test-env: the pinned WordPress never updates itself under a gate (from aff7378)

Author: iOSDevSK

skills/html2wp/SKILL.md

@@ -1939,8 +1939,9 @@ assets/scripts/test-env.sh down <slug>            # tear down when done
 
 `up` runs on a UNIQUE `docker compose` project (`h2wp-<slug>-<runid>`), finds
 its own free host port (real allocation via Docker, not an assumed `8082`),
-installs wp-cli and WordPress itself (the base `wordpress:latest` image ships
-neither wp-cli nor a mysql client — verify before assuming either is there),
+installs wp-cli and WordPress itself (the base image, WordPress 7.0.2 pinned by
+digest with its auto-updater off, ships neither wp-cli nor a mysql client —
+verify before assuming either is there),
 sets a permalink structure and asserts `.htaccess` actually got real
 `RewriteRule` lines rather than empty BEGIN/END markers, fixes `wp-content`
 ownership to `www-data`, and deletes WordPress's sample content. It writes

skills/html2wp/assets/scripts/test-env-compose.yml

@@ -27,7 +27,13 @@ services:
       # after that file is gone (see up_cmd). Empty when set by nothing.
       h2wp.state: "${H2WP_STATE_FILE:-}"
   wp:
-    # WordPress 7.0.2, pinned for the same reason as the database.
+    # WordPress 7.0.2, pinned for the same reason as the database: pinned by
+    # digest AND with the updater off. WordPress lives in the wp_data volume,
+    # and a site on the stock image updates its own core through wp-cron
+    # (major versions included): an idle preview went from 7.0.2 to 7.1.2 in
+    # place, and the gate running at that minute met maintenance mode. The
+    # constant stops core, plugin, theme and translation auto-updates.
+    # Repin deliberately (and record it), never by drift.
     image: wordpress:latest@sha256:fe04ca18a5897be659e0d48686467dc939409b6ee53394507d0d08396595be67
     depends_on:
       - db
@@ -36,6 +42,7 @@ services:
       WORDPRESS_DB_NAME: wordpress
       WORDPRESS_DB_USER: wordpress
       WORDPRESS_DB_PASSWORD: wppw
+      WORDPRESS_CONFIG_EXTRA: "define('AUTOMATIC_UPDATER_DISABLED', true);"
     ports:
       # No host port pinned on purpose — Docker allocates a free one
       # atomically, which is a real free-port search (no bind-then-hope race)

skills/html2wp/assets/scripts/test-env-pinned.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Copyright (c) 2026 BELNEM s.r.o. html2wp Source-Available Licence — see LICENSE.
+#
+# The test WordPress holds still: a fresh `test-env.sh up` runs the pinned
+# WordPress, and WordPress's own update checks (the wp-cron events that
+# installed 7.1.2 over an idle 7.0.2 preview, maintenance mode included)
+# change nothing: same version afterwards, no .maintenance file, and the
+# updater reports itself disabled.
+# Needs Docker. Uses its own throwaway env and removes it.
+set -uo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+command -v docker >/dev/null || { echo "SKIP: docker not available"; exit 0; }
+TMP="$(mktemp -d)"; SLUG="p-pinned-$$"
+cleanup() { (cd "$TMP" && bash "$HERE/test-env.sh" down "$SLUG" >/dev/null 2>&1); rm -rf "$TMP"; }
+trap cleanup EXIT
+fail=0; check() { if [ "$2" = "$3" ]; then echo "  ok   $1"; else echo "  FAIL $1: got '$2', want '$3'"; fail=1; fi; }
+
+cd "$TMP"
+bash "$HERE/test-env.sh" up "$SLUG" > up.log 2>&1 || { echo "up failed:"; tail -20 up.log; exit 1; }
+WP="$(python3 -c "import json;print(json.load(open('.test-env-$SLUG.json'))['wpCli'])")"
+# The version the image ships, read from the image's own copy: the pin is the
+# digest, so the test never hardcodes a WordPress release.
+IMG="$($WP eval 'include "/usr/src/wordpress/wp-includes/version.php"; echo $wp_version;' 2>/dev/null)"
+before="$($WP core version)"
+check "a fresh up runs the image's WordPress" "$before" "$IMG"
+check "the updater is off" "$($WP eval 'require_once ABSPATH."wp-admin/includes/class-wp-automatic-updater.php"; echo (new WP_Automatic_Updater())->is_disabled() ? "off" : "on";')" "off"
+$WP cron event run wp_version_check >/dev/null 2>&1
+$WP cron event run wp_maybe_auto_update >/dev/null 2>&1
+check "after WordPress's own update run: same version" "$($WP core version)" "$before"
+check "no maintenance mode left behind" "$($WP eval 'echo file_exists(ABSPATH.".maintenance") ? "present" : "absent";')" "absent"
+
+[ "$fail" = 0 ] && echo "ALL OK" || { echo "FAILED"; exit 1; }