kristianwindandClaude Opus 5
cc0aaf9272
`ci/bump-tested-up-to.sh` ran `git config user.name "compatibility check"` before committing. That writes .git/config and outlives the script, so from the first run onward every commit in that working copy is authored by "compatibility check <noreply@localhost>" with no Co-Authored-By trailer — including a release made by a person days later about something else. git announces an identity it cannot FIND and says nothing about one that is wrong, so the missing case is loud and this one is silent. Nothing fails, nothing warns, and the author is only visible to somebody reading `git log` for another reason. Measured across the family by the Nolimit Security session: six misattributed hand commits in one sibling including two releases, two in another, one in a third. This tree was clean — no local identity, 0 misattributed — and one run of the script away. The commit still signs itself as the robot, which is right: that one is not a person's. It just does it with `git -c … commit`, which configures the command and not the clone. Guarded in ci/static.sh, because the fix is one line and reverting it would be invisible for exactly as long as nobody reads an author field. Widened past what was reported: the pattern accepts any scope flag, since --global is the same fault one scope wider and reaches every repository on the box. Proven with a full matrix rather than one trigger — no flag, --local, --global and --system each go red with the named message and exit 1; a commented mention, `git -c user.name=… commit`, `git config core.autocrlf` and `git config --global core.pager` all stay green. The correct form being a control matters: a check that flagged the fix would get one of the two deleted. Five of those assertions are now in ci/selftest.sh (36 total), each with a landing check that the plant is in the file before its verdict is believed, and the passing line carries the script count — "every script is clean" reads the same over zero files as over eleven. ci/ ships nothing, so there is no version bump and no release here. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
85 lines
3.9 KiB
Bash
Executable File
85 lines
3.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Update "Tested up to" and "WC tested up to" to the versions that were just
|
|
# tested, and open a pull request if anything changed.
|
|
#
|
|
# Run only after the compatibility matrix has gone green against the current
|
|
# releases. The headers are a claim made to whoever installs the plugin — and
|
|
# in WooCommerce's case a banner the shop owner reads before deciding whether
|
|
# to update at all — so bumping them on a red build would be publishing a claim
|
|
# we have just watched fail.
|
|
#
|
|
# Writes nothing when the headers are already current, so a quiet week costs a
|
|
# green run and no noise.
|
|
set -euo pipefail
|
|
|
|
cd "$(dirname "$0")/.."
|
|
. ci/lib.sh
|
|
ci_load_conf
|
|
|
|
current_wp=$(curl -fsS --max-time 20 'https://api.wordpress.org/core/stable-check/1.0/' \
|
|
| tr ',' '\n' | sed -n -E 's/.*"([0-9][^"]*)"[[:space:]]*:[[:space:]]*"latest".*/\1/p' | head -1)
|
|
current_wc=$(curl -fsS --max-time 20 'https://api.wordpress.org/plugins/info/1.0/woocommerce.json' \
|
|
| sed -n -E 's/.*"version":"([^"]+)".*/\1/p' | head -1)
|
|
|
|
[ -n "$current_wp" ] || { echo "Could not read the current WordPress version." >&2; exit 1; }
|
|
|
|
readme=
|
|
for f in readme.txt README.txt; do [ -f "$f" ] && readme=$f && break; done
|
|
|
|
changed=()
|
|
|
|
if [ -n "$readme" ]; then
|
|
tested_wp=$(sed -n -E 's/^Tested up to:[[:space:]]*([^[:space:]]+).*/\1/p' "$readme" | head -1)
|
|
if [ "$tested_wp" != "$current_wp" ]; then
|
|
sed -i -E "s/^Tested up to:.*/Tested up to: $current_wp/" "$readme"
|
|
changed+=("WordPress ${tested_wp:-?} → $current_wp")
|
|
fi
|
|
fi
|
|
|
|
if [ "$NEEDS_WOOCOMMERCE" = yes ] && [ -n "$current_wc" ]; then
|
|
tested_wc=$(ci_plugin_header 'WC tested up to')
|
|
if [ "$tested_wc" != "$current_wc" ]; then
|
|
sed -i -E "s/^([[:space:]]*\*[[:space:]]*WC tested up to:).*/\1 $current_wc/" "$PLUGIN_MAIN"
|
|
[ -n "$readme" ] && sed -i -E "s/^WC tested up to:.*/WC tested up to: $current_wc/" "$readme"
|
|
changed+=("WooCommerce ${tested_wc:-?} → $current_wc")
|
|
fi
|
|
fi
|
|
|
|
if [ ${#changed[@]} -eq 0 ]; then
|
|
echo "The compatibility headers are already current — nothing to do."
|
|
exit 0
|
|
fi
|
|
|
|
# Re-read from disk rather than trusting the sed: a pattern that matched
|
|
# nothing would otherwise produce an empty, cheerful pull request.
|
|
for f in "$PLUGIN_MAIN" ${readme:+"$readme"}; do
|
|
git diff --quiet -- "$f" && continue
|
|
echo "--- $f"
|
|
git diff -- "$f" | sed -n '/^[+-][^+-]/p'
|
|
done
|
|
git diff --quiet && { echo "Nothing actually changed on disk — check the sed patterns." >&2; exit 1; }
|
|
|
|
branch="compat/tested-up-to-$current_wp-wc-$current_wc"
|
|
git checkout -b "$branch"
|
|
# The identity is scoped to THIS commit with `git -c`, never written to the
|
|
# clone. `git config user.name` persists in .git/config, so every later commit
|
|
# in this working copy — a release days afterwards, by a person — would be
|
|
# authored by the robot with no Co-Authored-By trailer. git announces a
|
|
# MISSING identity and says nothing about a wrong one, so that is silent.
|
|
# Signing this one commit as the robot is right: it is not a person's.
|
|
git -c user.name="compatibility check" -c user.email="noreply@localhost" \
|
|
commit -am "Tested against WordPress $current_wp and WooCommerce $current_wc
|
|
|
|
$(printf '%s\n' "${changed[@]}")
|
|
|
|
The compatibility matrix went green against these versions before this
|
|
was written, so the headers now say what was actually tested. WooCommerce
|
|
shows the 'WC tested up to' value to the shop owner as an untested-plugin
|
|
banner, which is what they read before deciding whether to press update."
|
|
|
|
git push -u origin "$branch"
|
|
|
|
gh pr create \
|
|
--title "Tested against WordPress $current_wp and WooCommerce $current_wc" \
|
|
--body "$(printf 'The weekly compatibility run passed against the current releases, so the headers are updated to match:\n\n%s\n\nOpened automatically by `ci/bump-tested-up-to.sh`. The versions here were tested before this PR existed; if the matrix had failed, the job that opens this would not have run.\n' "$(printf -- '- %s\n' "${changed[@]}")")"
|