Trust project configuration files in Behat runs by swissspidy · Pull Request #348 · wp-cli/wp-cli-tests

swissspidy · 2026-08-04T22:24:28Z

That PR gates require, exec, env and ssh-args directives found in a project-level wp-cli.yml behind a trust confirmation, controlled by --trust-project-config / WP_CLI_TRUST_PROJECT_CONFIG.

Test fixtures create such files all the time — Given a wp-cli.yml file: with a require: entry is one of the most common steps across the WP-CLI package suites, and given_a_request_to_a_url_respond_with_file() writes one itself. A Behat run is non-interactive, so without this change every one of those scenarios fails with:

Error: Untrusted project configuration file '…/wp-cli.yml' contains 'require' directive(s).
Run interactively to confirm, or set WP_CLI_TRUST_PROJECT_CONFIG=true / add path to system or
global config file to allow execution.

Changes

FeatureContext::get_process_env_variables() now passes WP_CLI_TRUST_PROJECT_CONFIG=1 to every command it runs. An explicit value in the outer environment still wins, following the same pass-through pattern already used for WP_CLI_CONFIG_PATH, WP_CLI_ALLOW_ROOT and friends.
Documented the behaviour in the README, including how a scenario overrides it per command (When I try \WP_CLI_TRUST_PROJECT_CONFIG=false wp cli version``), which is how the trust mechanism's own acceptance tests in Add project configuration trust verification (trust-project-config) wp-cli#6365 exercise the denial paths.

Testing

Ran the affected wp-cli/wp-cli feature scenarios against a checkout of wp-cli/wp-cli#6365 with this context patched in: the 28 scenarios that build a project wp-cli.yml containing require/exec/env/ssh-args and do not need a WordPress install (across command, config, flags, prompt, runcommand and runner features) fail without this change and pass with it. The nine new trust scenarios in features/config.feature still pass, confirming that the per-command override keeps working.

Note this needs to be released before wp-cli/wp-cli#6365's CI can go green, since that repo installs wp-cli/wp-cli-tests from a version constraint.

Generated by Claude Code

Summary by CodeRabbit

New Features
- Behat test processes now automatically trust project-level WP-CLI configuration by default.
- Added options to override this behavior globally or for individual commands.
Documentation
- Documented project configuration trust behavior and available override options.

WP-CLI gates `require`, `exec`, `env` and `ssh-args` directives found in a project-level wp-cli.yml behind a trust confirmation. Test fixtures create such files routinely and a non-interactive test run cannot answer the prompt, so pass WP_CLI_TRUST_PROJECT_CONFIG=1 to every command the Behat context runs. An explicit WP_CLI_TRUST_PROJECT_CONFIG in the outer environment still wins, and scenarios exercising the trust mechanism itself can keep overriding it per command. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RcafAC2UeQTVKoy8wVxJzB

coderabbitai · 2026-08-04T22:24:47Z

📝 Walkthrough

Walkthrough

Changes

Project configuration trust

Layer / File(s)	Summary
Configure and document project configuration trust `src/Context/FeatureContext.php`, `README.md`	Test processes now set `WP_CLI_TRUST_PROJECT_CONFIG` to an explicit environment value or default it to `1`. The README documents global and per-command overrides.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: copilot, schlessera

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: enabling project configuration file trust during Behat runs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch claude/wp-cli-pr-6365-landing-slkyfp

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 PHPStan (2.2.7)

PHPStan was skipped because the config uses disallowed bootstrapFiles, bootstrapFile, or includes directives.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

codecov · 2026-08-04T22:26:16Z

Codecov Report

❌ Patch coverage is 0% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/Context/FeatureContext.php	0.00%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!

Copilot

Pull request overview

This PR updates the WP-CLI Behat test harness to default to trusting project-level wp-cli.yml configuration during non-interactive runs, preventing widespread failures introduced by the new trust confirmation gate in wp-cli/wp-cli#6365.

Changes:

Default WP_CLI_TRUST_PROJECT_CONFIG to 1 for all Behat-invoked WP-CLI commands, while still honoring an explicitly-set outer environment value.
Document the default trust behavior and how to override it globally or per-command in the README.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/Context/FeatureContext.php	Adds a default `WP_CLI_TRUST_PROJECT_CONFIG=1` process environment value for commands executed by the Behat context (with passthrough override support).
README.md	Documents the default trust behavior in Behat runs and shows how to override it for the full run or per command.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Around line 150-157: Update the “Project configuration trust” heading in
README.md to use the repository’s configured setext heading style, and add a
gherkin language identifier to the command example’s fenced code block.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 47ae8d2e-65d6-4ffa-a607-d2c37a5e68b8

📥 Commits

Reviewing files that changed from the base of the PR and between b02c72d and 7896e5a.

📒 Files selected for processing (2)

README.md
src/Context/FeatureContext.php

coderabbitai · 2026-08-04T22:28:26Z

+#### Project configuration trust
+
+WP-CLI asks for confirmation before acting on `require`, `exec`, `env` or `ssh-args` directives found in a project-level `wp-cli.yml` file. Test fixtures create such files all the time and a test run cannot answer an interactive prompt, so the Behat context passes `WP_CLI_TRUST_PROJECT_CONFIG=1` to every command it runs.
+
+Set the `WP_CLI_TRUST_PROJECT_CONFIG` environment variable yourself to override that default for the whole run. Individual scenarios can override it per command:
+```
+When I try `WP_CLI_TRUST_PROJECT_CONFIG=false wp cli version`
+```


📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Fix the Markdown lint issues in the new section.

Line 150 must use the configured setext heading style. Line 155 must specify a fence language, such as gherkin.

Proposed fix

-#### Project configuration trust +Project configuration trust +--------------------------- ... -``` +```gherkin

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

#### Project configuration trust

WP-CLI asks for confirmation before acting on `require`, `exec`, `env` or `ssh-args` directives found in a project-level `wp-cli.yml` file. Test fixtures create such files all the time and a test run cannot answer an interactive prompt, so the Behat context passes `WP_CLI_TRUST_PROJECT_CONFIG=1` to every command it runs.

Set the `WP_CLI_TRUST_PROJECT_CONFIG` environment variable yourself to override that default for the whole run. Individual scenarios can override it per command:

```

When I try `WP_CLI_TRUST_PROJECT_CONFIG=false wp cli version`

```

Project configuration trust

---------------------------

WP-CLI asks for confirmation before acting on `require`, `exec`, `env` or `ssh-args` directives found in a project-level `wp-cli.yml` file. Test fixtures create such files all the time and a test run cannot answer an interactive prompt, so the Behat context passes `WP_CLI_TRUST_PROJECT_CONFIG=1` to every command it runs.

Set the `WP_CLI_TRUST_PROJECT_CONFIG` environment variable yourself to override that default for the whole run. Individual scenarios can override it per command:

🧰 Tools

🪛 markdownlint-cli2 (0.23.2)

[warning] 150-150: Heading style
Expected: setext; Actual: atx

(MD003, heading-style)

[warning] 155-155: Fenced code blocks should have a language specified

(MD040, fenced-code-language)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` around lines 150 - 157, Update the “Project configuration trust” heading in README.md to use the repository’s configured setext heading style, and add a gherkin language identifier to the command example’s fenced code block.

Source: Linters/SAST tools

swissspidy requested a review from a team as a code owner August 4, 2026 22:24

Copilot AI lite review requested due to automatic review settings August 4, 2026 22:24

Copilot started reviewing on behalf of swissspidy August 4, 2026 22:24 View session

swissspidy mentioned this pull request Aug 4, 2026

Add project configuration trust verification (trust-project-config) wp-cli/wp-cli#6365

Draft

Copilot AI reviewed Aug 4, 2026

View reviewed changes

coderabbitai Bot reviewed Aug 4, 2026

View reviewed changes

swissspidy marked this pull request as draft August 5, 2026 07:46

Navigation Menu

Uh oh!

Trust project configuration files in Behat runs - #348

Trust project configuration files in Behat runs#348
swissspidy wants to merge 1 commit into
mainfrom
claude/wp-cli-pr-6365-landing-slkyfp

swissspidy commented Aug 4, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 4, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

codecov Bot commented Aug 4, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot Aug 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

swissspidy commented Aug 4, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Testing

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

codecov Bot commented Aug 4, 2026

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

swissspidy commented Aug 4, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 4, 2026 •

edited

Loading