From c3c79f07492c1a5b10df95d74d74de85ccab79e7 Mon Sep 17 00:00:00 2001 From: TheWitness Date: Sat, 7 Nov 2026 15:45:11 -0500 Subject: [PATCH 1/5] ci: add non-blocking PHP 8.5 and 8.6 matrix legs Mirror Cacti/cacti#8633: run PHP 8.5 and 8.6 as experimental (non-blocking) matrix legs via continue-on-error so bleeding-edge toolchain gaps do not turn CI red. PHP 8.5 is provisioned through shivammathur/setup-php as usual. PHP 8.6 is still pre-release and the setup-php nightly ships ABI-skewed bundled extensions, so the 8.6 leg provisions a coherent CLI from Ondrej Sury's PPA instead. The Ondrej PPA has no php8.6-xdebug build yet, so the patch-coverage gate (which needs a coverage driver) is skipped on the 8.6 leg only; the 8.5 leg keeps it via setup-php's xdebug. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/plugin-ci-workflow.yml | 51 +++++++++++++++++++++++- 1 file changed, 50 insertions(+), 1 deletion(-) diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml index 1313bd9e..011cd10b 100644 --- a/.github/workflows/plugin-ci-workflow.yml +++ b/.github/workflows/plugin-ci-workflow.yml @@ -45,12 +45,23 @@ jobs: integration-test: timeout-minutes: 45 runs-on: ${{ matrix.os }} + continue-on-error: ${{ matrix.experimental }} strategy: fail-fast: false matrix: php: ['8.2', '8.3', '8.4'] os: [ubuntu-latest] + experimental: [false] + include: + # PHP 8.5 and 8.6 run as non-blocking (experimental) legs because + # their packages can lag on the runners and in Ondřej Surý's PPA. + - php: '8.5' + os: ubuntu-latest + experimental: true + - php: '8.6' + os: ubuntu-latest + experimental: true services: mariadb: @@ -88,6 +99,7 @@ jobs: fetch-depth: 0 - name: Install PHP ${{ matrix.php }} + if: matrix.php != '8.6' uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ matrix.php }} @@ -96,6 +108,41 @@ jobs: coverage: xdebug ini-values: "post_max_size=256M, max_execution_time=60, date.timezone=America/New_York" + # PHP 8.6 is still pre-release. shivammathur/setup-php ships a nightly + # 8.6.0-dev build whose bundled extensions are ABI-skewed against their own + # core (undefined symbol: smart_str_ferealloc / _safe_femalloc), so every + # extension fails to load and the CLI install dies. Ondřej Surý's PPA + # provides a coherent 8.6 RC build, so this experimental leg provisions the + # CLI from there instead. + - name: Install PHP 8.6 toolchain from Ondřej Surý's PPA + if: matrix.php == '8.6' + run: | + set -euo pipefail + sudo add-apt-repository -y ppa:ondrej/php + sudo apt-get update + sudo apt-get install -y \ + php8.6-cli php8.6-common \ + php8.6-intl php8.6-mysql php8.6-gd php8.6-ldap \ + php8.6-gmp php8.6-xml php8.6-curl php8.6-mbstring \ + php8.6-snmp php8.6-sqlite3 + # Make the Ondřej 8.6 CLI the default `php` so composer and the tests + # run under the same ABI-coherent build. + sudo update-alternatives --install /usr/bin/php php /usr/bin/php8.6 86 + sudo update-alternatives --set php /usr/bin/php8.6 + # Mirror the ini values the other legs receive via setup-php. + printf '%s\n' \ + 'post_max_size=256M' \ + 'max_execution_time=60' \ + 'date.timezone=America/New_York' \ + | sudo tee /etc/php/8.6/cli/conf.d/99-cacti-ci.ini >/dev/null + # setup-php normally provides Composer; it is skipped for this leg, so + # make sure a Composer binary is available for the dependency steps. + if ! command -v composer >/dev/null 2>&1; then + sudo apt-get install -y composer + fi + php -v + composer --version + - name: Check PHP version run: php -v @@ -235,7 +282,9 @@ jobs: # inside a live Cacti. What is enforceable is that a change covers the # lines it adds. - name: Enforce coverage of changed lines - if: github.event_name == 'pull_request' + # PHP 8.6 installs from the Ondřej PPA, which has no matching xdebug + # build yet, so there is no coverage driver on that experimental leg. + if: github.event_name == 'pull_request' && matrix.php != '8.6' env: BASE_REF: ${{ github.event.pull_request.base.sha }} run: | From 3a6b1ee4f7c73f3536057834c5b1cbb0dae8e105 Mon Sep 17 00:00:00 2001 From: TheWitness Date: Sat, 7 Nov 2026 20:05:36 -0500 Subject: [PATCH 2/5] test: skip coverage-fragment assertion when no coverage driver (PHP 8.6) PHP 8.6 currently has no code-coverage driver available: Xdebug does not support 8.6 yet and there is no php8.6-xdebug package, so the subprocess in this guard test never writes coverage/clover-guard.xml (it only does so when xdebug_start_code_coverage() exists, as in tests/bin/coverage-prepend.php). Gate the clover-guard.xml existence assertion on the same condition that governs whether the fragment is written. On PHP 8.2-8.5 the setup-php xdebug driver is present, so the assertion runs and enforces the patch-coverage gate exactly as before; on 8.6 it is skipped while every other guard-routing assertion still runs. No production code changes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- tests/Unit/QueryBuilderGuardTest.php | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/tests/Unit/QueryBuilderGuardTest.php b/tests/Unit/QueryBuilderGuardTest.php index ce4b5222..6a27f6ab 100644 --- a/tests/Unit/QueryBuilderGuardTest.php +++ b/tests/Unit/QueryBuilderGuardTest.php @@ -117,8 +117,19 @@ ->and($report['alert_full_error'])->toBe('The structured query builder is unavailable.') ->and($report['removal'])->toBe([]) ->and($report['removal_error'])->toBe('The structured query builder is unavailable.') - ->and($report['normalize'])->toBe($document, 'The normalize guard must pass the raw document through.') - ->and(is_file(dirname(__DIR__, 2) . '/coverage/clover-guard.xml'))->toBeTrue('The guard fragment must be written for the patch-coverage gate.'); + ->and($report['normalize'])->toBe($document, 'The normalize guard must pass the raw document through.'); + + /* + * The subprocess writes the clover-guard fragment only when an + * xdebug code-coverage driver is available (see run.php above and + * tests/bin/coverage-prepend.php). PHP 8.6 currently ships no + * coverage driver (no xdebug/pcov build yet), so the fragment is + * never produced there. Assert it only when a driver is present, + * so 8.2-8.5 still enforce the patch-coverage gate unchanged. + */ + if (function_exists('xdebug_start_code_coverage')) { + expect(is_file(dirname(__DIR__, 2) . '/coverage/clover-guard.xml'))->toBeTrue('The guard fragment must be written for the patch-coverage gate.'); + } } finally { foreach (['includes/functions.php', 'includes/alarmmanager.php', 'run.php'] as $relative) { $file = $shim . '/' . $relative; From b7f736595cbf9a075bd9c907ec147ee3ba7690a1 Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Sat, 7 Nov 2026 19:00:28 -0800 Subject: [PATCH 3/5] fix(ci): run the poller with the shared RRD group Use the runner effective group alongside the www-data user so newly created RRD files match the existing CI directory ownership. Covers flat and structured RRD paths without changing directory modes or suppressing warnings. Signed-off-by: Thomas Vincent --- .github/workflows/plugin-ci-workflow.yml | 2 +- CHANGELOG.md | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml index 011cd10b..d447ae82 100644 --- a/.github/workflows/plugin-ci-workflow.yml +++ b/.github/workflows/plugin-ci-workflow.yml @@ -344,7 +344,7 @@ jobs: - name: Run Cacti Poller run: | cd ${{ github.workspace }}/cacti - sudo -u www-data php poller.php --poller=1 --force --debug + sudo runuser -u www-data -g runner -- php poller.php --poller=1 --force --debug if ! grep -q "SYSTEM STATS" log/cacti.log; then echo "Cacti poller did not finish successfully" cat log/cacti.log diff --git a/CHANGELOG.md b/CHANGELOG.md index 6ac11755..5e392cd3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ --- develop --- +* dev: Run the CI poller with the shared runner group so RRD files and structured directories pass permission verification * security: Add the Cacti request nonce to plugin script tags so pages comply with the Content-Security-Policy nonce migration * test: Extend the browser E2E run with import, reprocess, dashboard and long owner name paths, and make its login work on Cacti 1.2.x and develop From 6be7acac6bbfb89bd4277aef475dac75b350a7b1 Mon Sep 17 00:00:00 2001 From: TheWitness Date: Sun, 8 Nov 2026 10:15:04 -0500 Subject: [PATCH 4/5] ci: pin PHP 8.6 leg to ubuntu-24.04 ubuntu-latest has rolled to Ubuntu 26.04 (Resolute). Ondrej Surys Launchpad PPA (ppa:ondrej/php) has no Release file for the resolute suite yet (it is migrating to packages.sury.org), so apt-get update 404s and the experimental 8.6 PPA toolchain install dies with exit code 100. Pin the experimental 8.6 leg to ubuntu-24.04 (Noble), which still serves the latest packaged 8.6 release candidate from the PPA. The other legs use shivammathur/setup-php and are unaffected. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/plugin-ci-workflow.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml index d447ae82..857be119 100644 --- a/.github/workflows/plugin-ci-workflow.yml +++ b/.github/workflows/plugin-ci-workflow.yml @@ -59,8 +59,11 @@ jobs: - php: '8.5' os: ubuntu-latest experimental: true + # Pinned to Ubuntu 24.04 (Noble): ubuntu-latest is now Ubuntu 26.04 + # (Resolute), which Ondrej Sury's PPA does not yet serve, so the 8.6 + # PPA toolchain install 404s. Noble carries the latest packaged 8.6 RC. - php: '8.6' - os: ubuntu-latest + os: ubuntu-24.04 experimental: true services: From 09cb55b3bd71dc81531c336f818bfea73468a804 Mon Sep 17 00:00:00 2001 From: TheWitness Date: Sun, 8 Nov 2026 10:41:58 -0500 Subject: [PATCH 5/5] ci: make PHP 8.5 a required (non-experimental) matrix leg Move PHP 8.5 from the non-blocking experimental include leg into the required base matrix. 8.5 is a stable release provisioned via shivammathur/setup-php like the other required legs, so it no longer needs continue-on-error. Only PHP 8.6 (still a pre-release installed from Ondrej Surys PPA, pinned to ubuntu-24.04) remains experimental. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/plugin-ci-workflow.yml | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml index 857be119..9ad14740 100644 --- a/.github/workflows/plugin-ci-workflow.yml +++ b/.github/workflows/plugin-ci-workflow.yml @@ -50,15 +50,12 @@ jobs: strategy: fail-fast: false matrix: - php: ['8.2', '8.3', '8.4'] + php: ['8.2', '8.3', '8.4', '8.5'] os: [ubuntu-latest] experimental: [false] include: - # PHP 8.5 and 8.6 run as non-blocking (experimental) legs because - # their packages can lag on the runners and in Ondřej Surý's PPA. - - php: '8.5' - os: ubuntu-latest - experimental: true + # PHP 8.6 runs as a non-blocking (experimental) leg because + # its packages can lag on the runners and in Ondřej Surý's PPA. # Pinned to Ubuntu 24.04 (Noble): ubuntu-latest is now Ubuntu 26.04 # (Resolute), which Ondrej Sury's PPA does not yet serve, so the 8.6 # PPA toolchain install 404s. Noble carries the latest packaged 8.6 RC.