From 59679c8c9da50ec0c68b0155366696b01ae25cc7 Mon Sep 17 00:00:00 2001 From: Filip Ilic Date: Fri, 14 Aug 2026 10:55:17 +0200 Subject: [PATCH] Fix Plugin Check CI: remove stored Composer credential; bump action to v1.1.9 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replaces this branch's earlier attempts, all of which were dead ends: setup-php pinning, unsetting GITHUB_TOKEN, the WP-CLI nightly, and the @wordpress/env 11.5.0 pin. Two independent breakages: 1. "Your github oauth token for github.com contains invalid characters". This is INTERMITTENT — setup-php stores the run's ephemeral Actions token in ~/.composer/auth.json as a github-oauth credential, and Composer rejects it only when that particular token contains a character its validator dislikes (composer#12076). Roughly half of runs failed, which is why every previous "fix" appeared to work and then regressed: a single green run proves nothing here. Verified in run 31784727273 that GITHUB_TOKEN and COMPOSER_AUTH are already EMPTY at that point and the credential lives on disk, so clearing env vars cannot help. dist-archive-command is a public package needing no auth, so the fix is to delete the stored credential. Note the WP-CLI nightly used earlier is now actively harmful: it reports as wp-cli 3.0.0-alpha, while every released dist-archive-command requires wp-cli ^2 / ^2.13, so `wp package install` cannot resolve against it. 2. "Environment not initialized. Run `wp-env start` first." — fixed upstream in plugin-check-action v1.1.7 (WordPress/plugin-check-action#590); v1.1.9 also picks up the v1.1.8 bundle-regression fix. Since that landed upstream, the @wordpress/env 11.5.0 pin is dropped rather than carried forward. dist-archive-command stays at v3.1.0: newest release accepting wp-cli ^2. v3.2.x requires ^2.13, which has no stable release (latest is 2.12.0). Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/plugin-check.yml | 29 +++++++++++++++++++++++++++-- 1 file changed, 27 insertions(+), 2 deletions(-) diff --git a/.github/workflows/plugin-check.yml b/.github/workflows/plugin-check.yml index fe48df729..665629ce8 100644 --- a/.github/workflows/plugin-check.yml +++ b/.github/workflows/plugin-check.yml @@ -16,8 +16,28 @@ jobs: coverage: none tools: wp-cli + # setup-php stores the ephemeral Actions token in ~/.composer/auth.json + # as a github-oauth credential. Composer rejects that token whenever it + # happens to contain a character its validator dislikes ("Your github + # oauth token for github.com contains invalid characters", + # composer#12076), so this step failed on roughly half of all runs + # depending on the token minted for that run. + # + # dist-archive-command is a PUBLIC package and needs no auth, so the + # fix is to delete the stored credential before installing. Clearing + # the env vars alone does NOT work — they are already empty here, and + # the credential lives on disk (verified in run 31784727273). + # + # Do NOT switch to the WP-CLI nightly to dodge this: it reports as + # wp-cli 3.0.0-alpha, and every released dist-archive-command requires + # wp-cli ^2 / ^2.13, so the install cannot resolve against it. + # + # Pinned to v3.1.0 deliberately: newest release accepting wp-cli ^2. + # v3.2.x requires ^2.13, which has no stable release (latest is 2.12.0). - name: Install latest version of dist-archive-command - run: wp package install wp-cli/dist-archive-command:v3.1.0 + run: | + rm -f "$(composer config --global home 2>/dev/null)/auth.json" + wp package install wp-cli/dist-archive-command:v3.1.0 - name: Build plugin run: | @@ -25,8 +45,13 @@ jobs: mkdir build unzip ${{ github.event.repository.name }}.zip -d build + # v1.1.7 fixed the wp-env silent-startup failure ("Environment not + # initialized. Run `wp-env start` first.") that broke this job on newer + # runner images; v1.1.9 fixes a bundle regression in v1.1.8. Because + # that fix landed upstream, @wordpress/env needs no version pin here. + # https://github.com/WordPress/plugin-check-action/pull/590 - name: Run plugin check - uses: wordpress/plugin-check-action@v1.1.5 + uses: wordpress/plugin-check-action@v1.1.9 with: build-dir: './build/${{ github.event.repository.name }}' exclude-checks: |