Build/Test Tools: Fail tests that make external HTTP requests outside the external-http group.

[adimoldovan]

Trac ticket: https://core.trac.wordpress.org/ticket/63083

A test that makes an external HTTP request without @group external-http now fails, and the request never leaves the machine:

This test made an external HTTP request but is not in the `external-http` group.
Add `@group external-http` to it, or mock the request with the `pre_http_request` filter.
- http://example.com/embed/foo

WP_UnitTestCase_Base adds a pre_http_request filter to each test outside the group, behind any mock the test adds itself. The check runs only when WP_RUN_CORE_TESTS is set, so plugin and theme suites that use the core test suite keep working.

Tests_oEmbed_WpEmbed::test_run_shortcode_url_only gets the annotation it was missing. It is the only test in trunk that the check catches. Its own assertions pass either way, because run_shortcode() falls back to maybe_make_link() and returns the same link, which is why the request went unnoticed.

PHPUnit 10 removes getGroups(), so that migration will have to touch this condition.

Testing Instructions

1. Start the environment: npm run env:start && npm run env:install.

2. Run each of these. Expect no failures.

   Command	Tests
   npm run test:php	31,050
   npm run test:php -- --group external-http	86
   npm run test:php -- --group ajax	190
   npm run test:php -- -c tests/phpunit/multisite.xml	31,885
   npm run test:php -- -c tests/phpunit/multisite.xml --group external-http	87

3. Confirm the check catches a new offender. Save this as tests/phpunit/tests/guardDemo.php:

   <?php
   class Tests_Guard_Demo extends WP_UnitTestCase {
       public function test_external_request() {
           wp_remote_get( 'http://example.com/' );
           $this->assertTrue( true );
       }
   }

   Run npm run test:php -- --filter Tests_Guard_Demo. Expect one failure that names the URL and tells you to add the group. Add @group external-http to the test and run it again: the default run now excludes it. Delete the file.

4. Confirm the annotation in this patch is what keeps the suite green. Remove @group external-http from Tests_oEmbed_WpEmbed::test_run_shortcode_url_only, then run npm run test:php -- --filter Tests_oEmbed_WpEmbed::test_run_shortcode_url_only. Expect the same failure. Restore the annotation.

5. Check the coding standards: composer lint tests/phpunit/includes/abstract-testcase.php tests/phpunit/tests/oembed/WpEmbed.php.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5
Used for: The report-only audit of the test suite, and assisted with the implementation.

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

[westonruter]

This is looking really good.

[lancewillett]

@adimoldovan Want to take out of draft now? What's next to land this?

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props adrianmoldovanwp, westonruter, lancewillett.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[lancewillett]

Landed in https://core.trac.wordpress.org/changeset/63560

[johnbillion]

Neat!