test.yml

name: Test

# Pushing to a branch that has an open PR previously triggered this workflow twice: once
# for `push` and once for `pull_request`. The concurrency group below cannot collapse the
# pair, because it deliberately keys pull requests on the branch name and everything else
# on the commit hash, putting the two runs in different groups. Limiting `push` to the
# default branch leaves pull requests covered by the `pull_request` event alone, while
# still running the suite on merges to master.
on:
  push:
    branches:
      - master
  pull_request:

# Cancels all previous workflow runs for pull requests that have not completed.
concurrency:
  # The concurrency group contains the workflow name and the branch name for pull requests
  # or the commit hash for any other events.
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }}
  cancel-in-progress: true

# Disable permissions for all available scopes by default.
# Any needed permissions should be configured at the job level.
permissions: {}

jobs:
  lint-js-css:
    name: Lint JS & CSS
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    permissions:
      contents: read # Required to clone the repo.
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          cache: "npm"
          node-version-file: ".nvmrc"

      - name: Install NPM dependencies
        run: npm install

      - name: Lint JS
        run: npm run lint:js

      - name: Lint CSS
        run: npm run lint:css

  lint-php-and-compatibility:
    name: Lint PHP & PHP Compatibility checks.
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    permissions:
      contents: read # Required to clone the repo.
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup PHP and Composer
        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2
        with:
          php-version: "8.3"

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          cache: "npm"
          node-version-file: ".nvmrc"

      - name: Install NPM dependencies
        run: npm install

      - name: Lint PHP
        run: npm run lint:php

      - name: Lint PHP Compatibility
        run: composer lint-compat

      - name: PHPStan
        run: npm run lint:phpstan

  test-php:
    name: Test PHP ${{ matrix.php }} ${{ matrix.wp != '' && format( ' (WP {0}) ', matrix.wp ) || '' }}
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    permissions:
      contents: read # Required to clone the repo.
    strategy:
      # One broken leg should not cancel the rest of the matrix and hide every
      # other result.
      fail-fast: false
      matrix:
        # PHP 7.4 and 8.0 cannot be run here any more. wp-env builds from
        # `wordpress:php<version>`, and those two tags were last rebuilt in 2022
        # and 2023 respectively, permanently pinned to Debian bullseye. Bullseye
        # LTS ended 2026-08-31, so its security Release file is now expired and
        # the `apt-get -qy update` in wp-env's generated Dockerfile exits 100
        # before a single test runs. No bookworm image exists for either version,
        # and wp-env hardcodes both the base image and that apt call, so there is
        # nothing to configure our way out of.
        #
        # NOTE: PHP 7.4 is still this plugin's declared minimum ("Requires PHP" in
        # two-factor.php, `>=7.4` in composer.json). It remains covered statically
        # by PHPCompatibilityWP via `testVersion 7.4-` in phpcs.xml.dist, but it
        # is no longer exercised at runtime. 8.1 is now the lowest version we
        # actually run the suite against.
        php:
          - "8.5"
          - "8.4"
          - "8.3"
          - "8.2"
          - "8.1"
        wp:
          - latest
          - wordpress/wordpress
          - wordpress/wordpress#7.0-branch
          - wordpress/wordpress#7.1-branch
    env:
      WP_ENV_PHP_VERSION: ${{ matrix.php }}
      WP_ENV_CORE: ${{ matrix.wp == 'latest' && 'https://wordpress.org/wordpress-latest.zip' || matrix.wp }}

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup PHP
        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2
        with:
          php-version: "8.3"

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          cache: "npm"
          node-version-file: ".nvmrc"

      - name: Install NPM dependencies
        run: npm install

      - name: Start the Docker testing environment
        uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
        with:
          timeout_minutes: 10
          max_attempts: 3
          command: npm run env start -- --xdebug=coverage

      - name: Composer install
        run: |
          rm composer.lock || true # We need to install fresh.
          # The composer.json platform override (php: 7.2.24) installs PHPUnit 8.5, which
          # cannot generate code coverage on PHP 8. For the coverage build only, bypass the
          # platform check so Composer installs PHPUnit 9.6. All other matrix jobs keep the
          # default dependency set.
          if [[ "${{ matrix.php }}" == "8.3" && "${{ matrix.wp }}" == "latest" ]]; then
            npm run composer -- install --ignore-platform-req=php
          else
            npm run composer install
          fi

      - name: Versions
        run: |
          npm run env run cli php -- -v
          npm run env run cli wp core version

      - name: Test
        run: |
          npm run env run tests-cli --env-cwd=wp-content/plugins/two-factor -- mkdir -p tests/logs
          npm run test

      - name: Upload coverage report artifact
        if: ${{ matrix.php == '8.3' && matrix.wp == 'latest' }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: coverage-report
          path: tests/logs/*.xml
          if-no-files-found: error # Coverage silently going missing is the bug this is meant to fix.

  # Uploading to Codecov without a CODECOV_TOKEN requires OIDC (`id-token: write`).
  # That permission is kept out of the test jobs, which run npm/Composer dependencies
  # and the test suite; this job only runs the pinned actions below. The Codecov badge
  # reflects the default branch, so uploading on pushes is sufficient and no PR-triggered
  # run ever holds the permission.
  coverage:
    name: Upload code coverage
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    needs: test-php
    if: ${{ github.event_name == 'push' }}
    permissions:
      contents: read # Required to clone the repo, which Codecov uses to attribute the report.
      id-token: write # Required for tokenless (OIDC) upload to Codecov.
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Download coverage report artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: coverage-report
          path: tests/logs

      - name: Upload code coverage report
        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
        with:
          use_oidc: true
          files: tests/logs/clover.xml,tests/logs/clover-multisite.xml
          flags: phpunit
          fail_ci_if_error: false

  build:
    name: Build
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    permissions:
      contents: read # Required to clone the repo.
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup PHP
        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2
        with:
          php-version: "8.3"

      - name: Setup Node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          cache: "npm"
          node-version-file: ".nvmrc"

      - name: Install NPM dependencies
        run: npm install

      - name: Build
        run: npm run build