Add resilient release artifact testing

Author: Tsvetan Stoychev

.github/workflows/ci.yml

@@ -123,3 +123,42 @@ jobs:
         env:
           WP_TESTS_DIR: /tmp/wordpress-tests-lib
         run: ./vendor/bin/phpunit --configuration phpunit-with-integration.xml
+
+  release-artifact:
+    name: Release ZIP smoke test
+    runs-on: ubuntu-latest
+    needs:
+      - translations
+      - unit
+      - integration
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup release PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '7.4'
+          tools: composer:v2
+          coverage: none
+
+      - name: Install release tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y rsync zip unzip
+
+      - name: Build and inspect release artifact
+        run: sh tools/build-release.sh
+
+      - name: Install and test packaged plugin
+        run: sh tools/smoke-test-release.sh release/basicrum.zip
+
+      - name: Upload release artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: basicrum-release
+          path: |
+            release/basicrum.zip
+            release/basicrum.zip.sha256
+          if-no-files-found: error

.github/workflows/prerelease.yml

@@ -13,30 +13,27 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v5
 
-      - name: Setup PHP
+      - name: Setup release PHP
         uses: shivammathur/setup-php@v2
         with:
           php-version: '7.4'
           tools: composer:v2
           coverage: none
 
-      - name: Install runtime dependencies
-        working-directory: plugins/basicrum
-        run: composer install --no-dev --no-interaction --prefer-dist
-
-      - name: Generate plugin artifact
+      - name: Install release tools
         run: |
-          set -e
           sudo apt-get update
-          sudo apt-get install -y rsync zip
+          sudo apt-get install -y rsync zip unzip
 
-          mkdir -p release/basicrum
-          rsync -rc --exclude-from="$GITHUB_WORKSPACE/plugins/basicrum/.distignore" "$GITHUB_WORKSPACE/plugins/basicrum/" release/basicrum/ --delete --delete-excluded
+      - name: Build and inspect release artifact
+        run: sh tools/build-release.sh
 
-          cd "$GITHUB_WORKSPACE/release"
-          zip -r "$GITHUB_WORKSPACE/basicrum.zip" basicrum
+      - name: Install and test packaged plugin
+        run: sh tools/smoke-test-release.sh release/basicrum.zip
 
-      - name: Upload release asset
+      - name: Upload release assets
         uses: softprops/action-gh-release@v2
         with:
-          files: basicrum.zip
+          files: |
+            release/basicrum.zip
+            release/basicrum.zip.sha256

.github/workflows/release.yml

@@ -13,30 +13,27 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v5
 
-      - name: Setup PHP
+      - name: Setup release PHP
         uses: shivammathur/setup-php@v2
         with:
           php-version: '7.4'
           tools: composer:v2
           coverage: none
 
-      - name: Install runtime dependencies
-        working-directory: plugins/basicrum
-        run: composer install --no-dev --no-interaction --prefer-dist
-
-      - name: Generate plugin artifact
+      - name: Install release tools
         run: |
-          set -e
           sudo apt-get update
-          sudo apt-get install -y rsync zip
+          sudo apt-get install -y rsync zip unzip
 
-          mkdir -p release/basicrum
-          rsync -rc --exclude-from="$GITHUB_WORKSPACE/plugins/basicrum/.distignore" "$GITHUB_WORKSPACE/plugins/basicrum/" release/basicrum/ --delete --delete-excluded
+      - name: Build and inspect release artifact
+        run: sh tools/build-release.sh
 
-          cd "$GITHUB_WORKSPACE/release"
-          zip -r "$GITHUB_WORKSPACE/basicrum.zip" basicrum
+      - name: Install and test packaged plugin
+        run: sh tools/smoke-test-release.sh release/basicrum.zip
 
-      - name: Upload release asset
+      - name: Upload release assets
         uses: softprops/action-gh-release@v2
         with:
-          files: basicrum.zip
+          files: |
+            release/basicrum.zip
+            release/basicrum.zip.sha256

Makefile

@@ -12,7 +12,7 @@ TEST_DB_PASS = root
 TEST_DB_HOST = db
 WP_TEST_VERSION ?= latest
 
-.PHONY: help build up down restart logs shell composer-install wp-install lint lint-fix lint-php translations integration-setup integration test package clean
+.PHONY: help build up down restart logs shell composer-install wp-install lint lint-fix lint-php translations integration-setup integration test package package-verify package-smoke clean
 
 help:
 	@echo "Targets:"
@@ -32,7 +32,9 @@ help:
 	@echo "  integration-setup  Install WordPress test suite inside containers"
 	@echo "  integration        Run integration tests"
 	@echo "  test               Run unit and integration tests"
-	@echo "  package            Build release zip via prerelease workflow logic"
+	@echo "  package            Build and inspect the release ZIP and checksum"
+	@echo "  package-verify     Inspect the existing release ZIP and checksum"
+	@echo "  package-smoke      Install and test the release ZIP in clean WordPress"
 
 build:
 	$(COMPOSE) build $(PHP_SERVICE)
@@ -84,9 +86,14 @@ integration:
 test: unit integration
 
 package:
-	$(COMPOSE) run --rm $(PHP_SERVICE) bash -lc 'mkdir -p /tmp/release/basicrum && rsync -rc --exclude-from=/workspace/.distignore /workspace/ /tmp/release/basicrum/ --delete --delete-excluded && cd /tmp/release && zip -r /workspace/basicrum.zip basicrum'
+	$(COMPOSE) run --rm --no-deps -w /repo $(PHP_SERVICE) sh /tools/build-release.sh /repo/$(PLUGIN_DIR) /repo/release
+
+package-verify:
+	$(COMPOSE) run --rm --no-deps -w /repo $(PHP_SERVICE) sh /tools/verify-release.sh /repo/release/basicrum.zip
+
+package-smoke: package
+	sh tools/smoke-test-release.sh release/basicrum.zip
 
 clean:
 	$(COMPOSE) down -v
-	rm -f basicrum.zip
 	rm -rf release

README.md

@@ -24,6 +24,7 @@ make integration
 make lint
 make translations
 make package
+make package-smoke
 ```
 
 ### Local WordPress
@@ -46,3 +47,22 @@ so HTTP beacon URLs are automatically upgraded to HTTPS.
 The WordPress plugin itself lives in `plugins/basicrum/`.
 
 If you want to work with Composer directly instead of using `make`, run commands from that directory.
+
+## Release Artifact
+
+`make package` builds `release/basicrum.zip`, generates
+`release/basicrum.zip.sha256`, and verifies that the archive contains the
+required runtime files without tests or other development files. The build runs
+`composer install --no-dev --classmap-authoritative` in a temporary directory,
+so the ZIP contains a fresh, optimized production autoloader without modifying
+the development checkout.
+
+Run `make package-smoke` before a release. It installs the generated ZIP into a
+fresh, isolated WordPress instance, activates it with WP-CLI, enables tracking,
+and requests both the Basicrum administration page and the frontend. The test
+also checks that the frontend loader is present and that neither request nor the
+WordPress logs contain PHP warnings or fatal errors.
+
+CI runs this same build and smoke-test path and retains both the ZIP and its
+SHA-256 checksum as workflow artifacts. Release and pre-release workflows attach
+both files to the GitHub release.

checklist.md

@@ -55,21 +55,21 @@ Acceptance criteria:
 
 ## 4. Make installation and release artifacts resilient
 
-- [ ] Handle a missing `vendor/autoload.php` without an uncaught PHP fatal error.
-- [ ] Provide a clear administrator-facing error or use a plugin-owned autoloading
+- [x] Handle a missing `vendor/autoload.php` without an uncaught PHP fatal error.
+- [x] Provide a clear administrator-facing error or use a plugin-owned autoloading
   strategy that does not require a generated `vendor` directory.
-- [ ] Move release packaging into one reusable script used by local builds and CI.
-- [ ] Build the exact release ZIP during CI.
-- [ ] Inspect the ZIP for required runtime files and excluded development files.
-- [ ] Install the ZIP into a clean WordPress instance.
-- [ ] Activate the packaged plugin through WP-CLI.
-- [ ] Render an admin request and a frontend request after activation.
-- [ ] Verify the frontend contains the expected loader when the plugin is enabled.
-- [ ] Generate and publish a SHA-256 checksum for release artifacts.
+- [x] Move release packaging into one reusable script used by local builds and CI.
+- [x] Build the exact release ZIP during CI.
+- [x] Inspect the ZIP for required runtime files and excluded development files.
+- [x] Install the ZIP into a clean WordPress instance.
+- [x] Activate the packaged plugin through WP-CLI.
+- [x] Render an admin request and a frontend request after activation.
+- [x] Verify the frontend contains the expected loader when the plugin is enabled.
+- [x] Generate and publish a SHA-256 checksum for release artifacts.
 
 Acceptance criteria:
 
-- [ ] The generated ZIP, rather than the source checkout, installs, activates, and
+- [x] The generated ZIP, rather than the source checkout, installs, activates, and
   serves requests without warnings or fatal errors.
 
 ## 5. Expand the compatibility matrix
@@ -156,5 +156,5 @@ Acceptance criteria:
 - [ ] Static analysis passes.
 - [ ] Composer validation and audit pass.
 - [ ] Generated asset checks pass.
-- [ ] The packaged ZIP smoke test passes.
+- [x] The packaged ZIP smoke test passes.
 - [ ] Version and repository convention checks pass.

docker-compose.yml

@@ -71,6 +71,7 @@ services:
     working_dir: /workspace
     volumes:
       - ./plugins/basicrum:/workspace
+      - ./:/repo
       - ./tools:/tools:ro
       - wp_tests_lib:/tmp/wordpress-tests-lib
       - wp_core:/tmp/wordpress

docker/release-smoke.yml

@@ -0,0 +1,47 @@
+services:
+  db:
+    image: mysql:8.0
+    command: --default-authentication-plugin=mysql_native_password
+    environment:
+      MYSQL_DATABASE: wordpress
+      MYSQL_USER: wordpress
+      MYSQL_PASSWORD: wordpress
+      MYSQL_ROOT_PASSWORD: root
+    healthcheck:
+      test: ["CMD", "mysqladmin", "ping", "-h", "127.0.0.1", "-proot"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+
+  wordpress:
+    image: wordpress:6.8-php8.2-apache
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      WORDPRESS_DB_HOST: db:3306
+      WORDPRESS_DB_NAME: wordpress
+      WORDPRESS_DB_USER: wordpress
+      WORDPRESS_DB_PASSWORD: wordpress
+    ports:
+      - "127.0.0.1::80"
+    volumes:
+      - wordpress_data:/var/www/html
+
+  wpcli:
+    image: wordpress:cli-2.12.0-php8.2
+    user: "33:33"
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      WORDPRESS_DB_HOST: db:3306
+      WORDPRESS_DB_NAME: wordpress
+      WORDPRESS_DB_USER: wordpress
+      WORDPRESS_DB_PASSWORD: wordpress
+    volumes:
+      - wordpress_data:/var/www/html
+      - "${BASICRUM_RELEASE_ZIP}:/artifacts/basicrum.zip:ro"
+
+volumes:
+  wordpress_data:

plugins/basicrum/.distignore

@@ -4,6 +4,8 @@
 /.vscode
 /tests
 /vendor/bin
+/vendor/**/.github
+/.distignore
 
 .phpunit.result.cache
 composer.json

plugins/basicrum/basicrum.php

@@ -23,11 +23,28 @@
 define( 'BASICRUM_PLUGIN_FILE', __FILE__ );
 define( 'BASICRUM_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
 
-// Load Composer autoloader.
-if ( file_exists( BASICRUM_PLUGIN_DIR . 'vendor/autoload.php' ) ) {
-	require_once BASICRUM_PLUGIN_DIR . 'vendor/autoload.php';
+// Load the optimized Composer autoloader included in release packages.
+$basicrum_autoloader = BASICRUM_PLUGIN_DIR . 'vendor/autoload.php';
+
+if ( ! is_readable( $basicrum_autoloader ) ) {
+	$basicrum_missing_autoloader_notice = static function () {
+		if ( ! current_user_can( 'activate_plugins' ) ) {
+			return;
+		}
+
+		printf(
+			'<div class="notice notice-error"><p>%s</p></div>',
+			esc_html__( 'Basicrum could not start because its Composer dependencies are missing. Reinstall the plugin from an official release ZIP.', 'basicrum' )
+		);
+	};
+
+	add_action( 'admin_notices', $basicrum_missing_autoloader_notice );
+	add_action( 'network_admin_notices', $basicrum_missing_autoloader_notice );
+	return;
 }
 
+require_once $basicrum_autoloader;
+
 // Bootstrap the plugin.
 $basicrum_plugin = new \Basicrum\WP\Plugin();
 $basicrum_plugin->register();