[hmbashar]

Summary

Adds tests for the functions of wp-admin/includes/plugin-install.php that output the Add Plugins screen. None of them had a test.

• install_popular_tags() asks the API for the hot tags with the arguments, caches the tags for three hours by arguments, and returns the error of the API without caching it.
• install_dashboard() outputs the table, the heading and the links of the popular tags (the name is encoded, one plugin is counted in the singular), or the message of the error.
• install_search_form() searches by keyword by default, uses the term (decoded, unslashed and escaped) and the type of the request.
• install_plugins_upload() outputs the upload form with its action, nonce, file field and button.
• install_plugins_favorites_form() outputs the form with the username of the user (escaped) and the nonce of the user.
• display_plugins_table() introduces the beta, featured and recommended tabs, outputs the table, and outputs nothing for the favorites without a user (a user in the request or in the option is enough).

Testing

vendor/bin/phpunit --filter 'Admin_Includes_Plugin_Install_InstallScreenFunctions_Test::'
vendor/bin/phpunit -c tests/phpunit/multisite.xml --filter 'Admin_Includes_Plugin_Install_InstallScreenFunctions_Test::'
vendor/bin/phpcs tests/phpunit/tests/admin/includes/plugin-install/InstallScreenFunctions_Test.php

Mutation check: 23 changes to these functions (the cache key and lifetime, the error handling, the links, the form defaults, the escaping, the nonces and the text of each tab) were each caught by a test.

The requests to WordPress.org are answered with the pre_http_request filter, so the response is a decoded JSON response like the real one.

Trac ticket: https://core.trac.wordpress.org/ticket/66558

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Sonnet 5.5
Used for: Written with AI and manually reviewed by me.

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs.

Core Committers: Use this line as a base for the props when committing in SVN:

Props hmbashar, huzaifaalmesbah.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

---

Props Bot commands

You can trigger Props Bot actions by commenting on this PR:

• @propsbot add <username> to give props to a GitHub user. Requires write access.
• @propsbot remove <username> to leave a user out of the props. Requires write access.
• @propsbot refresh to refresh this list. Adding the props-bot label works too.

[Copilot]

🟡 Changes recommended

The upload-form test checks only the nonce field name, allowing empty or wrong-action nonces that would break uploads to pass.

1 open issue

• Verify the upload nonce value and action · New

What changed in this PR

Adds unit tests for six functions that render the Add Plugins screen, without changing production code.

Changes:

• Covers popular-tag API requests, caching, and error handling with mocked HTTP responses.
• Checks dashboard output and search, upload, and favorites forms.
• Tests tab introductions and when the favorites table is displayed.

File	Description
tests/​phpunit/​tests/​admin/​includes/​plugin-install/​InstallScreenFunctions_Test.php	Adds Add Plugins screen tests, API fixtures, and output-capture helpers.

_{Review effort: Balanced}

[huzaifaalmesbah]

Thanks for the patch, @hmbashar! Good coverage for the Add Plugins screen rendering functions and popular tags API caching.

All 97 CI checks are green.

One quick suggestion: in test_install_plugins_upload_renders_form(), verifying the nonce action (wp_verify_nonce( ..., 'plugin-upload' )) in addition to checking for name="_wpnonce" would ensure the upload form is protected with the right action token.

Very clean output buffering and teardown hygiene!

_{AI Review: Gemini 3.8 Flash}