hardening: run the test suite, and add CodeQL

.github/workflows/codeql.yml

@@ -0,0 +1,60 @@
+# +-------------------------------------------------------------------------+
+# | Copyright (C) 2004-2026 The Cacti Group                                 |
+# +-------------------------------------------------------------------------+
+# | Cacti: The Complete RRDtool-based Graphing Solution                     |
+# +-------------------------------------------------------------------------+
+# | http://www.cacti.net/                                                   |
+# +-------------------------------------------------------------------------+
+#
+# CodeQL has no PHP analysis, so this covers the plugin JavaScript only.  Nothing in
+# CI performs taint analysis on the PHP: plugin-ci-workflow.yml runs a parser check
+# and an install smoke test, neither of which tracks a value from request to sink.
+
+name: "CodeQL"
+
+on:
+  push:
+    branches: [main, develop]
+    paths-ignore:
+      - "**/*.md"
+  pull_request:
+    branches: [main, develop]
+    paths-ignore:
+      - "**/*.md"
+  schedule:
+    - cron: "30 1 * * 1"
+  workflow_dispatch:
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["javascript-typescript"]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3
+        with:
+          languages: ${{ matrix.language }}
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/plugin-ci-workflow.yml

@@ -19,19 +19,116 @@
 # | http://www.cacti.net/                                                   |
 # +-------------------------------------------------------------------------+
 
-name: Plugin Integration Tests
+name: Monitor CI
 
 on:
   push:
     branches:
       - main
       - develop
+    paths:
+      - '**.php'
+      - '.github/workflows/**'
+      - 'phpunit.xml.dist'
+      - 'tests/**'
   pull_request:
     branches:
       - main
       - develop
+    paths:
+      - '**.php'
+      - '.github/workflows/**'
+      - 'phpunit.xml.dist'
+      - 'tests/**'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: monitor-ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
+  # The plugin ships tests that nothing ran: three files under tests/ that pass
+  # from a plain PHP CLI.  They cover request-variable output escaping, which is
+  # the class of defect most likely to regress here.
+  # A duplicate key or schema error stops GitHub loading the file, which
+  # presents as a workflow that silently never runs.  Catch it here instead.
+  workflow-lint:
+    name: Workflow syntax
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout Monitor Plugin
+      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+
+    - name: Run actionlint
+      uses: docker://rhysd/actionlint@sha256:887a259a5a534f3c4f36cb02dca341673c6089431057242cdc931e9f133147e9
+      with:
+        args: -color
+
+  unit-test:
+    name: Pest using Cacti Composer (Docker)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+    - name: Checkout monitor Plugin
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+    - name: Checkout Cacti runtime
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      with:
+        repository: Cacti/cacti
+        # Commit behind the annotated release/1.2.31 tag.
+        ref: 1e8eaca26b84b128c39ce8cc8ece42d7ff76aac1
+        path: cacti-runtime
+
+    - name: Checkout Cacti test toolchain
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      with:
+        repository: Cacti/cacti
+        # Pins Composer, Pest, the lock file and Cacti's Docker test image.
+        ref: 298bd51eca843490fb90b27ada6b3fecc9b9a7d8
+        path: cacti-toolchain
+
+    # The same image Cacti's own tests/tools/docker_pest.sh builds. Composer and
+    # Pest come from Cacti's locked toolchain, so the plugin ships no
+    # composer.json and no parallel vendor directory.
+    - name: Build Cacti test image
+      run: |
+        docker build --tag cacti-web --file cacti-toolchain/docker/Dockerfile cacti-toolchain/docker
+        docker build --tag cacti-monitor-test --file cacti-toolchain/docker/Dockerfile.test cacti-toolchain
+
+    - name: Run Pest
+      run: |
+        docker run --rm \
+          --volume "$PWD/cacti-runtime":/cacti \
+          --volume "$PWD":/cacti/plugins/monitor \
+          --user root \
+          --entrypoint composer cacti-monitor-test \
+          test -- --configuration=/cacti/plugins/monitor/phpunit.xml.dist
+
+  syntax-floor:
+    name: PHP 8.0 syntax floor
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout monitor Plugin
+      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+
+    - name: Install PHP 8.0
+      uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 # v2
+      with:
+        php-version: '8.0'
+
+    - name: Lint every PHP file
+      run: |
+        if find . -path ./vendor -prune -o -name '*.php' -print0 \
+          | xargs -0 -n1 php -l 2>&1 | grep -iv 'no syntax errors detected'; then
+          echo "Syntax errors found at the declared PHP floor"
+          exit 1
+        fi
+
   integration-test:
     runs-on: ${{ matrix.os }}
 
@@ -43,7 +140,7 @@ jobs:
 
     services:
       mariadb:
-        image: mariadb:10.6
+        image: mariadb:10.11
         env:
           MYSQL_ROOT_PASSWORD: cactiroot
           MYSQL_DATABASE: cacti
@@ -61,18 +158,19 @@ jobs:
 
     steps:
     - name: Checkout Cacti
-      uses: actions/checkout@v5
+      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
       with:
         repository: Cacti/cacti
+        ref: release/1.2.31
         path: cacti
 
     - name: Checkout Monitor Plugin
-      uses: actions/checkout@v5
+      uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
       with:
         path: cacti/plugins/monitor
 
     - name: Install PHP ${{ matrix.php }}
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 # v2
       with:
         php-version: ${{ matrix.php }}
         extensions: intl, mysql, gd, ldap, gmp, xml, curl, json, mbstring
@@ -81,11 +179,10 @@ jobs:
     - name: Check PHP version
       run: php -v
 
-    - name: Run apt-get update
-      run: sudo apt-get update
-
     - name: Install System Dependencies
-      run: sudo apt-get install -y apache2 snmp snmpd rrdtool fping libapache2-mod-php
+      run: |
+        sudo apt-get update
+        sudo apt-get install --yes --no-install-recommends apache2 snmp snmpd rrdtool fping libapache2-mod-php
 
     - name: Start SNMPD Agent and Test
       run: |
@@ -95,40 +192,37 @@ jobs:
     - name: Setup Permissions
       run: |
         sudo chown -R www-data:runner ${{ github.workspace }}/cacti
-        sudo find ${{ github.workspace }}/cacti -type d -exec chmod 775 {} \;
-        sudo find ${{ github.workspace }}/cacti -type f -exec chmod 664 {} \;
+        sudo find ${{ github.workspace }}/cacti -type d -exec chmod 775 {} +
+        sudo find ${{ github.workspace }}/cacti -type f -exec chmod 664 {} +
         sudo chmod +x ${{ github.workspace }}/cacti/cmd.php
         sudo chmod +x ${{ github.workspace }}/cacti/poller.php
 
-    - name: Create MySQL Config
-      run: |
-        echo -e "[client]\nuser = root\npassword = cactiroot\nhost = 127.0.0.1\n" > ~/.my.cnf
-        cat ~/.my.cnf
-
     - name: Initialize Cacti Database
       env:
-        MYSQL_AUTH_USR: '--defaults-file=~/.my.cnf'
+        MYSQL_PWD: cactiroot
       run: |
-        mysql $MYSQL_AUTH_USR -e 'CREATE DATABASE IF NOT EXISTS cacti;'
-        mysql $MYSQL_AUTH_USR -e "CREATE USER IF NOT EXISTS 'cactiuser'@'localhost' IDENTIFIED BY 'cactiuser';"
-        mysql $MYSQL_AUTH_USR -e "GRANT ALL PRIVILEGES ON cacti.* TO 'cactiuser'@'localhost';"
-        mysql $MYSQL_AUTH_USR -e "GRANT SELECT ON mysql.time_zone_name TO 'cactiuser'@'localhost';"
-        mysql $MYSQL_AUTH_USR -e "FLUSH PRIVILEGES;"
-        mysql $MYSQL_AUTH_USR cacti < ${{ github.workspace }}/cacti/cacti.sql
-        mysql $MYSQL_AUTH_USR -e "INSERT INTO settings (name, value) VALUES ('path_php_binary', '/usr/bin/php')" cacti
+        mysql --host=127.0.0.1 --user=root -e 'CREATE DATABASE IF NOT EXISTS cacti;'
+        mysql --host=127.0.0.1 --user=root -e "CREATE USER IF NOT EXISTS 'cactiuser'@'localhost' IDENTIFIED BY 'cactiuser';"
+        mysql --host=127.0.0.1 --user=root -e "GRANT ALL PRIVILEGES ON cacti.* TO 'cactiuser'@'localhost';"
+        mysql --host=127.0.0.1 --user=root -e "GRANT SELECT ON mysql.time_zone_name TO 'cactiuser'@'localhost';"
+        mysql --host=127.0.0.1 --user=root -e "FLUSH PRIVILEGES;"
+        mysql --host=127.0.0.1 --user=root cacti < ${{ github.workspace }}/cacti/cacti.sql
+        mysql --host=127.0.0.1 --user=root -e "INSERT INTO settings (name, value) VALUES ('path_php_binary', '/usr/bin/php')" cacti
 
     - name: Validate composer files
       run: |
         cd ${{ github.workspace }}/cacti
         if [ -f composer.json ]; then
-          composer validate --strict || true
+          composer validate --no-check-publish
         fi
 
     - name: Install Composer Dependencies
       run: |
         cd ${{ github.workspace }}/cacti
         if [ -f composer.json ]; then
-          sudo composer install --prefer-dist --no-progress
+          # Cacti core ships no composer.lock and declares no scripts, so nothing
+          # is lost by refusing to run package-supplied code as root.
+          sudo composer install --prefer-dist --no-interaction --no-progress --no-plugins --no-scripts
         fi
 
     - name: Create Cacti config.php
@@ -173,24 +267,37 @@ jobs:
     - name: Check PHP Syntax for Plugin
       run: |
         cd ${{ github.workspace }}/cacti/plugins/monitor
-        if find . -name '*.php' -exec php -l {} 2>&1 \; | grep -iv 'no syntax errors detected'; then
-          echo "Syntax errors found!"
-          exit 1
-        fi
+        find . -path './vendor' -prune -o -name '*.php' -print0 | xargs -0 -n1 php -l
 
     - name: Remove the plugins directory exclusion from the .phpstan.neon
-      run: sed '/plugins/d' -i .phpstan.neon
+      run: |
+        if [ -f .phpstan.neon ]; then
+          sed '/plugins/d' -i .phpstan.neon
+        fi
       working-directory: ${{ github.workspace }}/cacti
 
     - name: Mark composer scripts executable
-      run: sudo chmod +x ${{ github.workspace }}/cacti/include/vendor/bin/*
+      run: |
+        if [ -d "${{ github.workspace }}/cacti/include/vendor/bin" ]; then
+          sudo find "${{ github.workspace }}/cacti/include/vendor/bin" -maxdepth 1 -type f -exec chmod +x {} +
+        fi
 
     - name: Run Linter on base code
-      run: composer run-script lint ${{ github.workspace }}/cacti/plugins/monitor
+      run: |
+        if composer run-script --list | grep -qE '^  lint'; then
+          composer run-script lint ${{ github.workspace }}/cacti/plugins/monitor
+        else
+          echo 'Composer lint script is not defined; skipping.'
+        fi
       working-directory: ${{ github.workspace }}/cacti
 
     - name: Checking coding standards on base code
-      run: composer run-script phpcsfixer ${{ github.workspace }}/cacti/plugins/monitor
+      run: |
+        if composer run-script --list | grep -qE '^  phpcsfixer'; then
+          composer run-script phpcsfixer ${{ github.workspace }}/cacti/plugins/monitor
+        else
+          echo 'Composer phpcsfixer script is not defined; skipping.'
+        fi
       working-directory: ${{ github.workspace }}/cacti
 
 #    - name: Run PHPStan at Level 6 on base code outside of Composer due to technical issues
@@ -214,3 +321,11 @@ jobs:
           echo "=== Cacti Log ==="
           sudo cat ${{ github.workspace }}/cacti/log/cacti.log
         fi
+
+    - name: Upload Cacti log
+      if: failure()
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      with:
+        name: cacti-log-php-${{ matrix.php }}
+        path: ${{ github.workspace }}/cacti/log/cacti.log
+        if-no-files-found: ignore

.gitignore

@@ -22,3 +22,8 @@
 locales/po/*.mo
 vendor/
 .omc/
+
+# Lockfile is not committed: the plugin declares a range, and thold does the same.
+composer.lock
+/vendor/
+.phpunit.result.cache

phpunit.xml.dist

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<phpunit bootstrap="tests/bootstrap.php" colors="true" beStrictAboutOutputDuringTests="false">
+	<testsuites>
+		<testsuite name="Unit">
+			<directory>./tests/unit</directory>
+		</testsuite>
+		<testsuite name="Integration">
+			<directory>./tests/Integration</directory>
+		</testsuite>
+	</testsuites>
+</phpunit>