: none

      - run: make smoke DB_HOST=127.0.0.1 WP_VERSION=${{ matrix.wp }}