@automattic/vip 4.1.5 → 4.1.8

package/cmd/vip-next/pendo_wiring_test.go

@@ -1,148 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/Automattic/vip/internal/auth"
-	"github.com/Automattic/vip/internal/keychain"
-	"github.com/Automattic/vip/internal/telemetry"
-	"github.com/spf13/cobra"
-)
-
-// The Pendo endpoint requires the same bearer as the command API. A payload-only
-// test with an always-200 server did not catch the missing authentication.
-func TestPendoUsesCommandSession(t *testing.T) {
-	for _, mode := range []string{"stored", "bypassed", "login"} {
-		t.Run(mode, func(t *testing.T) {
-			for _, name := range []string{"DO_NOT_TRACK", "GO_ENV", "NODE_ENV", "VIP_TOKEN_OVERRIDE", "WPVIP_DEPLOY_TOKEN", "VIP_PROXY", "vip_proxy", "VIP_USE_SYSTEM_PROXY"} {
-				t.Setenv(name, "")
-			}
-			raw := validBootstrapRaw(t, 10000)
-			accepted, rejected := 0, 0
-			pendo := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				if r.Header.Get("Authorization") != "Bearer "+raw {
-					rejected++
-					w.WriteHeader(http.StatusUnauthorized)
-					return
-				}
-				accepted++
-			}))
-			defer pendo.Close()
-			tracker := &telemetry.Tracker{Clients: []telemetry.Client{&telemetry.PendoClient{Endpoint: pendo.URL, UserID: "fixture"}}}
-			rec := &gqlOpRecorder{}
-			api := rec.server(t, map[string]string{
-				"ResolveAppByName":                  resolveAppByNameBody,
-				"GetEnvironmentVariablesWithValues": envVarsWithValuesBody,
-			})
-			defer api.Close()
-			t.Setenv("API_HOST", api.URL)
-			k := newBootstrapKeychain(&bootstrapBackend{})
-			if mode != "login" {
-				if err := auth.NewStore(k).Save(raw); err != nil {
-					t.Fatal(err)
-				}
-			}
-			variable := "HELP"
-			if mode == "bypassed" {
-				variable = "help"
-			}
-			err := runWithDeps([]string{"config", "envvar", "get", variable, "--app", "example", "--env", "develop"}, runDeps{
-				Tracker:     tracker,
-				NewKeychain: func(string) *keychain.Keychain { return k },
-				NewLogin: func(store *auth.Store) func() (*auth.Token, error) {
-					return func() (*auth.Token, error) {
-						// Login events before saving a token must not issue anonymous requests.
-						tracker.TrackEvent("login_command_execute", nil)
-						if err := store.Save(raw); err != nil {
-							return nil, err
-						}
-						tracker.AliasUser(10000)
-						return parsedBootstrapToken(t, raw), nil
-					}
-				},
-			})
-			if err != nil {
-				t.Fatal(err)
-			}
-			if rejected != 0 || accepted < 2 {
-				t.Fatalf("Pendo accepted=%d rejected=%d; expected authenticated command events only", accepted, rejected)
-			}
-		})
-	}
-}
-
-func TestPendoDebugFlagReachesClient(t *testing.T) {
-	for _, name := range []string{"DO_NOT_TRACK", "GO_ENV", "NODE_ENV", "DEBUG"} {
-		t.Setenv(name, "")
-	}
-	var out, diagnostics bytes.Buffer
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(401) }))
-	defer srv.Close()
-	tr := &telemetry.Tracker{Clients: []telemetry.Client{&telemetry.PendoClient{Endpoint: srv.URL, HTTP: srv.Client(), GetToken: func() (string, error) { return "private-token", nil }}}}
-	root := newRootBase(&rootContext{tracker: tr})
-	root.SetOut(&out)
-	root.SetErr(&diagnostics)
-	root.AddCommand(&cobra.Command{Use: "probe", Run: func(cmd *cobra.Command, _ []string) {
-		tr.TrackEvent("test", nil)
-		fmt.Fprintln(cmd.OutOrStdout(), "ok")
-	}})
-	root.SetArgs([]string{"probe", "-d"})
-	if err := root.Execute(); err != nil {
-		t.Fatal(err)
-	}
-	if out.String() != "ok\n" || !strings.Contains(diagnostics.String(), "401") || strings.Contains(diagnostics.String(), "private-token") {
-		t.Fatalf("stdout=%q stderr=%q", out.String(), diagnostics.String())
-	}
-}
-
-func TestPendoImplicitLoginUsesDebugEnvironment(t *testing.T) {
-	for _, name := range []string{"DO_NOT_TRACK", "GO_ENV", "NODE_ENV", "VIP_TOKEN_OVERRIDE", "WPVIP_DEPLOY_TOKEN"} {
-		t.Setenv(name, "")
-	}
-	t.Setenv("DEBUG", "@automattic/vip:analytics:clients:pendo")
-	// Like Node, DEBUG is available during bootstrap, before command flag parsing.
-	output, err := os.CreateTemp(t.TempDir(), "stderr")
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer output.Close()
-	previous := os.Stderr
-	os.Stderr = output
-	defer func() { os.Stderr = previous }()
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(401) }))
-	defer srv.Close()
-	tr := &telemetry.Tracker{Clients: []telemetry.Client{&telemetry.PendoClient{Endpoint: srv.URL, HTTP: srv.Client()}}}
-	k := newBootstrapKeychain(&bootstrapBackend{})
-	err = runWithDeps([]string{"whoami"}, runDeps{
-		Tracker: tr, NewKeychain: func(string) *keychain.Keychain { return k },
-		NewLogin: func(store *auth.Store) func() (*auth.Token, error) {
-			return func() (*auth.Token, error) {
-				if err := store.Save("private-token"); err != nil {
-					return nil, err
-				}
-				tr.TrackEvent("login_command_token_submit_success", nil)
-				return nil, auth.ErrLoginCancelled // stop before any command API requests
-			}
-		},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if _, err := output.Seek(0, 0); err != nil {
-		t.Fatal(err)
-	}
-	diagnostics, err := io.ReadAll(output)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(string(diagnostics), "401") || strings.Contains(string(diagnostics), "private-token") {
-		t.Fatalf("bootstrap diagnostics=%q", diagnostics)
-	}
-}

package/cmd/vip-next/root.go

@@ -1,211 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"os"
-
-	"github.com/spf13/cobra"
-
-	"github.com/Automattic/vip/cmd/vip-next/commands"
-	"github.com/Automattic/vip/internal/appctx"
-	"github.com/Automattic/vip/internal/debuglog"
-	"github.com/Automattic/vip/internal/telemetry"
-	"github.com/Automattic/vip/internal/update"
-	"github.com/Automattic/vip/internal/version"
-)
-
-type rootContext struct {
-	tracker      *telemetry.Tracker
-	updateRunner commands.UpdateRunner
-	aliasApp     string
-	aliasEnv     string
-}
-
-func newRootBase(rc *rootContext) *cobra.Command {
-	root := &cobra.Command{
-		Use:           "vip-next",
-		Short:         "WordPress VIP command-line interface (Go edition)",
-		Long:          "vip-next is the Go rewrite of the @automattic/vip CLI. See https://docs.wpvip.com/.",
-		SilenceUsage:  true,
-		SilenceErrors: true,
-		Version:       version.String(),
-		Run:           func(cmd *cobra.Command, args []string) { _ = cmd.Help() },
-	}
-	root.SetVersionTemplate(version.String() + "\n")
-
-	// Node registers --debug as `-d, --debug [value]` (command.js:1108-1111)
-	// and forwards the value to debugLib.enable, using '*' when the flag is
-	// given without one (command.js:557-559). A cobra Bool rejected the
-	// namespace form that vip-next's own help advertised.
-	root.PersistentFlags().StringP("debug", "d", "", "Generate verbose output during command execution. Accepts a comma-separated list of debug namespaces to scope the output (--debug=ns1,ns2).")
-	root.PersistentFlags().Lookup("debug").NoOptDefVal = "*"
-	root.PersistentFlags().String("app", "", "target app slug (alternative: @app.env alias)")
-	root.PersistentFlags().String("env", "", "target environment slug (alternative: @app.env alias)")
-	// --non-interactive lives on root so every command (and the rechallenge
-	// middleware, via main.go's closure) can consult appctx.IsInteractive
-	// against a single, command-tree-wide flag.
-	root.PersistentFlags().Bool("non-interactive", false, "disable prompts; fail fast if a required flag is missing")
-
-	root.PersistentPreRunE = func(cmd *cobra.Command, args []string) error {
-		namespaces := os.Getenv("DEBUG")
-		if cmd.Flags().Changed("debug") {
-			if value, _ := cmd.Flags().GetString("debug"); value != "" {
-				namespaces = value
-			}
-		}
-		ctx := cmd.Context()
-		if ctx == nil {
-			ctx = context.Background()
-		}
-		cmd.SetContext(debuglog.WithLogger(ctx, namespaces, cmd.ErrOrStderr()))
-		rc.tracker.SetContext(cmd.Context())
-		flagApp, _ := cmd.Flags().GetString("app")
-		flagEnv, _ := cmd.Flags().GetString("env")
-		hasAlias := rc.aliasApp != "" || rc.aliasEnv != ""
-		hasFlag := flagApp != "" || flagEnv != ""
-		if hasAlias && hasFlag {
-			return errors.New("cannot combine @app alias with --app/--env on the same invocation")
-		}
-		if rc.aliasApp != "" {
-			_ = cmd.Flags().Set("app", rc.aliasApp)
-		}
-		if rc.aliasEnv != "" {
-			_ = cmd.Flags().Set("env", rc.aliasEnv)
-		}
-		return nil
-	}
-
-	return root
-}
-
-func newRootCmd(rc *rootContext) *cobra.Command {
-	root := newRootBase(rc)
-	runner := rc.updateRunner
-	if runner == nil {
-		runner = update.NewService()
-	}
-	root.AddCommand(commands.NewUpdateCmd(runner))
-	root.AddCommand(commands.LoginCmd())
-	root.AddCommand(commands.LogoutCmd())
-	root.AddCommand(commands.NewWhoamiCmd())
-	root.AddCommand(commands.NewDefensiveModeCmd())
-	root.AddCommand(commands.NewEdgeWorkersCmd())
-	root.AddCommand(commands.LogsCmd())
-	root.AddCommand(commands.SlowlogsCmd())
-
-	appCmd := commands.AppCmd()
-	appCmd.AddCommand(commands.AppListCmd())
-	// `vip app deploy` (+ `validate`) — M7c Custom Deployment. Wired
-	// before the wildcard so it snapshots `deploy` as a real subcommand.
-	appDeployCmd := commands.AppDeployCmd()
-	appDeployCmd.AddCommand(commands.AppDeployValidateCmd())
-	appCmd.AddCommand(appDeployCmd)
-	// `vip app <name>` (positional, no real subcommand) dispatches via the
-	// wildcard fallback. Must be wired AFTER real subcommands are added so the
-	// wildcard snapshots the (final) subcommand-name set.
-	appctx.WithWildcardCommand(appCmd, commands.RunAppGet)
-	root.AddCommand(appCmd)
-
-	// `vip config envvar list/get/get-all` — read-only M5 commands. Parent
-	// nodes are bare cobra.Commands; only the leaves wrap WithAppContext +
-	// WithEnvContext (via buildAppEnvCmd / buildAppEnvRenderableCmd).
-	configCmd := commands.ConfigCmd()
-	envvarCmd := commands.ConfigEnvvarCmd()
-	envvarCmd.AddCommand(commands.ConfigEnvvarListCmd())
-	envvarCmd.AddCommand(commands.ConfigEnvvarGetCmd())
-	envvarCmd.AddCommand(commands.ConfigEnvvarGetAllCmd())
-	// M6 mutation leaves. Production prod-gate is inline (message interpolates
-	// variable name + app name); --skip-confirmation lives on the leaf via
-	// WithSkipConfirmationFlag.
-	envvarCmd.AddCommand(commands.ConfigEnvvarSetCmd())
-	envvarCmd.AddCommand(commands.ConfigEnvvarDeleteCmd())
-	configCmd.AddCommand(envvarCmd)
-	// `vip config software get` — M8 read command. `update` will be added in Task 7.
-	configCmd.AddCommand(commands.ConfigSoftwareCmd())
-	root.AddCommand(configCmd)
-
-	// `vip db phpmyadmin` — M5 readonly. Parent `db` is a plain cobra.Command;
-	// only the leaf wraps WithAppContext + WithEnvContext (via buildAppEnvCmd).
-	dbCmd := commands.DBCmd()
-	dbCmd.AddCommand(commands.DBPhpmyadminCmd())
-	root.AddCommand(dbCmd)
-
-	// `vip cache purge-url` — M6 mutation. No prompt (cache purge is benign),
-	// so the leaf only needs the standard WithAppContext + WithEnvContext
-	// middleware via buildAppEnvCmd.
-	cacheCmd := commands.CacheCmd()
-	cacheCmd.AddCommand(commands.CachePurgeURLCmd())
-	root.AddCommand(cacheCmd)
-
-	// `vip import validate-sql` — M6b local-only file scanner. No GraphQL
-	// or appctx middleware; the leaf is a plain cobra command with
-	// ExactArgs(1).
-	importCmd := commands.ImportCmd()
-	importCmd.AddCommand(commands.ImportValidateSQLCmd())
-	// `vip import sql` (+ `status`) — M7a heavy command. `status` is a
-	// SUBCOMMAND of `import sql` (Node: command(...).command('status')).
-	importSQLCmd := commands.ImportSQLCmd()
-	importSQLCmd.AddCommand(commands.ImportSQLStatusCmd())
-	importCmd.AddCommand(importSQLCmd)
-	// `vip import media` (+ `status`, `abort`) — M7b heavy commands.
-	importMediaCmd := commands.ImportMediaCmd()
-	importMediaCmd.AddCommand(commands.ImportMediaStatusCmd())
-	importMediaCmd.AddCommand(commands.ImportMediaAbortCmd())
-	importCmd.AddCommand(importMediaCmd)
-	// `vip import validate-files` — M7b local validator (GraphQL only for
-	// the mediaImportConfig metadata; no app/env context).
-	importCmd.AddCommand(commands.ImportValidateFilesCmd())
-	root.AddCommand(importCmd)
-
-	// `vip backup db` / `vip export sql` — M7c heavy commands.
-	backupCmd := commands.BackupCmd()
-	backupCmd.AddCommand(commands.BackupDBCmd())
-	root.AddCommand(backupCmd)
-	exportCmd := commands.ExportCmd()
-	exportCmd.AddCommand(commands.ExportSQLCmd())
-	root.AddCommand(exportCmd)
-
-	// `vip sync` — M6 mutation. WithChildEnvContext rejects production targets;
-	// WithRequireConfirm prompts unconditionally before the mutation fires.
-	// Handler polls SyncProgress to a terminal state.
-	root.AddCommand(commands.SyncCmd())
-
-	// `vip wp` — WP1 SSH strategy + subshell. DisableFlagParsing; main.go's
-	// normalizeWPArgs handles the `--`/`--yes` reshaping.
-	root.AddCommand(commands.WPCmd())
-
-	// `vip search-replace <file>` — port of src/bin/vip-search-replace.js.
-	// Streams a local file through go-search-replace; defaults to STDOUT.
-	root.AddCommand(commands.SearchReplaceCmd())
-
-	// `vip dev-env` — full command tree (23 commands) as Node-CLI redirect
-	// stubs. dev-env (Docker/Lando local dev) is out of scope for vip-next;
-	// stubs ensure --help and completion show the surface. On the auth-bypass
-	// list so no login is required.
-	root.AddCommand(commands.DevEnvCmd())
-
-	applyVersionToSubcommands(root)
-
-	return root
-}
-
-// applyVersionToSubcommands mirrors Node, which adds -v/--version to EVERY
-// subcommand, not just the root (src/lib/cli/command.js:1103-1107 runs for
-// every bin, and command.js:553-555 prints the version and exits 0). Cobra
-// only synthesizes the flag for commands whose Version field is set, so the
-// field is propagated across the tree after wiring; cobra's
-// InitDefaultVersionFlag then applies the same "v unless already taken"
-// reservation Node's createOptionDefinition does.
-func applyVersionToSubcommands(root *cobra.Command) {
-	tmpl := root.VersionTemplate()
-	var walk func(c *cobra.Command)
-	walk = func(c *cobra.Command) {
-		for _, child := range c.Commands() {
-			child.Version = root.Version
-			child.SetVersionTemplate(tmpl)
-			walk(child)
-		}
-	}
-	walk(root)
-}

package/cmd/vip-next/update_bootstrap.go

@@ -1,94 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-	"sync"
-
-	"github.com/spf13/cobra"
-	"golang.org/x/term"
-
-	"github.com/Automattic/vip/internal/appctx"
-	"github.com/Automattic/vip/internal/update"
-)
-
-func isUpdateInvocation(root *cobra.Command, prepared []string) bool {
-	for i, arg := range prepared {
-		if arg == "--" {
-			prepared = prepared[:i]
-			break
-		}
-	}
-	cmd, _, err := root.Find(prepared)
-	return err == nil && cmd.Parent() == root && cmd.Name() == "update"
-}
-func installUpdateNotifier(root *cobra.Command, start func(*cobra.Command) func()) func() {
-	if start == nil {
-		return func() {}
-	}
-	var finish func()
-	var wrap func(*cobra.Command)
-	wrap = func(cmd *cobra.Command) {
-		if old := cmd.RunE; old != nil {
-			cmd.RunE = func(c *cobra.Command, a []string) error { finish = start(c); return old(c, a) }
-		} else if old := cmd.Run; old != nil {
-			cmd.Run = func(c *cobra.Command, a []string) { finish = start(c); old(c, a) }
-		}
-		for _, child := range cmd.Commands() {
-			wrap(child)
-		}
-	}
-	wrap(root)
-	var once sync.Once
-	return func() {
-		once.Do(func() {
-			if finish != nil {
-				finish()
-			}
-		})
-	}
-}
-func startUpdateNotice(cmd *cobra.Command) func() {
-	if !updateNoticeAllowed(cmd, appctx.IsInteractive(cmd), stderrTerminal(cmd), os.Getenv) {
-		return nil
-	}
-	service := update.NewService()
-	n := update.Notifier{State: service.State, Installed: service.Installed, Platform: service.Platform, Now: service.Now, Fetch: service.Fetch}
-	finish := n.Start(cmd.Context())
-	return func() {
-		if notice := finish(); notice != nil {
-			fmt.Fprintf(cmd.ErrOrStderr(), "A newer vip-next release is available: %s. Run vip-next update to install.\n", notice.Version)
-		}
-	}
-}
-func stderrTerminal(cmd *cobra.Command) bool {
-	f, ok := cmd.ErrOrStderr().(*os.File)
-	return ok && term.IsTerminal(int(f.Fd()))
-}
-func updateNoticeAllowed(cmd *cobra.Command, interactive, stderrTTY bool, getenv func(string) string) bool {
-	if !interactive || !stderrTTY || cmd.Parent() == nil {
-		return false
-	}
-	for _, key := range []string{"CI", "GITHUB_ACTIONS", "BUILDKITE"} {
-		if v := getenv(key); v != "" && v != "false" && v != "0" {
-			return false
-		}
-	}
-	if getenv("GO_ENV") == "test" || getenv("NODE_ENV") == "test" || getenv("VIP_NO_UPDATE_NOTIFIER") == "1" {
-		return false
-	}
-	for c := cmd; c != nil; c = c.Parent() {
-		if c.Name() == "update" && c.Parent() == cmd.Root() || c.Name() == "help" || c.Name() == "completion" || c.Name() == "wp" {
-			return false
-		}
-	}
-	if f := cmd.Flag("format"); f != nil && (f.Value.String() == "json" || f.Value.String() == "csv") {
-		return false
-	}
-	for _, name := range []string{"help", "version"} {
-		if f := cmd.Flag(name); f != nil && f.Value.String() == "true" {
-			return false
-		}
-	}
-	return true
-}

package/cmd/vip-next/update_bootstrap_test.go

@@ -1,85 +0,0 @@
-package main
-
-import (
-	"context"
-	"testing"
-
-	"github.com/Automattic/vip/internal/auth"
-	"github.com/Automattic/vip/internal/keychain"
-	"github.com/Automattic/vip/internal/update"
-)
-
-type updateRunnerFunc func(context.Context, update.Request, func(update.Step)) (update.Outcome, error)
-
-func (f updateRunnerFunc) Run(c context.Context, r update.Request, p func(update.Step)) (update.Outcome, error) {
-	return f(c, r, p)
-}
-func TestIsUpdateInvocation(t *testing.T) {
-	for _, tc := range []struct {
-		args []string
-		want bool
-	}{{[]string{"update", "--check"}, true}, {[]string{"--debug=update", "update", "--check"}, true}, {[]string{"--app", "update", "whoami"}, false}, {[]string{"config", "software", "update"}, false}, {[]string{"wp", "plugin", "update"}, false}, {[]string{"--", "update"}, false}, {[]string{"whoami", "update"}, false}} {
-		root := newRootCmd(&rootContext{})
-		if got := isUpdateInvocation(root, prepareArgs(root, tc.args)); got != tc.want {
-			t.Errorf("%q: got %v", tc.args, got)
-		}
-	}
-}
-func TestUpdateBypassesCredentialConstruction(t *testing.T) {
-	ran := false
-	deps := runDeps{NewKeychain: func(string) *keychain.Keychain { t.Fatal("update constructed credential store"); return nil }, NewLogin: func(*auth.Store) func() (*auth.Token, error) { t.Fatal("update requested login"); return nil }, UpdateRunner: updateRunnerFunc(func(_ context.Context, r update.Request, _ func(update.Step)) (update.Outcome, error) {
-		ran = true
-		return update.Outcome{Installed: "5.0.0", Channel: update.Stable}, nil
-	})}
-	if err := runWithDeps([]string{"update", "--check"}, deps); err != nil || !ran {
-		t.Fatal(err, ran)
-	}
-	ran = false
-	if err := runWithDeps([]string{"update", "--badflag"}, deps); err == nil || ran {
-		t.Fatal("invalid update dispatched", err, ran)
-	}
-}
-
-func TestUpdateNotificationGates(t *testing.T) {
-	root := newRootCmd(&rootContext{})
-	leaf, _, err := root.Find([]string{"whoami"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	empty := func(string) string { return "" }
-	if !updateNoticeAllowed(leaf, true, true, empty) {
-		t.Fatal("interactive command suppressed")
-	}
-	for _, key := range []string{"CI", "GITHUB_ACTIONS", "BUILDKITE", "GO_ENV", "NODE_ENV", "VIP_NO_UPDATE_NOTIFIER"} {
-		get := func(k string) string {
-			if k != key {
-				return ""
-			}
-			if key == "GO_ENV" || key == "NODE_ENV" {
-				return "test"
-			}
-			return "1"
-		}
-		if updateNoticeAllowed(leaf, true, true, get) {
-			t.Error("not suppressed", key)
-		}
-	}
-	if updateNoticeAllowed(leaf, false, true, empty) || updateNoticeAllowed(leaf, true, false, empty) {
-		t.Fatal("nonterminal notice")
-	}
-	for _, argv := range [][]string{{"update"}, {"wp"}, {"logs"}} {
-		r := newRootCmd(&rootContext{})
-		c, _, e := r.Find(argv)
-		if e != nil {
-			t.Fatal(e)
-		}
-		if argv[0] == "logs" {
-			if e = c.ParseFlags([]string{"--format=json"}); e != nil {
-				t.Fatal(e)
-			}
-		}
-		if updateNoticeAllowed(c, true, true, empty) {
-			t.Fatal("unsafe output notice", argv)
-		}
-	}
-}

package/cmd/vip-next/update_integration_test.go

@@ -1,137 +0,0 @@
-package main
-
-import (
-	"archive/tar"
-	"bytes"
-	"compress/gzip"
-	"context"
-	"crypto/sha256"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"net/url"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"testing"
-
-	json "encoding/json/v2"
-
-	"github.com/Automattic/vip/internal/auth"
-	"github.com/Automattic/vip/internal/keychain"
-	"github.com/Automattic/vip/internal/update"
-)
-
-type updateTransport func(*http.Request) (*http.Response, error)
-
-func (f updateTransport) RoundTrip(r *http.Request) (*http.Response, error) { return f(r) }
-
-// The subprocess executes the actual command/service/downloader/installer. Its
-// endpoint and installation injection live only in this test, never in the CLI.
-func TestUpdateServiceEndToEnd(t *testing.T) {
-	if os.Getenv("VIP_UPDATE_TEST_CHILD") != "1" {
-		exe, err := os.Executable()
-		if err != nil {
-			t.Fatal(err)
-		}
-		cmd := exec.Command(exe, "-test.run=^TestUpdateServiceEndToEnd$")
-		cmd.Env = append(os.Environ(), "VIP_UPDATE_TEST_CHILD=1", "DO_NOT_TRACK=1", "GO_ENV=test")
-		if output, err := cmd.CombinedOutput(); err != nil {
-			t.Fatalf("update subprocess: %v\n%s", err, output)
-		}
-		return
-	}
-	exe, err := os.Executable()
-	if err != nil {
-		t.Fatal(err)
-	}
-	payload, err := os.ReadFile(exe)
-	if err != nil {
-		t.Fatal(err)
-	}
-	suffix := ""
-	if runtime.GOOS == "windows" {
-		suffix = ".exe"
-	}
-	root := t.TempDir()
-	cli := filepath.Join(root, "vip-next"+suffix)
-	helper := filepath.Join(root, "go-search-replace"+suffix)
-	for _, path := range []string{cli, helper} {
-		if err := os.WriteFile(path, []byte("old installation"), 0755); err != nil {
-			t.Fatal(err)
-		}
-	}
-	var archive bytes.Buffer
-	gz := gzip.NewWriter(&archive)
-	tw := tar.NewWriter(gz)
-	for _, name := range []string{filepath.Base(cli), filepath.Base(helper)} {
-		if err := tw.WriteHeader(&tar.Header{Name: name, Mode: 0755, Size: int64(len(payload))}); err != nil {
-			t.Fatal(err)
-		}
-		if _, err := tw.Write(payload); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if err := tw.Close(); err != nil {
-		t.Fatal(err)
-	}
-	if err := gz.Close(); err != nil {
-		t.Fatal(err)
-	}
-	name := "vip-next-" + runtime.GOOS + "-" + runtime.GOARCH + ".tar.gz"
-	checksum := fmt.Sprintf("%x *%s", sha256.Sum256(archive.Bytes()), name)
-	downloadPath := "/Automattic/vip-cli/releases/download/5.0.1/"
-	metadata, err := json.Marshal([]update.Release{{Tag: "5.0.1", Assets: []update.Asset{{Name: name, URL: "https://github.com" + downloadPath + name}, {Name: name + ".sha256", URL: "https://github.com" + downloadPath + name + ".sha256"}}}})
-	if err != nil {
-		t.Fatal(err)
-	}
-	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Header.Get("Authorization") != "" {
-			t.Error("credential reached release server")
-		}
-		switch r.URL.Path {
-		case "/repos/Automattic/vip-cli/releases":
-			w.Write(metadata)
-		case downloadPath + name:
-			w.Write(archive.Bytes())
-		case downloadPath + name + ".sha256":
-			fmt.Fprint(w, checksum)
-		default:
-			http.NotFound(w, r)
-		}
-	}))
-	defer server.Close()
-	localURL, _ := url.Parse(server.URL)
-	client := server.Client()
-	transport := client.Transport
-	client.Transport = updateTransport(func(r *http.Request) (*http.Response, error) {
-		copy := r.Clone(r.Context())
-		u := *r.URL
-		u.Scheme = localURL.Scheme
-		u.Host = localURL.Host
-		copy.URL = &u
-		return transport.RoundTrip(copy)
-	})
-	service := update.NewService()
-	service.Installed = "5.0.0"
-	service.State = update.State{CacheDir: t.TempDir(), ConfigDir: t.TempDir()}
-	service.Executable = func() (string, error) { return cli, nil }
-	service.Fetch = (update.GitHub{Client: client, BaseURL: server.URL}).Releases
-	service.Stage = (update.Downloader{Client: client}).Stage
-	service.Installer.InspectOwnership = func(context.Context, update.Layout) (update.Ownership, error) { return update.Ownership{}, nil }
-	deps := runDeps{UpdateRunner: service, NewKeychain: func(string) *keychain.Keychain { t.Fatal("updater accessed VIP credentials"); return nil }, NewLogin: func(*auth.Store) func() (*auth.Token, error) { t.Fatal("updater requested login"); return nil }}
-	if err := runWithDeps([]string{"update", "--channel", "stable", "--non-interactive"}, deps); err != nil {
-		t.Fatal(err)
-	}
-	for _, path := range []string{cli, helper} {
-		got, err := os.ReadFile(path)
-		if err != nil || !bytes.Equal(got, payload) {
-			t.Fatalf("bundle not fully installed: %s %v", path, err)
-		}
-	}
-	ch, err := service.State.ReadChannel()
-	if err != nil || ch != update.Stable {
-		t.Fatal("channel not persisted", ch, err)
-	}
-}