The problem
This package requires johnpbloch/wp-cli-phar package and runs it via system call, but it doesn't explicitly call what was installed. Instead, it searches the whole project root for a file named wp. While this works for most cases, we have no guarantee the found file is WP-CLI we want to call. Additionally, unless the file belongs to whichever package's bin registration actually succeeded, it likely won't have the executable bit set, so it can't be run anyway
Also, executing any file named wp in the project directory feels slightly off from the security perspective.
Suggested solution
I suggest finding the exact path of WP-CLI executable with getInstallPath, and then calling it via PHP (since it is just a phar). This way we can avoid the problem with executable bit.
Alternatively, we could just run vendor/bin/wp since composer sets executable bit itself for files in that directory. But in this case we are not guaranteed to run johnpbloch's WP-CLI callable because another package's binary could occupy that path instead.
Context and additional info
There is a problem using this package in Wonolog.
First, Wonolog uses another package providing wp, so johnpbloch's gets skipped:
Skipped installation of bin wp for package johnpbloch/wp-cli-phar: name conflicts with an existing file
(see the workflow run) , and then a call to another WP-CLI binary fails:
PHP Warning: file_get_contents(phar://wp-cli.phar/vendor/wp-cli/wp-cli/templates/phar://vendor/globalis/wp-cli-bin/bin/wp/vendor/wp-cli/config-command/templates/wp-config.mustache): Failed to open stream: phar error: "vendor/wp-cli/wp-cli/templates/phar:/vendor/globalis/wp-cli-bin/bin/wp/vendor/wp-cli/config-command/templates/wp-config.mustache" is not a file in phar "wp-cli.phar" in phar:///home/runner/work/Wonolog/Wonolog/vendor/globalis/wp-cli-bin/bin/wp/vendor/wp-cli/wp-cli/php/utils.php on line 605
Script @php ./vendor/phpunit/phpunit/phpunit -c phpunit-integration-wp-phpunit.xml.dist --no-coverage handling the tests:integration:wp-phpunit event returned with error code 1
Error: Process completed with exit code 1.
(see the workflow run).
The problem
This package requires
johnpbloch/wp-cli-pharpackage and runs it via system call, but it doesn't explicitly call what was installed. Instead, it searches the whole project root for a file named wp. While this works for most cases, we have no guarantee the found file isWP-CLIwe want to call. Additionally, unless the file belongs to whichever package's bin registration actually succeeded, it likely won't have the executable bit set, so it can't be run anywayAlso, executing any file named wp in the project directory feels slightly off from the security perspective.
Suggested solution
I suggest finding the exact path of WP-CLI executable with getInstallPath, and then calling it via PHP (since it is just a phar). This way we can avoid the problem with executable bit.
Alternatively, we could just run
vendor/bin/wpsince composer sets executable bit itself for files in that directory. But in this case we are not guaranteed to run johnpbloch's WP-CLI callable because another package's binary could occupy that path instead.Context and additional info
There is a problem using this package in Wonolog.
First, Wonolog uses another package providing
wp, so johnpbloch's gets skipped:(see the workflow run) , and then a call to another WP-CLI binary fails:
(see the workflow run).