Skip to content

fix(wp-env): drop Composer 2.8 audit workaround #30

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
apermo merged 2 commits into from
Apr 20, 2026
Merged

fix(wp-env): drop Composer 2.8 audit workaround #30

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7302a06
fix(wp-env): drop Composer 2.8 audit workaround
apermo Apr 20, 2026
100e12d
docs: wrap 0.5.1 CHANGELOG entry at 120 chars
apermo Apr 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 0 additions & 17 deletions .github/workflows/reusable-lhci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,23 +82,6 @@ jobs:
if: inputs.setup-wp-env
run: npm install -g @wordpress/env

- name: Patch wp-env source for Composer 2.8 advisory block
if: inputs.setup-wp-env
run: |
DOCKER_CONFIG="$(npm root -g)/@wordpress/env/lib/runtime/docker/docker-config.js"
if [ ! -f "$DOCKER_CONFIG" ]; then
echo "::warning::wp-env docker-config.js not found — upstream may have moved it. See https://github.com/WordPress/gutenberg/issues/77470"
exit 0
fi
if grep -q 'audit.block-insecure' "$DOCKER_CONFIG"; then
echo "Already patched: $DOCKER_CONFIG"
elif grep -q 'RUN composer global require' "$DOCKER_CONFIG"; then
sed -i 's|RUN composer global require|RUN composer config --global audit.block-insecure false \&\& composer global require|g' "$DOCKER_CONFIG"
echo "Patched: $DOCKER_CONFIG"
else
echo "::warning::No 'RUN composer global require' found in $DOCKER_CONFIG — upstream may have changed. See https://github.com/WordPress/gutenberg/issues/77470"
fi

- name: Validate wp-env configuration
if: inputs.setup-wp-env
run: |
Expand Down
16 changes: 0 additions & 16 deletions .github/workflows/reusable-wp-e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,22 +94,6 @@
- name: Install wp-env
run: npm install -g @wordpress/env

- name: Patch wp-env source for Composer 2.8 advisory block
run: |
DOCKER_CONFIG="$(npm root -g)/@wordpress/env/lib/runtime/docker/docker-config.js"
if [ ! -f "$DOCKER_CONFIG" ]; then
echo "::warning::wp-env docker-config.js not found — upstream may have moved it. See https://github.com/WordPress/gutenberg/issues/77470"
exit 0
fi
if grep -q 'audit.block-insecure' "$DOCKER_CONFIG"; then
echo "Already patched: $DOCKER_CONFIG"
elif grep -q 'RUN composer global require' "$DOCKER_CONFIG"; then
sed -i 's|RUN composer global require|RUN composer config --global audit.block-insecure false \&\& composer global require|g' "$DOCKER_CONFIG"
echo "Patched: $DOCKER_CONFIG"
else
echo "::warning::No 'RUN composer global require' found in $DOCKER_CONFIG — upstream may have changed. See https://github.com/WordPress/gutenberg/issues/77470"
fi

- name: Validate wp-env configuration
run: |
if [ ! -f .wp-env.json ]; then
Expand Down Expand Up @@ -147,7 +131,7 @@

- name: Configure WordPress SMTP for Mailpit
if: inputs.mailpit
run: |

Check warning on line 134 in .github/workflows/reusable-wp-e2e.yml

View workflow job for this annotation

GitHub Actions / Lint workflows 

[actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2016:info:1:28: Expressions don't expand in single quotes, use double quotes for that [shellcheck]

Raw Output:
i:.github/workflows/reusable-wp-e2e.yml:134:15: shellcheck reported issue in this script: SC2016:info:1:28: Expressions don't expand in single quotes, use double quotes for that [shellcheck]
npx wp-env run cli wp eval '
$dir = ABSPATH . "wp-content/mu-plugins";
if (!is_dir($dir)) { mkdir($dir, 0755, true); }
Expand Down
16 changes: 0 additions & 16 deletions .github/workflows/reusable-wp-visual-regression.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,22 +107,6 @@
- name: Install wp-env
run: npm install -g @wordpress/env

- name: Patch wp-env source for Composer 2.8 advisory block
run: |
DOCKER_CONFIG="$(npm root -g)/@wordpress/env/lib/runtime/docker/docker-config.js"
if [ ! -f "$DOCKER_CONFIG" ]; then
echo "::warning::wp-env docker-config.js not found — upstream may have moved it. See https://github.com/WordPress/gutenberg/issues/77470"
exit 0
fi
if grep -q 'audit.block-insecure' "$DOCKER_CONFIG"; then
echo "Already patched: $DOCKER_CONFIG"
elif grep -q 'RUN composer global require' "$DOCKER_CONFIG"; then
sed -i 's|RUN composer global require|RUN composer config --global audit.block-insecure false \&\& composer global require|g' "$DOCKER_CONFIG"
echo "Patched: $DOCKER_CONFIG"
else
echo "::warning::No 'RUN composer global require' found in $DOCKER_CONFIG — upstream may have changed. See https://github.com/WordPress/gutenberg/issues/77470"
fi

- name: Validate wp-env configuration
run: |
if [ ! -f .wp-env.json ]; then
Expand Down Expand Up @@ -160,7 +144,7 @@

- name: Configure WordPress SMTP for Mailpit
if: inputs.mailpit
run: |

Check warning on line 147 in .github/workflows/reusable-wp-visual-regression.yml

View workflow job for this annotation

GitHub Actions / Lint workflows 

[actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2016:info:1:28: Expressions don't expand in single quotes, use double quotes for that [shellcheck]

Raw Output:
i:.github/workflows/reusable-wp-visual-regression.yml:147:15: shellcheck reported issue in this script: SC2016:info:1:28: Expressions don't expand in single quotes, use double quotes for that [shellcheck]
npx wp-env run cli wp eval '
$dir = ABSPATH . "wp-content/mu-plugins";
if (!is_dir($dir)) { mkdir($dir, 0755, true); }
Expand Down
11 changes: 11 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,17 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [0.5.1] - 2026-04-20

### Fixed

- `reusable-wp-e2e.yml`, `reusable-wp-visual-regression.yml`, `reusable-lhci.yml` — remove the `docker-config.js`
sed-patch shipped in 0.4.1–0.4.3. The upstream advisory metadata that blocked Composer 2.8 resolution of
PHPUnit 11 was corrected in
[FriendsOfPHP/security-advisories#762](https://github.com/FriendsOfPHP/security-advisories/pull/762)
(merged 2026-04-18), which is the feed Composer consults. The workaround is no longer needed; see
[WordPress/gutenberg#77472](https://github.com/WordPress/gutenberg/pull/77472) for the matching upstream revert.

## [0.5.0] - 2026-04-19

### Added
Expand Down
Loading