tests.yml

name: Run Tests

# When to run tests.
on:
  pull_request:
    types:
      - opened
      - synchronize
  push:
    branches:
      - main

jobs:
  dependabot-metadata:
    # Name.
    name: Dependabot Metadata

    # Virtual Environment to use.
    # @see: https://github.com/actions/virtual-environments
    runs-on: ubuntu-latest

    # Don't run if the PR is not from Dependabot.
    if: github.actor == 'dependabot[bot]'

    # Outputs.
    outputs:
      package-ecosystem: ${{ steps.metadata.outputs.package-ecosystem }}

    # Steps to fetch Dependabot metadata.
    steps:
      - name: Fetch Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@v3
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"

  tests:
    # Name.
    name: ${{ matrix.test-groups }} / WordPress ${{ matrix.wp-versions }} / PHP ${{ matrix.php-versions }}

    # Virtual Environment to use.
    # @see: https://github.com/actions/virtual-environments
    runs-on: ubuntu-latest

    # Requieres the dependabot-metadata job to have run successfully.
    needs: [dependabot-metadata]

    # Always allow non-Dependabot PRs and pushes.
    # For Dependabot PRs, only run when the update is for composer (skip github-actions updates).
    if: |
      always() &&
      (
        github.actor != 'dependabot[bot]' ||
        needs.dependabot-metadata.outputs.package-ecosystem == 'composer'
      )

    # Environment Variables.
    # Accessible by using ${{ env.NAME }}
    # Use ${{ secrets.NAME }} to include any GitHub Secrets in ${{ env.NAME }}
    env:
      ROOT_DIR: /var/www/html
      PLUGIN_DIR: /var/www/html/wp-content/plugins/convertkit
      CACHE_DIR: /var/www/html/wp-content/plugins/wp-super-cache/
      DB_NAME: test
      DB_USER: root
      DB_PASS: root
      DB_HOST: localhost
      WORDPRESS_V3_BLOCK_EDITOR_ENABLED: true
      WORDPRESS_DB_SQL_DUMP_FILE: tests/Support/Data/dump.sql
      INSTALL_PLUGINS: "admin-menu-editor autoptimize beaver-builder-lite-version block-visibility contact-form-7 classic-editor custom-post-type-ui debloat elementor forminator jetpack-boost mailchimp-for-wp rocket-lazy-load woocommerce wordpress-seo wpforms-lite litespeed-cache wp-crontrol wp-super-cache w3-total-cache wp-fastest-cache wp-optimize sg-cachepress" # Don't include this repository's Plugin here.
      INSTALL_PLUGINS_URLS: "https://downloads.wordpress.org/plugin/convertkit-for-woocommerce.1.6.4.zip http://cktestplugins.wpengine.com/wp-content/uploads/2024/01/convertkit-action-filter-tests.zip http://cktestplugins.wpengine.com/wp-content/uploads/2024/11/disable-doing-it-wrong-notices.zip http://cktestplugins.wpengine.com/wp-content/uploads/2025/03/uncode-js_composer.7.8.zip http://cktestplugins.wpengine.com/wp-content/uploads/2025/03/uncode-core.zip" # URLs to specific third party Plugins
      INSTALL_THEMES_URLS: "http://cktestplugins.wpengine.com/wp-content/uploads/2025/03/uncode.zip http://cktestplugins.wpengine.com/wp-content/uploads/2026/03/Divi_5.zip http://cktestplugins.wpengine.com/wp-content/uploads/2026/01/impeka.zip"
      CONVERTKIT_API_KEY: ${{ secrets.CONVERTKIT_API_KEY }} # ConvertKit API Key, stored in the repository's Settings > Secrets
      CONVERTKIT_API_SECRET: ${{ secrets.CONVERTKIT_API_SECRET }} # ConvertKit API Secret, stored in the repository's Settings > Secrets
      CONVERTKIT_API_KEY_NO_DATA: ${{ secrets.CONVERTKIT_API_KEY_NO_DATA }} # ConvertKit API Key for ConvertKit account with no data, stored in the repository's Settings > Secrets
      CONVERTKIT_API_SECRET_NO_DATA: ${{ secrets.CONVERTKIT_API_SECRET_NO_DATA }} # ConvertKit API Secret for ConvertKit account with no data, stored in the repository's Settings > Secrets
      CONVERTKIT_OAUTH_CLIENT_ID: ${{ secrets.CONVERTKIT_OAUTH_CLIENT_ID }}
      CONVERTKIT_OAUTH_REDIRECT_URI: ${{ secrets.CONVERTKIT_OAUTH_REDIRECT_URI }}
      KIT_OAUTH_REDIRECT_URI: ${{ secrets.KIT_OAUTH_REDIRECT_URI }}
      CONVERTKIT_API_SIGNED_SUBSCRIBER_ID: ${{ secrets.CONVERTKIT_API_SIGNED_SUBSCRIBER_ID }} # ConvertKit API Signed Subscriber ID, stored in the repository's Settings > Secrets
      CONVERTKIT_API_SIGNED_SUBSCRIBER_ID_NO_ACCESS: ${{ secrets.CONVERTKIT_API_SIGNED_SUBSCRIBER_ID_NO_ACCESS }} # ConvertKit API Signed Subscriber ID with no access to Products, stored in the repository's Settings > Secrets
      CONVERTKIT_API_RECAPTCHA_SITE_KEY: ${{ secrets.CONVERTKIT_API_RECAPTCHA_SITE_KEY }} # Google reCAPTCHA v3 Site Key, stored in the repository's Settings > Secrets
      CONVERTKIT_API_RECAPTCHA_SECRET_KEY: ${{ secrets.CONVERTKIT_API_RECAPTCHA_SECRET_KEY }} # Google reCAPTCHA v3 Secret Key, stored in the repository's Settings > Secrets
      
    # Defines the WordPress and PHP Versions matrix to run tests on
    # WooCommerce 5.9.0 requires WordPress 5.6 or greater, so we do not test on earlier versions
    # If testing older WordPress versions, ensure they are e.g. 5.7.4, 5.6.6 that have the X3 SSL fix: https://core.trac.wordpress.org/ticket/54207
    strategy:
      fail-fast: false
      matrix:
        wp-versions: [ 'latest' ] #[ '6.1.1', 'latest' ]
        php-versions: [ '8.1', '8.2', '8.3', '8.4' ] #[ '7.4', '8.0', '8.1' ]

        # Folder names within the 'tests' folder to run tests in parallel.
        test-groups: [
          'EndToEnd/broadcasts/blocks-shortcodes',
          'EndToEnd/broadcasts/import-export',
          'EndToEnd/forms/blocks-shortcodes',
          'EndToEnd/forms/general',
          'EndToEnd/forms/post-types',
          'EndToEnd/general/other',
          'EndToEnd/general/uninstall',
          'EndToEnd/general/plugin-screens',
          'EndToEnd/integrations/divi-builder',
          'EndToEnd/integrations/divi-theme',
          'EndToEnd/integrations/other',
          'EndToEnd/integrations/wlm',
          'EndToEnd/integrations/woocommerce',
          'EndToEnd/landing-pages',
          'EndToEnd/products',
          'EndToEnd/restrict-content/general',
          'EndToEnd/restrict-content/post-types',
          'EndToEnd/tags',
          'Integration'
        ]

    # Steps to install, configure and run tests
    steps:
      - name: Define Test Group Name
        id: test-group
        uses: mad9000/actions-find-and-replace-string@5
        with:
          source: ${{ matrix.test-groups }}
          find: '/'        
          replace: '-'
          replaceAll: true

      # Checkout Plugin to /home/runner/work/convertkit-wordpress/convertkit-wordpress/convertkit
      # We cannot checkout to ${{ env.PLUGIN_DIR }} as GitHub Actions require it be first placed in /home/runner/work/repo/repo
      - name: Checkout Plugin
        uses: actions/checkout@v6
        with:
          path: /home/runner/work/convertkit-wordpress/convertkit-wordpress/convertkit

      - name: Start MySQL
        run: sudo systemctl start mysql.service

      - name: Create MySQL Database
        run: |
          mysql -e 'CREATE DATABASE test;' -u${{ env.DB_USER }} -p${{ env.DB_PASS }}
          mysql -e 'SHOW DATABASES;' -u${{ env.DB_USER }} -p${{ env.DB_PASS }}

      # WordPress won't be able to connect to the DB if we don't perform this step.
      - name: Permit MySQL Password Auth for MySQL 8.0
        run: mysql -e "ALTER USER '${{ env.DB_USER }}'@'${{ env.DB_HOST }}' IDENTIFIED WITH mysql_native_password BY '${{ env.DB_PASS }}';"  -u${{ env.DB_USER }} -p${{ env.DB_PASS }} 

      # Some workflows checkout WordPress from GitHub, but that seems to bring a bunch of uncompiled files with it.
      # Instead download from wordpress.org stable.
      - name: Download and Extract WordPress
        run: |
          sudo chown -R runner:docker /var/www/html
          ls -la /var/www/html
          cd /var/www/html
          wget https://wordpress.org/wordpress-${{ matrix.wp-versions }}.tar.gz
          tar xfz wordpress-${{ matrix.wp-versions }}.tar.gz
          mv wordpress/* .
          rm -rf wordpress wordpress-${{ matrix.wp-versions }}.tar.gz

      # We install WP-CLI, as it provides useful commands to setup and install WordPress through the command line.
      - name: Install WP-CLI
        run: |
          curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
          chmod +x wp-cli.phar
          sudo mv wp-cli.phar /usr/local/bin/wp-cli

      - name: Setup wp-config.php
        working-directory: ${{ env.ROOT_DIR }}
        run: wp-cli config create --dbname=${{ env.DB_NAME }} --dbuser=${{ env.DB_USER }} --dbpass=${{ env.DB_PASS }} --dbhost=${{ env.DB_HOST }} --locale=en_DB

      - name: Install WordPress
        working-directory: ${{ env.ROOT_DIR }}
        run: wp-cli core install --url=127.0.0.1 --title=ConvertKit --admin_user=admin --admin_password=password --admin_email=wordpress@convertkit.local

      # env.INSTALL_PLUGINS is a list of Plugin slugs, space separated e.g. contact-form-7 woocommerce.
      - name: Install Free Third Party WordPress Plugins
        working-directory: ${{ env.ROOT_DIR }}
        run: wp-cli plugin install ${{ env.INSTALL_PLUGINS }}

      # env.INSTALL_PLUGINS_URLS is a list of Plugin URLs, space separated, to install specific versions of third party Plugins.
      - name: Install Free Third Party WordPress Specific Version Plugins
        working-directory: ${{ env.ROOT_DIR }}
        run: wp-cli plugin install ${{ env.INSTALL_PLUGINS_URLS }}

      # env.INSTALL_THEMES_URLS is a list of Theme URLs, space separated, to install specific versions of third party Themes.
      - name: Install Free Third Party WordPress Specific Version Themes
        working-directory: ${{ env.ROOT_DIR }}
        run: wp-cli theme install ${{ env.INSTALL_THEMES_URLS }}

      # These should be stored as a separated list of URLs in the repository Settings > Secrets > Repository Secret > CONVERTKIT_PAID_PLUGIN_URLS.
      # We cannot include the URLs in this file, as they're not Plugins we are permitted to distribute.
      - name: Install Paid Third Party WordPress Plugins
        working-directory: ${{ env.ROOT_DIR }}
        run: wp-cli plugin install ${{ secrets.CONVERTKIT_PAID_PLUGIN_URLS }}

      # Install 2021 Theme, which provides support for widgets.
      # 2021 Theme isn't included in WordPress 6.4 or higher, but is required for our widget tests.
      - name: Install WordPress Themes
        working-directory: ${{ env.ROOT_DIR }}
        run: wp-cli theme install twentytwentyone

      # Move Plugin
      - name: Move Plugin
        run: mv /home/runner/work/convertkit-wordpress/convertkit-wordpress/convertkit ${{ env.PLUGIN_DIR }}
      
      # WP_DEBUG = true is required so all PHP errors are output and caught by tests (E_ALL).
      # WP_DEBUG = false for other integraiton tests, as Elementor in PHP 8.4 throws a deprecation notice
      - name: Enable WP_DEBUG
        if: ${{ matrix.test-groups != 'EndToEnd/integrations/other' && matrix.php-versions != '8.4' }}
        working-directory: ${{ env.ROOT_DIR }}
        run: |
          wp-cli config set WP_DEBUG true --raw

      # FS_METHOD = direct is required for WP_Filesystem to operate without suppressed PHP fopen() errors that trip up tests.
      - name: Enable FS_METHOD
        working-directory: ${{ env.ROOT_DIR }}
        run: |
          wp-cli config set FS_METHOD direct

      # DISALLOW_FILE_MODS = true is required to disable the block directory's "Available to Install" suggestions, which trips up
      # tests that search and wait for block results.
      # We don't enable DISALLOW_FILE_MODS for the UninstallCest test, as tests will perform a Plugin deletion
      # which requires DISALLOW_FILE_MODS to not be true.
      - name: Enable DISALLOW_FILE_MODS
        if: ${{ matrix.test-groups != 'EndToEnd/general/uninstall' }}
        working-directory: ${{ env.ROOT_DIR }}
        run: |
          wp-cli config set DISALLOW_FILE_MODS true --raw

      # This step is deliberately after WordPress installation and configuration, as enabling PHP 8.x before using WP-CLI results
      # in the workflow failing due to incompatibilities between WP-CLI and PHP 8.x.
      # By installing PHP at this stage, we can still run our tests against e.g. PHP 8.x.
      - name: Install PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ matrix.php-versions }}
          coverage: xdebug

      # Configure nginx to use the PHP version and WOrdPress installation at /var/www/html
      - name: Configure nginx site
        run: |
          sudo rm -f /etc/nginx/sites-enabled/default
          sudo tee /etc/nginx/sites-available/default > /dev/null << 'EOF'

          server {
            listen 80 default_server;
            listen [::]:80 default_server;

            root /var/www/html;
            index index.php;

            server_name localhost;

            location / {
                try_files $uri $uri/ /index.php?$args;
            }

            location ~ \.php$ {
                include snippets/fastcgi-php.conf;
                fastcgi_pass unix:/run/php/php${{ matrix.php-versions }}-fpm.sock;

                # Prevent 502 Bad Gateway error "upstream sent too big header while reading response header from upstream"
                fastcgi_buffers 16 16k;
                fastcgi_buffer_size 32k;
                fastcgi_busy_buffers_size 64k;
            }

            location ~ /\.ht {
                deny all;
            }
          }
          EOF

          sudo ln -s /etc/nginx/sites-available/default /etc/nginx/sites-enabled/default || true

      - name: Test nginx
        run: sudo nginx -t

      - name: Start nginx
        run: sudo systemctl start nginx.service

      # Start chromedriver
      - name: Start chromedriver
        run: |
          export DISPLAY=:99
          chromedriver --port=9515 --url-base=/wd/hub &
          sudo Xvfb -ac :99 -screen 0 1920x1080x24 > /dev/null 2>&1 & # optional

      # Exchange API Keys and Secrets for OAuth Tokens.
      - name: Exchange API Key and Secret for OAuth Tokens
        id: get-oauth-tokens
        run: |
          response=$(curl -s -X POST "${{ secrets.CONVERTKIT_EXCHANGE_API_KEYS_ENDPOINT }}?api_key=${{ env.CONVERTKIT_API_KEY }}&api_secret=${{ env.CONVERTKIT_API_SECRET }}&client_id=${{ env.CONVERTKIT_OAUTH_CLIENT_ID }}&redirect_uri=${{ env.CONVERTKIT_OAUTH_REDIRECT_URI }}&tenant_name=github-actions-${{ steps.test-group.outputs.value }}-${{ matrix.php-versions }}")
          access_token=$(echo "$response" | jq -r '.oauth.access_token')
          refresh_token=$(echo "$response" | jq -r '.oauth.refresh_token')
          echo "CONVERTKIT_OAUTH_ACCESS_TOKEN=$access_token" >> $GITHUB_ENV
          echo "CONVERTKIT_OAUTH_REFRESH_TOKEN=$refresh_token" >> $GITHUB_ENV
          response=$(curl -s -X POST "${{ secrets.CONVERTKIT_EXCHANGE_API_KEYS_ENDPOINT }}?api_key=${{ env.CONVERTKIT_API_KEY_NO_DATA }}&api_secret=${{ env.CONVERTKIT_API_SECRET_NO_DATA }}&client_id=${{ env.CONVERTKIT_OAUTH_CLIENT_ID }}&redirect_uri=${{ env.CONVERTKIT_OAUTH_REDIRECT_URI }}&tenant_name=github-actions-${{ steps.test-group.outputs.value }}-${{ matrix.php-versions }}")
          access_token=$(echo "$response" | jq -r '.oauth.access_token')
          refresh_token=$(echo "$response" | jq -r '.oauth.refresh_token')
          echo "CONVERTKIT_OAUTH_ACCESS_TOKEN_NO_DATA=$access_token" >> $GITHUB_ENV
          echo "CONVERTKIT_OAUTH_REFRESH_TOKEN_NO_DATA=$refresh_token" >> $GITHUB_ENV

      # Write any secrets, such as API keys, to the .env.testing file now.
      - name: Define GitHub Secrets in .env.dist.testing
        uses: DamianReeves/write-file-action@v1.3
        with:
          path: ${{ env.PLUGIN_DIR }}/.env.testing
          contents: |
            WORDPRESS_V3_BLOCK_EDITOR_ENABLED=${{ env.WORDPRESS_V3_BLOCK_EDITOR_ENABLED }}
            WORDPRESS_DB_SQL_DUMP_FILE=${{ env.WORDPRESS_DB_SQL_DUMP_FILE }}
            CONVERTKIT_API_KEY=${{ env.CONVERTKIT_API_KEY }}
            CONVERTKIT_API_SECRET=${{ env.CONVERTKIT_API_SECRET }}
            CONVERTKIT_API_KEY_NO_DATA=${{ env.CONVERTKIT_API_KEY_NO_DATA }}
            CONVERTKIT_API_SECRET_NO_DATA=${{ env.CONVERTKIT_API_SECRET_NO_DATA }}
            CONVERTKIT_OAUTH_ACCESS_TOKEN=${{ env.CONVERTKIT_OAUTH_ACCESS_TOKEN }}
            CONVERTKIT_OAUTH_REFRESH_TOKEN=${{ env.CONVERTKIT_OAUTH_REFRESH_TOKEN }}
            CONVERTKIT_OAUTH_ACCESS_TOKEN_NO_DATA=${{ env.CONVERTKIT_OAUTH_ACCESS_TOKEN_NO_DATA }}
            CONVERTKIT_OAUTH_REFRESH_TOKEN_NO_DATA=${{ env.CONVERTKIT_OAUTH_REFRESH_TOKEN_NO_DATA }}
            CONVERTKIT_OAUTH_CLIENT_ID=${{ env.CONVERTKIT_OAUTH_CLIENT_ID }}
            CONVERTKIT_OAUTH_REDIRECT_URI=${{ env.CONVERTKIT_OAUTH_REDIRECT_URI }}
            KIT_OAUTH_REDIRECT_URI=${{ env.KIT_OAUTH_REDIRECT_URI }}
            CONVERTKIT_API_SIGNED_SUBSCRIBER_ID=${{ env.CONVERTKIT_API_SIGNED_SUBSCRIBER_ID }}
            CONVERTKIT_API_SIGNED_SUBSCRIBER_ID_NO_ACCESS=${{ env.CONVERTKIT_API_SIGNED_SUBSCRIBER_ID_NO_ACCESS }}
            CONVERTKIT_API_RECAPTCHA_SITE_KEY=${{ env.CONVERTKIT_API_RECAPTCHA_SITE_KEY }}
            CONVERTKIT_API_RECAPTCHA_SECRET_KEY=${{ env.CONVERTKIT_API_RECAPTCHA_SECRET_KEY }}
            
          write-mode: overwrite

      # Installs wp-browser, Codeception, PHP CodeSniffer and anything else needed to run tests.
      - name: Run Composer
        working-directory: ${{ env.PLUGIN_DIR }}
        run: composer update

      # Build the frontend CSS and JS assets
      - name: Run npm
        working-directory: ${{ env.PLUGIN_DIR }}
        run: |
          npm install
          npm run build

      # Confirm that expected files exist
      # if e.g. `composer install` or `npm run build` fails
      - name: Check Kit WordPress Libraries and Assets Exists
        working-directory: ${{ env.PLUGIN_DIR }}
        run: |
          set -e

          files=(
            "resources/frontend/css/frontend.css"
            "resources/frontend/js/dist/frontend.min.asset.php"
            "resources/frontend/js/dist/frontend.min.js"
            "vendor/convertkit/convertkit-wordpress-libraries/src/class-convertkit-api-traits.php"
            "vendor/convertkit/convertkit-wordpress-libraries/src/class-convertkit-api-v4.php"
            "vendor/convertkit/convertkit-wordpress-libraries/src/class-convertkit-log.php"
            "vendor/convertkit/convertkit-wordpress-libraries/src/class-convertkit-resource-v4.php"
            "vendor/convertkit/convertkit-wordpress-libraries/src/class-convertkit-review-request.php"
          )

          for file in "${files[@]}"; do
            echo "Checking: $file"
            test -f "$file" || { echo "❌ Missing required file: $file"; exit 1; }
          done

          echo "✅ All required files exist."

      - name: Build PHP Autoloader
        working-directory: ${{ env.PLUGIN_DIR }}
        run: composer dump-autoload

      # This ensures that applicable files and folders can be written to by WordPress and cache Plugins.
      - name: Set File and Folder Permissions
        run: |
          sudo chmod 767 ${{ env.ROOT_DIR }}
          sudo chown www-data:www-data ${{ env.ROOT_DIR }}

          sudo chmod 767 ${{ env.ROOT_DIR }}/wp-config.php
          sudo chown www-data:www-data ${{ env.ROOT_DIR }}/wp-config.php

          sudo chmod 767 ${{ env.ROOT_DIR }}/wp-content
          sudo chown www-data:www-data ${{ env.ROOT_DIR }}/wp-content

          sudo chmod -R 767 ${{ env.ROOT_DIR }}/wp-content/uploads
          sudo chown www-data:www-data ${{ env.ROOT_DIR }}/wp-content/uploads

      # This ensures the Plugin's log file can be written to.
      # We don't recursively do this, as it'll prevent Codeception from writing to the /tests/_output directory.
      - name: Set Permissions for Plugin Directory
        run: |
          sudo chmod g+w ${{ env.PLUGIN_DIR }}
          sudo chown www-data:www-data ${{ env.PLUGIN_DIR }}

      # Build Codeception Tests.
      - name: Build Tests
        working-directory: ${{ env.PLUGIN_DIR }}
        run: php vendor/bin/codecept build

      # Run Codeception Tests.
      - name: Run tests/${{ matrix.test-groups }}
        working-directory: ${{ env.PLUGIN_DIR }}
        run: php vendor/bin/codecept run tests/${{ matrix.test-groups }} --fail-fast

      # Artifacts are data generated by this workflow that we want to access, such as log files, screenshots, HTML output.
      # The if: failure() directive means that this will run when the workflow fails e.g. if a test fails, which is needed
      # because we want to see why a test failed.
      - name: Upload nginx Error Log to Artifact
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: nginx-error-log-${{ steps.test-group.outputs.value }}-${{ matrix.php-versions }}.log
          path: /var/log/nginx/error.log

      - name: Upload Test Results to Artifact
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: test-results-${{ steps.test-group.outputs.value }}-${{ matrix.php-versions }}
          path: ${{ env.PLUGIN_DIR }}/tests/_output/

      - name: Upload Plugin Log File to Artifact
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: log-${{ steps.test-group.outputs.value }}-${{ matrix.php-versions }}.txt
          path: ${{ env.PLUGIN_DIR }}/log/log.txt

  build-and-deploy:
    name: WordPress Playground

    # Require the dependabot-metadata and tests workflows to have run successfully.
    needs: [dependabot-metadata, tests]
    if: |
      always() &&
      github.event_name == 'pull_request' &&
      needs.tests.result == 'success' &&
      (
        github.actor != 'dependabot[bot]' ||
        needs.dependabot-metadata.outputs.package-ecosystem == 'composer'
      )

    # Virtual Environment to use.
    # @see: https://github.com/actions/virtual-environments
    runs-on: ubuntu-latest

    # Define permissions for this action.
    permissions:
      id-token: write
      contents: write
      pull-requests: write

    # Environment Variables.
    # Accessible by using ${{ env.NAME }}
    # Use ${{ secrets.NAME }} to include any GitHub Secrets in ${{ env.NAME }}
    # The base folder will always be /home/runner/work/github-repo-name/github-repo-name
    env:
      PLUGIN_SLUG: "convertkit" # The plugin's slug
      AWS_ROLE: "arn:aws:iam::048876701201:role/KitWPPluginBuildsRole"
      AWS_ROLE_SESSION_NAME: "kit-wordpress"
      AWS_BUCKET: "048876701201-kit-wp-plugin-builds" # The Amazon S3 bucket name
      AWS_REGION: "us-east-2" # The Amazon S3 region
      CONVERTKIT_API_KEY: ${{ secrets.CONVERTKIT_API_KEY }} # ConvertKit API Key, stored in the repository's Settings > Secrets
      CONVERTKIT_API_SECRET: ${{ secrets.CONVERTKIT_API_SECRET }} # ConvertKit API Secret, stored in the repository's Settings > Secrets
      CONVERTKIT_OAUTH_CLIENT_ID: ${{ secrets.CONVERTKIT_OAUTH_CLIENT_ID }}
      CONVERTKIT_OAUTH_REDIRECT_URI: ${{ secrets.CONVERTKIT_OAUTH_REDIRECT_URI }}
      
    # Steps to build and provide the Playground URL
    steps:
      # Checkout (copy) this repository's Plugin to this VM.
      - name: Checkout Plugin
        uses: actions/checkout@v6

      # Installs Kit WordPress Libraries.
      - name: Run Composer
        run: composer install --no-dev

      # Build the frontend CSS and JS assets.
      - name: Run npm
        run: |
          npm install
          npm run build

      # Configure AWS Credentials
      - name: Configure AWS credentials
        id: credentials
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ env.AWS_ROLE }}
          role-session-name: ${{ env.AWS_ROLE_SESSION_NAME }}
          aws-region: ${{ env.AWS_REGION }}

      # Create ZIP file
      - name: Create ZIP File
        run: |
          zip -r ${{ env.PLUGIN_SLUG }}.zip . -x ".git/*" ".github/*" ".scripts/*" ".wordpress-org/*" "log/*" "node_modules/*" "tests/*" "*.md" "*.yml" "*.json" "*.neon" "*.lock" "*.xml" "*.dist" ".eslintrc.js" "*.example" "*.testing" "vendor/convertkit/convertkit-wordpress-libraries/.git/*"

      # Exchange API Keys and Secrets for OAuth Tokens.
      - name: Exchange API Key and Secret for OAuth Tokens
        id: get-oauth-tokens
        run: |
          response=$(curl -s -X POST "${{ secrets.CONVERTKIT_EXCHANGE_API_KEYS_ENDPOINT }}?api_key=${{ env.CONVERTKIT_API_KEY }}&api_secret=${{ env.CONVERTKIT_API_SECRET }}&client_id=${{ env.CONVERTKIT_OAUTH_CLIENT_ID }}&redirect_uri=${{ env.CONVERTKIT_OAUTH_REDIRECT_URI }}&tenant_name=github-playground-${{ github.event.pull_request.number }}")
          access_token=$(echo "$response" | jq -r '.oauth.access_token')
          refresh_token=$(echo "$response" | jq -r '.oauth.refresh_token')
          echo "CONVERTKIT_OAUTH_ACCESS_TOKEN=$access_token" >> $GITHUB_ENV
          echo "CONVERTKIT_OAUTH_REFRESH_TOKEN=$refresh_token" >> $GITHUB_ENV
          
      # Create base64 encoded version of blueprint JSON for Playground URL.
      # See: https://wordpress.github.io/wordpress-playground/blueprints/using-blueprints#base64-encoded-blueprints
      - name: Create Blueprint JSON, Base64 Encoded
        id: blueprint
        run: |
          echo "blueprint_json_base64=$(echo -n '{"landingPage":"/wp-admin/index.php","login":true,"features":{"networking":true},"steps":[{"step":"setSiteOptions","options":{"_wp_convertkit_settings":{"access_token":"${{ env.CONVERTKIT_OAUTH_ACCESS_TOKEN }}","refresh_token":"${{ env.CONVERTKIT_OAUTH_REFRESH_TOKEN }}"}}},{"step":"installPlugin","pluginData":{"resource":"url","url":"https://${{ env.AWS_BUCKET }}.s3.${{ env.AWS_REGION }}.amazonaws.com/${{ env.PLUGIN_SLUG }}/${{ github.event.pull_request.number }}/${{ env.PLUGIN_SLUG }}.zip"}}]}' | base64 -w 0)" >> $GITHUB_OUTPUT

      # Upload to S3
      - name: Upload to S3
        id: upload-s3
        run: |
          aws s3 cp ${{ env.PLUGIN_SLUG }}.zip s3://${{ env.AWS_BUCKET }}/${{ env.PLUGIN_SLUG }}/${{ github.event.pull_request.number }}/${{ env.PLUGIN_SLUG }}.zip

      # Add comment to PR linking to Playground
      - name: Comment on PR
        uses: actions/github-script@v9
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `## WordPress Playground
              
              :rocket: Your PR has been built and is ready for testing in WordPress Playground!
              
              [Click here to test your changes in WordPress Playground](https://playground.wordpress.net/#${{ steps.blueprint.outputs.blueprint_json_base64 }})`
            })