From 310714ef4a4328353d9e2fa4c52e8da2f9816aa2 Mon Sep 17 00:00:00 2001 From: aaronmedina-dev Date: Thu, 9 Jul 2026 15:04:10 +0930 Subject: [PATCH 1/2] Add opensearch-plugins input to php-quality-checks Service containers can't install plugins before they start, so projects needing OpenSearch plugins (e.g. Adobe Commerce needs analysis-icu and analysis-phonetic) had to rely on a custom prebuilt image. This adds an optional opensearch-plugins input: when set, the API/integration test jobs install the listed plugins into the search container and restart it before running tests. Defaults to empty, so existing consumers are unaffected. --- .github/workflows/php-quality-checks.yml | 47 ++++++++++++++++++++++++ docs/php-quality-checks.md | 5 ++- 2 files changed, 50 insertions(+), 2 deletions(-) diff --git a/.github/workflows/php-quality-checks.yml b/.github/workflows/php-quality-checks.yml index e3fbc47..d18faf5 100644 --- a/.github/workflows/php-quality-checks.yml +++ b/.github/workflows/php-quality-checks.yml @@ -146,6 +146,14 @@ on: required: false default: "opensearchproject/opensearch" + opensearch-plugins: + description: >- + Space-separated OpenSearch plugins to install into the search service + before tests run (e.g., "analysis-icu analysis-phonetic") + type: string + required: false + default: "" + jobs: # Install Composer dependencies with caching and detect available tools install: @@ -804,6 +812,19 @@ jobs: [ -d "pub" ] && echo " ✅ pub/" fi + - name: Install OpenSearch plugins + if: inputs.opensearch-plugins != '' + run: | + echo "🔌 Installing OpenSearch plugins: ${{ inputs.opensearch-plugins }}" + for plugin in ${{ inputs.opensearch-plugins }}; do + docker exec ${{ job.services.search.id }} \ + bin/opensearch-plugin install --batch "$plugin" + done + docker restart ${{ job.services.search.id }} + echo "⏳ Waiting for OpenSearch to restart..." + timeout 120 bash -c 'until curl -sf http://localhost:9200/_cluster/health; do sleep 3; done' + echo "✅ OpenSearch is up with plugins installed" + - name: Run Integration Tests run: | echo "🔗 Running integration tests..." @@ -931,6 +952,19 @@ jobs: [ -d "pub" ] && echo " ✅ pub/" fi + - name: Install OpenSearch plugins + if: inputs.opensearch-plugins != '' + run: | + echo "🔌 Installing OpenSearch plugins: ${{ inputs.opensearch-plugins }}" + for plugin in ${{ inputs.opensearch-plugins }}; do + docker exec ${{ job.services.search.id }} \ + bin/opensearch-plugin install --batch "$plugin" + done + docker restart ${{ job.services.search.id }} + echo "⏳ Waiting for OpenSearch to restart..." + timeout 120 bash -c 'until curl -sf http://localhost:9200/_cluster/health; do sleep 3; done' + echo "✅ OpenSearch is up with plugins installed" + - name: Run REST API Tests run: | echo "🔌 Running REST API functional tests..." @@ -1079,6 +1113,19 @@ jobs: [ -d "pub" ] && echo " ✅ pub/" fi + - name: Install OpenSearch plugins + if: inputs.opensearch-plugins != '' + run: | + echo "🔌 Installing OpenSearch plugins: ${{ inputs.opensearch-plugins }}" + for plugin in ${{ inputs.opensearch-plugins }}; do + docker exec ${{ job.services.search.id }} \ + bin/opensearch-plugin install --batch "$plugin" + done + docker restart ${{ job.services.search.id }} + echo "⏳ Waiting for OpenSearch to restart..." + timeout 120 bash -c 'until curl -sf http://localhost:9200/_cluster/health; do sleep 3; done' + echo "✅ OpenSearch is up with plugins installed" + - name: Run GraphQL API Tests run: | echo "📊 Running GraphQL API functional tests..." diff --git a/docs/php-quality-checks.md b/docs/php-quality-checks.md index 3331fa5..d9e17e8 100644 --- a/docs/php-quality-checks.md +++ b/docs/php-quality-checks.md @@ -36,6 +36,7 @@ A comprehensive PHP quality assurance workflow supporting static analysis, codin | rabbitmq-version | ❌ | string | 4.1-management | RabbitMQ Docker image tag. | | opensearch-image | ❌ | string | opensearchproject/opensearch | OpenSearch Docker image name, combined with `opensearch-version` as the tag. | | opensearch-version | ❌ | string | 2 | OpenSearch Docker image tag. | +| opensearch-plugins | ❌ | string | "" | Space-separated OpenSearch plugins to install into the search service before tests run (e.g., `analysis-icu analysis-phonetic`). | | **Advanced Configuration** | | debug | ❌ | boolean | false | Enable verbose logging and debug output | @@ -77,15 +78,15 @@ jobs: phpstan-level: "9" ``` -**Custom Service Images (e.g., OpenSearch with plugins):** +**OpenSearch with plugins (e.g., Adobe Commerce):** ```yaml jobs: magento-quality: uses: aligent/workflows/.github/workflows/php-quality-checks.yml@main with: php-version: "8.4" - opensearch-image: "aligent/bitbucket-opensearch" opensearch-version: "3.1.0" + opensearch-plugins: "analysis-icu analysis-phonetic" ``` **Magento project with pre-commit hook scripts (use-custom-config):** From d6c4f2ae33c8f82c7880b150a4b1326c42f2e88f Mon Sep 17 00:00:00 2001 From: aaronmedina-dev Date: Thu, 9 Jul 2026 15:17:10 +0930 Subject: [PATCH 2/2] Pass plugin inputs to the shell via env vars zizmor flagged the inline template expansions in the plugin install steps as potential code injection. Route the input and container id through env instead of expanding them directly in the script. --- .github/workflows/php-quality-checks.yml | 33 +++++++++++++++--------- 1 file changed, 21 insertions(+), 12 deletions(-) diff --git a/.github/workflows/php-quality-checks.yml b/.github/workflows/php-quality-checks.yml index d18faf5..4f32f08 100644 --- a/.github/workflows/php-quality-checks.yml +++ b/.github/workflows/php-quality-checks.yml @@ -814,13 +814,16 @@ jobs: - name: Install OpenSearch plugins if: inputs.opensearch-plugins != '' + env: + OPENSEARCH_PLUGINS: ${{ inputs.opensearch-plugins }} + SEARCH_CONTAINER_ID: ${{ job.services.search.id }} run: | - echo "🔌 Installing OpenSearch plugins: ${{ inputs.opensearch-plugins }}" - for plugin in ${{ inputs.opensearch-plugins }}; do - docker exec ${{ job.services.search.id }} \ + echo "🔌 Installing OpenSearch plugins: $OPENSEARCH_PLUGINS" + for plugin in $OPENSEARCH_PLUGINS; do + docker exec "$SEARCH_CONTAINER_ID" \ bin/opensearch-plugin install --batch "$plugin" done - docker restart ${{ job.services.search.id }} + docker restart "$SEARCH_CONTAINER_ID" echo "⏳ Waiting for OpenSearch to restart..." timeout 120 bash -c 'until curl -sf http://localhost:9200/_cluster/health; do sleep 3; done' echo "✅ OpenSearch is up with plugins installed" @@ -954,13 +957,16 @@ jobs: - name: Install OpenSearch plugins if: inputs.opensearch-plugins != '' + env: + OPENSEARCH_PLUGINS: ${{ inputs.opensearch-plugins }} + SEARCH_CONTAINER_ID: ${{ job.services.search.id }} run: | - echo "🔌 Installing OpenSearch plugins: ${{ inputs.opensearch-plugins }}" - for plugin in ${{ inputs.opensearch-plugins }}; do - docker exec ${{ job.services.search.id }} \ + echo "🔌 Installing OpenSearch plugins: $OPENSEARCH_PLUGINS" + for plugin in $OPENSEARCH_PLUGINS; do + docker exec "$SEARCH_CONTAINER_ID" \ bin/opensearch-plugin install --batch "$plugin" done - docker restart ${{ job.services.search.id }} + docker restart "$SEARCH_CONTAINER_ID" echo "⏳ Waiting for OpenSearch to restart..." timeout 120 bash -c 'until curl -sf http://localhost:9200/_cluster/health; do sleep 3; done' echo "✅ OpenSearch is up with plugins installed" @@ -1115,13 +1121,16 @@ jobs: - name: Install OpenSearch plugins if: inputs.opensearch-plugins != '' + env: + OPENSEARCH_PLUGINS: ${{ inputs.opensearch-plugins }} + SEARCH_CONTAINER_ID: ${{ job.services.search.id }} run: | - echo "🔌 Installing OpenSearch plugins: ${{ inputs.opensearch-plugins }}" - for plugin in ${{ inputs.opensearch-plugins }}; do - docker exec ${{ job.services.search.id }} \ + echo "🔌 Installing OpenSearch plugins: $OPENSEARCH_PLUGINS" + for plugin in $OPENSEARCH_PLUGINS; do + docker exec "$SEARCH_CONTAINER_ID" \ bin/opensearch-plugin install --batch "$plugin" done - docker restart ${{ job.services.search.id }} + docker restart "$SEARCH_CONTAINER_ID" echo "⏳ Waiting for OpenSearch to restart..." timeout 120 bash -c 'until curl -sf http://localhost:9200/_cluster/health; do sleep 3; done' echo "✅ OpenSearch is up with plugins installed"