Skip to content

docs: document PHP 8 hardening and CI behavior - #330

Draft
somethingwithproof wants to merge 3 commits into
Cacti:developfrom
somethingwithproof:agent/docs-security-php8-workflow
Draft

docs: document PHP 8 hardening and CI behavior#330
somethingwithproof wants to merge 3 commits into
Cacti:developfrom
somethingwithproof:agent/docs-security-php8-workflow

Conversation

@somethingwithproof

Copy link
Copy Markdown
Member

Summary

  • document the PHP 8 runtime and Linux integration-test baseline
  • describe CSRF, output escaping, callback, CSV, and XML import hardening
  • explain UTC partition maintenance and the dMaxValue fail-safe behavior
  • record the security, test, and CI changes in the develop changelog

Dependency

This branch includes the existing commit from #329 so the documentation PR can run against the repaired integration workflow. Once #329 lands in develop, the remaining diff is documentation-only.

Validation

  • Dockerized actionlint and YAML parsing
  • repository-wide PHP 8.0 syntax lint in Linux Docker
  • Dockerized regression run: 5 passed, with the same 3 inherited develop failures
  • Markdown lint matches the develop baseline at 48 legacy findings and introduces no new violations
  • untouched Cacti release/1.2.31 composer.json validated and installed in an ephemeral Linux Composer container
  • Dockerized git diff --check

No composer.json was added, edited, or pushed.

Three defects, all failing open or failing at setup:

- the plugin syntax check redirected find's own output rather than php's, so
  PHP errors never reached the grep testing for them; the step could not fail
- MYSQL_AUTH_USR carried a literal tilde, because parameter expansion happens
  after tilde expansion, so MySQL was handed a path it could not resolve
- the Cacti checkout took the default branch, which is 1.3 in development and
  whose CLI installer currently fatals with an undefined __()

plugin_syslog additionally installed libapache2-mod-php${{ matrix.php }},
which Ubuntu does not package, so apt exited 100 before Cacti was reached.

Verified with actionlint, which is clean on the result.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant