wexample-wex-addon-dev-php 12.3.1__tar.gz → 12.5.0__tar.gz

{wexample_wex_addon_dev_php-12.3.1 → wexample_wex_addon_dev_php-12.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: wexample-wex-addon-dev-php
-Version: 12.3.1
+Version: 12.5.0
 Summary: Extends wex with PHP-specific development commands for Composer, Laravel, Symfony, and WordPress services running in Docker containers
 Author-Email: weeger <contact@wexample.com>
 License: MIT
@@ -13,8 +13,8 @@ Requires-Dist: attrs>=23.1.0
 Requires-Dist: cattrs>=23.1.0
 Requires-Dist: wexample-filestate-php>=6.4.0
 Requires-Dist: wexample-filestate-symfony>=2.0.0
-Requires-Dist: wexample-wex-addon-ai>=16.1.0
-Requires-Dist: wexample-wex-addon-app>=32.1.0
+Requires-Dist: wexample-wex-addon-ai>=17.0.0
+Requires-Dist: wexample-wex-addon-app>=32.3.0
 Requires-Dist: wexample-wex-addon-dev-javascript>=8.2.0
 Provides-Extra: dev
 Requires-Dist: pytest; extra == "dev"
@@ -23,7 +23,7 @@ Description-Content-Type: text/markdown
 
 # wex_addon_dev_php
 
-Version: 12.3.1
+Version: 12.5.0
 
 `wex_addon_dev_php` extends the wex CLI with PHP-specific development commands for Composer, Laravel, Symfony, and WordPress services running in Docker containers. It is aimed at PHP developers who manage their apps through wex and need framework-aware automation — dependency wiring, migration runs, lock-file refreshes — executed directly inside the running service containers. The addon registers four workdir types (`php`, `php-package`, `php-packages-suite`, `php-symfony`) and contributes its commands through the standard `PhpAddonManager` plugin point.
 
@@ -275,8 +275,8 @@ Visit the [Wexample Suite documentation](https://docs.wexample.com) for the comp
 - cattrs: >=23.1.0
 - wexample-filestate-php: >=6.4.0
 - wexample-filestate-symfony: >=2.0.0
-- wexample-wex-addon-ai: >=16.1.0
-- wexample-wex-addon-app: >=32.1.0
+- wexample-wex-addon-ai: >=17.0.0
+- wexample-wex-addon-app: >=32.3.0
 - wexample-wex-addon-dev-javascript: >=8.2.0
 
 ## Versioning & Compatibility Policy

{wexample_wex_addon_dev_php-12.3.1 → wexample_wex_addon_dev_php-12.5.0}/README.md

@@ -1,6 +1,6 @@
 # wex_addon_dev_php
 
-Version: 12.3.1
+Version: 12.5.0
 
 `wex_addon_dev_php` extends the wex CLI with PHP-specific development commands for Composer, Laravel, Symfony, and WordPress services running in Docker containers. It is aimed at PHP developers who manage their apps through wex and need framework-aware automation — dependency wiring, migration runs, lock-file refreshes — executed directly inside the running service containers. The addon registers four workdir types (`php`, `php-package`, `php-packages-suite`, `php-symfony`) and contributes its commands through the standard `PhpAddonManager` plugin point.
 
@@ -252,8 +252,8 @@ Visit the [Wexample Suite documentation](https://docs.wexample.com) for the comp
 - cattrs: >=23.1.0
 - wexample-filestate-php: >=6.4.0
 - wexample-filestate-symfony: >=2.0.0
-- wexample-wex-addon-ai: >=16.1.0
-- wexample-wex-addon-app: >=32.1.0
+- wexample-wex-addon-ai: >=17.0.0
+- wexample-wex-addon-app: >=32.3.0
 - wexample-wex-addon-dev-javascript: >=8.2.0
 
 ## Versioning & Compatibility Policy

{wexample_wex_addon_dev_php-12.3.1 → wexample_wex_addon_dev_php-12.5.0}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "pdm.backend"
 
 [project]
 name = "wexample-wex-addon-dev-php"
-version = "12.3.1"
+version = "12.5.0"
 description = "Extends wex with PHP-specific development commands for Composer, Laravel, Symfony, and WordPress services running in Docker containers"
 authors = [
     { name = "weeger", email = "contact@wexample.com" },
@@ -22,8 +22,8 @@ dependencies = [
     "cattrs>=23.1.0",
     "wexample-filestate-php>=6.4.0",
     "wexample-filestate-symfony>=2.0.0",
-    "wexample-wex-addon-ai>=16.1.0",
-    "wexample-wex-addon-app>=32.1.0",
+    "wexample-wex-addon-ai>=17.0.0",
+    "wexample-wex-addon-app>=32.3.0",
     "wexample-wex-addon-dev-javascript>=8.2.0",
 ]
 

wexample_wex_addon_dev_php-12.5.0/src/wexample_wex_addon_dev_php/deployment/step/symfony_env_local_deployment_step.py

@@ -0,0 +1,288 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any, ClassVar
+
+from wexample_wex_addon_app.const.deployment import (
+    DEPLOYMENT_STATUS_KO,
+    DEPLOYMENT_STATUS_OK,
+    DEPLOYMENT_STATUS_UNKNOWN,
+)
+from wexample_wex_addon_app.deployment.abstract_deployment_step import (
+    AbstractDeploymentStep,
+)
+
+if TYPE_CHECKING:
+    from wexample_wex_addon_app.helper.remote import ResolvedRemote
+    from wexample_wex_addon_app.workdir.managed_workdir import ManagedWorkdir
+
+# What a Symfony app's runtime always needs from the host, whatever `env.build` says:
+# the build env reaches no service and holds no secret, by its own contract.
+ALWAYS_FROM_THE_HOST: tuple[str, ...] = ("APP_SECRET", "DATABASE_URL")
+
+# Config only these envs load: what it reads is never asked of a deployed host.
+NOT_DEPLOYED_ENVS: tuple[str, ...] = ("dev", "test")
+
+# A variable named so is a key the app signs with: made on the host, never asked.
+SECRET_SUFFIX = "_SECRET"
+
+
+def _keys(content: str, names_only: bool = False) -> set[str]:
+    keys = set()
+    for line in content.splitlines():
+        line = line.strip()
+        if not line or line.startswith("#"):
+            continue
+        name = line if names_only else line.partition("=")[0]
+        name = name.removeprefix("export ").strip()
+        if name and (names_only or "=" in line):
+            keys.add(name)
+    return keys
+
+
+def _quote(value: str) -> str:
+    """A value as Symfony's Dotenv reads it back literally: single quotes take nothing
+    for a variable, and are only left for double ones when the value holds one."""
+    if "'" not in value:
+        return f"'{value}'"
+    escaped = value.replace("\\", "\\\\").replace('"', '\\"').replace("$", "\\$")
+    return f'"{escaped}"'
+
+
+def _without_env_blocks(content: str) -> str:
+    """The config with its `when@dev:` and `when@test:` blocks cut out."""
+    kept: list[str] = []
+    skipping = False
+    for line in content.splitlines():
+        if line and not line[0].isspace() and not line.startswith("#"):
+            skipping = line.rstrip().rstrip(":") in {
+                f"when@{env}" for env in NOT_DEPLOYED_ENVS
+            }
+        if not skipping:
+            kept.append(line)
+    return "\n".join(kept)
+
+
+class SymfonyEnvLocalDeploymentStep(AbstractDeploymentStep):
+    """The host's checkout has a `.env.local` giving every variable the app reads that the
+    image does not carry — the image's `.env` is `.wex/docker/env.build`, there to let the
+    kernel boot during the build and nothing more.
+
+    The variables are read off the app's own config (`%env(…)%`), so the list follows the
+    app; one read with a `default::` fallback, or only by `dev`/`test` config, is not
+    required. Only the names are looked at on the host, never the values.
+
+    Written when there is none, the way one copies a `.env.dist`: the signing secrets
+    generated, every other value the local `.env` gives, made the host's — the local
+    domain becomes the env's, and a secret the host generated for itself — a database
+    password — is named `${KEY}` and filled in on the host from its own env file, so it
+    never travels and nobody has to go and read it. Nothing is asked: what is copied as
+    it is gets named, for the operator to correct on the host if it must differ.
+    """
+
+    LABEL: ClassVar[str] = "Symfony .env.local"
+    NAME: ClassVar[str] = "symfony_env_local"
+    PER_ENV: ClassVar[bool] = True
+    REQUIRES: ClassVar[tuple[str, ...]] = ("remote_app_dir",)
+
+    @staticmethod
+    def _build_env_keys(workdir: ManagedWorkdir) -> set[str]:
+        path = workdir.get_path() / ".wex" / "docker" / "env.build"
+        if not path.is_file():
+            return set()
+        return _keys(path.read_text(encoding="utf-8"))
+
+    @staticmethod
+    def _exists(remote: ResolvedRemote) -> bool:
+        import shlex
+
+        from wexample_wex_addon_app.helper.remote import remote_run
+
+        path = shlex.quote(f"{remote['path']}/.env.local")
+        return remote_run(remote, f"sudo -n test -f {path}").returncode == 0
+
+    @staticmethod
+    def _host_keys(remote: ResolvedRemote) -> set[str] | None:
+        """The names the host's `.env.local` defines — values cut off on the host, so
+        none ever travels."""
+        import shlex
+
+        from wexample_wex_addon_app.helper.remote import remote_run
+
+        path = shlex.quote(f"{remote['path']}/.env.local")
+        result = remote_run(
+            remote,
+            f"sudo -n sh -c 'test -f {path} && cut -d= -f1 {path} || true'",
+        )
+        if result.returncode != 0:
+            return None
+        return _keys(result.stdout + "\n", names_only=True)
+
+    @staticmethod
+    def _local_values(workdir: ManagedWorkdir) -> dict[str, str]:
+        """What the app's local `.env` gives — offered to the operator, never sent as is."""
+        path = workdir.get_path() / ".env"
+        if not path.is_file():
+            return {}
+        values = {}
+        for line in path.read_text(encoding="utf-8").splitlines():
+            line = line.strip()
+            if not line or line.startswith("#") or "=" not in line:
+                continue
+            key, _, value = line.removeprefix("export ").partition("=")
+            value = value.strip()
+            if len(value) >= 2 and value[0] == value[-1] and value[0] in "'\"":
+                value = value[1:-1]
+            values[key.strip()] = value
+        return values
+
+    def applies_to(self, workdir: ManagedWorkdir) -> bool:
+        from wexample_wex_addon_app.app_addon_manager import AppAddonManager
+
+        if self.kernel is None:
+            return False
+        services = AppAddonManager.from_kernel(self.kernel).get_app_services(workdir)
+        return any(service.name == "symfony" for service in services)
+
+    def apply(
+        self, workdir: ManagedWorkdir, remote: ResolvedRemote | None, io: Any = None
+    ) -> str:
+        import secrets
+        import shlex
+
+        from wexample_wex_addon_app.helper.deployment import DEPLOYMENT_HOST_USER
+        from wexample_wex_addon_app.helper.remote import remote_run
+
+        defaults = self._host_defaults(workdir, remote)
+        values: dict[str, str] = {}
+        generated: list[str] = []
+        for key in self._needed(workdir):
+            if key.endswith(SECRET_SUFFIX):
+                values[key] = secrets.token_hex(32)
+                generated.append(key)
+            else:
+                # Written even empty: Symfony refuses a variable that is not there, and
+                # an empty one is how an app says « not used here ».
+                values[key] = defaults.get(key, "")
+
+        path = f"{remote['path']}/.env.local"
+        # Through stdin, never a command line: a secret must not show in the host's
+        # process list nor in a shell history. The `${KEY}` are resolved there.
+        result = remote_run(
+            remote,
+            f"sudo -n -u {DEPLOYMENT_HOST_USER} python3 -c {shlex.quote(_HOST_WRITER)} "
+            f"{shlex.quote(remote['path'] + '/.wex/local/env.yml')} {shlex.quote(path)}",
+            input="".join(f"{key}={_quote(value)}\n" for key, value in values.items()),
+        )
+        if result.returncode != 0:
+            raise RuntimeError(
+                f"Writing {path} on {remote['host']} failed: {result.stderr.strip()[:300]}"
+            )
+
+        made = f", generated {', '.join(generated)} (kept there, not shown)" if generated else ""
+        empty = [key for key, value in values.items() if not value]
+        copied = [
+            key for key, value in values.items()
+            if value and key not in generated and value == self._local_values(workdir).get(key)
+        ]
+        rest = (f" Copied as they are locally: {', '.join(copied)}." if copied else "") + (
+            f" Left empty: {', '.join(empty)}." if empty else ""
+        )
+        return f"Wrote {path} on {remote['host']}{made}.{rest}"
+
+    def can_apply(self, workdir: ManagedWorkdir, remote: ResolvedRemote | None) -> bool:
+        # Written when there is none, never over one: an existing file is the host's.
+        return self._host_keys(remote) == set() and not self._exists(remote)
+
+    def check(self, workdir: ManagedWorkdir, remote: ResolvedRemote | None) -> tuple[str, str]:
+        present = self._host_keys(remote)
+        if present is None:
+            return DEPLOYMENT_STATUS_UNKNOWN, "could not read it"
+        if not present and not self._exists(remote):
+            return DEPLOYMENT_STATUS_KO, f"no {remote['path']}/.env.local"
+        missing = [key for key in self._needed(workdir) if key not in present]
+        if missing:
+            return DEPLOYMENT_STATUS_KO, f"no value for {', '.join(missing)}"
+        return DEPLOYMENT_STATUS_OK, f"{remote['path']}/.env.local"
+
+    def hint(self, workdir: ManagedWorkdir, remote: ResolvedRemote | None) -> str:
+        present = self._host_keys(remote) or set()
+        missing = [key for key in self._needed(workdir) if key not in present]
+        return (
+            f"Give {remote['path']}/.env.local on {remote['host']} (owned by www-data) the "
+            f"host's values for: {', '.join(missing)} — and mount it into the container, "
+            "the image only carries the build env."
+        )
+
+    def _host_defaults(
+        self, workdir: ManagedWorkdir, remote: ResolvedRemote
+    ) -> dict[str, str]:
+        """The local `.env` values, with what is this machine's replaced by the host's:
+        the domain, and every generated secret by a `${KEY}` the host resolves."""
+        import yaml
+        from wexample_wex_addon_app.helper.deployment import deployment_declared_vars
+
+        local_env = workdir.get_path() / ".wex" / "local" / "env.yml"
+        local_secrets = (
+            yaml.safe_load(local_env.read_text(encoding="utf-8")) or {}
+            if local_env.is_file()
+            else {}
+        )
+        replacements: dict[str, str] = {}
+        for key, meta in deployment_declared_vars(workdir, self.kernel).items():
+            value = local_secrets.get(key)
+            if isinstance(meta, dict) and meta.get("generated") and value:
+                replacements[str(value)] = "${" + key + "}"
+        domain = workdir.get_config().search("domain").get_str_or_none()
+        env_domain = (
+            workdir.get_config(env_name=remote["env"]).search("domain").get_str_or_none()
+        )
+        if domain and env_domain:
+            replacements[domain] = env_domain
+
+        defaults = {}
+        for key, value in self._local_values(workdir).items():
+            for old, new in replacements.items():
+                value = value.replace(old, new)
+            defaults[key] = value
+        return defaults
+
+    def _needed(self, workdir: ManagedWorkdir) -> list[str]:
+        """The variables the app's config reads that the build env does not give, plus
+        those it never gives for real."""
+        import re
+
+        config = workdir.get_path() / "config"
+        referenced: set[str] = set()
+        for path in config.rglob("*.yaml"):
+            if any(part in NOT_DEPLOYED_ENVS for part in path.relative_to(config).parts):
+                continue
+            content = _without_env_blocks(path.read_text(encoding="utf-8"))
+            for match in re.finditer(r"%env\(([^)]+)\)%", content):
+                processors, _, key = match.group(1).rpartition(":")
+                # `default::KEY` falls back on its own: the app runs without it.
+                if "default:" not in f"{processors}:":
+                    referenced.add(key)
+        built = self._build_env_keys(workdir)
+        needed = {key for key in referenced if key not in built} | set(ALWAYS_FROM_THE_HOST)
+        return sorted(needed)
+
+
+# Run on the host: fills every `${KEY}` of the content on stdin from the host's env
+# file, then writes it for the owner alone. A key the env file lacks stays as it is.
+_HOST_WRITER = """
+import os, re, sys
+values = {}
+with open(sys.argv[1]) as env:
+    for line in env:
+        match = re.match(r"^([A-Za-z_][A-Za-z0-9_]*):\\s*(.*?)\\s*$", line)
+        if match:
+            values[match[1]] = match[2].strip("\\"'")
+content = re.sub(
+    r"\\$\\{([A-Za-z_][A-Za-z0-9_]*)\\}",
+    lambda m: values.get(m[1], m[0]),
+    sys.stdin.read(),
+)
+os.umask(0o077)
+with open(sys.argv[2], "w") as target:
+    target.write(content)
+"""

{wexample_wex_addon_dev_php-12.3.1 → wexample_wex_addon_dev_php-12.5.0}/src/wexample_wex_addon_dev_php/php_addon_manager.py

@@ -20,6 +20,13 @@ class PhpAddonManager(FormatterContributingAddonMixin, AbstractAddonManager):
 
         return wexample_wex_addon_dev_php
 
+    def get_deployment_step_classes(self) -> list[type]:
+        from wexample_wex_addon_dev_php.deployment.step.symfony_env_local_deployment_step import (
+            SymfonyEnvLocalDeploymentStep,
+        )
+
+        return [SymfonyEnvLocalDeploymentStep]
+
     def get_formatter_classes(self) -> list[type[AbstractFormatter]]:
         from wexample_wex_addon_dev_php.formatter.php_code_formatter import (
             PhpCodeFormatter,

wexample_wex_addon_dev_php-12.5.0/src/wexample_wex_addon_dev_php/resources/docker/Dockerfile.roave

@@ -0,0 +1,31 @@
+FROM php:8.5-cli
+
+RUN apt-get update && apt-get install -y \
+    git \
+    unzip \
+    libicu-dev \
+    libzip-dev \
+    libpng-dev \
+    && rm -rf /var/lib/apt/lists/* \
+    && docker-php-ext-install bcmath gd intl zip \
+    # A test suite compiling a Symfony container outgrows the CLI's 128M.
+    && echo 'memory_limit=1G' > /usr/local/etc/php/conf.d/memory.ini
+
+# The publish runs under sudo, so the container runs as root while the mounted
+# repositories belong to the user: git refuses them as of dubious ownership,
+# Roave fails, and every change in src/ reads as a breaking one.
+RUN git config --system --add safe.directory '*'
+
+RUN groupadd -g 1000 appuser && \
+    useradd -m -u 1000 -g 1000 -s /bin/bash appuser
+
+COPY --from=composer:latest /usr/bin/composer /usr/bin/composer
+
+USER appuser
+RUN composer global require roave/backward-compatibility-check
+
+ENV PATH="/home/appuser/.composer/vendor/bin:${PATH}"
+
+WORKDIR /var/www/html
+
+CMD ["tail", "-f", "/dev/null"]

wexample_wex_addon_dev_php-12.5.0/src/wexample_wex_addon_dev_php/services/symfony/docker/docker-compose.yml

@@ -0,0 +1,24 @@
+services:
+  # What a host runs: the release image CI built, the code inside it and nothing
+  # mounted over it. APP_RELEASE_IMAGE is computed by `app::config/build` from the
+  # app's origin (or `docker.release_image`); BRANCH is the env's. The host's
+  # secrets reach it through the env composes (see samples/env/dev and prod).
+  symfony:
+    container_name: ${APP_PROJECT_NAME}_symfony
+    image: ${APP_RELEASE_IMAGE}:${BRANCH}
+    environment:
+      - VIRTUAL_HOST=${APP_DOMAINS_STRING}
+      - VIRTUAL_PORT=80
+    extends:
+      file: ${SERVICE_DEFAULT_COMPOSE}
+      service: default
+
+  # What a developer runs: the generic php image with the checkout mounted over
+  # /var/www/html, Caddyfile and php.ini bound from the app. Only the local env
+  # extends it (samples/env/local) — a service declared here starts nothing on its
+  # own, these files are only ever reached through `extends`.
+  symfony_local:
+    container_name: ${APP_PROJECT_NAME}_symfony
+    extends:
+      file: ${SERVICE_PHP_COMPOSE}
+      service: php

wexample_wex_addon_dev_php-12.5.0/src/wexample_wex_addon_dev_php/services/symfony/samples/env/dev/docker/docker-compose.yml

@@ -0,0 +1,8 @@
+services:
+  symfony:
+    environment:
+      - LETSENCRYPT_HOST=${APP_DOMAINS_STRING}
+    volumes:
+      # The host's secrets, untracked in its checkout: the image only carries the
+      # build env (.wex/docker/env.build).
+      - ${APP_PATH}.env.local:/var/www/html/.env.local:ro

wexample_wex_addon_dev_php-12.5.0/src/wexample_wex_addon_dev_php/services/symfony/samples/env/local/docker/docker-compose.yml

@@ -0,0 +1,11 @@
+services:
+  # Local runs the image built from Dockerfile.dev with the checkout mounted —
+  # `symfony_local` — never the release image the base compose points at.
+  symfony:
+    extends:
+      file: ${SERVICE_SYMFONY_COMPOSE}
+      service: symfony_local
+    image: ${APP_NAME}:local
+    build:
+      context: ${APP_PATH}
+      dockerfile: .wex/docker/images/Dockerfile.dev

wexample_wex_addon_dev_php-12.5.0/src/wexample_wex_addon_dev_php/services/symfony/samples/env/prod/docker/docker-compose.yml

@@ -0,0 +1,8 @@
+services:
+  symfony:
+    environment:
+      - LETSENCRYPT_HOST=${APP_DOMAINS_STRING}
+    volumes:
+      # The host's secrets, untracked in its checkout: the image only carries the
+      # build env (.wex/docker/env.build).
+      - ${APP_PATH}.env.local:/var/www/html/.env.local:ro

{wexample_wex_addon_dev_php-12.3.1 → wexample_wex_addon_dev_php-12.5.0}/src/wexample_wex_addon_dev_php/workdir/php_package_workdir.py

@@ -188,3 +188,78 @@ class PhpPackageWorkdir(WithRunnerWorkdirMixin, PhpWorkdir):
 
         # Uses git repo to deploy packages.
         self.push_to_deployment_remote()
+
+    def _test_run_without_container(self) -> None:
+        """In the php image of the runners, the dependencies included.
+
+        php is not on the host, and neither are the dependencies: a package's
+        vendor/ lives in a Docker volume of its own, mounted where the tests
+        expect it, so the host keeps no copy of it for an editor to index. The
+        volume is refilled only when composer.json changed since; no lock is
+        written, the package's own being left as it is.
+
+        The packages' directory is mounted whole: the local siblings are linked
+        into vendor/ by relative paths (composer path repositories). Run as the
+        real user, so what the tests write stays the user's under a sudo publish.
+        """
+        import hashlib
+        import os
+
+        from wexample_helpers.helper.user import user_get_real_gid, user_get_real_uid
+
+        runner = self._get_or_create_runner("roave")
+        runner.build()
+
+        user = f"{user_get_real_uid()}:{user_get_real_gid()}"
+        path = self.get_path()
+        path_hash = hashlib.md5(str(path).encode()).hexdigest()[:8]
+        vendor_volume = f"wex-php-vendor-{path.name}-{path_hash}"
+        cache_volume = "wex-php-composer-cache"
+
+        # The mount point: Docker would create it as root otherwise. Created by
+        # the user already when wex itself does not run as root.
+        vendor_dir = path / "vendor"
+        if not vendor_dir.exists():
+            vendor_dir.mkdir()
+            if os.geteuid() == 0:
+                os.chown(vendor_dir, user_get_real_uid(), user_get_real_gid())
+
+        # A new volume belongs to root; the tests run as the user.
+        self.shell_run_for_app(
+            cmd=[
+                "docker", "run", "--rm", "--user", "0",
+                "-v", f"{vendor_volume}:/vendor",
+                "-v", f"{cache_volume}:/cache",
+                runner.image_name,
+                "chown", user, "/vendor", "/cache",
+            ]
+        )
+
+        packages_dir = "/var/www/packages"
+        package_dir = f"{packages_dir}/{path.name}"
+        script = (
+            "set -e; "
+            'sum=$(sha1sum composer.json | cut -d" " -f1); '
+            'if [ "$(cat vendor/.wex-composer-json 2>/dev/null)" != "$sum" ]; then '
+            "composer config --global lock false; "
+            "composer update --no-interaction --no-progress --no-scripts; "
+            'echo "$sum" > vendor/.wex-composer-json; '
+            "fi; "
+            # The run history is not written into the package; every package
+            # requires PHPUnit ^13, which names the option so.
+            "exec vendor/bin/phpunit --do-not-record-test-run-history"
+        )
+        self.shell_run_for_app(
+            cmd=[
+                "docker", "run", "--rm", "--user", user,
+                "-e", "HOME=/tmp",
+                "-e", "COMPOSER_HOME=/tmp/composer",
+                "-e", "COMPOSER_CACHE_DIR=/cache",
+                "-v", f"{path.parent}:{packages_dir}",
+                "-v", f"{vendor_volume}:{package_dir}/vendor",
+                "-v", f"{cache_volume}:/cache",
+                "-w", package_dir,
+                runner.image_name,
+                "sh", "-c", script,
+            ]
+        )