Skip to content

Run EPV through the organization's strict EPV workflow - #48

Merged
bonelifer merged 2 commits into
masterfrom
strict-epv
Oct 19, 2026
Merged

bonelifer merged 2 commits into
masterfrom
strict-epv

Conversation

@bonelifer

Copy link
Copy Markdown
Contributor

Switches this extension's EPV (Extension Pre Validator) check to the organization's strict EPV workflow, phpbbmodders/.github/.github/workflows/epv.yml@v1 (phpbbmodders/.github#2), as piloted in phpbbmodders/contactadmin#46.

Why

  • EPV exits 0 unless it finds a Fatal problem, so its Error findings never failed this workflow.
  • Pointing EPV at the extension folder made it report a false "Packaging structure" error. The shared workflow points it at phpBB/ext/ instead.
  • The shared workflow fails on any Fatal or Error finding that isn't listed, with a reason, in the extension's .github/epv-allowed.txt.

Changes

  • tests.yml: phpbb-extensions/test-framework is called with EPV: 0, so it no longer runs EPV itself; its other checks are unchanged.
  • New epv job calling the shared workflow for phpBB 3.3.x.

Allowed EPV findings (new .github/epv-allowed.txt, each with its reason)

  • Error: Using htmlspecialchars in /event/banhammer_listener.php: The ban-domain value is escaped with ENT_QUOTES on purpose (see the comment above it); utf8_htmlspecialchars() would only use ENT_COMPAT.
  • Error: Using unserialize in /migrations/v101_data.php: Released migration: reads the extension's own banhammer_settings config_text from its previous version, with allowed_classes off. Released migrations must not be changed.

Testing

Claude ran EPV (phpbb/epv dev-master) locally on this branch, pointed at the folder containing phpbbmodders/banhammer. Its only Fatal or Error findings are the ones listed above, and the shared workflow's filter passes with this allowlist. This PR's CI is the first run of the new job here.


Investigated and written by Claude on behalf of William Jacoby (bonelifer).

🤖 Generated with Claude Code

bonelifer and others added 2 commits October 19, 2026 01:00
EPV exits 0 on Error findings, so they never failed this workflow, and
pointing it at the extension folder gave a false "Packaging structure"
error. EPV now runs in an epv job that calls phpbbmodders/.github's
reusable EPV workflow (v1), which fails on any Fatal or Error finding not
listed in .github/epv-allowed.txt.

.github/epv-allowed.txt lists this extension's justified findings, each
with its reason.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@bonelifer
bonelifer merged commit 88c9366 into master Oct 19, 2026
34 checks passed
@bonelifer
bonelifer deleted the strict-epv branch October 19, 2026 07:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant