Repository navigation
Feature/update features - #1
Merged
Merged
Conversation
Package entries now declare GPL-2.0-or-later, the license of the WordPress archives they represent (distinct from this repository's MIT scripts). The license is set from a constant in buildEntry to prevent entries from ever carrying outdated values. 1342 existing entries have been backfilled.
Refactored constants, utilities, HTTP logic, version comparison, and packages file handling out of check-new-versions.js and generate-packages-json.js into separate modules for maintainability. Added dependency-free package.json with `npm test` using Node's built-in test runner, plus first offline tests for HTTP and version utilities. Behavior unchanged; both scripts work identically to the pre-refactor versions.
…functions Tests cover all validate/validateEntry violation codes, parseVersionPhp, metadataFromOffer/Sibling, buildEntry/storedFields/newFields, and asymmetricLines. generate-packages-json.js gains require.main guard and module.exports for testability; CLI behavior is unchanged.
…seams Enables running the gate script as a child process with environment-based configuration seams: - PACKAGES_FILE and VERSION_CHECK_URL for routing test data - DOWNLOAD_BASE_OVERRIDE for overriding archive probe base URL (test-only, never used for dist URLs) The gate now includes a require.main guard and exports functions for importing during tests.
…mode Package entries now include wordpress/core-implementation, source, description, homepage, support, and keywords fields, computed in buildEntry and validated in validateEntry for consistency. A new offline deterministic --backfill mode enables regeneration of packages.json without manual data entry. All 1342 versions (671 + 671) have been backfilled while preserving existing fields unchanged.
The git baseline reader used Node's default 1 MiB maxBuffer in execFileSync, which caused ENOBUFS when packages.json grew to ~1.46 MB. This error was silently treated as "no baseline available", disabling version invariant checks. Increase maxBuffer to 256 MiB to accommodate packages.json growth. Distinguish between legitimate "no baseline" cases (missing git/repo/HEAD/file) and actual read failures, which now throw an error instead of silently disabling checks. Add regression tests with >1 MiB baseline fixtures to prevent regression.
For each new version, download the archive and compute SHA-1 and MD5 locally, then compare against published .sha1 and .md5 files. A mismatch defers the version pair with CHECKSUM-MISMATCH reason; a missing .md5 is informational. Downloads are size-capped by content-length and by running total while streaming. Includes offline tests with mock HTTP server.
Adds audit-checksums.js script that re-fetches the .sha1 for each stored WordPress version and compares it with the published shasum, failing on mismatches or missing archives. Isolated network failures are treated as transient unless more than 10% of entries are unreachable. audit-checksums.yml workflow runs the audit every Monday and opens or comments on a GitHub issue on failure. Includes comprehensive offline tests.
Add issues:write permission and implement a step to automatically open an issue (or comment on an existing one with the same title) when the WordPress release watch update job fails.
Add attestation step for packages.json using actions/attest, pinned to v4.2.2. Only runs after confirming commit was pushed. Scopes id-token and attestations write permissions to the update job.
Clarify that no end-to-end guarantee is made on pickup time, and describe the actual chain: best-effort cron (~10 minutes), generator download and verification (few minutes), Pages rebuild (1–2 minutes), and CDN max-age=600 (up to 10 minutes). Point to job summary for observable measured lag.
… duplicate detection Add prerelease version parsing and comparison supporting X.Y-betaN and X.Y-RCN formats with stability ordering stable > RC > beta. Extend duplicate detection to treat "6.9-RC1" and "6.9.0-RC1" as equivalent. Validation accepts both stable and prerelease versions while maintaining stable-only behavior of VERSION_RE constant.
…handling The gate and generator now query wordpress.org's beta channel and merge its offers with the stable ones. Stable-channel offers win on version collision, ensuring stable versions remain authoritative. Any beta-channel failure is logged (BETA-CHANNEL-UNAVAILABLE) and never fails the run; stable-check enumeration remains stable-only, so prereleases only ever enter through offers. Tests include offline scenarios for beta channel fetch failures and offer merging. Test seams use environment variables (API_URL_OVERRIDE, STABLE_CHECK_URL_OVERRIDE) to point at local servers per test.
A pre-release missing the archive for one variant no longer blocks the other from being published. Pre-releases without a metadata source are now skipped instead of deferred, preventing permanently untagged versions from keeping the workflow red. Stable-version behavior unchanged. Includes comprehensive offline tests (T3.3).
…lags Adds guidance on installing pre-release versions (beta/RC) by setting minimum-stability or using explicit @rc flags. Also notes unverified behavior around whether wordpress.org publishes -no-content archives for pre-releases.
…ith byte-deterministic serialization Introduces lib/tag-composer.js with buildTagComposerJson and serializeTagComposerJson functions that produce the exact manifest to be published in each package's repository at tag time. Documents two key decisions made before any tag exists: keeping the explicit version field to match WordPress core's established Composer package layout, and accepting the long-standing undocumented Packagist behavior around dist.url/dist.shasum preservation rather than working around it. Task T7.1: library and tests only; no publisher or workflow yet.
Adds publish-packages.js (T7.2) to publish each package's untagged versions as one commit plus a lightweight tag per version to its own repository, in ascending order, idempotently, never force-pushing or deleting anything. Includes comprehensive end-to-end tests against real bare Git repositories. Skips variants without configured remotes and supports --dry-run mode.
… error sanitization Adds a third workflow job that publishes package version tags to variant repositories, gated on both PUBLISH_TOKEN configuration and an actual push in this run. The publisher authenticates plain GitHub HTTPS remotes with the token and forces stdio capture via a git() wrapper to prevent the token or raw git stderr from reaching logs. Errors are sanitized before propagation. Verified with comprehensive tests including a real subprocess scenario that confirms token containment in captured output. Job runs with read-only permissions outside the write concurrency group since it writes other repositories only.
…ure-Node validation Tests that the tag composer.json resolves correctly through Composer against a local repository when installed, loudly skips (never silently) when absent, and always validates both variants have required Composer fields with no null/empty values.
…s requirements and limitations
…m verification, auditing, and attestation
lib/status.js computes status.json and badges/*.json payloads from package data, with proper handling of latest/latestStable per variant and cross-variant versions. The WordPress badge always shows the stable version, never a prerelease. Includes offline tests covering edge cases, determinism, and file I/O.
Integrates status computation into the main generator: - Adds writeStatus() to generate status.json and badge files after each run (best-effort, never fails the run) - Adds selectPickup() to determine pickup lag from summaryRows - Adds --status CLI mode for offline verification (fails loudly on error) - Bootstraps status.json and badge files with pickup: null until observed - Reuses already-measured pickup lag rather than re-measuring it - Includes comprehensive tests for pickup selection logic
Introduces validate-badges.js to make real HTTP requests against every badge URL found in README.md and report whether each one genuinely renders. Native GitHub badges (Actions workflow badges) are checked directly; shields.io endpoint badges get two independent checks (the image endpoint itself and the underlying JSON endpoint) to distinguish shields.io outages from missing artifacts. The validator reports all failures without throwing, so one broken badge doesn't hide others. Also enhances http.js to capture content-type header for validation checks.
Implement weekly, non-gating badge validator modeled on checksum audit: schedule-based with manual dispatch option, opens or comments on issue on failure, never blocks commits or PRs. Document the validator in README next to badge source table.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.