Skip to content

test(php): run PHPUnit in a separate wp-env config - #791

Merged
aryanjasala merged 34 commits into
theme-elementary-v2from
test/wp-env-tests-config
Oct 1, 2026
Merged

aryanjasala merged 34 commits into
theme-elementary-v2from
test/wp-env-tests-config

Conversation

@aryanjasala

@aryanjasala aryanjasala commented Oct 1, 2026 •

Copy link
Copy Markdown
Member

@wordpress/env 11.16 (from #790, now on this branch) deprecates the env.tests block and the automatic tests environment, and prints a warning on every wp-env start. Its documented replacement is a second config file passed with --config.

Changes

  • .wp-env.tests.json defines the test environment: the theme, PHP 8.2, port 5891, its own containers and database, and WP_DEBUG on (the logger tests need it).
  • .wp-env.json sets testsEnvironment to false and drops env.tests.
  • pretest:php starts the test environment (a few seconds when it is already up) and installs Composer dependencies in its cli container; test:php runs PHPUnit there.
  • Docs, the scaffold skill and the dev-tools test fixture describe the new setup. The test-only WP_DEBUG override step in docs/local-development.md and its row in docs/internal/maintenance.md are gone: the committed test config covers it.
  • .gitignore ignores .wp-env.tests.override.json.

Why not run the tests in the development environment's cli container: wp-env's wp-tests-config.php there uses the site's database and wp_ prefix, so the suite wipes the development site's content. Checked: the site's posts went from 3 to 0.

CI needs no change: ci-test-php runs npm run wp-env start and then npm run test:php, whose pretest hook starts the test environment, and WP_ENV_PHP_VERSION and WP_ENV_CORE apply to it too.

Testing

  • wp-env start and npm run test:php: no deprecation warnings; the test environment comes up on 5891 in its own containers
  • PHPUnit: 101 tests, 267 assertions; a second run takes 8 seconds
  • A post created on the development site survives the test run
  • WP_ENV_PHP_VERSION=8.3 npm run test:php runs on PHP 8.3.35 and passes
  • Jest 59 of 59, lint:all passes

dependabot Bot and others added 30 commits May 28, 2026 09:00
Bumps [tmp](https://github.com/raszi/node-tmp) from 0.2.5 to 0.2.7.
- [Changelog](https://github.com/raszi/node-tmp/blob/master/CHANGELOG.md)
- [Commits](raszi/node-tmp@v0.2.5...v0.2.7)

---
updated-dependencies:
- dependency-name: tmp
  dependency-version: 0.2.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.3 to 1.8.4.
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.3...v1.8.4)

---
updated-dependencies:
- dependency-name: shell-quote
  dependency-version: 1.8.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [launch-editor](https://github.com/vitejs/launch-editor) from 2.13.1 to 2.14.1.
- [Commits](vitejs/launch-editor@v2.13.1...v2.14.1)

---
updated-dependencies:
- dependency-name: launch-editor
  dependency-version: 2.14.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [form-data](https://github.com/form-data/form-data) from 4.0.5 to 4.0.6.
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.5...v4.0.6)

---
updated-dependencies:
- dependency-name: form-data
  dependency-version: 4.0.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) from 7.29.0 to 7.29.6.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core)

---
updated-dependencies:
- dependency-name: "@babel/core"
  dependency-version: 7.29.6
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [ws](https://github.com/websockets/ws) and [@wp-playground/cli](https://github.com/WordPress/wordpress-playground). These dependencies needed to be updated together.

Updates `ws` from 8.18.3 to 8.21.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.18.3...8.21.1)

Updates `ws` from 8.19.0 to 8.21.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.18.3...8.21.1)

Updates `ws` from 7.5.10 to 7.5.12
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.18.3...8.21.1)

Updates `@wp-playground/cli` from 3.1.3 to 3.1.44
- [Release notes](https://github.com/WordPress/wordpress-playground/releases)
- [Changelog](https://github.com/WordPress/wordpress-playground/blob/trunk/CHANGELOG.md)
- [Commits](WordPress/wordpress-playground@v3.1.3...v3.1.44)

---
updated-dependencies:
- dependency-name: ws
  dependency-version: 8.21.1
  dependency-type: indirect
- dependency-name: ws
  dependency-version: 8.21.1
  dependency-type: indirect
- dependency-name: ws
  dependency-version: 7.5.12
  dependency-type: indirect
- dependency-name: "@wp-playground/cli"
  dependency-version: 3.1.44
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [websocket-driver](https://github.com/faye/websocket-driver-node) from 0.7.4 to 0.7.5.
- [Changelog](https://github.com/faye/websocket-driver-node/blob/main/CHANGELOG.md)
- [Commits](faye/websocket-driver-node@0.7.4...0.7.5)

---
updated-dependencies:
- dependency-name: websocket-driver
  dependency-version: 0.7.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps  and [svgo](https://github.com/svg/svgo). These dependencies needed to be updated together.

Updates `svgo` from 3.3.3 to 3.3.4
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v3.3.3...v3.3.4)

Updates `svgo` from 4.0.1 to 4.0.2
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v3.3.3...v3.3.4)

---
updated-dependencies:
- dependency-name: svgo
  dependency-version: 3.3.4
  dependency-type: indirect
- dependency-name: svgo
  dependency-version: 4.0.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [shell-quote](https://github.com/ljharb/shell-quote) from 1.8.4 to 1.10.0.
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.8.4...v1.10.0)

---
updated-dependencies:
- dependency-name: shell-quote
  dependency-version: 1.10.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [immutable](https://github.com/immutable-js/immutable-js) from 5.1.5 to 5.1.9.
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v5.1.5...v5.1.9)

---
updated-dependencies:
- dependency-name: immutable
  dependency-version: 5.1.9
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) from 5.10.0 to 5.10.1.
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v5.10.0...v5.10.1)

---
updated-dependencies:
- dependency-name: fast-xml-parser
  dependency-version: 5.10.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.3 to 3.1.4.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.3...v3.1.4)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.10 to 8.5.22.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.10...8.5.22)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.22
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.5.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.4...v3.1.5)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [postcss](https://github.com/postcss/postcss) from 8.5.22 to 8.5.25.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.22...8.5.25)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.25
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Run Copilot code review on GitHub-hosted runners
Bumps  and [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser). These dependencies needed to be updated together.

Updates `postcss-selector-parser` from 7.1.1 to 7.1.5
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@v7.1.1...7.1.5)

Updates `postcss-selector-parser` from 6.1.2 to 6.1.4
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@v7.1.1...7.1.5)

---
updated-dependencies:
- dependency-name: postcss-selector-parser
  dependency-version: 7.1.5
  dependency-type: indirect
- dependency-name: postcss-selector-parser
  dependency-version: 6.1.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.5 to 3.1.7.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.5...v3.1.7)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@humanfs/node](https://github.com/humanwhocodes/humanfs/tree/HEAD/packages/node) from 0.16.7 to 0.16.8.
- [Release notes](https://github.com/humanwhocodes/humanfs/releases)
- [Changelog](https://github.com/humanwhocodes/humanfs/blob/main/packages/node/CHANGELOG.md)
- [Commits](https://github.com/humanwhocodes/humanfs/commits/node-v0.16.8/packages/node)

---
updated-dependencies:
- dependency-name: "@humanfs/node"
  dependency-version: 0.16.8
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [joi](https://github.com/hapijs/joi) from 18.0.2 to 18.2.8.
- [Commits](hapijs/joi@v18.0.2...v18.2.8)

---
updated-dependencies:
- dependency-name: joi
  dependency-version: 18.2.8
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#767)

Bumps [baseline-browser-mapping](https://github.com/web-platform-dx/baseline-browser-mapping) from 2.10.0 to 2.11.21.
- [Release notes](https://github.com/web-platform-dx/baseline-browser-mapping/releases)
- [Commits](web-platform-dx/baseline-browser-mapping@v2.10.0...v2.11.21)

---
updated-dependencies:
- dependency-name: baseline-browser-mapping
  dependency-version: 2.11.21
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps  and [svgo](https://github.com/svg/svgo). These dependencies needed to be updated together.

Updates `svgo` from 3.3.4 to 3.3.5
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v3.3.4...v3.3.5)

Updates `svgo` from 4.0.2 to 4.1.0
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v3.3.4...v3.3.5)

---
updated-dependencies:
- dependency-name: svgo
  dependency-version: 3.3.5
  dependency-type: indirect
- dependency-name: svgo
  dependency-version: 4.1.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps  and [js-yaml](https://github.com/nodeca/js-yaml). These dependencies needed to be updated together.

Updates `js-yaml` from 3.14.2 to 3.15.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.2...3.15.2)

Updates `js-yaml` from 4.1.1 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.2...3.15.2)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [adm-zip](https://github.com/cthackers/adm-zip) to 0.6.1 and updates ancestor dependency [@wordpress/scripts](https://github.com/WordPress/gutenberg/tree/HEAD/packages/scripts). These dependencies need to be updated together.


Updates `adm-zip` from 0.5.16 to 0.6.1
- [Release notes](https://github.com/cthackers/adm-zip/releases)
- [Changelog](https://github.com/cthackers/adm-zip/blob/master/history.md)
- [Commits](cthackers/adm-zip@v0.5.16...v0.6.1)

Updates `@wordpress/scripts` from 31.5.0 to 35.0.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/scripts/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/scripts@35.0.0/packages/scripts)

---
updated-dependencies:
- dependency-name: adm-zip
  dependency-version: 0.6.1
  dependency-type: indirect
- dependency-name: "@wordpress/scripts"
  dependency-version: 35.0.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [markdown-it](https://github.com/markdown-it/markdown-it) to 14.3.2 and updates ancestor dependency [@wordpress/scripts](https://github.com/WordPress/gutenberg/tree/HEAD/packages/scripts). These dependencies need to be updated together.


Updates `markdown-it` from 12.3.2 to 14.3.2
- [Changelog](https://github.com/markdown-it/markdown-it/blob/14.3.2/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@12.3.2...14.3.2)

Updates `@wordpress/scripts` from 35.0.0 to 36.0.0
- [Release notes](https://github.com/WordPress/gutenberg/releases)
- [Changelog](https://github.com/WordPress/gutenberg/blob/trunk/packages/scripts/CHANGELOG.md)
- [Commits](https://github.com/WordPress/gutenberg/commits/@wordpress/scripts@36.0.0/packages/scripts)

---
updated-dependencies:
- dependency-name: markdown-it
  dependency-version: 14.3.2
  dependency-type: indirect
- dependency-name: "@wordpress/scripts"
  dependency-version: 36.0.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.12 to 1.1.21.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.21)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.21
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Brings main's history into v2 so release PR #692 has no conflicts. main only
changed package.json and package-lock.json (v1 Dependabot bumps, superseded
by v2's own dependencies) and copilot-code-review.yml (already identical on
v2), so the tree stays exactly as v2 had it.
npm audit reported 93 vulnerabilities (62 high) on v2. Now 0.

- @wordpress/scripts 32.3.0 -> 35.0.0, the first release whose e2e
  tooling no longer pulls in extract-zip, which has no patched version.
  @wordpress/jest-preset-default 12.47.0 -> 14.2.0 to match (Jest 30).
- @wordpress/env 11.7.0 -> 11.16.0 (drops extract-zip),
  @wordpress/babel-preset-default 8.47.0 -> 8.56.0, browserslist 4.28.2 ->
  4.29.3, svgo 4.0.1 -> 4.1.0.
- overrides, for fixes the parents' ranges do not reach:
  webpack-dev-server 6.0.0 (no patched 5.x; was pinned to 5.2.1),
  serialize-javascript 7.1.2 (was 7.0.3), minimatch 3.1.5 for v3 consumers
  only (was 3.1.3 for every consumer), qs 6.16.0, markdownlint-cli 0.49.1
  and js-yaml 5.4.2 for its v5 consumers.
- webpack.blocks.config.js and docs/hmr.md no longer say the dev server is
  v5; the proxy workaround still applies to v6.
@wordpress/jest-console 9 (via jest-preset-default 14) fails any test that
calls console.warn unless the test expects it through its own matchers, so
spying on console.warn no longer works. Use toHaveWarnedWith with the exact
message.
Follows rtCamp/plugin-elementary#28 and #29 so both starters stay on the
same toolchain:

- @wordpress/scripts 36.0.0 instead of 35.0.0. 36 runs Vitest for
  test-unit-js and drops the bundled Jest preset, Babel transform and
  GitHub Actions reporter, so test:js uses wp-scripts test-unit-jest, jest
  and jest-environment-jsdom 30.5.0 are direct dev dependencies,
  @wordpress/jest-preset-default is removed, and tests/js/jest.config.js
  sets up jsdom, test discovery and a style mock itself.
- webpack-dev-server stays on 5.x at 5.2.6, which is patched; only its
  sockjs > uuid dependency needed an override. This reverts the 6.0.0
  override and the doc and comment changes that went with it.
- Overrides are scoped to the parent that pins the old version (express >
  qs, markdownlint-cli > js-yaml, copy-webpack-plugin >
  serialize-javascript, sockjs > uuid, @wordpress/scripts > adm-zip)
  instead of applying everywhere.
- The duplicate-entry test goes back to spying on console.warn, since
  @wordpress/jest-console no longer loads without the preset.

npm audit still reports 0 vulnerabilities.
wp-env 11.16 deprecates the env.tests block and the automatic tests
environment. The replacement it documents is a second config file, so
.wp-env.tests.json defines the test environment (port 5891, its own
containers and database, WP_DEBUG on), and .wp-env.json sets
testsEnvironment to false. pretest:php starts that environment and
test:php runs PHPUnit in its cli container.

A second config, not the development environment's cli container: wp-env's
wp-tests-config.php there uses the site's database and wp_ prefix, so the
suite would wipe the development site's content.

CI keeps working unchanged: WP_ENV_PHP_VERSION and WP_ENV_CORE apply to the
test environment too. The docs drop the test-only WP_DEBUG override, which
the committed test config now covers.
#790 was squash-merged, so bring its squash commit in; the tree it adds is
identical to the #790 commits this branch already has.
@aryanjasala
aryanjasala changed the base branch from fix/v2-security to theme-elementary-v2 October 1, 2026 20:53
@aryanjasala
aryanjasala merged commit dd8ad91 into theme-elementary-v2 Oct 1, 2026
@aryanjasala
aryanjasala deleted the test/wp-env-tests-config branch October 1, 2026 20:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants