deployment.yml

name: Deployment

on:
  workflow_dispatch:
  push:
    branches:
      - main
      - release-**

jobs:

  build: #---------------------------------------------------------------------
    name: Build Phar
    runs-on: ubuntu-latest

    if: ${{ github.repository_owner == 'wp-cli' }}
    steps:
      - name: Check out source code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up PHP environment
        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
        with:
          php-version: 'latest'
          extensions: mysql, zip, imagick
          coverage: none
          tools: composer
        env:
          COMPOSER_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Composer dependencies & cache dependencies
        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # v4
        env:
          COMPOSER_ROOT_VERSION: 'dev-main'
        with:
          # Bust the cache at least once a month - output format: YYYY-MM-DD.
          custom-cache-suffix: $(date -u -d "-0 month -$(($(date +%d)-1)) days" "+%F")

      - name: Store WP-CLI version
        run: |
          CLI_VERSION=$(head -n 1 vendor/wp-cli/wp-cli/VERSION)
          if [[ $CLI_VERSION == *"-alpha"* ]]
          then
          	GIT_HASH=$(git rev-parse HEAD)
          	GIT_SHORT_HASH=${GIT_HASH:0:7}
          	CLI_VERSION="$CLI_VERSION-$GIT_SHORT_HASH"
          fi
          echo "CLI_VERSION=$CLI_VERSION" > $GITHUB_ENV
          echo "$CLI_VERSION" > cli_version.txt

      # The version and manifest uploads do not depend on the Phar, so they run
      # alongside the build instead of ahead of it.
      - parallel:
          - name: Upload WP-CLI version
            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
            with:
              name: cli_version
              path: cli_version.txt

          - name: Upload manifest file
            uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
            with:
              name: manifest
              path: vendor/wp-cli/wp-cli/manifest.json

          - name: Build the Phar file
            run: php -dphar.readonly=0 utils/make-phar.php wp-cli.phar --version=$CLI_VERSION

      - name: Upload built Phar file
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: wp-cli-phar
          path: wp-cli.phar

  test: #----------------------------------------------------------------------
    name: Functional - WP ${{ matrix.wp }} on PHP ${{ matrix.php }} with MySQL ${{ matrix.mysql }}
    strategy:
      fail-fast: false
      matrix:
        php: ['8.5', '7.4']
        wp: ['latest']
        mysql: ['8.0']
        include:
          - php: '7.4'
            wp: 'trunk'
            mysql: '5.6'
          - php: '7.4'
            wp: 'trunk'
            mysql: '5.7'
          - php: '7.4'
            wp: 'trunk'
            mysql: '8.0'
          - php: '8.5'
            wp: 'trunk'
            mysql: '8.0'
          - php: '8.5'
            wp: 'trunk'
            mysql: '5.7'
          - php: '8.5'
            wp: 'trunk'
            mysql: '5.6'
          - php: '7.2'
            wp: '4.9'
            mysql: '5.6'
          - php: '7.2'
            wp: '6.9'
            mysql: '8.0'
    runs-on: ubuntu-22.04
    env:
      WP_CLI_BIN_DIR: /tmp/wp-cli-phar
    needs: [build]

    if: ${{ github.repository_owner == 'wp-cli' }}
    steps:
      - name: Check out source code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      # Neither the database server nor the built Phar is needed until the tests
      # are prepared, so fetch both in the background while PHP and the Composer
      # dependencies are set up. The MySQL action only downloads its own
      # binaries, so it cannot contend with apt.
      - name: Setup MySQL Server
        id: setup-mysql
        background: true
        uses: shogo82148/actions-setup-mysql@1d4ebc60ba1227dd13fc7e6ba845bd3997928d75 # v1
        with:
          mysql-version: ${{ matrix.mysql }}
          auto-start: true
          root-password: root
          user: wp_cli_test
          password: password1
          my-cnf: |
            default_authentication_plugin=mysql_native_password

      - name: Download built Phar file
        background: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: wp-cli-phar

      - name: Install Ghostscript
        timeout-minutes: 10
        run: |
          sudo apt-get update
          sudo apt-get install ghostscript -y

      - name: Set up PHP environment
        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
        with:
          php-version: '${{ matrix.php }}'
          extensions: imagick, mysql, zip
          coverage: none
          tools: composer
        env:
          COMPOSER_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Composer dependencies & cache dependencies
        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # v4
        env:
          COMPOSER_ROOT_VERSION: 'dev-main'
        with:
          # Bust the cache at least once a month - output format: YYYY-MM-DD.
          custom-cache-suffix: $(date -u -d "-0 month -$(($(date +%d)-1)) days" "+%F")

      - name: Change ImageMagick policy to allow pdf->png conversion.
        run: |
          sudo sed -i 's/^.*policy.*coder.*none.*PDF.*//' /etc/ImageMagick-6/policy.xml

      - name: Wait for the MySQL server and the Phar download
        wait-all:

      - name: Prepare built Phar file for Behat tests
        run: |
          mkdir -p $WP_CLI_BIN_DIR
          mv wp-cli.phar $WP_CLI_BIN_DIR/wp
          chmod +x $WP_CLI_BIN_DIR/wp

      - name: Configure DB environment
        run: |
          echo "MYSQL_HOST=127.0.0.1" >> $GITHUB_ENV
          echo "MYSQL_TCP_PORT=3306" >> $GITHUB_ENV
          echo "WP_CLI_TEST_DBROOTUSER=root" >> $GITHUB_ENV
          echo "WP_CLI_TEST_DBROOTPASS=root" >> $GITHUB_ENV
          echo "WP_CLI_TEST_DBNAME=wp_cli_test" >> $GITHUB_ENV
          echo "WP_CLI_TEST_DBUSER=wp_cli_test" >> $GITHUB_ENV
          echo "WP_CLI_TEST_DBPASS=password1" >> $GITHUB_ENV
          echo "WP_CLI_TEST_DBHOST=127.0.0.1:3306" >> $GITHUB_ENV

      - name: Prepare test database
        run: composer prepare-tests

      - name: Check Behat environment
        run: WP_CLI_TEST_DEBUG_BEHAT_ENV=1 composer behat

      - name: Run Behat
        env:
          WP_VERSION: '${{ matrix.wp }}'
        run: composer behat || composer behat-rerun

  deploy: #-----------------------------------------------------------------------
    name: Deployment
    runs-on: ubuntu-latest
    needs: [build, test]

    if: ${{ github.repository_owner == 'wp-cli' && github.event_name != 'workflow_dispatch' }}
    steps:
      - name: Check out builds repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: wp-cli/builds
          token: ${{ secrets.ACTIONS_BOT }}

      - parallel:
          - name: Download WP-CLI version
            uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
            with:
              name: cli_version

          - name: Download manifest file
            uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
            with:
              name: manifest

          - name: Download built Phar file
            uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
            with:
              name: wp-cli-phar

      - name: Set new nightly version
        run: |
          cat cli_version.txt > phar/NIGHTLY_VERSION

      - name: Set file name for release branch
        if: ${{ contains(github.ref, 'release') }}
        run: |
          echo 'FILENAME=wp-cli-release.phar' >> $GITHUB_ENV
          echo 'MANIFEST_FILENAME=wp-cli-release.manifest.json' >> $GITHUB_ENV

      - name: Set file name for main branch
        if: ${{ contains(github.ref, 'main') }}
        run: |
          echo 'FILENAME=wp-cli-nightly.phar' >> $GITHUB_ENV
          echo 'MANIFEST_FILENAME=wp-cli-nightly.manifest.json' >> $GITHUB_ENV

      - name: Move manifest file into correct location
        run: |
          mv manifest.json phar/$MANIFEST_FILENAME

      - name: Move built Phar file into correct location
        run: |
          mv wp-cli.phar phar/$FILENAME

      - name: Make built Phar executable
        run: |
          chmod +x phar/$FILENAME

      - name : Create hashes
        run: |
          md5sum phar/$FILENAME | cut -d ' ' -f 1 > phar/$FILENAME.md5
          sha512sum phar/$FILENAME | cut -d ' ' -f 1 > phar/$FILENAME.sha512

      - name: Commit files
        run: |
          git config --local user.email "action@github.com"
          git config --local user.name "GitHub Action"
          git add phar/$FILENAME phar/$FILENAME.md5 phar/$FILENAME.sha512 phar/NIGHTLY_VERSION phar/$MANIFEST_FILENAME
          git commit -m "phar build: $GITHUB_REPOSITORY@$GITHUB_SHA"

      - name: Push changes
        uses: ad-m/github-push-action@881a6320fdb16eb5318c5054f31c218aec2b324c # v1
        with:
          github_token: ${{ secrets.ACTIONS_BOT }}
          branch: gh-pages
          repository: wp-cli/builds

  build-rpm: #-----------------------------------------------------------------------
    name: Build RPM package
    runs-on: ubuntu-latest
    if: ${{ contains(github.ref, 'release') && github.repository_owner == 'wp-cli' && github.event_name != 'workflow_dispatch' }}
    needs: [deploy]

    steps:
      # The RPM tooling comes from apt, which is slow and independent of the
      # checkouts and the Phar download, so install it in the background.
      - name: Install RPM build tooling
        background: true
        run: |
          sudo apt-get update
          sudo apt-get install rpm rpmlint -y

      - name: Check out builds repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: wp-cli/builds
          token: ${{ secrets.ACTIONS_BOT }}

      - name: Check out bundle repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ github.repository }}
          ref: ${{ github.sha }}
          path: bundle
          persist-credentials: false

      - name: Download built Phar file
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: wp-cli-phar

      - name: Copy RPM build configuration
        run: |
          cp bundle/utils/wp-cli-rpm.spec .
          cp bundle/utils/wp-cli-updaterpm.sh .

      - name: Wait for the RPM build tooling
        wait-all:

      - name: Build RPM package
        run: |
          bash wp-cli-updaterpm.sh

      - name: Verify built RPM package contents
        run: |
          set -euxo pipefail
          rpm_file="$(ls rpm-src/noarch/wp-cli-*.noarch.rpm)"
          # The package must ship a launcher in the bin dir and the Phar in the data dir.
          rpm -qlp "$rpm_file" | tee /tmp/rpm-files.txt
          grep -qx '/usr/bin/wp' /tmp/rpm-files.txt
          grep -qx '/usr/share/wp-cli/wp-cli.phar' /tmp/rpm-files.txt
          # /usr/bin/wp must be the shell launcher that honors WP_CLI_PHP / WP_CLI_PHP_ARGS,
          # not the Phar itself.
          mkdir -p rpm-verify
          ( cd rpm-verify && rpm2cpio "../$rpm_file" | cpio -idm )
          test -x rpm-verify/usr/bin/wp
          head -n1 rpm-verify/usr/bin/wp | grep -q '^#!/bin/sh'
          grep -q '/usr/share/wp-cli/wp-cli.phar' rpm-verify/usr/bin/wp
          test -s rpm-verify/usr/share/wp-cli/wp-cli.phar
          # Run the extracted launcher through a probe standing in for PHP: it must
          # forward WP_CLI_PHP_ARGS before the Phar and export WP_CLI_PHP_USED. The
          # probe asserts and exits without needing the Phar at its installed path.
          printf '%s\n' \
            '#!/bin/sh' \
            'case " $* " in' \
            '  *" -d memory_limit=256M "*) : ;;' \
            '  *) echo "WP_CLI_PHP_ARGS not forwarded: $*" >&2; exit 3 ;;' \
            'esac' \
            '[ -n "$WP_CLI_PHP_USED" ] || { echo "WP_CLI_PHP_USED not exported" >&2; exit 4; }' \
            'exit 0' \
            > /tmp/wp-cli-php-probe
          chmod +x /tmp/wp-cli-php-probe
          WP_CLI_PHP=/tmp/wp-cli-php-probe WP_CLI_PHP_ARGS="-d memory_limit=256M" rpm-verify/usr/bin/wp cli version

      - name: Copy RPM package into builds folder
        run: |
          cp -n rpm-src/noarch/wp-cli-*.noarch.rpm rpm

      - name: Commit files
        run: |
          git config --local user.email "action@github.com"
          git config --local user.name "GitHub Action"
          git add rpm
          git commit -m "rpm build: $GITHUB_REPOSITORY@$GITHUB_SHA"

      - name: Push changes
        uses: ad-m/github-push-action@881a6320fdb16eb5318c5054f31c218aec2b324c # v1
        with:
          github_token: ${{ secrets.ACTIONS_BOT }}
          branch: gh-pages
          repository: wp-cli/builds

  build-deb: #-----------------------------------------------------------------------
    name: Build DEB package
    runs-on: ubuntu-latest
    if: ${{ contains(github.ref, 'release') && github.repository_owner == 'wp-cli' && github.event_name != 'workflow_dispatch' }}
    needs: [build-rpm]

    steps:
      # The DEB tooling comes from apt, which is slow and independent of the
      # checkouts and the Phar download, so install it in the background.
      - name: Install DEB build tooling
        background: true
        run: |
          sudo apt-get update
          sudo apt-get install fakeroot lintian -y

      - name: Check out builds repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: wp-cli/builds
          token: ${{ secrets.ACTIONS_BOT }}

      - name: Check out bundle repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ github.repository }}
          ref: ${{ github.sha }}
          path: bundle
          persist-credentials: false

      - name: Download built Phar file
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: wp-cli-phar

      - name: Copy DEB build configuration
        run: |
          cp bundle/utils/wp-cli-updatedeb.sh .

      - name: Wait for the DEB build tooling
        wait-all:

      - name: Build DEB package
        run: |
          bash wp-cli-updatedeb.sh

      - name: Verify built DEB package contents
        run: |
          set -euxo pipefail
          deb_file="$(ls php-wpcli*all.deb)"
          # The package must ship a launcher in the bin dir and the Phar in the data dir.
          dpkg-deb -c "$deb_file" | tee /tmp/deb-files.txt
          grep -Eq ' \./usr/bin/wp$' /tmp/deb-files.txt
          grep -Eq ' \./usr/share/wp-cli/wp-cli.phar$' /tmp/deb-files.txt
          # Install the package and exercise the launcher (php ships on the runner).
          sudo dpkg -i "$deb_file" || sudo apt-get install -f -y
          test -x /usr/bin/wp
          head -n1 /usr/bin/wp | grep -q '^#!/bin/sh'
          test -s /usr/share/wp-cli/wp-cli.phar
          # Default interpreter works.
          wp --info
          wp cli version
          # A probe that stands in for PHP and asserts what the launcher forwarded:
          # it must receive WP_CLI_PHP_ARGS before the Phar and inherit WP_CLI_PHP_USED.
          printf '%s\n' \
            '#!/bin/sh' \
            'case " $* " in' \
            '  *" -d memory_limit=256M "*) : ;;' \
            '  *) echo "WP_CLI_PHP_ARGS not forwarded: $*" >&2; exit 3 ;;' \
            'esac' \
            '[ -n "$WP_CLI_PHP_USED" ] || { echo "WP_CLI_PHP_USED not exported" >&2; exit 4; }' \
            'exit 0' \
            > /tmp/wp-cli-php-probe
          chmod +x /tmp/wp-cli-php-probe
          # Proves WP_CLI_PHP selects the interpreter AND WP_CLI_PHP_ARGS reaches it.
          WP_CLI_PHP=/tmp/wp-cli-php-probe WP_CLI_PHP_ARGS="-d memory_limit=256M" wp cli version
          # A deliberately broken WP_CLI_PHP must actually be used: if it were ignored,
          # this would still succeed. This is the regression guard for the whole fix.
          if WP_CLI_PHP=/bin/false wp cli version 2>/dev/null; then
            echo "WP_CLI_PHP was ignored by the launcher" >&2
            exit 1
          fi

      - name: Copy DEB package into builds folder
        run: |
          cp -n php-wpcli*all.deb deb

      - name: Commit files
        run: |
          git config --local user.email "action@github.com"
          git config --local user.name "GitHub Action"
          git add deb
          git commit -m "deb build: $GITHUB_REPOSITORY@$GITHUB_SHA"

      - name: Push changes
        uses: ad-m/github-push-action@881a6320fdb16eb5318c5054f31c218aec2b324c # v1
        with:
          github_token: ${{ secrets.ACTIONS_BOT }}
          branch: gh-pages
          repository: wp-cli/builds