Skip to content

Check a production install in CI, including Wordfence - #304

Merged
conatus merged 6 commits into
mainfrom
ccr-b2160b1f-production-ci
Nov 2, 2026
Merged

conatus merged 6 commits into
mainfrom
ccr-b2160b1f-production-ci

Conversation

@conatus

@conatus conatus commented Oct 19, 2026 •

Copy link
Copy Markdown
Member

Production installs were not covered by CI, so failures specific to Composer installs without development packages, production assets or Wordfence could pass development checks. This adds a production install workflow using the shared checks already on main.

Changes

  • Install Composer dependencies with the deployment flags (--no-dev --no-scripts), build production theme assets and set WP_ENV=production.
  • Activate the three production plugins: Safe SVG, Wordfence and WordPress Importer. Run the plugin, smoke, browser and PHP log checks against that install.
  • Enable PHP error logging and check both WordPress's debug log and the WordPress container logs. A failed Docker log read now fails the check and preserves its error output.
  • Let PHP-FPM write Wordfence's firewall folder in CI, where the runner owns the checkout.
  • Share one admin login between editor tests. E2E_DEV_SERVER=false tests the production build without starting the dev server or overwriting its assets.
  • Update the README and changelog to describe the current dependencies and checks.

Validation

  • PHP regression tests cover failed container-log reads with empty or partial output, clean logs, normal PHP-FPM output, container PHP warnings and WordPress debug-log warnings. Both failure cases reproduced the false success before the fix.
  • The existing plugin-checker regression tests cover failed environment lookups, failed plugin-list reads and a valid empty plugin list.
  • Local validation: Composer tests, Pint, Composer validation, ShellCheck and production workflow validation.
  • The development and production CI workflows run the plugin, smoke, browser and PHP log checks against fresh installs.

claude and others added 4 commits October 19, 2026 15:48
mnsami/composer-custom-directory-installer puts Carbon Fields in
web/app/vendor/, where its admin scripts and styles can be served. It
was a dev dependency, so the deploy's `composer install --no-dev` left it
out and installed Carbon Fields in vendor/, outside the web root, and the
admin's Carbon Fields assets returned 404. It is now a normal dependency.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H7mTobLooqmmxgZuJYAE8d
A new workflow installs the site the way deploy.yml deploys it: Composer
without dev packages, the production theme build, WP_ENV=production and
every plugin active, including Wordfence, which development turns off.
It runs the plugin, smoke, browser and PHP log checks against that.
It found the Carbon Fields install path fixed in the previous commit.

To support it:
- PHP logs errors to the wordpress container's output, as hosts do, and
  check-php-log.sh checks that as well as WordPress's debug log, which
  production doesn't write
- The browser tests can run without the dev server (E2E_DEV_SERVER=false),
  which would otherwise replace the production build in build/
- The browser tests log in once and share the session. A login on a fresh
  install with Wordfence active failed once in six runs, and couldn't be
  reproduced, so this cuts logins from three to one
- Wordfence's firewall folder is made writable by PHP-FPM, as the runner
  owns the checkout

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H7mTobLooqmmxgZuJYAE8d
Base automatically changed from ccr-b2160b1f-9ttju2 to main November 2, 2026 16:05
@conatus
conatus merged commit 0f7dcf6 into main Nov 2, 2026
4 checks passed
@conatus
conatus deleted the ccr-b2160b1f-production-ci branch November 2, 2026 16:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants