test: add an integration suite running against wordpress and woocommerce

[YvesCesar]

The theme had no tests beyond a shell smoke test of the deploy webhook. This adds a PHPUnit suite that runs against a real WordPress with WooCommerce, plus a workflow for it.

Suite

• composer test runs phpunit-integration.xml.dist. composer install brings in WordPress, the WordPress test suite (wp-phpunit) and WooCommerce; the tests only need a MySQL/MariaDB database. The bootstrap loads WooCommerce and activates this theme from the repository folder.
• One test file per theme file, mirroring its path: tests/Integration/Inc/AccountTest.php for inc/account.php, tests/Integration/Woocommerce/Myaccount/FormLoginTest.php for the login template override.
• The fragment sync and the webhook fetch from a local static site served by donatj/mock-webserver. Calls to api.github.com have fixed URLs, so they are answered through pre_http_request. Any other outgoing request fails the test.
• phpunit.yml runs the suite on the PHP versions from composer.json, with actions pinned by SHA.
• readme.txt says how to run it, locally and on the SaaS stack.

The tests describe what the theme does today, including a few things worth knowing:

• The "Choose a plan" button falls back to the shop, and to the home page when there is no shop page, so it always shows while WooCommerce is active.
• The libresign/saas-onboarding pattern that inc/account.php prepends to the shop and checkout is not registered, so nothing is prepended.
• The fragment files are read once per request and cached in a static variable.

Fixes

Each one comes with a test that failed before the fix.

• redirect_to as an array: libresign_theme_get_purchase_redirect_target() passed $_REQUEST['redirect_to'] to wp_validate_redirect() without checking it is a string, so ?redirect_to[]=x ended in a TypeError. The function runs on the account page and after login and registration. It now ignores a value that is not a string. A guest opening /?redirect_to[]=x still gets an error from WooCommerce itself: BlockTypesController::redirect_to_field(), hooked to woocommerce_login_form_end, does the same with $_GET['redirect_to'] (also in WooCommerce 11.1.2).

• CPF/CNPJ placeholder: WooCommerce does not accept placeholder among the attributes of an additional checkout field. It dropped it and raised a "called incorrectly" notice on every request, so "Required for customers in Brazil" was never shown. The attribute is removed, and the registration moved from a closure to libresign_theme_register_cpf_cnpj_field() so the test can register the field again and check that WooCommerce raises no notice.

• Default deploy workflow: without a saved setting, the webhook only synced a run of a workflow named Deploy on the gh-pages branch. In LibreSign/site, Deploy runs on main, and the run on gh-pages is GitHub's pages build and deployment, so that combination never happened. The default is now pages build and deployment, the value the Customizer already shows and the one the libresign-wp-customizations plugin uses.

Verification

• composer ci passes: 235 tests.
• The suite passes in random order (--order-by=random) across repeated runs.
• Breaking one rule at a time in the theme makes at least one test fail: the redirect validation, the CPF check digits, the Brazil-only rule, the webhook signature, the duplicate delivery check, the terms consent, the missing logo detection, the optional locale 404, the registration column shown without a purchase, and the order of the header and footer stylesheet.

[vitormattos]

The integration test setup looks good overall, and the test structure is much better now.

I left one change request in AccountTest.php. The test for the missing libresign/saas-onboarding pattern is making a known incomplete behavior part of the expected test suite.

I do not think this PR needs to implement the missing pattern, but I think this test should be removed and the missing pattern should be tracked separately.

After this is adjusted, I do not see another blocker in this PR.

[vitormattos]

This test makes the missing libresign/saas-onboarding pattern an expected behavior.

The code in inc/account.php says that this pattern should be added to the shop and checkout pages, so the current behavior does not match the intended behavior.

I do not think we need to fix the missing pattern in this PR because that would increase the scope of this change. But I also do not think we should keep a test that will fail when this known issue is fixed.

Could we remove this test from this PR and track the missing pattern separately?