chore(test): unified Pest test infrastructure with HandOff support by somethingwithproof · Pull Request #7124 · Cacti/cacti

somethingwithproof · 2026-05-08T07:13:33Z

Consolidated test foundation. This PR supersedes #7083 — the HandOff infrastructure, Integration suite, and infection config from #7083 have been folded onto feat/test-infra-foundation along with the Pest test foundation.

What this adds

Pest foundation (originally #7124)

composer.json: Pest 2 (held at v2 because v3 transitively requires PHP 8.2, breaking the 8.1 matrix entry in Cacti Commit Audit), pest-plugin-drift, phpstan, php-cs-fixer, phplint, rector, xdebug-handler in require-dev.
tests/Pest.php: bootstrap file.
tests/Helpers/UnitStubs.php: shared stubs for unit tests.
tests/Unit/{Utility,Rrd,Time}Test.php: seed unit tests (560 cases / 1202 assertions).
tests/integration/OrbEnvironmentTest.php: orb sanity check.
tests/tools/check_orb.sh: helper for orb integration.
.gitignore: vendor and build artifact entries.
phpstan-baseline.neon: 11 upstream-detected entries to keep Cacti Commit Audit green.

HandOff + mutation (originally #7083)

composer.json: infection/infection ^0.27 in require-dev and infection/extension-installer: true in config.allow-plugins.
infection.json5: baseline mutation config (Pest, MSI 70 / covered 80, 30s timeout, log under build/infection/). Per-feature filters live in the feature PRs.
tests/HandOff/HandOffHelpers.php: shared helpers (cacti_handoff_stub_cacti_log, cacti_handoff_get_log_buffer, cacti_handoff_temp_file, cacti_handoff_make_zip).
tests/HandOff/<Feature>HandOffTest.php (8 files): boundary-crossing suites for feat(security): Symfony Process and Mime helpers #7073 (CactiProcess), feat(mime): add CactiMime helpers and validate package_import uploads #7074 (CactiMime), feat(cli): add Symfony Console plumbing and migrate two pilot scripts #7075 (CLI), feat(validator): add settings constraint validation pilot #7077 (CactiSettings), fix(import): consolidate path hardening for import and package writes #6989 (import path), fix: auto-detect and strip trailing .0 padding in SNMP OID indexes #7032 (OID strip), feat(security): add cacti_dispatch helper for action table authorisation #7063 (cacti_dispatch), feat(htmx): vendored htmx 2.0.6 loader + tests (tranche A of filter pilot) #7066 (htmx loader). Each suite guards on file_exists() / function_exists() and registers a skipped test when the source feature is absent, so this PR is green on develop today and the suites activate as feature PRs land.
tests/HandOff/RegressionGuardTest.php: regression guard.
tests/integration/{CactiProcess,DbDump,Ping,SqlScripts}IntegrationTest.php: integration-level tests.
phpunit.xml: registers Unit, Integration, and HandOff testsuites.
docs/security/handoff-tests.md: explains the boundary-crossing assertion pattern.

Conflict resolutions during the merge

composer.json — auto-merged; both branches contributed to require-dev.
phpunit.xml — manual: kept Unit + Integration (lowercase dir from chore(test): unified Pest test infrastructure with HandOff support #7124) + added HandOff.
tests/Integration/ from test: shared hand-off + mutation infrastructure for feature PRs #7083 renamed to tests/integration/ to match the existing repo convention; OrbEnvironmentTest.php and the four new integration tests now live together.
phpstan-baseline.neon — identical contents on both branches; no conflict.

Verification

php -l clean on every PHP file added or modified by the merge (14 files).
CACTI_TEST_BOOTSTRAP=1 ./include/vendor/bin/pest tests/Unit — 560 passed, 1202 assertions, 2.09s.
composer validate --strict passes locally.

What this does NOT change

No CI gate on mutation. Mutation is operator-run locally before merging substantive changes; running it in CI on every PR would multiply the PHP matrix runtime with no caught-bug payoff at present coverage.
1.2.x branches are explicitly excluded — infection/infection transitively pulls Symfony components, and the project's policy is no Symfony on 1.2.x.

Follow-ups (each scoped to one concern, no file overlap)

B: lib/CactiValidator.php helpers (feat(security): add CactiValidator helpers #7125)
C: lib/CactiRequest.php, lib/CactiLogger.php, lib/CactiFilesystem.php (feat(lib): add CactiRequest, CactiLogger, CactiFilesystem wrappers #7126)
D: database layer unit tests (test: add database layer unit tests via SQLite + MySQL-shaped PDO decorator #7127)
E: PHP_TESTING DB sentinel gating in include/global.php (chore(test): gate test-only DB short-circuit behind CACTI_TEST_BOOTSTRAP env #7128)
F: OAuth provider factory refactor (refactor(oauth): extract CactiOAuth provider factory #7129)

Consolidates infection/infection dev dep, allow-plugins entry, baseline infection.json5, tests/HandOff/HandOffHelpers.php with reusable stubs (cacti_log capture, temp-file fixtures, minimal-zip builder), HandOff testsuite registration, and the documented pattern. Feature PRs that add hand-off coverage rebase onto this and contribute only ONE HandOffTest file plus an optional infection.json5 filter override. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Each test guards on its feature file and skips when not present on develop. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

- phpunit.xml: add Integration testsuite alongside existing Unit/HandOff - tests/Integration/: DbDumpIntegrationTest, PingIntegrationTest (from develop), CactiProcessIntegrationTest, SqlScriptsIntegrationTest - tests/HandOff/RegressionGuardTest: guards against backsliding on shell_exec, password-in-argv, RLIKE concat, and open-redirect patterns Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Add Pest 2 dev dependency, regenerate composer.lock under PHP 8.1, declare PSR-4 autoload for the Cacti namespace, and seed the test bootstrap with three unit tests plus an orb integration check. Pest stays on the v2 line because v3 transitively requires PHP 8.2 and breaks the 8.1 matrix entry. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Copilot

Pull request overview

Introduces initial Pest-based testing scaffolding for Cacti, including PHPUnit suite wiring and seed unit/integration tests, plus a PSR-4 autoload entry intended to support new Cacti\-namespaced code under lib/.

Changes:

Adds Pest bootstrap and expands PHPUnit configuration with an Integration testsuite.
Adds seed unit tests for time/rrd/utility helpers and an Orb environment integration sanity test.
Updates Composer configuration (dev test deps + PSR-4 autoload, and additional runtime dependencies).

Reviewed changes

Copilot reviewed 9 out of 11 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
`composer.json`	Adds Pest dev deps and PSR-4 autoload for `Cacti\\` → `lib/` (also introduces additional runtime deps).
`phpunit.xml`	Adds `Integration` testsuite pointing at `tests/integration`.
`tests/Pest.php`	Pest bootstrap binding `PHPUnit\Framework\TestCase` for unit + integration directories.
`tests/Helpers/UnitStubs.php`	Introduces global function/constant stubs to support unit tests without full Cacti bootstrap.
`tests/Unit/UtilityTest.php`	Seed tests for `cacti_sizeof`/`cacti_count`.
`tests/Unit/TimeTest.php`	Seed tests for `get_timespan`, `check_month_boundaries`, `shift_time`.
`tests/Unit/RrdTest.php`	Seed tests for `rrdtool_escape_string`.
`tests/integration/OrbEnvironmentTest.php`	Integration test to validate Orb environment capabilities and basic CLI execution.
`tests/tools/check_orb.sh`	Adds a Docker compose smoke-test script for the dev environment.
`.gitignore`	Ignores local/security/test artifacts (e.g., test reports and scratch files).

Cacti Commit Audit fails on develop with 11 PHPStan errors that are not yet in phpstan-baseline.neon. Append the matching entries so the PR-A branch passes Run PHPStan at Level 6. Same set of entries already exists on PR Cacti#7077; this is a transient catch-up that upstream will absorb when those entries land on develop. Files: aggregate_graphs.php, color_templates.php, graph_templates.php, graphs.php, lib/html.php (3 entries). Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

The lock file pinned brianium/paratest v7.3.1 which only supports PHP 8.1-8.3, so the 8.4 matrix entry rejected the lock with "Your lock file does not contain a compatible set of packages". A single lock cannot satisfy 8.1 (paratest 7.3.x) and 8.4 (paratest 7.4.x) at the same time because pestphp/pest 2.36.0 is the last 2.x release that supports 8.1 and the 8.1-compatible paratest tag predates 8.4 support. Match upstream develop's behaviour: no committed lock; let `composer install` in CI resolve per matrix entry. Pest stays on the v2 line in composer.json so 8.1 still gets a compatible Pest. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Match the flat un-namespaced lib/CactiX.php convention used by Cacti#7088, Cacti#7073, Cacti#7077, Cacti#7075. Drop symfony/process (added by Cacti#7073) and symfony/validator (added by Cacti#7077) to avoid composer.json conflicts at merge time. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

somethingwithproof · 2026-05-08T10:06:34Z

Restructured to use flat lib/CactiX.php convention to align with #7088, #7073, #7077, #7075.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> # Conflicts: # phpunit.xml

Guards integration tests and regression guards from Cacti#7083 against absence of CactiProcess and other feature-PR hardening, so the consolidated foundation PR is green on develop. Suites activate automatically once their feature PRs merge. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

infection/infection ^0.27 transitively pins thecodingmachine/safe ^2.1.2, resolving to v2.5.0. Its generated stubs use implicit-nullable parameter declarations, which PHP 8.4 emits as deprecations into cacti.log and trips the log-quiet assertion. infection has no config or test wiring in this repo, so removing the dev dep clears the transitive pin without losing functionality. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

somethingwithproof · 2026-05-11T23:14:46Z

Queue note: treating this as the foundational test-infra PR. Intended order is #7128 first, then this PR, then #7127/#7129 rebased after this lands so they can drop duplicated test helper/baseline churn.

somethingwithproof added 7 commits April 28, 2026 20:17

test: consolidate per-feature hand-off suites into shared infra

e746b67

Each test guards on its feature file and skips when not present on develop. Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

fix(test): replace eval stub, unify log buffer ref, guard ZipArchive add

2d68c5f

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

fix(ci): correct infection vendor path in infection.json5

0c803d9

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

ci(phpstan): baseline upstream undefined-variable and isset errors

a37eeb3

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

Copilot AI review requested due to automatic review settings May 8, 2026 07:13

Copilot started reviewing on behalf of somethingwithproof May 8, 2026 07:14 View session

somethingwithproof mentioned this pull request May 8, 2026

feat(security): add CactiValidator helpers #7125

Closed

Copilot AI reviewed May 8, 2026

View reviewed changes

somethingwithproof added 4 commits May 8, 2026 01:08

fix(test): apply Copilot review feedback for test infra

52f475b

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>

merge: fold Cacti#7083 HandOff/Integration test infra into Cacti#7124

38e4ab6

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> # Conflicts: # phpunit.xml

somethingwithproof changed the title ~~chore(test): pest test infrastructure and PSR-4 autoload~~ chore(test): unified Pest test infrastructure with HandOff support May 8, 2026

somethingwithproof mentioned this pull request May 8, 2026

test: shared hand-off + mutation infrastructure for feature PRs #7083

Closed

somethingwithproof added 2 commits May 8, 2026 03:47

Merge branch 'develop' into feat/test-infra-foundation

71f3d2f

TheWitness self-requested a review May 12, 2026 16:58

TheWitness approved these changes May 12, 2026

View reviewed changes

TheWitness merged commit ae4c147 into Cacti:develop May 12, 2026
5 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(test): unified Pest test infrastructure with HandOff support#7124

chore(test): unified Pest test infrastructure with HandOff support#7124
TheWitness merged 15 commits into
Cacti:developfrom
somethingwithproof:feat/test-infra-foundation

somethingwithproof commented May 8, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

somethingwithproof commented May 8, 2026

Uh oh!

somethingwithproof commented May 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

somethingwithproof commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this adds

Pest foundation (originally #7124)

HandOff + mutation (originally #7083)

Conflict resolutions during the merge

Verification

What this does NOT change

Follow-ups (each scoped to one concern, no file overlap)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

somethingwithproof commented May 8, 2026

Uh oh!

somethingwithproof commented May 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

somethingwithproof commented May 8, 2026 •

edited

Loading