From 0e530c266d38bf4959beba3e3e173072c99ecad9 Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Mon, 12 Oct 2026 21:18:37 -0700 Subject: [PATCH 1/4] ci: pin fixtures and install locked shared test dependencies Signed-off-by: Thomas Vincent --- .github/workflows/flowview-query-go.yml | 2 ++ .github/workflows/plugin-ci-workflow.yml | 46 +++++++++++------------- CHANGELOG.md | 1 + 3 files changed, 23 insertions(+), 26 deletions(-) diff --git a/.github/workflows/flowview-query-go.yml b/.github/workflows/flowview-query-go.yml index 1b23fc5..1ea27d5 100644 --- a/.github/workflows/flowview-query-go.yml +++ b/.github/workflows/flowview-query-go.yml @@ -41,6 +41,8 @@ jobs: steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up Go uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml index 5a5a0c0..5262581 100644 --- a/.github/workflows/plugin-ci-workflow.yml +++ b/.github/workflows/plugin-ci-workflow.yml @@ -19,11 +19,20 @@ on: - main - develop +permissions: + contents: read + env: CACTI: 1.2.x + CACTI_REF: d6d230f712c0af1a0391646f65364950ebf131af # 1.2.x fixture + +concurrency: + group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: integration-test: + timeout-minutes: 45 runs-on: ${{ matrix.os }} strategy: @@ -34,7 +43,7 @@ jobs: services: mariadb: - image: mariadb:11.8 + image: mariadb:11.8@sha256:6422478cb8e159f080fb1d8ccf65101e26fe51385787fde7d16c3b165a331f15 env: MYSQL_ROOT_PASSWORD: cactiroot MYSQL_DATABASE: cacti @@ -54,13 +63,15 @@ jobs: - name: Checkout Cacti uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false repository: Cacti/cacti - ref: ${{ env.CACTI }} + ref: ${{ env.CACTI_REF }} path: cacti - name: Checkout flowview Plugin uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false path: cacti/plugins/flowview # patch-coverage.php diffs against the base branch below. fetch-depth: 0 @@ -69,6 +80,7 @@ jobs: uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: ${{ matrix.php }} + tools: composer:2.10.3 extensions: intl, mysql, gd, ldap, gmp, xml, curl, json, mbstring, snmp coverage: xdebug ini-values: "post_max_size=256M, max_execution_time=60, date.timezone=America/New_York" @@ -118,29 +130,11 @@ jobs: mysql "$MYSQL_AUTH_USR" cacti < ${{ github.workspace }}/cacti/cacti.sql mysql "$MYSQL_AUTH_USR" -e "INSERT INTO settings (name, value) VALUES ('path_php_binary', '/usr/bin/php')" cacti - - name: Validate composer files - run: | - cd ${{ github.workspace }}/cacti - if [ -f composer.json ]; then - composer validate --strict || true - fi - - - name: Install Composer Dependencies - run: | - cd ${{ github.workspace }}/cacti - if [ -f composer.json ]; then - sudo composer config --no-plugins allow-plugins.pestphp/pest-plugin true - sudo composer require --dev --no-progress --no-interaction "pestphp/pest: ^3" "pestphp/pest-plugin-drift: ^3.0" - sudo rm -f composer.lock - sudo composer install --dev --no-progress - fi - - - name: Restore vendor ownership for Pest - run: | - cd ${{ github.workspace }}/cacti - if [ -d include/vendor ]; then - sudo chown -R runner:runner include/vendor composer.lock - fi + - name: Install locked Cacti and plugin test dependencies + uses: Cacti/cacti/.github/actions/setup-plugin-dependencies@b1d8dd6a03a3c756a2b22dfe3a0c744b1f11116c + with: + cacti-directory: cacti + install-core-dev: 'false' - name: Create Cacti config.php run: | @@ -186,7 +180,7 @@ jobs: - name: Run Pest Unit Tests run: | cd ${{ github.workspace }}/cacti - include/vendor/bin/pest --configuration=plugins/flowview/phpunit.xml \ + "$CACTI_PEST_BIN" --configuration=plugins/flowview/phpunit.xml \ --coverage-clover=plugins/flowview/coverage/clover.xml # Whole-file coverage is meaningless here: most of the plugin only runs diff --git a/CHANGELOG.md b/CHANGELOG.md index 3ca11bc..656c009 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,7 @@ # Changelog --- develop --- +* security: Pin CI fixtures and shared test dependencies, disable persisted checkout credentials, and limit workflow permissions and runtime * issue: Shorten the graph drilldown button title from 'View NetFlow Traffic In Range' to 'NetFlow' so it reads cleanly as a label in Cacti's graph action menu * dev: Create the plugin's config.php from config.php.dist for the flowview install step in the integration-test workflow (removed immediately afterwards so the unit tests still run with no config file), so the install no longer fails with "needs configuration" From 9d721b3d36267e5cb22ac426ccb0466b1d5603f1 Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Mon, 12 Oct 2026 21:46:53 -0700 Subject: [PATCH 2/4] ci: fetch shared tooling through a pinned sparse checkout Signed-off-by: Thomas Vincent --- .github/workflows/plugin-ci-workflow.yml | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml index 5262581..16b88a9 100644 --- a/.github/workflows/plugin-ci-workflow.yml +++ b/.github/workflows/plugin-ci-workflow.yml @@ -130,8 +130,21 @@ jobs: mysql "$MYSQL_AUTH_USR" cacti < ${{ github.workspace }}/cacti/cacti.sql mysql "$MYSQL_AUTH_USR" -e "INSERT INTO settings (name, value) VALUES ('path_php_binary', '/usr/bin/php')" cacti + # Core's release archives exclude .github and tests. Fetch these paths + # through Git at the immutable helper revision instead of an Action archive. + - name: Checkout shared CI tooling + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: Cacti/cacti + ref: f3ff777992875740e4665fedfe2eff8335f5b894 + persist-credentials: false + path: ci-tools + sparse-checkout: | + .github/actions/setup-plugin-dependencies + tests/tools/plugin-harness + - name: Install locked Cacti and plugin test dependencies - uses: Cacti/cacti/.github/actions/setup-plugin-dependencies@b1d8dd6a03a3c756a2b22dfe3a0c744b1f11116c + uses: ./ci-tools/.github/actions/setup-plugin-dependencies with: cacti-directory: cacti install-core-dev: 'false' From 6d6b8849ace64a6e5b613b5d1ec04b69aebcd877 Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Sat, 17 Oct 2026 17:04:11 -0700 Subject: [PATCH 3/4] docs(changelog): list CI hardening as a dev entry Signed-off-by: Thomas Vincent --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 656c009..885ad97 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,7 +1,6 @@ # Changelog --- develop --- -* security: Pin CI fixtures and shared test dependencies, disable persisted checkout credentials, and limit workflow permissions and runtime * issue: Shorten the graph drilldown button title from 'View NetFlow Traffic In Range' to 'NetFlow' so it reads cleanly as a label in Cacti's graph action menu * dev: Create the plugin's config.php from config.php.dist for the flowview install step in the integration-test workflow (removed immediately afterwards so the unit tests still run with no config file), so the install no longer fails with "needs configuration" @@ -13,6 +12,7 @@ * issue: Prevent flow-capture from fatally erroring (TypeError in spl_object_hash) when flowview_db_check_reconnect() held a null shared-database handle; normalize a non-object connection to false so db_check_reconnect() checks and reconnects the default connection instead * dev: Measure CI coverage with xdebug instead of pcov so the plugin's own sources are instrumented (pcov auto-scopes to the Composer root and skipped cacti/plugins/, leaving the patch-coverage gate with nothing to measure) * dev: Enforce patch coverage of changed lines in CI and remove the inert COMPOSER_ROOT_VERSION env from the Pest step +* dev: Pin CI fixtures and shared test dependencies, disable persisted checkout credentials, and limit workflow permissions and runtime * issue#110: Add NAT (postNAT source/destination IP and port) support to the core raw flow schema, filters, and DNS resolution; see flowview_upgrade_nat_columns.php to backfill existing partitions * security: Add a version-safe CSP nonce (`plugin_flowview_csp_nonce()`) to every inline `