Repository navigation
fix: extract WordPress core without truncated file names - #78
Merged
mrrobot47 merged 2 commits intoOct 5, 2026
Merged
Conversation
WordPress 7.x .tar.gz packages store paths longer than 100 bytes in PAX headers. WP-CLI <= 2.12 extracts with PharData, which truncates them (wp-cli/wp-cli#6320), so deployed sites fail `wp core verify-checksums`. Let WP-CLI only download and md5-check the package (--no-extract), extract it with tar/unzip, then gate on wp core verify-checksums. Mirrors EasyEngine/site-command#504 and EasyEngine/site-type-wp#241.
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Checksum verification currently suppresses unexpected failures, allowing unverified deployments.
Review effort: Balanced
Findings: 1
What changed in this PR
Adds reliable WordPress core extraction to prevent truncated filenames.
Changes:
- Downloads archives without WP-CLI extraction.
- Extracts via
tar/unzip. - Verifies core checksums after extraction.
| File | Description |
|---|---|
main.sh |
Adds core download, extraction, and verification logic. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Any other verify-checksums failure (PHP/WP-CLI runtime errors etc.) now fails the deploy instead of continuing unverified. Matches the fetch-error handling in EasyEngine/site-command#504.
mrrobot47
approved these changes
Oct 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
WordPress 7.x
.tar.gzpackages store paths longer than 100 bytes in PAX headers. WP-CLI <= 2.12 extracts them with PHP'sPharData, which truncates the names (wp-cli/wp-cli#6320).setup_wordpress_files()runs a plainwp core download, so deployed sites get a broken core (25 files underwp-includes/php-ai-client/) and failwp core verify-checksums. This is what triggers the false-positive 'WordPress Core Checksum Failed' ED alerts on CI/CD sites.Fix
New
download_wordpress_core()inmain.sh, same approach as EasyEngine/site-command#504 and EasyEngine/site-type-wp#241:wp core download --no-extractonly downloads and md5-checks the package.tar(orunzipfor the.zipWP-CLI 3.0 saves).wp core verify-checksums. Fail on missing or modified core files; warn only if WordPress.org checksums can't be fetched.nightly/trunkkeep WP-CLI's own.zipextraction and skip verification (no published checksums).Testing
In
wordpress:cli(WP-CLI 2.12.0): WP 7.1.2 downloads, extracts and passeswp core verify-checksums; nightly still extracts. Not tested: the.zipbranch and a full action run on a real site.