Skip to content
NeoWiki CI (PHP)

Gate GET /subject-labels by per-page read permission #2987

Sign in to view logs

Gate GET /subject-labels by per-page read permission

Gate GET /subject-labels by per-page read permission #2987

Workflow file for this run

.github/workflows/ci-php.yml at b1ca656
name: NeoWiki CI (PHP)
on:
workflow_dispatch:
push:
paths-ignore:
- '.github/workflows/ci-ts.yml'
- '.github/workflows/ci-redherb.yml'
- '.github/workflows/neo-ci-ts.yml'
- 'resources/**'
- 'Neo/neojs/**'
pull_request:
paths-ignore:
- '.github/workflows/ci-ts.yml'
- '.github/workflows/ci-redherb.yml'
- '.github/workflows/neo-ci-ts.yml'
- 'resources/**'
- 'Neo/neojs/**'
jobs:
test:
name: "PHPUnit: MW ${{ matrix.mw }}, PHP ${{ matrix.php }}"
strategy:
fail-fast: false
matrix:
include:
- mw: 'REL1_43'
php: '8.3'
runs-on: ubuntu-latest
env:
NEO4J_URL_OVERRIDE: bolt://neo4j:password@localhost:7689
NEO4J_URL_READ_OVERRIDE: bolt://mediawiki_read:mediawiki_read@localhost:7689
# Live QLever store for the SPARQL query system test. Overrides the dev-stack hostname in
# phpunit.xml.dist (PHPUnit <env> does not override an existing environment variable), so the test
# reaches the QLever the "Start QLever" step publishes on the runner's localhost.
QLEVER_TEST_URL: http://localhost:7019/
QLEVER_TEST_ACCESS_TOKEN: neowiki_test_token
services:
test_neo:
image: neo4j:enterprise
ports:
- 7689:7689
- 7475:7475
env:
NEO4J_ACCEPT_LICENSE_AGREEMENT: eval
NEO4J_AUTH: neo4j/password
NEO4J_server_bolt_listen__address: :7689
NEO4J_server_http_listen__address: :7475
options: --name test_neo --hostname test_neo
defaults:
run:
working-directory: mediawiki
steps:
- name: Setup PHP
uses: shivammathur/setup-php@v2
with:
php-version: ${{ matrix.php }}
extensions: mbstring, intl
tools: composer
- name: Disable Composer block-insecure
working-directory: ~
run: composer config --global audit.block-insecure false
- name: Cache MediaWiki
id: cache-mediawiki
uses: actions/cache@v5
with:
path: |
mediawiki
!mediawiki/extensions/
!mediawiki/vendor/
key: mw_${{ matrix.mw }}-php${{ matrix.php }}
- name: Cache Composer cache
uses: actions/cache@v5
with:
path: ~/.composer/cache
key: composer-php${{ matrix.php }}
- uses: actions/checkout@v6
with:
path: EarlyCopy
- name: Install MediaWiki
if: steps.cache-mediawiki.outputs.cache-hit != 'true'
working-directory: ~
run: bash EarlyCopy/.github/workflows/installMediaWiki.sh ${{ matrix.mw }} NeoWiki
- uses: actions/checkout@v6
with:
path: mediawiki/extensions/NeoWiki
- name: Load RedHerb test extension
run: echo 'wfLoadExtension( "RedHerb", "$IP/extensions/NeoWiki/tests/RedHerb/extension.json" );' >> LocalSettings.php
- run: composer update
- name: Wait for Neo4j
uses: iFaxity/wait-on-action@v1
with:
resource: http-get://localhost:7689
timeout: 60000
# QLever for the SPARQL query system test. It cannot be a `services:` container: its bring-up needs
# a multi-step entrypoint (build an empty index, then serve) that a service container cannot express
# (no command/args, only an image + options). So it is started explicitly, like the "Create neo4j
# user" docker step below. --persist-updates is omitted: the store is fresh per CI run and the test
# clears it, so keeping updates in memory is enough. The index is built in /tmp rather than the dev
# stack's /index: the image runs as a non-root user with no /index (the dev stack provides it via a
# volume), so a bare `docker run` must use an already-writable in-image path.
# --service-allowed-iri-prefixes disables SPARQL federation, matching the dev stack (see
# Docker/docker-compose.dev.yml): QLever allows every SERVICE IRI unless the option is given, and "-"
# is the documented deny-all value (an invalid prefix no IRI matches). No test federates.
- name: Start QLever
run: |
docker run -d --name test_qlever -p 7019:7019 -e QLEVER_ACCESS_TOKEN=neowiki_test_token \
--entrypoint /bin/bash docker.io/adfreiburg/qlever:latest -lc '
set -e
cd /tmp
: > data.nt
qlever-index -i neowiki -F nt -f data.nt
exec qlever-server -i neowiki -p 7019 -a "$QLEVER_ACCESS_TOKEN" -m 1G --service-allowed-iri-prefixes -'
- name: Run update.php
run: php maintenance/update.php --quick
- name: Create neo4j user
run: docker exec test_neo bash -c \
"echo \"CREATE USER mediawiki_read SET PASSWORD 'mediawiki_read' CHANGE NOT REQUIRED; GRANT ROLE reader TO mediawiki_read;\" | cypher-shell -u neo4j -p password -a bolt://localhost:7689"
- name: Wait for QLever
run: |
for i in $(seq 1 40); do
if curl -fsS -o /dev/null "http://localhost:7019/?query=SELECT%20%2A%20WHERE%20%7B%20%3Fs%20%3Fp%20%3Fo%20%7D%20LIMIT%201"; then
echo "QLever is serving"; exit 0
fi
sleep 2
done
echo "QLever did not become ready in time; dumping logs:"; docker logs test_qlever; exit 1
- name: Run PHPUnit
run: php tests/phpunit/phpunit.php -c extensions/NeoWiki/phpunit.xml.dist
phpcs:
name: "PHPCS with PHP 8.3"
runs-on: ubuntu-latest
steps:
- name: Setup PHP
uses: shivammathur/setup-php@v2
with:
php-version: 8.3
- name: Checkout NeoExtension
uses: actions/checkout@v6
- name: Install dependencies
run: composer install
- name: Run PHPCS
run: vendor/bin/phpcs -p -s --standard=phpcs.xml
PHPStan:
name: "PHPStan: MW ${{ matrix.mw }}, PHP ${{ matrix.php }}"
strategy:
matrix:
include:
- mw: 'REL1_43'
php: '8.3'
runs-on: ubuntu-latest
defaults:
run:
working-directory: mediawiki
steps:
- name: Setup PHP
uses: shivammathur/setup-php@v2
with:
php-version: ${{ matrix.php }}
extensions: mbstring, intl
tools: composer
- name: Disable Composer block-insecure
working-directory: ~
run: composer config --global audit.block-insecure false
- name: Cache MediaWiki
id: cache-mediawiki
uses: actions/cache@v5
with:
path: |
mediawiki
!mediawiki/extensions/
!mediawiki/vendor/
key: mw_${{ matrix.mw }}-php${{ matrix.php }}
- name: Cache Composer cache
uses: actions/cache@v5
with:
path: ~/.composer/cache
key: composer-php${{ matrix.php }}
- uses: actions/checkout@v6
with:
path: EarlyCopy
- name: Install MediaWiki
if: steps.cache-mediawiki.outputs.cache-hit != 'true'
working-directory: ~
run: bash EarlyCopy/.github/workflows/installMediaWiki.sh ${{ matrix.mw }} NeoWiki
- uses: actions/checkout@v6
with:
path: mediawiki/extensions/NeoWiki
- run: composer update
- name: Composer install
run: cd extensions/NeoWiki && composer install --no-progress --no-interaction --prefer-dist --optimize-autoloader
- name: PHPStan
run: cd extensions/NeoWiki && vendor/bin/phpstan analyze --configuration=phpstan.neon --memory-limit=2G
# Psalm:
# name: "Psalm: MW ${{ matrix.mw }}, PHP ${{ matrix.php }}"
#
# continue-on-error: true # TODO
#
# strategy:
# matrix:
# include:
# - mw: 'master'
# php: '8.3'
#
# runs-on: ubuntu-latest
#
# defaults:
# run:
# working-directory: mediawiki
#
# steps:
# - name: Setup PHP
# uses: shivammathur/setup-php@v2
# with:
# php-version: ${{ matrix.php }}
# extensions: mbstring, intl
# tools: composer
#
# - name: Cache MediaWiki
# id: cache-mediawiki
# uses: actions/cache@v5
# with:
# path: |
# mediawiki
# !mediawiki/extensions/
# !mediawiki/vendor/
# key: mw_${{ matrix.mw }}-php${{ matrix.php }}
#
# - name: Cache Composer cache
# uses: actions/cache@v5
# with:
# path: ~/.composer/cache
# key: composer-php${{ matrix.php }}
#
# - uses: actions/checkout@v6
# with:
# path: EarlyCopy
#
# - name: Install MediaWiki
# if: steps.cache-mediawiki.outputs.cache-hit != 'true'
# working-directory: ~
# run: bash EarlyCopy/.github/workflows/installMediaWiki.sh ${{ matrix.mw }} NeoWiki
#
# - uses: actions/checkout@v6
# with:
# path: mediawiki/extensions/NeoWiki
#
# - uses: actions/checkout@v6
# with:
# repository: ProfessionalWiki/Neo
# path: mediawiki/extensions/NeoWiki/Neo
# token: ${{ secrets.NEO_READ_FPAT }}
# # Expected to expire on Sep 12 2025
# # https://github.com/organizations/ProfessionalWiki/settings/secrets/actions/NEO_READ_FPAT (enter new value)
# # (Re)generate token with contents read access for Neo and NeoExtension at https://github.com/settings/tokens?type=beta
#
# - run: composer update
#
# - name: Composer install
# run: cd extensions/NeoWiki && composer install --no-progress --no-interaction --prefer-dist --optimize-autoloader
#
# - name: Psalm
# run: cd extensions/NeoWiki && vendor/bin/psalm --config=psalm.xml --no-diff