WEB-1194: Read releases from private repositories with a token (1.4.0)

[miguelcolmenares]

Summary

wp-github-updater can now read the releases of a private GitHub repository with a token, and keeps working anonymously for public ones. Phase 1 of WEB-1194 (making the SilverAssist plugin repositories private without breaking updates on the sites). Once this ships, the plugins bundle it, the sites get the token, and only then the repositories go private.

Changes

• Token. New token_constant option (default SILVER_GITHUB_TOKEN) and UpdaterConfig::getGithubToken(): a PHP constant first, then an environment variable, trimmed, null when empty. Never read from the database.
• Requests. Authorization: Bearer is sent to api.github.com only, never to another host.
• Download. With a token the package is the asset API URL. The download is done in two steps: the first request carries the token and stops at GitHub's redirect (redirection => 0), the second goes to the signed storage URL without the token. A redirect that is not https is refused.
• Diagnostics. A distinct log message for 401, 403 and 404, with and without a token, naming the constant to check. The token is never logged and a failed version lookup is not cached, so a site that stops updating can be diagnosed from its PHP log.
• PHPStan. Fixes the 29 level 8 errors and the stale ignoreErrors pattern, so composer check passes again (separate commit, no behaviour changes apart from two small hardenings listed in the CHANGELOG).
• Docs. New "Private Repositories" README section, token_constant option, 1.4.0 CHANGELOG, integration guide example. The "public GitHub releases" wording is gone, and the README requires_php default is corrected (8.2).

Tests

Nothing from WordPress core is mocked in the new tests. They run on the real WordPress Test Suite (WP_UnitTestCase) and intercept requests with WordPress' own pre_http_request filter.

• tests/WordPress/UpdaterPrivateReleasesTest.php: 12 tests (headers, asset URL, redirect without the token, refused insecure redirect, 401/403/404 messages, token never logged, failures not cached).
• tests/Unit/UpdaterConfigTest.php: 7 tests for the token lookup (constant, environment, precedence, trimming).
• tests/WordPress/PrivateRepoLiveTest.php: opt-in, skipped unless WPGU_LIVE_REPO, WPGU_LIVE_VERSION and SILVER_GITHUB_TOKEN are set.

Verification

• PHPCS 0 errors, PHPStan level 8 0 errors (was 29).
• Mock mode (no WordPress suite): 52 tests pass. Real WordPress suite: 80 tests pass, 3 skipped (the live ones).
• Live run against a real private repository with a release and a ZIP asset: the latest version is read with the token, the asset is downloaded through GitHub's signed redirect and is a valid ZIP, and without the token the repository is unreachable and the log explains why.
• Mutation check: sending the token to every host, ignoring the asset API URL, or following redirects automatically each make the expected tests fail.

Notes

• No version field to bump (the version comes from the tag). Release v1.4.0 follows the merge.
• The repository CI only runs the tests on a tag; there is no pull request workflow for tests, PHPCS or PHPStan. That is why the PHPStan errors went unnoticed and is worth a follow-up.
• The existing Unit and Integration tests still use tests/wordpress-mocks.php. Migrating them to the real suite is a separate change.