Fix

Author: PDowney

.github/scripts/test-automation.py

@@ -1,11 +1,10 @@
 #!/usr/bin/env python3
-"""
-Standard-library regression fixtures, executed by GitHub's package-check job.
+"""Standard-library regression fixtures, executed by GitHub's package-check job.
 
 These fixtures do not bootstrap WordPress or replace workflow-generated PHP tests.
 All mutation is confined to a temporary fixture repository on the runner.
 Processes use system tools in /usr/bin on the Ubuntu runner/WSL target; PATH
-overrides select only the intentional curl/grep substitutes inside shell steps.
+overrides select only intentional command substitutes inside extracted shell steps.
 """
 
 from __future__ import annotations
@@ -47,6 +46,16 @@ def workflow_step(filename: str, name: str) -> str:
     return textwrap.dedent(section.split("        run: |\n", 1)[1])
 
 
+def successful_quality_jobs() -> list[dict[str, str]]:
+    """Build completed job fixtures from the compatibility workflow's names."""
+    workflow = (WORKFLOWS / "wp-compatibility-test.yml").read_text()
+    names = [name for name in re.findall(r"^    name: (.+)$", workflow, re.M) if "${{" not in name]
+    names += [f"Test WordPress {wp} with PHP {php} (highest deps)"
+              for php in ("8.2", "8.3", "8.4", "8.5") for wp in ("6.8", "latest", "nightly")]
+    names.append("Test WordPress latest with PHP 8.2 (lowest deps)")
+    return [{"name": name, "status": "completed", "conclusion": "success"} for name in names]
+
+
 class AutomationTests(unittest.TestCase):
     def setUp(self):
         self.temporary = tempfile.TemporaryDirectory(prefix="es-optimizer-automation-")
@@ -160,18 +169,16 @@ def accepts_run(runs):
         (self.root / "bin/jq").chmod(0o700)
         with patch.dict(os.environ, PATH=f"{self.root / 'bin'}:{os.environ['PATH']}"):
             self.assertTrue(accepts_run([run]))
+        self.assertTrue(accepts_run([dict(run, event="workflow_dispatch")]))
         self.assertFalse(accepts_run([]))
         for changes in ({"head_sha": "other"}, {"event": "pull_request"},
                         {"head_branch": "other"}, {"head_repository": {"full_name": "fork/repo"}},
-                        {"conclusion": "failure"}, {"conclusion": "cancelled"}, {"status": "in_progress"}):
+                        {"conclusion": "failure"}, {"conclusion": "cancelled"},
+                        {"status": "queued"}, {"status": "in_progress"}):
             self.assertFalse(accepts_run([dict(run, **changes)]))
         self.assertFalse(accepts_run([run, dict(run, id=2, conclusion="failure")]))
-        workflow = (WORKFLOWS / "wp-compatibility-test.yml").read_text()
-        names = [name for name in re.findall(r"^    name: (.+)$", workflow, re.M) if "${{" not in name]
-        names += [f"Test WordPress {wp} with PHP {php} (highest deps)"
-                  for php in ("8.2", "8.3", "8.4", "8.5") for wp in ("6.8", "latest", "nightly")]
-        names.append("Test WordPress latest with PHP 8.2 (lowest deps)")
-        jobs = [{"name": name, "status": "completed", "conclusion": "success"} for name in names]
+        self.assertFalse(accepts_run([run, dict(run, id=2, status="in_progress", conclusion=None)]))
+        jobs = successful_quality_jobs()
 
         def accepts_jobs(records):
             # Repository-owned jq program; job records remain separate JSON data.
@@ -191,6 +198,66 @@ def accepts_jobs(records):
                 self.assertFalse(accepts_jobs(changed))
         self.assertFalse(accepts_jobs(jobs + [jobs[0]]))
 
+    def test_release_gate_uses_tested_commit_and_explains_rejections(self):
+        script = workflow_step("release.yml", "Require successful quality checks for this commit")
+        self.write("bin/gh", '#!/bin/sh\nprintf "%s\\n" "$@" >> "$FIXTURE_GH_ARGS"\n'
+                   'case "$*" in\n'
+                   '  *actions/workflows/wp-compatibility-test.yml/runs*) cat "$FIXTURE_RUNS" ;;\n'
+                   '  *actions/runs/1/jobs*) cat "$FIXTURE_JOBS" ;;\n'
+                   '  *) exit 92 ;;\nesac\n')
+        self.write("bin/git", '#!/bin/sh\n[ "$1" = rev-parse ] || exit 92\n'
+                   '[ -n "$FIXTURE_TAG_SHA" ] || exit 1\nprintf "%s\\n" "$FIXTURE_TAG_SHA"\n')
+        for command in ("gh", "git"):
+            (self.root / "bin" / command).chmod(0o700)
+        run = {"id": 1, "head_sha": "tested-commit", "head_branch": "main",
+               "head_repository": {"full_name": "fixture/repo"},
+               "event": "push", "status": "completed", "conclusion": "success"}
+        jobs = successful_quality_jobs()
+        cases = (
+            ("ready", [run], jobs, "", True),
+            ("missing", [], jobs, "", False),
+            ("queued", [dict(run, status="queued", conclusion=None)], jobs, "", False),
+            ("running", [dict(run, status="in_progress", conclusion=None)], jobs, "", False),
+            ("failed", [dict(run, conclusion="failure")], jobs, "", False),
+            ("missing-job", [run], jobs[:-1], "", False),
+            ("matching-tag", [run], jobs, "tested-commit", True),
+            ("wrong-tag", [run], jobs, "untested-tip", False),
+        )
+        for label, runs, records, tag_sha, accepted in cases:
+            with self.subTest(case=label):
+                self.write("fixture-runs.json", json.dumps({"workflow_runs": runs}))
+                self.write("fixture-jobs.json", json.dumps([{"jobs": records}]))
+                self.write("gh-args", "")
+                self.write("step-summary", "")
+                env = dict(os.environ, PATH=f"{self.root / 'bin'}:{os.environ['PATH']}",
+                           GITHUB_REPOSITORY="fixture/repo", VERSION="1.2.3",
+                           GITHUB_SHA="untested-tip", GITHUB_REF_NAME="default-branch",
+                           RELEASE_SHA="tested-commit", RELEASE_BRANCH="main",
+                           GITHUB_SERVER_URL="https://github.invalid", RUNNER_TEMP=str(self.root),
+                           GITHUB_STEP_SUMMARY=str(self.root / "step-summary"),
+                           FIXTURE_RUNS=str(self.root / "fixture-runs.json"),
+                           FIXTURE_JOBS=str(self.root / "fixture-jobs.json"),
+                           FIXTURE_GH_ARGS=str(self.root / "gh-args"), FIXTURE_TAG_SHA=tag_sha)
+                # Local command substitutes need no inherited GitHub credentials.
+                env.pop("GH_TOKEN", None)
+                env.pop("GITHUB_TOKEN", None)
+                # Fixed repository-owned shell step; gh/git are local fixture substitutes.
+                result = subprocess.run(  # nosec B603
+                    ["/usr/bin/bash", "-e", "-o", "pipefail", "-c", script],
+                    env=env, capture_output=True, text=True
+                )
+                self.assertEqual(accepted, result.returncode == 0, result.stdout + result.stderr)
+                arguments = (self.root / "gh-args").read_text()
+                self.assertIn("head_sha=tested-commit\n", arguments)
+                self.assertIn("branch=main\n", arguments)
+                self.assertNotIn("untested-tip", arguments)
+                summary = (self.root / "step-summary").read_text()
+                if accepted:
+                    self.assertIn("https://github.invalid/fixture/repo/actions/runs/1", summary)
+                else:
+                    self.assertIn("::error::", result.stdout)
+                    self.assertEqual("", summary)
+
     def test_release_lookup_fails_closed_on_http_and_transport_errors(self):
         script = workflow_step("release.yml", "Check if release exists")
         self.write("bin/curl", '#!/bin/sh\nprintf "%s" "$FIXTURE_HTTP_STATUS"\nexit "$FIXTURE_CURL_EXIT"\n')

.github/workflows/release.yml

@@ -1,8 +1,10 @@
 name: Create Release
 
 on:
-  push:
-    # Trigger on pushes to the main or master branch.
+  # Start after quality checks finish, rather than racing them on the same push.
+  workflow_run:
+    workflows: [ "WordPress Compatibility & Plugin Check" ]
+    types: [ completed ]
     branches: [ main, master ]
   # Allow manual triggering.
   workflow_dispatch:
@@ -12,21 +14,33 @@ permissions:
   actions: read
 
 concurrency:
-  group: release-${{ github.ref }}
+  group: release-${{ github.event.workflow_run.head_branch || github.ref_name }}
   cancel-in-progress: false
 
 env:
   PLUGIN_SLUG: enginescript-site-optimizer
 
 jobs:
   check-and-release:
-    if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'
+    if: >-
+      (github.event_name == 'workflow_dispatch' &&
+       (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master')) ||
+      (github.event_name == 'workflow_run' &&
+       github.event.workflow_run.conclusion == 'success' &&
+       github.event.workflow_run.head_repository.full_name == github.repository &&
+       (github.event.workflow_run.event == 'push' || github.event.workflow_run.event == 'workflow_dispatch') &&
+       (github.event.workflow_run.head_branch == 'main' || github.event.workflow_run.head_branch == 'master'))
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    env:
+      # workflow_run's github.sha is the default-branch tip, not necessarily the tested commit.
+      RELEASE_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
+      RELEASE_BRANCH: ${{ github.event.workflow_run.head_branch || github.ref_name }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
         with:
+          ref: ${{ env.RELEASE_SHA }}
           fetch-depth: 0
 
       - name: Get latest version
@@ -63,25 +77,28 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           VERSION: ${{ steps.get_version.outputs.version }}
         run: |
-          # Fail closed while checks are queued/running. Rerun this release job
-          # after the exact commit's compatibility workflow has passed.
+          # Automatic releases start after quality succeeds; manual runs must also
+          # prove every gate for the exact commit checked out above.
           gh api --method GET \
             "repos/$GITHUB_REPOSITORY/actions/workflows/wp-compatibility-test.yml/runs" \
-            -f head_sha="$GITHUB_SHA" -f branch="$GITHUB_REF_NAME" -f per_page=100 \
+            -f head_sha="$RELEASE_SHA" -f branch="$RELEASE_BRANCH" -f per_page=100 \
             > "$RUNNER_TEMP/quality-runs.json"
-          RUN_ID=$(jq -er --arg sha "$GITHUB_SHA" --arg repo "$GITHUB_REPOSITORY" \
-            --arg branch "$GITHUB_REF_NAME" '
+          if ! RUN_ID=$(jq -er --arg sha "$RELEASE_SHA" --arg repo "$GITHUB_REPOSITORY" \
+            --arg branch "$RELEASE_BRANCH" '
             [.workflow_runs[] | select(.head_sha == $sha and .head_branch == $branch
               and .head_repository.full_name == $repo
               and (.event == "push" or .event == "workflow_dispatch"))]
             | sort_by(.id) | last
             | select(.status == "completed" and .conclusion == "success") | .id
-            ' "$RUNNER_TEMP/quality-runs.json")
+            ' "$RUNNER_TEMP/quality-runs.json"); then
+            echo "::error::No completed successful compatibility run for commit $RELEASE_SHA on $RELEASE_BRANCH. Check WordPress Compatibility & Plugin Check before rerunning a manual release."
+            exit 1
+          fi
           gh api --paginate --slurp \
             "repos/$GITHUB_REPOSITORY/actions/runs/$RUN_ID/jobs?filter=latest&per_page=100" \
             > "$RUNNER_TEMP/quality-jobs.json"
           # A successful workflow with a skipped/missing gate is insufficient.
-          jq -e '
+          if ! jq -e '
             ["WP Plugin Check (PHP 8.3)", "PHPCS (PHP 8.3)", "WP VIP CS (PHP 8.3)",
              "PHPMD (PHP 8.3)", "Psalm Static Analysis (PHP 8.3)",
              "Security Scan (PHP 8.3)", "PHPStan for WP (PHP 8.3)",
@@ -93,9 +110,15 @@ jobs:
             | all($expected[]; . as $name |
                 ([$jobs[] | select(.name == $name)] | length) == 1 and
                 any($jobs[]; .name == $name and .status == "completed" and .conclusion == "success"))
-            ' "$RUNNER_TEMP/quality-jobs.json"
+            ' "$RUNNER_TEMP/quality-jobs.json"; then
+            echo "::error::Quality run $RUN_ID has a missing, duplicate, unfinished or unsuccessful required job."
+            exit 1
+          fi
           if git rev-parse --verify "refs/tags/v$VERSION" >/dev/null 2>&1; then
-            [[ $(git rev-parse "refs/tags/v$VERSION^{commit}") == "$GITHUB_SHA" ]]
+            if [[ $(git rev-parse "refs/tags/v$VERSION^{commit}") != "$RELEASE_SHA" ]]; then
+              echo "::error::Tag v$VERSION already points to a different commit."
+              exit 1
+            fi
           fi
           echo "Quality evidence: $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$RUN_ID" \
             >> "$GITHUB_STEP_SUMMARY"
@@ -155,7 +178,7 @@ jobs:
         uses: softprops/action-gh-release@v3
         with:
           tag_name: v${{ steps.get_version.outputs.version }}
-          target_commitish: ${{ github.sha }}
+          target_commitish: ${{ env.RELEASE_SHA }}
           fail_on_unmatched_files: true
           name: Release v${{ steps.get_version.outputs.version }}
           body: |