Fix PHPUnit cache writes through readonly mounts (#1805)

* Fix PHPUnit cache writes through readonly mounts

* Restrict PHPUnit caches to sandbox paths

* Use private PHPUnit result cache files

* Add Playground PHPUnit cache isolation integration

* Fix PHPUnit integration workflow triggers

Author: chubes4

.github/workflows/agent-task-contracts.yml

@@ -22,6 +22,9 @@ on:
       - "tests/redaction.test.ts"
       - "tests/production-boundary-enforcement.test.ts"
       - "tests/runtime-tool-policy.test.ts"
+      - "packages/runtime-playground/src/phpunit-command-handlers.ts"
+      - "tests/playground-phpunit-readonly-cache.integration.test.ts"
+      - "tests/fixtures/phpunit-playground-harness/**"
   push:
     paths:
       - ".github/scripts/run-agent-task/**"
@@ -43,6 +46,9 @@ on:
       - "tests/redaction.test.ts"
       - "tests/production-boundary-enforcement.test.ts"
       - "tests/runtime-tool-policy.test.ts"
+      - "packages/runtime-playground/src/phpunit-command-handlers.ts"
+      - "tests/playground-phpunit-readonly-cache.integration.test.ts"
+      - "tests/fixtures/phpunit-playground-harness/**"
 
 jobs:
   contracts:
@@ -55,10 +61,15 @@ jobs:
         with:
           node-version: 22
           cache: npm
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.2'
+          tools: composer:v2
       - run: npm ci
       - run: npm run build
       - run: npm run test:agent-task-contracts
       - run: npm run test:runtime-sources-playground-integration
+      - run: npm run test:playground-phpunit-readonly-cache-integration
       - run: npm run test:native-agent-task-playground-e2e
       - run: npm run test:native-agent-task-interruption
       - run: npm run test:redaction
@@ -71,4 +82,4 @@ jobs:
       - uses: actions/checkout@v4
       - uses: docker://rhysd/actionlint:1.7.7
         with:
-          args: .github/workflows/run-agent-task.yml
+          args: .github/workflows/agent-task-contracts.yml .github/workflows/run-agent-task.yml

package.json

@@ -93,6 +93,7 @@
     "test:runtime-sources-playground-integration": "tsx tests/runtime-sources-playground-integration.test.ts",
     "test:playground-readonly-mounts": "tsx tests/playground-readonly-mounts.test.ts",
     "test:playground-readonly-mounts-integration": "tsx tests/playground-readonly-mounts-integration.test.ts",
+    "test:playground-phpunit-readonly-cache-integration": "tsx tests/playground-phpunit-readonly-cache.integration.test.ts",
     "test:browser-task-builder": "tsx tests/browser-task-builder.test.ts",
     "test:browser-runtime-generic-invoker": "tsx tests/browser-runtime-generic-invoker.test.ts",
     "test:browser-runtime-file-ops": "tsx tests/browser-runtime-file-ops.test.ts",

packages/runtime-playground/src/phpunit-command-handlers.ts

@@ -273,8 +273,44 @@ function ${options.relativeFunctionName}(string $path, string $${options.rootPar
 }
 
 function phpunitArgsPhp(functionName: string, logFunction: string): string {
-  return `function ${functionName}(array $argv) {
-    $arguments = array('colors' => 'never', 'testdox' => true, 'verbose' => false, 'cacheResult' => false, 'extensions' => array());
+  return `function ${functionName}_private_cache_result_file() {
+    $path = false;
+    try {
+        $candidate = '/tmp/wp-codebox-phpunit-' . bin2hex(random_bytes(24)) . '.cache';
+        $handle = @fopen($candidate, 'x');
+        if ($handle !== false) {
+            fclose($handle);
+            $path = $candidate;
+        }
+    } catch (Throwable $e) {
+        // tempnam() asks the operating system to allocate a unique file when
+        // cryptographic randomness is unavailable.
+    }
+    if ($path === false) {
+        $path = tempnam('/tmp', 'wp-codebox-phpunit-');
+    }
+    if ($path === false) {
+        throw new RuntimeException('Unable to allocate a private PHPUnit result cache file.');
+    }
+    if (!@chmod($path, 0600)) {
+        @unlink($path);
+        throw new RuntimeException('Unable to restrict the private PHPUnit result cache file permissions.');
+    }
+    // fileperms() is meaningful on the POSIX filesystems used by Playground.
+    // Fail closed rather than passing a cache file with broader permissions.
+    $mode = @fileperms($path);
+    if ($mode !== false && (($mode & 0777) !== 0600)) {
+        @unlink($path);
+        throw new RuntimeException('Private PHPUnit result cache file permissions are not 0600.');
+    }
+    register_shutdown_function(static function () use ($path): void {
+        @unlink($path);
+    });
+    return $path;
+}
+
+function ${functionName}(array $argv) {
+    $arguments = array('colors' => 'never', 'testdox' => true, 'verbose' => false, 'cacheResult' => false, 'cacheResultFile' => ${functionName}_private_cache_result_file(), 'extensions' => array());
     $args = array_slice($argv, 1);
     for ($i = 0; $i < count($args); $i++) {
         $arg = $args[$i];

tests/fixtures/phpunit-playground-harness/composer.json

@@ -0,0 +1,17 @@
+{
+  "name": "automattic/wp-codebox-phpunit-playground-harness",
+  "description": "Locked PHPUnit harness for the WP Codebox Playground integration test.",
+  "license": "GPL-2.0-or-later",
+  "require": {
+    "php": ">=8.1",
+    "phpunit/phpunit": "9.6.34",
+    "wp-phpunit/wp-phpunit": "6.9.4",
+    "yoast/phpunit-polyfills": "3.1.2"
+  },
+  "config": {
+    "platform": {
+      "php": "8.3.0"
+    },
+    "sort-packages": true
+  }
+}