Repository navigation
Run EPV through the organization's strict EPV workflow - #90
Merged
Merged
Conversation
EPV exits 0 on Error findings, so they never failed this workflow, and pointing it at the extension folder gave a false "Packaging structure" error. EPV now runs in an epv job that calls phpbbmodders/.github's reusable EPV workflow (v1) on phpBB 3.3.x and master, which fails on any Fatal or Error finding not listed in .github/epv-allowed.txt. The test-framework calls get EPV: 0 so EPV doesn't run twice. The 29 htmlspecialchars($value, ENT_COMPAT, 'UTF-8') calls EPV flags now use utf8_htmlspecialchars($value), which is the same call. The calls that use ENT_QUOTES or ENT_XML1 on purpose, the JavaScript-string addslashes() in the search ACP, ext.php's unserialize() and four released migrations without revert_schema() are listed in .github/epv-allowed.txt with their reasons. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Switches the wiki's EPV (Extension Pre Validator) check to the organization's strict EPV workflow,
phpbbmodders/.github/.github/workflows/epv.yml@v1(phpbbmodders/.github#2), as piloted in phpbbmodders/contactadmin#46.Why
phpBB/ext/instead..github/epv-allowed.txt.Changes
tests.yml: both phpbb-extensions/test-framework calls (3.3.x and master) getEPV: 0, so EPV doesn't run twice. A newepvjob calls the shared workflow for phpBB 3.3.x and master, matching the extension's<4.1phpBB range.htmlspecialchars($value, ENT_COMPAT, 'UTF-8')calls in 12 files now use phpBB'sutf8_htmlspecialchars($value), which is exactly the same call, so output doesn't change..github/epv-allowed.txtfor the findings kept on purpose:htmlspecialcharswithENT_QUOTESinevent/wikilink_listener.php,wiki/markup.phpandwiki/templates.php(anchors, table of contents, link fragments), and withENT_NOQUOTES | ENT_XML1inwiki/discussion.php.utf8_htmlspecialchars()can't pass those flags.addslashesincontroller/acp_search.php: the progress-bar URL for a JavaScript string, as in phpBB 4.0's ownacp_search.php.unserializeinext.php: phpBB's own migration dependency lists and reparser resume point, read withallowed_classesoff when an old install is moved.update_0_2_0,update_0_3_0,update_0_3_1andupdate_0_3_2withoutrevert_schema(): they add columns towiki_article, whichinitial_module'srevert_schema()drops with the whole table. Released migrations must not be changed.Testing
Claude ran:
dev-master(on PHP 8.4, and on PHP 7.4 as the 3.3.x job does) and withdev-epv-phpbb4. Each time it reports 17 Errors, all in the allowlist, and the shared workflow's filter passes.php-lint.sh --stricton PHP 8.2 and 8.4 (the extension needs 8.2): clean.This PR's CI is the first run of the new job here.
Investigated and written by Claude on behalf of William Jacoby (bonelifer).
🤖 Generated with Claude Code