test(compat): expand environment coverage

dknauss · dknauss · commit 7b6f766403b6 · 2026-03-23T01:41:41.000-06:00
Verified wp-env Apache + MariaDB behavior against installed @wordpress/env at node_modules/@wordpress/env/lib/runtime/docker/build-docker-compose-config.js.
diff --git a/.github/workflows/e2e-visual.yml b/.github/workflows/e2e-visual.yml
@@ -7,7 +7,7 @@ on:
 
 jobs:
   e2e-visual:
-    name: "E2E Visual Baselines (non-blocking)"
+    name: "E2E Visual Baselines (Apache + MariaDB, non-blocking)"
     runs-on: ubuntu-24.04
     timeout-minutes: 30
 
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
@@ -8,7 +8,7 @@ on:
 
 jobs:
   e2e-tests:
-    name: "E2E Tests (Playwright)"
+    name: "E2E Tests (Playwright, Apache + MariaDB)"
     runs-on: ubuntu-24.04
     timeout-minutes: 30
 
diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml
@@ -15,7 +15,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php: ['8.1', '8.2', '8.3', '8.4']
+        php: ['8.0', '8.1', '8.2', '8.3', '8.4']
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -39,7 +39,12 @@ jobs:
           restore-keys: ${{ runner.os }}-composer-
 
       - name: Install Composer dependencies
-        run: composer install --no-interaction --prefer-dist
+        run: |
+          if [ "${{ matrix.php }}" = "8.0" ]; then
+            composer install --no-interaction --prefer-dist --ignore-platform-req=php
+          else
+            composer install --no-interaction --prefer-dist
+          fi
 
       - name: Run unit tests
         run: composer test:unit
@@ -92,20 +97,70 @@ jobs:
           verbose: true
 
   integration-tests:
-    name: "Integration Tests (PHP ${{ matrix.php }}, WP ${{ matrix.wp }}, MS ${{ matrix.multisite }})"
+    name: "Integration Tests (PHP ${{ matrix.php }}, WP ${{ matrix.wp }}, MS ${{ matrix.multisite }}, ${{ matrix.db_label }})"
     runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
-        php: ['8.1', '8.3']
-        wp: ['6.7', '7.0-beta4']
-        multisite: [false, true]
+        include:
+          - php: '8.0'
+            wp: '6.2'
+            multisite: false
+            db_label: 'MySQL 8.0'
+            db_image: 'mysql:8.0'
+          - php: '8.1'
+            wp: '6.7'
+            multisite: false
+            db_label: 'MySQL 8.0'
+            db_image: 'mysql:8.0'
+          - php: '8.1'
+            wp: '6.7'
+            multisite: true
+            db_label: 'MySQL 8.0'
+            db_image: 'mysql:8.0'
+          - php: '8.3'
+            wp: '6.7'
+            multisite: false
+            db_label: 'MySQL 8.0'
+            db_image: 'mysql:8.0'
+          - php: '8.3'
+            wp: '6.7'
+            multisite: true
+            db_label: 'MySQL 8.0'
+            db_image: 'mysql:8.0'
+          - php: '8.1'
+            wp: '7.0-beta4'
+            multisite: false
+            db_label: 'MySQL 8.0'
+            db_image: 'mysql:8.0'
+          - php: '8.1'
+            wp: '7.0-beta4'
+            multisite: true
+            db_label: 'MySQL 8.0'
+            db_image: 'mysql:8.0'
+          - php: '8.3'
+            wp: '7.0-beta4'
+            multisite: false
+            db_label: 'MySQL 8.0'
+            db_image: 'mysql:8.0'
+          - php: '8.3'
+            wp: '7.0-beta4'
+            multisite: true
+            db_label: 'MySQL 8.0'
+            db_image: 'mysql:8.0'
+          - php: '8.1'
+            wp: '6.7'
+            multisite: false
+            db_label: 'MariaDB LTS'
+            db_image: 'mariadb:lts'
     services:
-      mysql:
-        image: mysql:8.0
+      db:
+        image: ${{ matrix.db_image }}
         env:
           MYSQL_ROOT_PASSWORD: root
           MYSQL_ALLOW_EMPTY_PASSWORD: 'yes'
+          MARIADB_ROOT_PASSWORD: root
+          MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: 'yes'
         ports:
           - 3306:3306
         options: >-
@@ -143,7 +198,12 @@ jobs:
           restore-keys: ${{ runner.os }}-composer-
 
       - name: Install Composer dependencies
-        run: composer install --no-interaction --prefer-dist
+        run: |
+          if [ "${{ matrix.php }}" = "8.0" ]; then
+            composer install --no-interaction --prefer-dist --ignore-platform-req=php
+          else
+            composer install --no-interaction --prefer-dist
+          fi
 
       - name: Install WordPress test suite
         run: bash bin/install-wp-tests.sh wordpress_test root root 127.0.0.1 ${{ matrix.wp }}
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -90,6 +90,21 @@ npm run test:e2e:local
 
 Use the local site's real admin credentials. `WP_BASE_URL` can be `http://` or `https://` depending on your local environment.
 
+For WordPress Studio, use the Studio site's localhost port directly. Studio is the
+recommended local path for SQLite-focused verification because it avoids pretending
+that the default `wp-env` Docker stack exercises SQLite:
+
+```bash
+WP_BASE_URL="http://localhost:8881" \
+WP_USERNAME="admin" \
+WP_PASSWORD="password" \
+npm run test:e2e:local
+```
+
+If you point Playwright at a Studio site, keep `WP_BASE_URL` and `WP_REQUEST_BASE_URL`
+on the same `localhost:<port>` origin unless you intentionally configured a custom
+domain for that Studio instance.
+
 To run the multisite network-admin regression against the `multisite-subdomains` Local site:
 
 ```bash
diff --git a/bin/install-wp-tests.sh b/bin/install-wp-tests.sh
@@ -21,14 +21,42 @@ MYSQLADMIN_BIN=""
 LOCAL_SOCKET_HOST_DETECTED=false
 
 download() {
-    if [ `which curl` ]; then
-        curl -sL "$1" > "$2";
-    elif [ `which wget` ]; then
-        wget -nv -O "$2" "$1"
-    else
-        echo "Error: Neither curl nor wget is installed."
-        exit 1
-    fi
+	local url="$1"
+	local destination="$2"
+	local tmp_destination="${destination}.tmp"
+	local attempt=1
+	local max_attempts=5
+	local sleep_seconds=2
+
+	while [ "$attempt" -le "$max_attempts" ]; do
+		rm -f "$tmp_destination"
+
+		if command -v curl > /dev/null 2>&1; then
+			if curl -fsSL --connect-timeout 15 --max-time 300 "$url" -o "$tmp_destination"; then
+				mv "$tmp_destination" "$destination"
+				return 0
+			fi
+		elif command -v wget > /dev/null 2>&1; then
+			if wget -q -T 30 -O "$tmp_destination" "$url"; then
+				mv "$tmp_destination" "$destination"
+				return 0
+			fi
+		else
+			echo "Error: Neither curl nor wget is installed."
+			exit 1
+		fi
+
+		if [ "$attempt" -lt "$max_attempts" ]; then
+			echo "Download failed (attempt $attempt/$max_attempts): $url"
+			sleep "$sleep_seconds"
+			sleep_seconds=$(( sleep_seconds * 2 ))
+		fi
+
+		attempt=$(( attempt + 1 ))
+	done
+
+	echo "Error: failed to download $url after $max_attempts attempts."
+	exit 1
 }
 
 # Check if svn is installed
@@ -153,7 +181,7 @@ elif [[ $WP_VERSION == 'nightly' || $WP_VERSION == 'trunk' ]]; then
 	WP_TESTS_TAG="trunk"
 else
 	# http serves a single offer, whereas https serves multiple. we only want one
-	download http://api.wordpress.org/core/version-check/1.7/ /tmp/wp-latest.json
+	download https://api.wordpress.org/core/version-check/1.7/ /tmp/wp-latest.json
 	grep '[0-9]+\.[0-9]+(\.[0-9]+)?' /tmp/wp-latest.json
 	LATEST_VERSION=$(grep -o '"version":"[^"]*' /tmp/wp-latest.json | sed 's/"version":"//')
 	if [[ -z "$LATEST_VERSION" ]]; then
diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md
@@ -110,7 +110,7 @@ All 5 phases shipped. Identified by independent assessments from Codex, Gemini,
 
 ### ✓ CI Matrix — ~~Phase A~~ ✅ Done v2.9.2
 
-- PHP 8.0–8.4, WP 6.7 + latest + trunk, single-site + multisite + PCOV coverage
+- PHP 8.0–8.4 for unit tests; targeted integration coverage for WordPress 6.2, 6.7, and 7.0-beta4; single-site + multisite + PCOV coverage
 
 ---
 
@@ -121,17 +121,18 @@ challenges and priorities for WP Sudo.
 
 Current project state (as of March 8, 2026):
 - Current test and size counts are centralized in [`docs/current-metrics.md`](docs/current-metrics.md).
-- CI pipeline: unit tests on PHP 8.1–8.4; integration tests on PHP 8.1 and 8.3; WordPress 6.7 + latest + trunk; single-site + multisite + PCOV coverage job
+- CI pipeline: unit tests on PHP 8.0–8.4; integration tests on PHP 8.0/8.1/8.3; WordPress 6.2, 6.7, and 7.0-beta4; single-site + multisite; MySQL 8.0 plus one MariaDB lane; PCOV coverage job
 - WordPress 7.0 Beta 2 tested (February 27, 2026); GA is April 9, 2026
 
 ---
 
 ## 1. Integration Tests — Scope and Value
 
 > **Status: Complete.** The integration test suite shipped in v2.4.0 (55 tests) and
-> expanded in v2.4.1 (73 tests). CI runs against PHP 8.1–8.4, WordPress latest +
-> trunk, single-site + multisite. The analysis below is preserved for context on
-> what drove the test design.
+> expanded in v2.4.1 (73 tests). CI now runs targeted compatibility lanes across
+> PHP 8.0/8.1/8.3 and WordPress 6.2, 6.7, and 7.0-beta4 with single-site +
+> multisite coverage. The analysis below is preserved for context on what drove
+> the test design.
 
 ### What unit tests cover well (no integration gap)
 - Request matching across all 7 surfaces (98 GateTest methods)
@@ -402,10 +403,10 @@ Local by Flywheel sites. Gaps remain in CI and broader hosting diversity.
 
 | Dimension | Current coverage | Gap |
 |-----------|-----------------|-----|
-| **Web server** | nginx (Studio, Local multisite-subdirectory) + Apache (Local single-site, Local multisite-subdomain) | Apache in CI (mod_php, FastCGI, FPM variants) |
-| **PHP version** | 8.0–8.4 (CI matrix), 8.2 (Local dev) | ✅ Covered — PHP 8.0 added to CI v2.9.2 |
-| **Database** | MySQL 8.0 (Local CI), SQLite (Studio) | MariaDB 10.x, MySQL 5.7 (legacy hosts) |
-| **WordPress version** | 6.7 + latest + trunk (CI), 6.9.1–7.0-beta2 (dev sites) | 6.2–6.6 still untested; 6.7+ now covered in CI |
+| **Web server** | Apache + MariaDB (`wp-env` Playwright CI), nginx + SQLite (Studio local), nginx/Apache + MySQL (Local manual) | nginx in automated CI; Apache variants beyond the default `wp-env` stack |
+| **PHP version** | 8.0–8.4 (unit CI), 8.0/8.1/8.3 (integration CI), 8.2 (Studio/wp-env local) | 8.2 and 8.4 are still missing from integration CI |
+| **Database** | MySQL 8.0 (integration CI), MariaDB LTS (`wp-env` CI + one integration lane), SQLite (Studio local) | automated SQLite CI, MariaDB matrix breadth, MySQL 5.7 legacy hosts |
+| **WordPress version** | 6.2 support-floor lane, 6.7 stable lane, 7.0-beta4 forward lane | 6.3–6.6 still untested in automation |
 | **OS** | macOS (dev), Ubuntu 24.04 (CI) | Windows (if any WP-CLI or path handling is OS-sensitive) |
 | **Hosting stack** | Bare local dev | Shared hosting (cPanel), managed WP (Pressable, WP Engine, Cloudways), containerized (Docker, Kubernetes) |
 
@@ -421,21 +422,20 @@ Local by Flywheel sites. Gaps remain in CI and broader hosting diversity.
   `json_validate()` (8.3+), readonly properties (8.2+).
 - **Database engine:** MariaDB and MySQL have subtle JSON and collation differences.
   The upgrader migration chain and option serialization could behave differently.
-- **Backward compat:** The plugin declares WordPress 6.2+ minimum. CI now tests
-  6.7, latest, and trunk. WP 6.2–6.6 remain untested — 6.7 is a reasonable floor
-  covering most active hosts.
+- **Backward compat:** The plugin declares WordPress 6.2+ minimum. CI now includes
+  a dedicated 6.2 floor lane, plus 6.7 and 7.0-beta4. WP 6.3–6.6 remain untested.
 
 ### Recommended approach
 
-**Phase A: Expand CI matrix** ✅ Done v2.9.2
+**Phase A: Expand CI matrix** ✅ Done v2.9.2, extended in v2.14.x
 
-CI matrix now covers PHP 8.0–8.4 (unit tests) and PHP 8.0/8.1/8.3 × WP 6.7/latest/trunk × single-site/multisite (18 integration runs). Further backward compat expansion (WP 6.2–6.6) can be added incrementally if 6.7 runs cleanly.
+CI matrix now covers PHP 8.0–8.4 for unit tests, a 6.2 support-floor integration lane on PHP 8.0, stable/forward integration lanes on PHP 8.1 and 8.3 for WordPress 6.7 and 7.0-beta4, and one dedicated MariaDB lane. Further backward compat expansion (WP 6.3–6.6) can be added incrementally if the 6.2 floor lane stays green.
 
-**Phase B: Apache + MariaDB CI job (medium effort)**
+**Phase B: Apache + MariaDB CI job** ✅ Covered by Playwright `wp-env`
 
-Add a separate CI job that runs on an Apache + MariaDB container instead of the
-default nginx + MySQL. This catches `.htaccess`-dependent behavior and MariaDB
-query differences.
+The Playwright workflow already runs against the default `wp-env` Docker stack,
+which is Apache + MariaDB. That lane is now named explicitly in CI so it is
+visible as an intentional compatibility signal rather than an accidental default.
 
 **Phase C: Manual testing matrix (low effort, recurring)**
 
diff --git a/docs/current-metrics.md b/docs/current-metrics.md
@@ -20,10 +20,10 @@ Verification environment: primary local repo checkout at `/Users/danknauss/Devel
 | Metric | Value | Verification |
 |---|---:|---|
 | Production PHP lines (`includes/`, `wp-sudo.php`, `uninstall.php`, `mu-plugin/`, `bridges/`) | 8,963 | `find ./includes ./wp-sudo.php ./uninstall.php ./mu-plugin ./bridges -type f -name "*.php" -print0 | xargs -0 wc -l | tail -1` |
-| Tests PHP lines (`tests/`) | 17,253 | `find ./tests -type f -name "*.php" -print0 | xargs -0 wc -l | tail -1` |
-| Production + tests PHP lines | 26,216 | sum of the two rows above |
-| Test-to-production ratio | 1.92:1 | `17253 / 8963` |
-| Total repo PHP lines (excluding `vendor/`, `vendor_test/`, `.tmp/`, `.git/`) | 26,273 | `find . -type f -name "*.php" ! -path "*/vendor/*" ! -path "*/vendor_test/*" ! -path "*/.tmp/*" ! -path "*/.git/*" -print0 | xargs -0 wc -l | tail -1` |
+| Tests PHP lines (`tests/`) | 17,290 | `find ./tests -type f -name "*.php" -print0 | xargs -0 wc -l | tail -1` |
+| Production + tests PHP lines | 26,253 | sum of the two rows above |
+| Test-to-production ratio | 1.93:1 | `17290 / 8963` |
+| Total repo PHP lines (excluding `vendor/`, `vendor_test/`, `.tmp/`, `.git/`) | 26,310 | `find . -type f -name "*.php" ! -path "*/vendor/*" ! -path "*/vendor_test/*" ! -path "*/.tmp/*" ! -path "*/.git/*" -print0 | xargs -0 wc -l | tail -1` |
 
 ## Architectural Facts
 
@@ -41,7 +41,7 @@ the count in prose without a verification command.
 | Audit hooks | 9 | `grep -c "do_action.*wp_sudo_" includes/class-*.php \| awk -F: '{sum+=$2} END{print sum}'` | v2.11.0 |
 | Settings fields (base) | 5 | 1 numeric (duration) + 4 policy dropdowns (REST, CLI, Cron, XML-RPC) | v2.0.0 |
 | Settings fields (with WPGraphQL) | 6 | +1 conditional WPGraphQL policy dropdown | v2.5.0 |
-| E2E tests | 45 | `npx playwright test --config tests/e2e/playwright.config.ts --list` | unreleased |
+| E2E tests | 47 | `npx playwright test --config tests/e2e/playwright.config.ts --list` | unreleased |
 
 ### Files that reference these counts
 
@@ -61,8 +61,8 @@ value across these known consumers:
 
 Source: `.github/workflows/phpunit.yml`
 
-- Unit test matrix: PHP 8.1, 8.2, 8.3, 8.4
-- Integration matrix: PHP 8.1 and 8.3; WordPress 6.7 and 7.0-beta4; multisite true/false
+- Unit test matrix: PHP 8.0, 8.1, 8.2, 8.3, 8.4
+- Integration matrix: PHP 8.0, 8.1, 8.3; WordPress 6.2, 6.7, 7.0-beta4; MySQL 8.0 plus one MariaDB LTS lane; multisite true/false on the main MySQL lanes
 
 ## Verification Notes
 
diff --git a/tests/e2e/fixtures/wp-sudo-e2e-public-api.php b/tests/e2e/fixtures/wp-sudo-e2e-public-api.php
@@ -0,0 +1,37 @@
+<?php
+/**
+ * Test-only mu-plugin for E2E coverage of wp_sudo_require().
+ *
+ * @package WP_Sudo
+ */
+
+if ( ! defined( 'ABSPATH' ) ) {
+	exit;
+}
+
+add_action(
+	'admin_init',
+	static function (): void {
+		if ( ! is_admin() || ! isset( $_GET['wp_sudo_require_test'] ) ) {
+			return;
+		}
+
+		if (
+			! wp_sudo_require(
+				array(
+					'rule_id'    => 'e2e.public_api.require',
+					'return_url' => admin_url( '?wp_sudo_require_test=1' ),
+				)
+			)
+		) {
+			return;
+		}
+
+		add_action(
+			'admin_notices',
+			static function (): void {
+				echo '<div id="wp-sudo-e2e-public-api-ok" class="notice notice-success"><p>Public API require passed.</p></div>';
+			}
+		);
+	}
+);
diff --git a/tests/e2e/specs/public-api.spec.ts b/tests/e2e/specs/public-api.spec.ts
