Repository navigation
Run EPV through the organization's strict EPV workflow - #46
Merged
Merged
Conversation
EPV exits 0 on Error findings, so they never failed this workflow, and pointing it at the extension folder gave a false "Packaging structure" error. The old EPV steps are replaced by an epv job that calls phpbbmodders/.github's reusable EPV workflow on phpBB 3.3 and 4.0, which fails on any Fatal or Error finding not listed in .github/epv-allowed.txt. The one allowed finding is the unserialize() in ext.php, which reads phpBB's own migration data with allowed_classes off. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
phpbbmodders/.github#2 is merged and tagged v1, so the pilot's pin to that PR's commit is replaced by the tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 19, 2026
Merged
Merged
Merged
This was referenced Oct 19, 2026
Merged
bonelifer
added a commit
to phpbbmodders/phpbb-ext-wiki
that referenced
this pull request
Oct 19, 2026
Switches the wiki's EPV (Extension Pre Validator) check to the organization's strict EPV workflow, `phpbbmodders/.github/.github/workflows/epv.yml@v1` (phpbbmodders/.github#2), as piloted in phpbbmodders/contactadmin#46. **Why** - EPV exits 0 unless it finds a Fatal problem, so its Error findings never failed this workflow. - Pointing EPV at the extension folder made it report a false "Packaging structure" error. The shared workflow points it at `phpBB/ext/` instead. - The shared workflow fails on any Fatal or Error finding that isn't listed, with a reason, in the extension's `.github/epv-allowed.txt`. **Changes** - `tests.yml`: both phpbb-extensions/test-framework calls (3.3.x and master) get `EPV: 0`, so EPV doesn't run twice. A new `epv` job calls the shared workflow for phpBB 3.3.x and master, matching the extension's `<4.1` phpBB range. - 29 `htmlspecialchars($value, ENT_COMPAT, 'UTF-8')` calls in 12 files now use phpBB's `utf8_htmlspecialchars($value)`, which is exactly the same call, so output doesn't change. - New `.github/epv-allowed.txt` for the findings kept on purpose: - `htmlspecialchars` with `ENT_QUOTES` in `event/wikilink_listener.php`, `wiki/markup.php` and `wiki/templates.php` (anchors, table of contents, link fragments), and with `ENT_NOQUOTES | ENT_XML1` in `wiki/discussion.php`. `utf8_htmlspecialchars()` can't pass those flags. - `addslashes` in `controller/acp_search.php`: the progress-bar URL for a JavaScript string, as in phpBB 4.0's own `acp_search.php`. - `unserialize` in `ext.php`: phpBB's own migration dependency lists and reparser resume point, read with `allowed_classes` off when an old install is moved. - Released migrations `update_0_2_0`, `update_0_3_0`, `update_0_3_1` and `update_0_3_2` without `revert_schema()`: they add columns to `wiki_article`, which `initial_module`'s `revert_schema()` drops with the whole table. Released migrations must not be changed. **Testing** Claude ran: - EPV locally on this branch with `dev-master` (on PHP 8.4, and on PHP 7.4 as the 3.3.x job does) and with `dev-epv-phpbb4`. Each time it reports 17 Errors, all in the allowlist, and the shared workflow's filter passes. - The wiki's PHPUnit suite on phpBB 3.3.x: 356 tests pass. - `php-lint.sh --strict` on PHP 8.2 and 8.4 (the extension needs 8.2): clean. This PR's CI is the first run of the new job here. --- Investigated and written by [Claude](https://www.anthropic.com/claude) on behalf of William Jacoby ([bonelifer](https://github.com/bonelifer)). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pilots the organization's strict EPV workflow (phpbbmodders/.github#2) on Contact Admin.
Stacked on #45. It targets
masterso this repository's CI runs, which means it also shows #45's commits until #45 is merged. After that it will be rebased ontomaster, leaving only the changes below.Changes
tests.yml: the "Setup EPV" and "Run EPV" steps, theEPVsetting and the EPV-only matrix values are replaced by anepvjob. It callsphpbbmodders/.github/.github/workflows/epv.ymlfor phpBB 3.3.x and master, which fails on any EPV Fatal or Error finding that isn't allowed. The basic-checks job keeps its code sniffer, image and executable-file checks, and its check names..github/epv-allowed.txtwith one entry, theunserialize()inext.php. It reads phpBB's own serialized migration dependency lists when moving an oldrmcgirr83/contactadmininstall, withallowed_classesoff, so no objects can be created..github/is already export-ignored, so the file isn't in release ZIPs..githubPR's commit (3dcf869) for this pilot. Before this is merged, it switches to@v1, once the.githubPR is merged and tagged.Testing
Claude ran the reusable workflow's steps locally in throwaway Docker containers on this branch. On phpBB 3.3.x with PHP 7.4 and phpBB master with PHP 8.2, the only Error finding is the allowed
unserialize, and the job passes. With the allowlist removed it fails. This PR's own CI run is the first run on GitHub.Investigated and written by Claude on behalf of William Jacoby (bonelifer).
🤖 Generated with Claude Code