WPScan API: Ensure comments are only submitted for changed add-ons

tests/integration/WpscanScanFindAddonDirsAlteredTest.php

@@ -44,6 +44,13 @@ final class WpscanScanFindAddonDirsAlteredTest extends TestCase {
 		'repo-owner'      => null,
 	);
 
+	/**
+	 * Variable for skipped files.
+	 *
+	 * @var $commit_skipped_files
+	 */
+	private array $commit_skipped_files = array();
+
 	/**
 	 * Setup function. Require files, prepare repository, etc.
 	 *
@@ -105,6 +112,26 @@ protected function tearDown(): void {
 		unset( $this->options );
 	}
 
+	/**
+	 * Get files affected by commit by pull request.
+	 *
+	 * @return array
+	 */
+	private function getFilesAffectedByCommitByPR() :array {
+		return vipgoci_github_files_affected_by_commit(
+			$this->options,
+			$this->options['commit'],
+			$this->commit_skipped_files,
+			true,
+			true,
+			true,
+			array(
+				'skip_folders' => $this->options['wpscan-api-skip-folders'],
+			),
+			false
+		);
+	}
+
 	/**
 	 * Test when addons are added to pull request.
 	 *
@@ -149,11 +176,10 @@ public function testFindDirsAlteredAddonAdded(): void {
 
 		vipgoci_unittests_output_unsuppress();
 
-		$commit_skipped_files = array();
-
 		$results_actual = vipgoci_wpscan_find_addon_dirs_altered(
 			$this->options,
-			$commit_skipped_files
+			$this->commit_skipped_files,
+			$this->getFilesAffectedByCommitByPR()
 		);
 
 		$results_expected = array(
@@ -214,11 +240,10 @@ public function testFindDirsAlteredAddonUpdated(): void {
 
 		vipgoci_unittests_output_unsuppress();
 
-		$commit_skipped_files = array();
-
 		$results_actual = vipgoci_wpscan_find_addon_dirs_altered(
 			$this->options,
-			$commit_skipped_files
+			$this->commit_skipped_files,
+			$this->getFilesAffectedByCommitByPR()
 		);
 
 		$results_expected = array(
@@ -276,11 +301,10 @@ public function testFindDirsAlteredAddonRemoved(): void {
 
 		vipgoci_unittests_output_unsuppress();
 
-		$commit_skipped_files = array();
-
 		$results_actual = vipgoci_wpscan_find_addon_dirs_altered(
 			$this->options,
-			$commit_skipped_files
+			$this->commit_skipped_files,
+			$this->getFilesAffectedByCommitByPR()
 		);
 
 		$this->assertSame(

tests/integration/WpscanScanSaveForSubmissionTest.php

@@ -41,6 +41,13 @@ final class WpscanScanSaveForSubmissionTest extends TestCase {
 		'repo-owner'      => null,
 	);
 
+	/**
+	 * Variable for skipped files.
+	 *
+	 * @var $commit_skipped_files
+	 */
+	private array $commit_skipped_files = array();
+
 	/**
 	 * Variable for problematic addons.
 	 *
@@ -243,6 +250,26 @@ private function prLabelRemove() :void {
 		);
 	}
 
+	/**
+	 * Get files affected by commit by pull request.
+	 *
+	 * @return array
+	 */
+	private function getFilesAffectedByCommitByPR() :array {
+		return vipgoci_github_files_affected_by_commit(
+			$this->options,
+			$this->options['commit'],
+			$this->commit_skipped_files,
+			true,
+			true,
+			true,
+			array(
+				'skip_folders' => $this->options['wpscan-api-skip-folders'],
+			),
+			false
+		);
+	}
+
 	/**
 	 * Test function when a 'skip-wpscan' label is associated with
 	 * pull request, so results should not be added.
@@ -282,7 +309,6 @@ public function testSaveForSubmissionWithLabel(): void {
 
 		$commit_issues_submit = array();
 		$commit_issues_stats  = array();
-		$commit_skipped_files = array();
 
 		$commit_issues_submit[ $this->options['wpscan-pr-1-number'] ] = array();
 		$commit_issues_stats[ $this->options['wpscan-pr-1-number'] ]  = array(
@@ -300,7 +326,8 @@ public function testSaveForSubmissionWithLabel(): void {
 			$this->options,
 			$commit_issues_submit,
 			$commit_issues_stats,
-			$commit_skipped_files,
+			$this->commit_skipped_files,
+			$this->getFilesAffectedByCommitByPR(),
 			$this->problematic_addons_found
 		);
 
@@ -364,7 +391,6 @@ public function testSaveForSubmissionNoLabel(): void {
 
 		$commit_issues_submit = array();
 		$commit_issues_stats  = array();
-		$commit_skipped_files = array();
 
 		$commit_issues_submit[ $this->options['wpscan-pr-1-number'] ] = array();
 		$commit_issues_stats[ $this->options['wpscan-pr-1-number'] ]  = array(
@@ -376,7 +402,8 @@ public function testSaveForSubmissionNoLabel(): void {
 			$this->options,
 			$commit_issues_submit,
 			$commit_issues_stats,
-			$commit_skipped_files,
+			$this->commit_skipped_files,
+			$this->getFilesAffectedByCommitByPR(),
 			$this->problematic_addons_found
 		);
 

tests/unit/WpCoreMiscGetAddonsNotAlteredTest.php

@@ -0,0 +1,96 @@
+<?php
+/**
+ * Test vipgoci_wpcore_misc_get_addons_not_altered() function.
+ *
+ * @package Automattic/vip-go-ci
+ */
+
+declare(strict_types=1);
+
+namespace Vipgoci\Tests\Unit;
+
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Class that implements the testing.
+ *
+ * @runTestsInSeparateProcesses
+ * @preserveGlobalState disabled
+ */
+final class WpCoreMiscGetAddonsNotAlteredTest extends TestCase {
+	/**
+	 * Setup function. Require file.
+	 *
+	 * @return void
+	 */
+	protected function setUp() :void {
+		require_once __DIR__ . '/../../wp-core-misc.php';
+		require_once __DIR__ . '/../../misc.php';
+	}
+
+	/**
+	 * Tests common usage of the function.
+	 *
+	 * @covers ::vipgoci_wpcore_misc_get_addons_not_altered
+	 *
+	 * @return void
+	 */
+	public function testGetAddonsNotAltered(): void {
+		$options = array(
+			'wpscan-api-paths' => array(
+				'plugins',
+				'themes',
+				'client-mu-plugins',
+			),
+		);
+
+		$known_addons = array(
+			'client-mu-plugins/my-plugin/plugin.php',
+			'client-mu-plugins/my-plugin/path1/test.php',
+			'client-mu-plugins/my-plugin/path1/test2.php',
+			'client-mu-plugins/my-plugin2/plugin.php',
+			'plugins/hello/hello.php',
+			'plugins/hello2/hello2.php',
+			'plugins/hello3/hello3.php',
+			'themes/theme1/hello/hello.php',
+			'themes/theme1/style.css',
+			'themes/theme2/hello/hello.php',
+			'themes/theme2/style.css',
+			'themes/theme3/hello/hello.php',
+			'themes/theme3/style.css',
+		);
+
+		$files_affected_by_commit_by_pr = array(
+			'all' => array(
+				'client-mu-plugins/my-plugin/plugin.php',
+				'client-mu-plugins/my-plugin/path1/test.php',
+				'client-mu-plugins/my-plugin/path1/test2.php',
+				'plugins/hello/hello.php',
+				'plugins/hello/docs/file.php',
+				'plugins/hello/docs/file.txt',
+				'plugins/hello2/hello2.php',
+				'testing/test-plugin.php',
+				'themes/theme1/hello/hello.php',
+				'themes/theme2/style.css',
+			),
+		);
+
+		$addons_not_altered = vipgoci_wpcore_misc_get_addons_not_altered(
+			$options,
+			$known_addons,
+			$files_affected_by_commit_by_pr
+		);
+
+		$this->assertSame(
+			array(
+				'client-mu-plugins/my-plugin2/plugin.php',
+				'plugins/hello3/hello3.php',
+				'themes/theme1/style.css',
+				'themes/theme2/hello/hello.php',
+				'themes/theme3/hello/hello.php',
+				'themes/theme3/style.css',
+			),
+			$addons_not_altered
+		);
+	}
+}

unittests.ini.dist

@@ -56,6 +56,7 @@ lint-php2-version=8.1
 plugin-slug=classic-editor
 theme-slug=twentytwenty
 wpscan-pr-1-commit-id=343d83dda119ef782ad66ad1db9e7f80b0630cc4
+wpscan-pr-1-branch-ref=master
 wpscan-pr-1-dirs-scan=plugins,mu-plugins,themes
 wpscan-pr-1-number=52
 wpscan-pr-1-dirs-altered=plugins/hello,plugins/not-a-plugin,themes/twentytwentyone

wp-core-misc.php

@@ -845,3 +845,65 @@ function vipgoci_wpcore_misc_get_addon_data_and_slugs_for_directory(
 	return $addons_found;
 }
 
+/**
+ * Returns a list of WordPress add-ons found in $known_addons that
+ * cannot be associated with changes in pull requests. Attempts to
+ * associate each changed file with an add-on, and returns
+ * those that cannot be associated.
+ *
+ * @param array $options                        Options array for the program.
+ * @param array $known_addons                   Array of paths to known add-ons (relative to repository base).
+ * @param array $files_affected_by_commit_by_pr Files affected by commit by pull request (relative to repository base).
+ *
+ * @return Array Paths to add-ons that could not be associated with changed files.
+ */
+function vipgoci_wpcore_misc_get_addons_not_altered(
+	array $options,
+	array $known_addons,
+	array $files_affected_by_commit_by_pr
+) :array {
+	$addons_matched = array();
+
+	$changed_files = $files_affected_by_commit_by_pr['all'];
+
+	$known_addon_base_paths = array();
+
+	foreach ( $known_addons as $addon_path ) {
+		$known_addon_base_paths[ dirname( $addon_path ) ] = $addon_path;
+	}
+
+	foreach ( $changed_files as $changed_file ) {
+		if ( in_array( $changed_file, $known_addons, true ) ) {
+			$addons_matched[ $changed_file ] = $changed_file;
+			continue;
+		}
+
+		$changed_file_dirname = $changed_file;
+
+		do {
+			$changed_file_dirname = dirname( $changed_file_dirname );
+
+			if ( in_array(
+				$changed_file_dirname,
+				$options['wpscan-api-paths'],
+				true
+			) ) {
+				break;
+			}
+
+			if ( isset( $known_addon_base_paths[ $changed_file_dirname ] ) ) {
+				$addons_matched[ $changed_file ] = $known_addon_base_paths[ $changed_file_dirname ];
+
+				break;
+			}
+		} while ( str_contains( $changed_file_dirname, '/' ) );
+	}
+
+	return array_values(
+		array_diff(
+			$known_addons,
+			array_values( $addons_matched )
+		)
+	);
+}
+