Skip to content

ci: pin fixtures and install locked shared test dependencies - #275

Draft
somethingwithproof wants to merge 1 commit into
developfrom
security/actions-hardening-20261013
Draft

somethingwithproof wants to merge 1 commit into
developfrom
security/actions-hardening-20261013

Conversation

@somethingwithproof

@somethingwithproof somethingwithproof commented Oct 13, 2026 •

Copy link
Copy Markdown
Member

CI currently changes Cacti's Composer manifest and resolves dependencies during each run. Pin the Cacti fixture and MariaDB image, install committed locks through the shared core action, and run Composer as the runner user. Set read-only permissions, disable persisted checkout credentials, cap integration jobs at 45 minutes, and cancel superseded PR runs. Add Actions updates where missing.

The existing events, matrix, job names, PHPUnit configuration, coverage thresholds, plugin schema/localization checks and polling steps are retained. No plugin-local test manifest is added. Stream retains its own runtime dependency contract.

Validation: full actionlint including shellcheck passes. The shared harness passes Thold's Linux tests and FlowView/Stream unit tests. Syslog's two unit failures reproduce with the existing core Pest toolchain. GitHub integration checks on this PR must complete before merge.

Depends on Cacti/cacti#8345. Merge the shared core tooling before this caller migration. The tooling is sparse-checked out at the published helper commit because Cacti source archives exclude CI files. No secrets are passed to the helper.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant