Fix Plugin Check CI: remove stored Composer credential, bump plugin-check-action by ilicfilip · Pull Request #766 · ProgressPlanner/progress-planner

ilicfilip · 2026-05-29T13:13:49Z

Fixes the Plugin Check job, which has been failing on and off since May.

Branch reset onto current develop and reduced to one commit — the earlier
attempts here (setup-php pin, unsetting GITHUB_TOKEN, the WP-CLI nightly, the
@wordpress/env 11.5.0 pin) were all dead ends and have been dropped.

The bug is intermittent — that's why it kept "coming back"

setup-php stores the run's ephemeral Actions token in ~/.composer/auth.json
as a github-oauth credential. Composer rejects it with

Failed to get composer instance: Your github oauth token for github.com
contains invalid characters

but only when that particular token happens to contain a character its
validator dislikes (composer#12076).
Roughly half of all runs failed.

That intermittency is the reason every previous fix looked like it worked and
then regressed — a green run proves nothing here. Demonstrated by re-running an
unchanged commit and watching it flip from pass to fail.

The fix

dist-archive-command is a public package and needs no auth at all, so the
credential is simply removed before installing:

- name: Install latest version of dist-archive-command
  run: |
    rm -f "$(composer config --global home 2>/dev/null)/auth.json"
    wp package install wp-cli/dist-archive-command:v3.1.0

Run 31784727273 confirms the mechanism: GITHUB_TOKEN and COMPOSER_AUTH
are already empty at that point, and the token is in
/home/runner/.composer/auth.json. That is why clearing env vars — the approach
tried previously on this branch — could never work.

Second, separate breakage

Environment not initialized. Run 'wp-env start' first. — fixed upstream in
plugin-check-action v1.1.7
(#590); this bumps
to v1.1.9, which also picks up the v1.1.8 bundle-regression fix. Since the
fix landed upstream, the @wordpress/env 11.5.0 pin is dropped rather than
carried forward.

Two pins that look stale but are load-bearing

Do NOT switch to the WP-CLI nightly. It now reports as wp-cli 3.0.0-alpha, while every released dist-archive-command requires wp-cli ^2
/ ^2.13 — wp package install cannot resolve against it.
dist-archive-command stays at v3.1.0 — newest release accepting wp-cli ^2. v3.2.x needs ^2.13, which has no stable release (latest is 2.12.0).

Both are documented in workflow comments so they aren't "modernized" back into
breakage.

Verification

Green run with this exact workflow: 31784727273
(install, build, and plugin check all pass).

Because the failure is token-dependent, treat an occasional red run as a signal
to re-read the mechanism above rather than as proof this regressed.

The same fix is also present in #767; this PR exists so develop gets it
without waiting on that draft feature branch. Whichever merges first, the other
becomes a no-op.

github-actions · 2026-05-29T13:14:04Z

Test on Playground
Test this pull request on the Playground
or download the zip

github-actions · 2026-05-29T13:15:53Z

✅ Code Coverage Report

Metric	Value
Total Coverage	31.62% 📉
Base Coverage	31.62%
Difference	📈 0.00%

⚠️ Coverage below recommended 40% threshold

🎉 Great job maintaining/improving code coverage!

ℹ️ About this report

All tests run in a single job with Xdebug coverage
Security tests excluded from coverage to prevent output issues
Coverage calculated from line coverage percentages

Two independent upstream breakages stack in this job: 1. `wp package install` fails with "Your github oauth token for github.com contains invalid characters". The stable WP-CLI phar bundles an old Composer that rejects the current GitHub Actions token format (hyphens) — composer#12076. setup-php exports the token via COMPOSER_AUTH, so pinning setup-php or clearing GITHUB_TOKEN does not help (both were tried in #766 and failed). The nightly phar bundles a Composer with relaxed validation, which fixed this step in #766. 2. The plugin check step then failed with "Environment not initialized. Run `wp-env start` first." plugin-check-action generated a .wp-env.json that loaded plugin-check from a download URL; on newer runner images wp-env exits 0 without initializing. #766 worked around it by pinning @wordpress/env to 11.5.0, which did not work and left that PR blocked. Upstream fixed (2) in plugin-check-action v1.1.7, so no @wordpress/env pin is needed — pinning to 11.5.0 against a fixed action would be counterproductive. v1.1.9 also picks up the v1.1.8 bundle-regression fix. Ref: WordPress/plugin-check-action#590 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

… WP-CLI Reverts the WP-CLI nightly step added in the previous commit and documents why the surrounding pins exist. The nightly was a May workaround for Composer rejecting the GitHub Actions token ("contains invalid characters", composer#12076). Two things changed: - composer#12076 was fixed in Composer 2.10.0 (2026-05-28, one day after that debugging session) and setup-php now ships 2.10.2, so the stable WP-CLI phar no longer hits the token error. Confirmed on CI run 31781466704: Composer reached dependency resolution, no token error. - The nightly has since become wp-cli 3.0.0-alpha, and every released dist-archive-command requires wp-cli ^2 / ^2.13, so `wp package install` can no longer resolve against it. The nightly is now a dead end. dist-archive-command stays on v3.1.0: it is the newest release accepting wp-cli ^2. v3.2.x needs ^2.13, which has no stable release (latest is 2.12.0). The remaining real fix is the action bump. v1.1.7 fixed the wp-env silent-startup failure ("Environment not initialized") that blocked #766; v1.1.9 picks up the v1.1.8 bundle-regression fix. Since that landed upstream, the @wordpress/env 11.5.0 pin from #766 is not carried over. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…o v1.1.9 Replaces this branch's earlier attempts, all of which were dead ends: setup-php pinning, unsetting GITHUB_TOKEN, the WP-CLI nightly, and the @wordpress/env 11.5.0 pin. Two independent breakages: 1. "Your github oauth token for github.com contains invalid characters". This is INTERMITTENT — setup-php stores the run's ephemeral Actions token in ~/.composer/auth.json as a github-oauth credential, and Composer rejects it only when that particular token contains a character its validator dislikes (composer#12076). Roughly half of runs failed, which is why every previous "fix" appeared to work and then regressed: a single green run proves nothing here. Verified in run 31784727273 that GITHUB_TOKEN and COMPOSER_AUTH are already EMPTY at that point and the credential lives on disk, so clearing env vars cannot help. dist-archive-command is a public package needing no auth, so the fix is to delete the stored credential. Note the WP-CLI nightly used earlier is now actively harmful: it reports as wp-cli 3.0.0-alpha, while every released dist-archive-command requires wp-cli ^2 / ^2.13, so `wp package install` cannot resolve against it. 2. "Environment not initialized. Run `wp-env start` first." — fixed upstream in plugin-check-action v1.1.7 (WordPress/plugin-check-action#590); v1.1.9 also picks up the v1.1.8 bundle-regression fix. Since that landed upstream, the @wordpress/env 11.5.0 pin is dropped rather than carried forward. dist-archive-command stays at v3.1.0: newest release accepting wp-cli ^2. v3.2.x requires ^2.13, which has no stable release (latest is 2.12.0). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

github-actions · 2026-08-14T08:57:46Z

🔍 WordPress Plugin Check Report

❌ Status: Failed

📊 Report

🎯 Total Issues	❌ Errors	⚠️ Warnings
11	1	10

❌ Errors (1)

📁 readme.txt (1 error)

📍 Line	🔖 Check	💬 Message
`0`	outdated_tested_upto_header	Tested up to: 6.9 < 7.0. The "Tested up to" value in your plugin is not set to the current version of WordPress. This means your plugin will not show up in searches, as we require plugins to be compatible and documented as tested up to the most recent version of WordPress.

⚠️ Warnings (10)

📁 classes/suggested-tasks/providers/class-content-review.php (4 warnings)

📍 Line	🔖 Check	💬 Message
`232`	WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in	Using exclusionary parameters, like post__not_in, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.
`377`	WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in	Using exclusionary parameters, like post__not_in, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.
`381`	WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in	Using exclusionary parameters, like post__not_in, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.
`388`	WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in	Using exclusionary parameters, like post__not_in, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.

📁 classes/suggested-tasks/data-collector/class-unpublished-content.php (1 warning)

📍 Line	🔖 Check	💬 Message
`103`	WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in	Using exclusionary parameters, like post__not_in, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.

📁 classes/activities/class-query.php (2 warnings)

📍 Line	🔖 Check	💬 Message
`71`	PluginCheck.Security.DirectDB.UnescapedDBParameter	Unescaped parameter $table_name used in $wpdb->query()\n$table_name assigned unsafely at line 58.
`163`	PluginCheck.Security.DirectDB.UnescapedDBParameter	Unescaped parameter $where_args used in $wpdb->get_results()\n$where_args assigned unsafely at line 153.

📁 classes/suggested-tasks/data-collector/class-yoast-orphaned-content.php (1 warning)

📍 Line	🔖 Check	💬 Message
`111`	PluginCheck.Security.DirectDB.UnescapedDBParameter	Unescaped parameter $query used in $wpdb->get_row()\n$query assigned unsafely at line 98.

📁 classes/suggested-tasks/data-collector/class-terms-without-posts.php (1 warning)

📍 Line	🔖 Check	💬 Message
`120`	PluginCheck.Security.DirectDB.UnescapedDBParameter	Unescaped parameter $query used in $wpdb->get_results()\n$query assigned unsafely at line 118.

📁 classes/suggested-tasks/data-collector/class-terms-without-description.php (1 warning)

📍 Line	🔖 Check	💬 Message
`108`	PluginCheck.Security.DirectDB.UnescapedDBParameter	Unescaped parameter $query used in $wpdb->get_results()\n$query assigned unsafely at line 106.

🤖 Generated by WordPress Plugin Check Action • Learn more about Plugin Check

ilicfilip changed the title ~~Pin setup-php to 2.37.1 in plugin-check workflow~~ Fix Plugin Check job: clear GitHub token for wp-cli package install May 29, 2026

ilicfilip changed the title ~~Fix Plugin Check job: clear GitHub token for wp-cli package install~~ Fix Plugin Check job: update WP-CLI so Composer accepts new GitHub token format May 29, 2026

ilicfilip changed the title ~~Fix Plugin Check job: update WP-CLI so Composer accepts new GitHub token format~~ Fix Plugin Check CI: WP-CLI token fix done; wp-env regression blocked upstream May 29, 2026

ilicfilip force-pushed the filip/pin-setup-php-plugin-check branch from 3f83a1a to 59679c8 Compare August 14, 2026 08:55

ilicfilip changed the title ~~Fix Plugin Check CI: WP-CLI token fix done; wp-env regression blocked upstream~~ Fix Plugin Check CI: remove stored Composer credential, bump plugin-check-action Aug 14, 2026

Navigation Menu

Uh oh!

Fix Plugin Check CI: remove stored Composer credential, bump plugin-check-action - #766

Fix Plugin Check CI: remove stored Composer credential, bump plugin-check-action#766
ilicfilip wants to merge 1 commit into
developfrom
filip/pin-setup-php-plugin-check

ilicfilip commented May 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

ilicfilip commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

The bug is intermittent — that's why it kept "coming back"

The fix

Second, separate breakage

Two pins that look stale but are load-bearing

Verification

Uh oh!

github-actions Bot commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Code Coverage Report

Uh oh!

github-actions Bot commented Aug 14, 2026

🔍 WordPress Plugin Check Report

📊 Report

❌ Errors (1)

⚠️ Warnings (10)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ilicfilip commented May 29, 2026 •

edited

Loading

github-actions Bot commented May 29, 2026 •

edited

Loading

github-actions Bot commented May 29, 2026 •

edited

Loading