Repository navigation
Conversation
The integration tests install and run the Joomla full package they download from the GitHub release. tests/ci/download-joomla.sh now compares its SHA-256 with tests/ci/joomla-checksums.sha256 and unpacks nothing on a mismatch (or if the version is not listed). 5.4.8's MD5/SHA1 were checked against downloads.joomla.org; 6.1.3's checksum is from the release asset and says so. tests/lint/check-joomla-checksums.php, run by the lint job, makes sure every version of the CI matrix has an entry. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LhhhdjhErC9ZiaS4HyRjsh
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
tests/ci/install-joomla.shpiped the Joomla full package from the GitHub release straight intotar. Everything the integration tests then run (Joomla, plus plugin and component installed into it) starts from that download, so it should be the package that was checked, not whatever the network - or a replaced release asset - delivers.Change
tests/ci/joomla-checksums.sha256: the SHA-256 of the packages in the CI matrix (5.4.8, 6.1.3).tests/ci/download-joomla.sh VERSION TARGET: downloads the package, compares its SHA-256 and unpacks only on a match. A version that is not listed fails immediately, before downloading, with a hint on how to add it (JOOMLA_SHA256can supply a hash for trying a version locally).install-joomla.shuses it; the com_bfstop workflow installs through this script as well.tests/lint/check-joomla-checksums.php, run by the lint job, checks the file's format and that every Joomla version of the matrix inci.ymlhas an entry, so raising a version without a checksum fails the cheap lint job with a clear message instead of every integration job.How the checksums were established
e7ce8043...,bdb3752f...; Joomla's page lists no SHA-256, so the SHA-256 is computed from that same file).Tested
download-joomla.sh: valid package unpacks; a wrong hash exits 1 and unpacks nothing; an unlisted version fails before downloading;JOOMLA_SHA256with the right hash is accepted.install-joomla.shon a fresh directory and database with Joomla 6.1.3 (and earlier with 5.4.8, through the same script): installs, plugin and component install.The runs of this PR exercise the new path on all six database/Joomla combinations.
Generated by Claude Code