Update Testing Framework Consistent with Thold

[TheWitness]

Summary

This picks up PR #27 ("test: add Pest v1 security test infrastructure") and
updates its testing framework to be consistent with the model used by
Cacti/plugin_thold, while keeping
Pest as the test runner:

• Remove composer.json/composer.lock — Pest/PHPUnit no longer come from
  a vendor tree local to this plugin.
• Add tests/.cacti-version, tests/TestCase.php, and
  tests/bootstrap-unit.php (adapted from thold). bootstrap-unit.php
  verifies the Cacti checkout in CI matches tests/.cacti-version, requires
  Cacti's own Composer vendor autoloader, and stubs the Cacti global
  functions plugin source expects.
• Replace tests/bootstrap.php with tests/bootstrap-unit.php and update
  tests/Pest.php's comment to match.
• Update phpunit.xml to bootstrap from tests/bootstrap-unit.php, scope
  the testsuite to tests/Security, and declare covered source files.
• Add .github/copilot-instructions.md adapted from thold's for the
  Evidence plugin.

Test plan

• CI workflow (Pest Tests) builds the Cacti test image and runs Pest
  against tests/Security successfully.

[Copilot]

🟡 Changes recommended

Unresolved issues affect PHPUnit configuration, PHP 7.4 coverage, and Cacti bootstrap compatibility.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates Evidence’s testing infrastructure to use Cacti-managed Pest/PHPUnit tooling with pinned CI integration.

Changes:

• Adds Cacti-aware bootstrap, fixtures, and security tests.
• Adds PHPUnit configuration and Docker-based GitHub Actions testing.
• Removes plugin-local Composer dependencies and adds testing guidance.

File summaries

File	Description
tests/TestCase.php	Adds the PHPUnit base fixture.
tests/Security/SetupStructureTest.php	Tests plugin structure metadata.
tests/Security/Php74CompatibilityTest.php	Checks PHP 7.4 compatibility.
tests/Pest.php	Documents the test bootstrap configuration.
tests/bootstrap-unit.php	Adds Cacti runtime validation and test stubs.
tests/.cacti-version	Pins the Cacti runtime version.
phpunit.xml	Configures tests, bootstrap, and coverage.
.github/workflows/php-unit-tests.yml	Adds Docker-based Pest CI.
.github/copilot-instructions.md	Documents repository testing conventions.

Review details

Suppressed comments (5)

tests/Security/Php74CompatibilityTest.php:23

• These four text searches do not actually verify PHP 7.4 parse compatibility: union types, attributes, match, named arguments, constructor property promotion, and mixed are all PHP 8 syntax that these patterns miss. A source file can introduce one and this test will still pass; run php -l with a PHP 7.4 interpreter (or use a PHP parser) over the complete source set instead of relying on this allowlist.

	it('does not use str_contains (PHP 8.0)', function () use ($files) {

tests/bootstrap-unit.php:255

• The bootstrap defines the other poller verbosity constants but omits POLLER_VERBOSITY_HIGH, which include/functions.php::plugin_evidence_time_to_run() uses on every call. A class-based test that loads that source through the new helper will therefore throw an undefined-constant error instead of exercising the function; add the Cacti value for this constant.

if (!defined('POLLER_VERBOSITY_MEDIUM')) {
	define('POLLER_VERBOSITY_MEDIUM', 3);
}

tests/bootstrap-unit.php:131

• Cacti's db_fetch_cell() and db_fetch_cell_prepared() use false for a no-row result, while these test doubles return an empty string. That changes the missing-value contract and can make PHP 8 behavior differ between tests and production when a caller checks the result strictly or passes it to a typed/internal function. Use false as the default no-row value.

if (!function_exists('db_fetch_cell_prepared')) {
	function db_fetch_cell_prepared($sql, $params = array()) {
		return '';
	}

tests/bootstrap-unit.php:125

• Cacti's db_fetch_cell() returns false when no row, but this test double returns an empty string. Keeping the stub's sentinel consistent with Cacti is necessary so tests do not exercise a different missing-value contract; return false here as well.

if (!function_exists('db_fetch_cell')) {
	function db_fetch_cell($sql) {
		return '';
	}

tests/bootstrap-unit.php:263

• The value for POLLER_VERBOSITY_NONE does not match Cacti: Cacti uses NONE = 1 and reserves 6 for POLLER_VERBOSITY_DEVDBG. A test that exercises logging or compares verbosity levels will therefore observe the wrong production behavior. Define this constant as 1 (and add DEVDBG separately if needed).

if (!defined('POLLER_VERBOSITY_NONE')) {
	define('POLLER_VERBOSITY_NONE', 6);
}

• Files reviewed: 9/9 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.