From a6db436a488b8e78570fadb45892b1b819e43925 Mon Sep 17 00:00:00 2001
From: Marcus Quinn <6428977+marcusquinn@users.noreply.github.com>
Date: Mon, 16 Mar 2026 23:08:00 +0000
Subject: [PATCH] fix: address bin/install-wp-tests.sh PR #15 review feedback
 (issue #29) (#54)

* fix: address PR #15 review feedback in bin/install-wp-tests.sh

- Harden download(): use curl -fsSL/-o, wget -qO, add else branch for
  missing curl/wget (HIGH finding from coderabbit)
- Fix beta/RC version logic: set WP_TESTS_TAG='branches/$WP_BRANCH' so
  the computed tag is not silently discarded (MEDIUM finding)
- Use --branch "$WP_TESTS_TAG" in git clone so the correct WP version
  is checked out instead of always pulling master (MEDIUM finding)
- Add failure checks (if ! cmd) after git clone and cp operations in
  install_test_suite (MEDIUM finding)
- Quote $ioption in all sed calls to prevent word splitting
- Replace sed trailing-slash strip with ${WP_CORE_DIR%/} (SC2001)
- Quote ${SKIP_DB_CREATE} and $EXTRA to prevent word splitting (SC2086)
- Suppress SC2001 for VERSION_ESCAPED sed (regex dot-escaping requires sed)
- ShellCheck: zero violations

Closes #29

* fix: strip SVN prefix from WP_TESTS_TAG for git clone --branch

WP_TESTS_TAG uses SVN-style paths (tags/X.Y.Z, branches/X.Y, trunk)
but git clone --branch requires bare ref names (X.Y.Z, X.Y, trunk).

Derive GIT_REF by stripping the tags/ or branches/ prefix before
passing to git clone. Also remove the no-op grep line in the latest
version lookup and add head -1 to guard against multiple matches.

Fixes CI failure: 'fatal: Remote branch tags/6.9.4 not found'
Closes #29
---
 bin/install-wp-tests.sh | 81 +++++++++++++++++++++++++++--------------
 1 file changed, 53 insertions(+), 28 deletions(-)

diff --git a/bin/install-wp-tests.sh b/bin/install-wp-tests.sh
index bf50908..462a59f 100755
--- a/bin/install-wp-tests.sh
+++ b/bin/install-wp-tests.sh
@@ -17,15 +17,19 @@ WP_TESTS_DIR=${WP_TESTS_DIR-/tmp/wordpress-tests-lib}
 WP_CORE_DIR=${WP_CORE_DIR-/tmp/wordpress/}
 
 download() {
-    if command -v curl > /dev/null; then
-        curl -s "$1" > "$2";
-    elif command -v wget > /dev/null; then
-        wget -nv -O "$2" "$1"
-    fi
+	if command -v curl >/dev/null 2>&1; then
+		curl -fsSL "$1" -o "$2"
+	elif command -v wget >/dev/null 2>&1; then
+		wget -qO "$2" "$1"
+	else
+		echo "Error: Neither curl nor wget is installed" >&2
+		exit 1
+	fi
 }
 
 if [[ $WP_VERSION =~ ^[0-9]+\.[0-9]+\-(beta|RC)[0-9]+$ ]]; then
 	WP_BRANCH=${WP_VERSION%\-*}
+	WP_TESTS_TAG="branches/$WP_BRANCH"
 elif [[ $WP_VERSION =~ ^[0-9]+\.[0-9]+$ ]]; then
 	WP_TESTS_TAG="branches/$WP_VERSION"
 elif [[ $WP_VERSION =~ [0-9]+\.[0-9]+\.[0-9]+ ]]; then
@@ -40,27 +44,38 @@ elif [[ $WP_VERSION == 'nightly' || $WP_VERSION == 'trunk' ]]; then
 else
 	# http serves a single offer, whereas https serves multiple. we only want one
 	download http://api.wordpress.org/core/version-check/1.7/ /tmp/wp-latest.json
-	grep '[0-9]+\.[0-9]+(\.[0-9]+)?' /tmp/wp-latest.json
-	LATEST_VERSION=$(grep -o '"version":"[^"]*' /tmp/wp-latest.json | sed 's/"version":"//')
+	LATEST_VERSION=$(grep -o '"version":"[^"]*' /tmp/wp-latest.json | sed 's/"version":"//' | head -1)
 	if [[ -z "$LATEST_VERSION" ]]; then
 		echo "Latest WordPress version could not be found"
 		exit 1
 	fi
 	WP_TESTS_TAG="tags/$LATEST_VERSION"
 fi
+
+# Derive a git ref from WP_TESTS_TAG by stripping the SVN-style prefix.
+# WP_TESTS_TAG uses "tags/X.Y.Z", "branches/X.Y", or "trunk".
+# git clone --branch requires the bare ref name ("X.Y.Z", "X.Y", or "trunk").
+if [[ "$WP_TESTS_TAG" == tags/* ]]; then
+	GIT_REF="${WP_TESTS_TAG#tags/}"
+elif [[ "$WP_TESTS_TAG" == branches/* ]]; then
+	GIT_REF="${WP_TESTS_TAG#branches/}"
+else
+	GIT_REF="$WP_TESTS_TAG"
+fi
+
 set -ex
 
 install_wp() {
 
 	if [ -d "$WP_CORE_DIR" ]; then
-		return;
+		return
 	fi
 
 	mkdir -p "$WP_CORE_DIR"
 
 	if [[ $WP_VERSION == 'nightly' || $WP_VERSION == 'trunk' ]]; then
 		mkdir -p "$WP_CORE_DIR"
-		download https://wordpress.org/nightly-builds/wordpress-latest.zip  "$WP_CORE_DIR/wordpress-nightly.zip"
+		download https://wordpress.org/nightly-builds/wordpress-latest.zip "$WP_CORE_DIR/wordpress-nightly.zip"
 		unzip -q "$WP_CORE_DIR/wordpress-nightly.zip" -d "$WP_CORE_DIR"
 		rm "$WP_CORE_DIR/wordpress-nightly.zip"
 	else
@@ -71,6 +86,7 @@ install_wp() {
 			if [[ $WP_VERSION =~ [0-9]+\.[0-9]+\.[0] ]]; then
 				LATEST_VERSION=${WP_VERSION%??}
 			else
+				# shellcheck disable=SC2001
 				VERSION_ESCAPED=$(echo "$WP_VERSION" | sed 's/\./\\\\./g')
 				LATEST_VERSION=$(grep -o '"version":"'"$VERSION_ESCAPED"'[^"]*' "$WP_CORE_DIR/wp-latest.json" | sed 's/"version":"//' | head -1)
 			fi
@@ -82,7 +98,7 @@ install_wp() {
 		else
 			local ARCHIVE_NAME="wordpress-$WP_VERSION"
 		fi
-		download https://wordpress.org/"${ARCHIVE_NAME}".tar.gz  "$WP_CORE_DIR/wordpress.tar.gz"
+		download https://wordpress.org/"${ARCHIVE_NAME}".tar.gz "$WP_CORE_DIR/wordpress.tar.gz"
 		tar --strip-components=1 -zxmf "$WP_CORE_DIR/wordpress.tar.gz" -C "$WP_CORE_DIR"
 		rm "$WP_CORE_DIR/wordpress.tar.gz"
 	fi
@@ -101,12 +117,21 @@ install_test_suite() {
 	# set up testing suite if it doesn't yet exist
 	if [ ! -d "$WP_TESTS_DIR" ]; then
 		mkdir -p "$WP_TESTS_DIR"
-		git clone --quiet --depth=1 https://github.com/WordPress/wordpress-develop.git /tmp/wordpress-develop
+		if ! git clone --quiet --depth=1 --branch "$GIT_REF" https://github.com/WordPress/wordpress-develop.git /tmp/wordpress-develop; then
+			echo "Error: Failed to clone wordpress-develop at branch/tag $GIT_REF" >&2
+			exit 1
+		fi
 		if [ -d /tmp/wordpress-develop/tests/phpunit/includes ]; then
-			cp -r /tmp/wordpress-develop/tests/phpunit/includes "$WP_TESTS_DIR/"
+			if ! cp -r /tmp/wordpress-develop/tests/phpunit/includes "$WP_TESTS_DIR/"; then
+				echo "Error: Failed to copy phpunit includes to $WP_TESTS_DIR" >&2
+				exit 1
+			fi
 		fi
 		if [ -d /tmp/wordpress-develop/tests/phpunit/data ]; then
-			cp -r /tmp/wordpress-develop/tests/phpunit/data "$WP_TESTS_DIR/"
+			if ! cp -r /tmp/wordpress-develop/tests/phpunit/data "$WP_TESTS_DIR/"; then
+				echo "Error: Failed to copy phpunit data to $WP_TESTS_DIR" >&2
+				exit 1
+			fi
 		fi
 	fi
 
@@ -116,15 +141,15 @@ install_test_suite() {
 		else
 			download https://raw.githubusercontent.com/WordPress/wordpress-develop/master/wp-tests-config-sample.php "$WP_TESTS_DIR"/wp-tests-config.php
 		fi
-		WP_CORE_DIR=$(echo "$WP_CORE_DIR" | sed "s:/\+$::")
-		sed $ioption "s:dirname( __FILE__ ) . '/src/':'$WP_CORE_DIR/':" "$WP_TESTS_DIR"/wp-tests-config.php
-		sed $ioption "s/youremptytestdbnamehere/$DB_NAME/" "$WP_TESTS_DIR"/wp-tests-config.php
-		sed $ioption "s/yourusernamehere/$DB_USER/" "$WP_TESTS_DIR"/wp-tests-config.php
-		sed $ioption "s/yourpasswordhere/$DB_PASS/" "$WP_TESTS_DIR"/wp-tests-config.php
-		sed $ioption "s|localhost|${DB_HOST}|" "$WP_TESTS_DIR"/wp-tests-config.php
+		WP_CORE_DIR="${WP_CORE_DIR%/}"
+		sed "$ioption" "s:dirname( __FILE__ ) . '/src/':'$WP_CORE_DIR/':" "$WP_TESTS_DIR"/wp-tests-config.php
+		sed "$ioption" "s/youremptytestdbnamehere/$DB_NAME/" "$WP_TESTS_DIR"/wp-tests-config.php
+		sed "$ioption" "s/yourusernamehere/$DB_USER/" "$WP_TESTS_DIR"/wp-tests-config.php
+		sed "$ioption" "s/yourpasswordhere/$DB_PASS/" "$WP_TESTS_DIR"/wp-tests-config.php
+		sed "$ioption" "s|localhost|${DB_HOST}|" "$WP_TESTS_DIR"/wp-tests-config.php
 
 		if [ "$MULTISITE" = "true" ]; then
-			sed $ioption "s:// define( 'WP_TESTS_MULTISITE', true );:define( 'WP_TESTS_MULTISITE', true );:" "$WP_TESTS_DIR"/wp-tests-config.php
+			sed "$ioption" "s:// define( 'WP_TESTS_MULTISITE', true );:define( 'WP_TESTS_MULTISITE', true );:" "$WP_TESTS_DIR"/wp-tests-config.php
 		fi
 	fi
 
@@ -132,27 +157,27 @@ install_test_suite() {
 
 install_db() {
 
-	if [ ${SKIP_DB_CREATE} = "true" ]; then
+	if [ "${SKIP_DB_CREATE}" = "true" ]; then
 		return 0
 	fi
 
 	local PARTS
-	IFS=':' read -ra PARTS <<< "$DB_HOST"
-	local DB_HOSTNAME=${PARTS[0]};
-	local DB_SOCK_OR_PORT=${PARTS[1]};
+	IFS=':' read -ra PARTS <<<"$DB_HOST"
+	local DB_HOSTNAME=${PARTS[0]}
+	local DB_SOCK_OR_PORT=${PARTS[1]}
 	local EXTRA=""
 
-	if [ -n "$DB_HOSTNAME" ] ; then
+	if [ -n "$DB_HOSTNAME" ]; then
 		if [[ $DB_SOCK_OR_PORT =~ ^[0-9]+$ ]]; then
 			EXTRA=" --host=$DB_HOSTNAME --port=$DB_SOCK_OR_PORT --protocol=tcp"
-		elif [ -n "$DB_SOCK_OR_PORT" ] ; then
+		elif [ -n "$DB_SOCK_OR_PORT" ]; then
 			EXTRA=" --socket=$DB_SOCK_OR_PORT"
-		elif [ -n "$DB_HOSTNAME" ] ; then
+		elif [ -n "$DB_HOSTNAME" ]; then
 			EXTRA=" --host=$DB_HOSTNAME --protocol=tcp"
 		fi
 	fi
 
-	mysqladmin create "$DB_NAME" --user="$DB_USER" --password="$DB_PASS"$EXTRA || true
+	mysqladmin create "$DB_NAME" --user="$DB_USER" --password="$DB_PASS""$EXTRA" || true
 }
 
 install_wp