From 10eb82155921f92603be0ebc6d1edcf77892b2b6 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Sun, 12 Jul 2026 22:58:45 -0700
Subject: [PATCH 1/8] ci: pin integration tests to Cacti 1.2.31

---
 .github/workflows/plugin-ci-workflow.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml
index aea428fe..51a1e7f8 100644
--- a/.github/workflows/plugin-ci-workflow.yml
+++ b/.github/workflows/plugin-ci-workflow.yml
@@ -64,6 +64,7 @@ jobs:
       uses: actions/checkout@v7
       with:
         repository: Cacti/cacti
+        ref: release/1.2.31
         path: cacti
     
     - name: Checkout Thold Plugin

From 38dfe3ce0022b2082acda19a4e7ee3fb7937150a Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Tue, 14 Jul 2026 02:41:47 -0700
Subject: [PATCH 2/8] Guard optional PHPStan configuration

---
 .github/workflows/plugin-ci-workflow.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml
index 51a1e7f8..6cf44970 100644
--- a/.github/workflows/plugin-ci-workflow.yml
+++ b/.github/workflows/plugin-ci-workflow.yml
@@ -191,7 +191,10 @@ jobs:
         fi
     
     - name: Remove the plugins directory exclusion from the .phpstan.neon
-      run: sed '/plugins/d' -i .phpstan.neon
+      run: |
+        if [ -f .phpstan.neon ]; then
+          sed '/plugins/d' -i .phpstan.neon
+        fi
       working-directory: ${{ github.workspace }}/cacti
 
     - name: Mark composer scripts executable

From ff35eb5909a4a51573d8fb0d45a1456d1493eea0 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Tue, 14 Jul 2026 02:45:12 -0700
Subject: [PATCH 3/8] Guard optional Composer vendor binaries

---
 .github/workflows/plugin-ci-workflow.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml
index 6cf44970..6b0f1247 100644
--- a/.github/workflows/plugin-ci-workflow.yml
+++ b/.github/workflows/plugin-ci-workflow.yml
@@ -198,7 +198,10 @@ jobs:
       working-directory: ${{ github.workspace }}/cacti
 
     - name: Mark composer scripts executable
-      run: sudo chmod +x ${{ github.workspace }}/cacti/include/vendor/bin/*
+      run: |
+        if [ -d "${{ github.workspace }}/cacti/include/vendor/bin" ]; then
+          sudo find "${{ github.workspace }}/cacti/include/vendor/bin" -maxdepth 1 -type f -exec chmod +x {} +
+        fi
 
     - name: Run Linter on base code
       run: composer run-script lint ${{ github.workspace }}/cacti/plugins/thold

From 6d00653eac2192082d1f6243d016bb71cea6743f Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Tue, 14 Jul 2026 02:50:43 -0700
Subject: [PATCH 4/8] Skip unavailable Composer quality scripts

---
 .github/workflows/plugin-ci-workflow.yml | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml
index 6b0f1247..a788c66a 100644
--- a/.github/workflows/plugin-ci-workflow.yml
+++ b/.github/workflows/plugin-ci-workflow.yml
@@ -204,11 +204,21 @@ jobs:
         fi
 
     - name: Run Linter on base code
-      run: composer run-script lint ${{ github.workspace }}/cacti/plugins/thold
+      run: |
+        if composer run-script --list | grep -qE '^  lint'; then
+          composer run-script lint ${{ github.workspace }}/cacti/plugins/thold
+        else
+          echo 'Composer lint script is not defined; skipping.'
+        fi
       working-directory: ${{ github.workspace }}/cacti
 
     - name: Checking coding standards on base code
-      run: composer run-script phpcsfixer ${{ github.workspace }}/cacti/plugins/thold
+      run: |
+        if composer run-script --list | grep -qE '^  phpcsfixer'; then
+          composer run-script phpcsfixer ${{ github.workspace }}/cacti/plugins/thold
+        else
+          echo 'Composer phpcsfixer script is not defined; skipping.'
+        fi
       working-directory: ${{ github.workspace }}/cacti
 
 #    - name: Run PHPStan at Level 6 on base code outside of Composer due to technical issues

From 66325f8e0d1df72a4590695ef5ec15267e523389 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Sun, 16 Aug 2026 22:45:38 -0700
Subject: [PATCH 5/8] ci: keep watching Cacti develop alongside the pinned
 release

Pinning the checkout makes the suite exercise the compatibility contract the
plugin declares, but it also means a regression in Cacti develop stops being
visible here. One advisory job restores that signal: it builds against develop
and is marked continue-on-error, so it reports without turning the plugin's own
pull requests red.

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 .github/workflows/plugin-ci-workflow.yml | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml
index a788c66a..1606ae73 100644
--- a/.github/workflows/plugin-ci-workflow.yml
+++ b/.github/workflows/plugin-ci-workflow.yml
@@ -35,11 +35,21 @@ jobs:
   integration-test:
     runs-on: ${{ matrix.os }}
     
+    # A failure against the pinned release is a real failure. The develop entry
+    # is advisory: it is how a core regression becomes visible here, but it must
+    # not turn the plugin's own pull requests red.
+    continue-on-error: ${{ matrix.cacti != 'release/1.2.31' }}
+
     strategy:
       fail-fast: false
       matrix:
         php: ['8.1', '8.2', '8.3', '8.4']
         os: [ubuntu-latest]
+        cacti: ['release/1.2.31']
+        include:
+          - php: '8.4'
+            os: ubuntu-latest
+            cacti: 'develop'
     
     services:
       mariadb:
@@ -57,14 +67,14 @@ jobs:
           --health-timeout=5s
           --health-retries=3
     
-    name: PHP ${{ matrix.php }} Integration Test on ${{ matrix.os }}
+    name: PHP ${{ matrix.php }} Integration Test on ${{ matrix.os }} against Cacti ${{ matrix.cacti }}
     
     steps:
     - name: Checkout Cacti
       uses: actions/checkout@v7
       with:
         repository: Cacti/cacti
-        ref: release/1.2.31
+        ref: ${{ matrix.cacti }}
         path: cacti
     
     - name: Checkout Thold Plugin

From 9623978cf3fbb8b0ba7c2a0306bee0804a32e4d8 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Mon, 17 Aug 2026 13:20:36 -0700
Subject: [PATCH 6/8] ci: address workflow review feedback

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 .github/workflows/plugin-ci-workflow.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/plugin-ci-workflow.yml b/.github/workflows/plugin-ci-workflow.yml
index 1606ae73..5e4f3db6 100644
--- a/.github/workflows/plugin-ci-workflow.yml
+++ b/.github/workflows/plugin-ci-workflow.yml
@@ -203,7 +203,7 @@ jobs:
     - name: Remove the plugins directory exclusion from the .phpstan.neon
       run: |
         if [ -f .phpstan.neon ]; then
-          sed '/plugins/d' -i .phpstan.neon
+          sed -i '/plugins/d' .phpstan.neon
         fi
       working-directory: ${{ github.workspace }}/cacti
 
@@ -215,7 +215,7 @@ jobs:
 
     - name: Run Linter on base code
       run: |
-        if composer run-script --list | grep -qE '^  lint'; then
+        if composer --no-ansi run-script --list | grep -qE '^[[:space:]]+lint([[:space:]]|$)'; then
           composer run-script lint ${{ github.workspace }}/cacti/plugins/thold
         else
           echo 'Composer lint script is not defined; skipping.'
@@ -224,7 +224,7 @@ jobs:
 
     - name: Checking coding standards on base code
       run: |
-        if composer run-script --list | grep -qE '^  phpcsfixer'; then
+        if composer --no-ansi run-script --list | grep -qE '^[[:space:]]+phpcsfixer([[:space:]]|$)'; then
           composer run-script phpcsfixer ${{ github.workspace }}/cacti/plugins/thold
         else
           echo 'Composer phpcsfixer script is not defined; skipping.'

From ffd7fe1e72a70c03996a292ae304c54642e9c067 Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Mon, 17 Aug 2026 13:29:21 -0700
Subject: [PATCH 7/8] ci: run plugin tests with Cacti Pest

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 .github/workflows/php-unit-tests.yml | 55 ++++++++++++++++++----------
 .gitignore                           |  3 --
 composer.json                        | 49 -------------------------
 phpunit.xml                          |  5 ++-
 tests/bin/patch-coverage.php         |  9 ++++-
 tests/bootstrap-unit.php             | 26 +++++++++++--
 tests/docker/Dockerfile              | 29 ---------------
 tests/docker/docker-compose.yml      | 15 --------
 8 files changed, 69 insertions(+), 122 deletions(-)
 delete mode 100644 composer.json
 delete mode 100644 tests/docker/Dockerfile
 delete mode 100644 tests/docker/docker-compose.yml

diff --git a/.github/workflows/php-unit-tests.yml b/.github/workflows/php-unit-tests.yml
index 9ab561f2..345e3af3 100644
--- a/.github/workflows/php-unit-tests.yml
+++ b/.github/workflows/php-unit-tests.yml
@@ -20,7 +20,7 @@
 # +-------------------------------------------------------------------------+
 
 
-name: PHP Unit Tests
+name: Pest Tests
 
 on:
   push:
@@ -41,7 +41,7 @@ concurrency:
 
 jobs:
   unit-test:
-    name: PHPUnit on PHP 8.1 (Docker)
+    name: Pest using Cacti Composer (Docker)
     runs-on: ubuntu-latest
 
     steps:
@@ -51,25 +51,40 @@ jobs:
           # patch-coverage.php diffs against the base branch.
           fetch-depth: 0
 
-      # The image is the same one developers run locally via
-      # `composer test:docker`, so a green run here is reproducible off-CI.
-      - name: Build test image
-        run: docker build --tag cacti-thold-test:php8.1 --file tests/docker/Dockerfile tests/docker
-
-      - name: Validate composer.json
-        run: docker run --rm --volume "$PWD":/cacti/plugins/thold cacti-thold-test:php8.1 composer validate --strict --no-check-lock
+      - name: Checkout Cacti test infrastructure
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: Cacti/cacti
+          # Pin the Cacti Composer/Pest toolchain so upstream changes cannot
+          # silently alter this plugin's test environment.
+          ref: 298bd51eca843490fb90b27ada6b3fecc9b9a7d8
+          path: cacti
 
-      - name: Install dependencies
-        run: docker run --rm --volume "$PWD":/cacti/plugins/thold cacti-thold-test:php8.1 composer install --no-progress --no-ansi
+      # Build the same Linux image used by Cacti's tests/tools/docker_pest.sh.
+      # Composer installs and executes Cacti's locked Pest toolchain in /work;
+      # Thold contributes no parallel vendor directory or PHPUnit dependency.
+      - name: Build Cacti test image
+        run: |
+          docker build --tag cacti-web --file cacti/docker/Dockerfile cacti/docker
+          docker build --tag cacti-thold-test --file cacti/docker/Dockerfile.test cacti
 
-      # Same scripts a developer runs locally, and the same names Cacti core uses.
       - name: Lint every PHP source file
-        run: docker run --rm --volume "$PWD":/cacti/plugins/thold cacti-thold-test:php8.1 composer lint
+        run: |
+          docker run --rm --volume "$PWD":/work/plugins/thold \
+            --env COMPOSER_ROOT_VERSION=1.3.0-dev \
+            --entrypoint composer cacti-thold-test \
+            run-script lint /work/plugins/thold
 
-      - name: Run unit tests with coverage
+      - name: Run Pest with coverage
         run: |
-          docker run --rm --volume "$PWD":/cacti/plugins/thold cacti-thold-test:php8.1 \
-            composer test:coverage
+          docker run --rm --volume "$PWD":/work/plugins/thold \
+            --env COMPOSER_ROOT_VERSION=1.3.0-dev \
+            --env XDEBUG_MODE=coverage \
+            --user root \
+            --entrypoint composer cacti-thold-test \
+            test -- --configuration=plugins/thold/phpunit.xml \
+            --coverage-clover=plugins/thold/coverage/clover.xml \
+            plugins/thold/tests/Unit
 
       # Whole-file coverage is meaningless here: most of the plugin only runs
       # inside a live Cacti. What is enforceable is that a change covers the
@@ -77,11 +92,11 @@ jobs:
       - name: Enforce coverage of changed lines
         if: github.event_name == 'pull_request'
         env:
-          BASE_REF: origin/${{ github.base_ref }}
+          BASE_REF: ${{ github.event.pull_request.base.sha }}
         run: |
-          docker run --rm --volume "$PWD":/cacti/plugins/thold --env BASE_REF \
-            cacti-thold-test:php8.1 \
-            sh -c 'git config --global --add safe.directory /cacti/plugins/thold && php tests/bin/patch-coverage.php coverage/clover.xml "$BASE_REF" 100'
+          docker run --rm --volume "$PWD":/plugin --workdir /plugin \
+            --env BASE_REF --user root --entrypoint sh cacti-thold-test \
+            -c 'git config --global --add safe.directory /plugin && php tests/bin/patch-coverage.php coverage/clover.xml "$BASE_REF" 100'
 
       - name: Upload coverage report
         if: always()
diff --git a/.gitignore b/.gitignore
index 0806dc45..e2e016a6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -21,9 +21,6 @@
 
 locales/po/*.mo
 
-/vendor/
-/composer.lock
 /.phpunit.cache/
 /coverage/
-/coverage/
 /.phpunit.result.cache
diff --git a/composer.json b/composer.json
deleted file mode 100644
index 94aead2f..00000000
--- a/composer.json
+++ /dev/null
@@ -1,49 +0,0 @@
-{
-    "_comment": [
-        "+-------------------------------------------------------------------------+",
-        "| Copyright (C) 2004-2026 The Cacti Group                                 |",
-        "|                                                                         |",
-        "| This program is free software; you can redistribute it and/or           |",
-        "| modify it under the terms of the GNU General Public License             |",
-        "| as published by the Free Software Foundation; either version 2          |",
-        "| of the License, or (at your option) any later version.                  |",
-        "|                                                                         |",
-        "| This program is distributed in the hope that it will be useful,         |",
-        "| but WITHOUT ANY WARRANTY; without even the implied warranty of          |",
-        "| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |",
-        "| GNU General Public License for more details.                            |",
-        "+-------------------------------------------------------------------------+",
-        "| Cacti: The Complete RRDtool-based Graphing Solution                     |",
-        "+-------------------------------------------------------------------------+",
-        "| http://www.cacti.net/                                                   |",
-        "+-------------------------------------------------------------------------+"
-    ],
-    "name": "cacti/plugin-thold",
-    "description": "Thold Plugin for Cacti",
-    "type": "project",
-    "license": "GPL-2.0-only",
-    "require-dev": {
-        "overtrue/phplint": "^9.6",
-        "phpunit/phpunit": "^10.5.64"
-    },
-    "scripts": {
-        "lint": "phplint --no-cache --exclude=vendor ",
-        "test": "phpunit --display-warnings",
-        "test:coverage": "phpunit --display-warnings --coverage-clover=coverage/clover.xml",
-        "test:docker": "docker compose -f tests/docker/docker-compose.yml run --rm phpunit"
-    },
-    "config": {
-        "sort-packages": true,
-        "vendor-dir": "vendor",
-        "platform": {
-            "php": "8.1.0"
-        },
-        "platform-check": true
-    },
-    "autoload-dev": {
-        "classmap": [
-            "tests/Helpers/",
-            "tests/TestCase.php"
-        ]
-    }
-}
diff --git a/phpunit.xml b/phpunit.xml
index 46a8d9a8..3f0a7011 100644
--- a/phpunit.xml
+++ b/phpunit.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:noNamespaceSchemaLocation="vendor/phpunit/phpunit/phpunit.xsd"
+         xsi:noNamespaceSchemaLocation="../../include/vendor/phpunit/phpunit/phpunit.xsd"
          bootstrap="tests/bootstrap-unit.php"
          cacheDirectory=".phpunit.cache"
          colors="true"
@@ -19,6 +19,9 @@
 	</testsuites>
 
 	<!--
+		Pest reads this PHPUnit-compatible configuration through Cacti's
+		Composer-managed vendor tree.
+
 		thold_functions.php is the only plugin source that loads without a
 		running Cacti; every other file includes ./include/auth.php and
 		dispatches on the request at top level.
diff --git a/tests/bin/patch-coverage.php b/tests/bin/patch-coverage.php
index 83f9c73f..b6f5ff7f 100644
--- a/tests/bin/patch-coverage.php
+++ b/tests/bin/patch-coverage.php
@@ -58,14 +58,19 @@
  */
 function changed_lines($base_ref) {
 	$command = 'git diff --no-ext-diff --unified=0 --no-color --diff-filter=AM ' . escapeshellarg($base_ref) . '...HEAD -- "*.php"';
-	$diff    = shell_exec($command);
+	$output  = [];
+	$status  = 0;
 
-	if ($diff === null) {
+	exec($command, $output, $status);
+
+	if ($status !== 0) {
 		fwrite(STDERR, "git diff failed\n");
 
 		exit(2);
 	}
 
+	$diff = implode("\n", $output);
+
 	$changed = [];
 	$file    = null;
 
diff --git a/tests/bootstrap-unit.php b/tests/bootstrap-unit.php
index 6ab1ecbe..4d9ceb76 100644
--- a/tests/bootstrap-unit.php
+++ b/tests/bootstrap-unit.php
@@ -27,16 +27,36 @@
  * a future integration suite loads real Cacti first.
  */
 
-require_once dirname(__DIR__) . '/vendor/autoload.php';
+$cacti_root = dirname(__DIR__, 3);
+$autoload   = $cacti_root . '/include/vendor/autoload.php';
+$version    = $cacti_root . '/include/cacti_version';
+
+if (!is_readable($autoload)) {
+	throw new RuntimeException("Cacti Composer autoloader is not readable: $autoload");
+}
+
+if (!is_readable($version)) {
+	throw new RuntimeException("Cacti version file is not readable: $version");
+}
+
+$cacti_version = trim((string) file_get_contents($version));
+
+if ($cacti_version === '') {
+	throw new RuntimeException("Cacti version file is empty: $version");
+}
+
+require_once $autoload;
+require_once __DIR__ . '/Helpers/CactiStubs.php';
+require_once __DIR__ . '/TestCase.php';
 
 /*
  * base_path has to point at the Cacti root two levels above this plugin:
  * thold_functions.php builds include paths from it at runtime.
  */
 $GLOBALS['config'] = [
-	'base_path'       => dirname(dirname(dirname(__DIR__))),
+	'base_path'       => $cacti_root,
 	'url_path'        => '/cacti/',
-	'cacti_version'   => '1.2.31',
+	'cacti_version'   => $cacti_version,
 	'cacti_server_os' => 'unix',
 ];
 
diff --git a/tests/docker/Dockerfile b/tests/docker/Dockerfile
deleted file mode 100644
index 518f7321..00000000
--- a/tests/docker/Dockerfile
+++ /dev/null
@@ -1,29 +0,0 @@
-# Test runner for the Thold plugin.
-#
-# Pinned to PHP 8.1 because that is the oldest interpreter the CI matrix
-# covers; what passes here passes on 8.2-8.4.  pcov rather than Xdebug: line
-# coverage is the only debug feature the suite needs and pcov is far cheaper.
-FROM php:8.1-cli-alpine@sha256:7949370448b0b4d9787776dc5968e0fd8d48763292344b5fbf21539441228a98
-
-# git is needed by the changed-line coverage gate, which diffs against the
-# base branch.
-RUN apk add --no-cache git gmp-dev \
-	&& docker-php-ext-install gmp \
-	&& apk add --no-cache --virtual .build-deps $PHPIZE_DEPS \
-	&& pecl install pcov \
-	&& docker-php-ext-enable pcov \
-	&& apk del .build-deps
-
-COPY --from=composer:2@sha256:4d71c3c2109c61d5415544264b59ad4087e4c5b7244481723664138fd36d5040 /usr/bin/composer /usr/bin/composer
-
-# The plugin lives where Cacti would put it, because thold_functions.php
-# resolves its own includes through $config['base_path'] . '/plugins/thold'.
-# No network or database is involved; the Cacti framework functions themselves
-# are stubbed in tests/bootstrap.php.
-WORKDIR /cacti/plugins/thold
-
-ENV COMPOSER_ALLOW_SUPERUSER=1 \
-    COMPOSER_NO_INTERACTION=1 \
-    COMPOSER_CACHE_DIR=/tmp/composer-cache
-
-CMD ["sh", "-c", "composer install --no-progress --no-ansi && composer test"]
diff --git a/tests/docker/docker-compose.yml b/tests/docker/docker-compose.yml
deleted file mode 100644
index 99d38b47..00000000
--- a/tests/docker/docker-compose.yml
+++ /dev/null
@@ -1,15 +0,0 @@
-# Local mirror of the unit-test CI job.  `docker compose -f
-# tests/docker/docker-compose.yml run --rm phpunit` runs exactly what CI runs.
-services:
-  phpunit:
-    build:
-      context: .
-      dockerfile: Dockerfile
-    image: cacti-thold-test:php8.1
-    working_dir: /cacti/plugins/thold
-    volumes:
-      - ../..:/cacti/plugins/thold
-      - composer-cache:/tmp/composer-cache
-
-volumes:
-  composer-cache:

From 5413613c4c563672114bd8a87daed455ade5871f Mon Sep 17 00:00:00 2001
From: Thomas Vincent <thomasvincent@gmail.com>
Date: Mon, 17 Aug 2026 13:42:57 -0700
Subject: [PATCH 8/8] test: pin Cacti harness expectations

Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
---
 .github/workflows/php-unit-tests.yml | 29 ++++++++++++++++++----------
 phpunit.xml                          |  2 +-
 tests/.cacti-version                 |  1 +
 tests/bin/patch-coverage.php         |  4 ++--
 tests/bootstrap-unit.php             | 14 ++++++++++++++
 5 files changed, 37 insertions(+), 13 deletions(-)
 create mode 100644 tests/.cacti-version

diff --git a/.github/workflows/php-unit-tests.yml b/.github/workflows/php-unit-tests.yml
index 345e3af3..89eb1ad4 100644
--- a/.github/workflows/php-unit-tests.yml
+++ b/.github/workflows/php-unit-tests.yml
@@ -51,22 +51,29 @@ jobs:
           # patch-coverage.php diffs against the base branch.
           fetch-depth: 0
 
-      - name: Checkout Cacti test infrastructure
+      - name: Checkout Cacti 1.2.31 runtime
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: Cacti/cacti
-          # Pin the Cacti Composer/Pest toolchain so upstream changes cannot
-          # silently alter this plugin's test environment.
+          # Commit behind the annotated release/1.2.31 tag.
+          ref: 1e8eaca26b84b128c39ce8cc8ece42d7ff76aac1
+          path: cacti-runtime
+
+      - name: Checkout Cacti test toolchain
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: Cacti/cacti
+          # Pin Composer, Pest, the lock file, and Cacti's Docker test image.
           ref: 298bd51eca843490fb90b27ada6b3fecc9b9a7d8
-          path: cacti
+          path: cacti-toolchain
 
       # Build the same Linux image used by Cacti's tests/tools/docker_pest.sh.
       # Composer installs and executes Cacti's locked Pest toolchain in /work;
       # Thold contributes no parallel vendor directory or PHPUnit dependency.
       - name: Build Cacti test image
         run: |
-          docker build --tag cacti-web --file cacti/docker/Dockerfile cacti/docker
-          docker build --tag cacti-thold-test --file cacti/docker/Dockerfile.test cacti
+          docker build --tag cacti-web --file cacti-toolchain/docker/Dockerfile cacti-toolchain/docker
+          docker build --tag cacti-thold-test --file cacti-toolchain/docker/Dockerfile.test cacti-toolchain
 
       - name: Lint every PHP source file
         run: |
@@ -77,14 +84,16 @@ jobs:
 
       - name: Run Pest with coverage
         run: |
-          docker run --rm --volume "$PWD":/work/plugins/thold \
+          docker run --rm \
+            --volume "$PWD/cacti-runtime":/cacti \
+            --volume "$PWD":/cacti/plugins/thold \
             --env COMPOSER_ROOT_VERSION=1.3.0-dev \
             --env XDEBUG_MODE=coverage \
             --user root \
             --entrypoint composer cacti-thold-test \
-            test -- --configuration=plugins/thold/phpunit.xml \
-            --coverage-clover=plugins/thold/coverage/clover.xml \
-            plugins/thold/tests/Unit
+            test -- --configuration=/cacti/plugins/thold/phpunit.xml \
+            --coverage-clover=/cacti/plugins/thold/coverage/clover.xml \
+            /cacti/plugins/thold/tests/Unit
 
       # Whole-file coverage is meaningless here: most of the plugin only runs
       # inside a live Cacti. What is enforceable is that a change covers the
diff --git a/phpunit.xml b/phpunit.xml
index 3f0a7011..b68405ad 100644
--- a/phpunit.xml
+++ b/phpunit.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:noNamespaceSchemaLocation="../../include/vendor/phpunit/phpunit/phpunit.xsd"
+         xsi:noNamespaceSchemaLocation="/work/include/vendor/phpunit/phpunit/phpunit.xsd"
          bootstrap="tests/bootstrap-unit.php"
          cacheDirectory=".phpunit.cache"
          colors="true"
diff --git a/tests/.cacti-version b/tests/.cacti-version
new file mode 100644
index 00000000..0848465b
--- /dev/null
+++ b/tests/.cacti-version
@@ -0,0 +1 @@
+1.2.31
diff --git a/tests/bin/patch-coverage.php b/tests/bin/patch-coverage.php
index b6f5ff7f..43e0a936 100644
--- a/tests/bin/patch-coverage.php
+++ b/tests/bin/patch-coverage.php
@@ -61,9 +61,9 @@ function changed_lines($base_ref) {
 	$output  = [];
 	$status  = 0;
 
-	exec($command, $output, $status);
+	$last_line = exec($command, $output, $status);
 
-	if ($status !== 0) {
+	if ($last_line === false || $status !== 0) {
 		fwrite(STDERR, "git diff failed\n");
 
 		exit(2);
diff --git a/tests/bootstrap-unit.php b/tests/bootstrap-unit.php
index 4d9ceb76..ce2b2615 100644
--- a/tests/bootstrap-unit.php
+++ b/tests/bootstrap-unit.php
@@ -30,6 +30,7 @@
 $cacti_root = dirname(__DIR__, 3);
 $autoload   = $cacti_root . '/include/vendor/autoload.php';
 $version    = $cacti_root . '/include/cacti_version';
+$expected   = __DIR__ . '/.cacti-version';
 
 if (!is_readable($autoload)) {
 	throw new RuntimeException("Cacti Composer autoloader is not readable: $autoload");
@@ -39,12 +40,25 @@
 	throw new RuntimeException("Cacti version file is not readable: $version");
 }
 
+if (!is_readable($expected)) {
+	throw new RuntimeException("Expected Cacti version file is not readable: $expected");
+}
+
 $cacti_version = trim((string) file_get_contents($version));
+$expected_version = trim((string) file_get_contents($expected));
 
 if ($cacti_version === '') {
 	throw new RuntimeException("Cacti version file is empty: $version");
 }
 
+if ($expected_version === '') {
+	throw new RuntimeException("Expected Cacti version file is empty: $expected");
+}
+
+if ($cacti_version !== $expected_version) {
+	throw new RuntimeException("Expected Cacti $expected_version, found $cacti_version in $version");
+}
+
 require_once $autoload;
 require_once __DIR__ . '/Helpers/CactiStubs.php';
 require_once __DIR__ . '/TestCase.php';