Shopware 6 | Update, Test & Release 3.5.0

.github/scripts/resolve-dockware-tag.py

@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+"""Resolve the newest dockware/shopware image tag for a Shopware series.
+
+The pinned-version problem this solves: when Shopware ships a patch, a
+hardcoded matrix keeps testing the previous one and the new release goes
+unverified until somebody notices.
+
+dockware publishes a plain multi-arch tag (6.7.13.0) plus per-arch tags
+(6.7.13.0-amd64). A fresh release often appears as -amd64 first and only
+gains its manifest hours later, so prefer the plain tag and fall back to
+-amd64 rather than skipping a release that is already testable.
+"""
+import json
+import re
+import sys
+import urllib.request
+
+REGISTRY = 'https://hub.docker.com/v2/repositories/dockware/shopware/tags'
+MAX_PAGES = 5
+
+
+def fetch_tags():
+    names, url = [], f'{REGISTRY}?page_size=100'
+    for _ in range(MAX_PAGES):
+        with urllib.request.urlopen(url, timeout=30) as res:
+            payload = json.load(res)
+        names.extend(t['name'] for t in payload.get('results', []))
+        url = payload.get('next')
+        if not url:
+            break
+    return names
+
+
+def resolve(series, names):
+    pattern = re.compile(r'^' + re.escape(series) + r'\.(\d+)\.(\d+)(-amd64)?$')
+    versions = {}
+    for name in names:
+        match = pattern.match(name)
+        if not match:
+            continue
+        key = (int(match.group(1)), int(match.group(2)))
+        versions.setdefault(key, set()).add(name)
+
+    if not versions:
+        raise SystemExit(f'no dockware tag found for series {series}')
+
+    newest = max(versions)
+    candidates = versions[newest]
+    plain = f'{series}.{newest[0]}.{newest[1]}'
+    # Plain tag is multi-arch; the -amd64 fallback still runs on GitHub runners.
+    return plain if plain in candidates else f'{plain}-amd64'
+
+
+if __name__ == '__main__':
+    if len(sys.argv) != 2:
+        raise SystemExit('usage: resolve-dockware-tag.py <series, e.g. 6.7>')
+    print(resolve(sys.argv[1], fetch_tags()))

.github/workflows/e2e-nightly.yml

@@ -0,0 +1,42 @@
+name: E2E Nightly
+
+# Walks the whole range the plugin claims in composer.json (>=6.5.8.0 <6.8).
+# This is what turns that claim into something verified rather than asserted:
+# when Shopware ships a patch that moves a template or renames a block, this
+# goes red the next morning instead of surfacing in a support ticket.
+on:
+  schedule:
+    - cron: '15 2 * * *'
+  workflow_dispatch:
+
+jobs:
+  # The newest patch of each supported series is resolved at run time, so a
+  # fresh Shopware release is covered the next night with no edit here.
+  resolve:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.build.outputs.matrix }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: build
+        run: |
+          set -e
+          latest_67=$(python3 .github/scripts/resolve-dockware-tag.py 6.7)
+          latest_66=$(python3 .github/scripts/resolve-dockware-tag.py 6.6)  # extended support until 2028-02-28
+          latest_65=$(python3 .github/scripts/resolve-dockware-tag.py 6.5)  # extended support until 2027-02-28, our floor
+          # Two older 6.7 patches stay pinned: the resolver only yields the
+          # newest per series, and drift often shows up one patch back.
+          matrix=$(python3 -c 'import json,sys; print(json.dumps(sys.argv[1:]))' \
+            "$latest_67" '6.7.12.2' '6.7.11.1' "$latest_66" "$latest_65")
+          echo "matrix: $matrix"
+          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
+
+  matrix:
+    needs: resolve
+    strategy:
+      fail-fast: false
+      matrix:
+        shopware: ${{ fromJson(needs.resolve.outputs.matrix) }}
+    uses: ./.github/workflows/e2e-shopware.yml
+    with:
+      shopware: ${{ matrix.shopware }}

.github/workflows/e2e-shopware.yml

@@ -0,0 +1,176 @@
+name: E2E (reusable)
+
+# Runs the shop-level regression suite against one real Shopware version.
+# Called by e2e.yml (per PR, latest only) and e2e-nightly.yml (full matrix).
+on:
+  workflow_call:
+    inputs:
+      shopware:
+        description: 'Shopware version, must exist as a dockware/shopware tag'
+        required: true
+        type: string
+
+jobs:
+  e2e:
+    name: Shopware ${{ inputs.shopware }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+
+    steps:
+      - name: Checkout plugin
+        uses: actions/checkout@v4
+        with:
+          path: plugin
+
+      - name: Start Shopware ${{ inputs.shopware }}
+        run: |
+          docker run -d --rm --name shop -p 80:80 \
+            -e SHOPWARE_SKIP_BUNDLE_DUMP=1 \
+            dockware/shopware:${{ inputs.shopware }}
+
+      # -p 80:80 means the browser sends Host: localhost, which matches the
+      # sales channel domain dockware ships. Do not remap the port without also
+      # updating sales_channel_domain, or Shopware answers 400.
+      - name: Wait for the shop to answer
+        run: |
+          # Any HTTP status means the web server is answering. Do not gate on
+          # 200: a domain mismatch answers 400 on 6.7 and 500 on 6.5, and
+          # gating on specific codes made 6.5 look like it never booted.
+          for i in $(seq 1 90); do
+            code=$(curl -s -o /dev/null -w '%{http_code}' --max-time 10 http://localhost/ || true)
+            if [ -n "$code" ] && [ "$code" != "000" ]; then echo "shop up (HTTP $code)"; exit 0; fi
+            sleep 5
+          done
+          echo "::error::shop did not become ready"; docker logs shop | tail -50; exit 1
+
+      - name: Copy plugin into the container
+        run: |
+          docker exec shop mkdir -p /var/www/html/custom/plugins
+          docker cp plugin shop:/var/www/html/custom/plugins/BuckarooPayments
+          docker exec -u root shop chown -R www-data:www-data /var/www/html/custom/plugins
+
+      # Shopware 6.7.13 pins mcp/sdk ^0.6.0, which carries CVE-2026-53965 with no
+      # in-range fix, so Composer 2.10+ refuses to resolve it.
+      # Best-effort on purpose: the dockware images currently ship Composer
+      # 2.2.x, which predates advisory blocking and rejects the policy.* key
+      # outright. Keep the step so newer images stay unblocked.
+      - name: Allow the known mcp/sdk advisory (best effort)
+        run: |
+          docker exec -u www-data -w /var/www/html shop \
+            composer config policy.advisories.ignore-id.CVE-2026-53965 \
+            "no in-range fix; MCP server not enabled" \
+            || echo "composer in this image predates advisory blocking - nothing to ignore"
+
+      - name: Install plugin via composer path repository
+        run: |
+          docker exec -u www-data -w /var/www/html shop \
+            composer config repositories.buckaroo path 'custom/plugins/BuckarooPayments'
+          docker exec -u www-data -w /var/www/html shop \
+            composer require buckaroo/shopware6:'*' --no-interaction --no-scripts
+
+      - name: Activate plugin and build assets
+        run: |
+          docker exec -u www-data -w /var/www/html shop bin/console plugin:refresh
+          docker exec -u www-data -w /var/www/html shop bin/console plugin:install --activate BuckarooPayments
+          docker exec -u www-data -w /var/www/html shop bin/console assets:install
+          docker exec -u www-data -w /var/www/html shop bin/console theme:compile
+          docker exec -u www-data -w /var/www/html shop bin/console cache:clear
+
+      # A fresh install renders zero buckaroo methods on the confirm page, for
+      # two independent reasons. Both are environment setup, not plugin bugs,
+      # and both silently reduced the buckaroo assertions to an empty set - a
+      # page-wide [class*="bk-"] check stayed green here while nothing buckaroo
+      # rendered at all, because the override tags Shopware's own methods with
+      # a bare `bk-` too.
+      #
+      # mysql runs as root over the socket: dockware's default exec user gets
+      # EACCES on /var/run/mysqld/mysqld.sock, and -u www-data does too.
+      - name: Make the buckaroo methods selectable in the storefront
+        run: |
+          # 1. plugin:install --activate marks the methods active but never
+          #    writes sales_channel_payment_method, and Shopware only offers
+          #    methods attached to the sales channel.
+          docker exec -i -u root shop mysql -uroot -proot shopware <<'SQL'
+          INSERT IGNORE INTO sales_channel_payment_method (sales_channel_id, payment_method_id)
+          SELECT sc.id, pm.id
+          FROM sales_channel sc
+          CROSS JOIN payment_method pm
+          JOIN plugin p ON pm.plugin_id = p.id
+          WHERE p.name = 'BuckarooPayments' AND pm.active = 1;
+          SQL
+
+          # 2. CheckoutConfirmTemplateSubscriber::hideNotEnabledPaymentMethods
+          #    drops every method whose <buckarooKey>Enabled setting is falsy,
+          #    and a fresh install has no such settings at all.
+          docker exec -i -u root shop mysql -uroot -proot shopware <<'SQL'
+          INSERT INTO system_config (id, configuration_key, configuration_value, sales_channel_id, created_at)
+          SELECT UNHEX(REPLACE(UUID(), '-', '')),
+                 CONCAT('BuckarooPayments.config.', bkey, 'Enabled'),
+                 '{"_value": true}', NULL, NOW()
+          FROM (
+            SELECT DISTINCT JSON_UNQUOTE(JSON_EXTRACT(pmt.custom_fields, '$.buckaroo_key')) AS bkey
+            FROM payment_method pm
+            JOIN plugin p ON pm.plugin_id = p.id
+            JOIN payment_method_translation pmt ON pmt.payment_method_id = pm.id
+            WHERE p.name = 'BuckarooPayments'
+              AND JSON_EXTRACT(pmt.custom_fields, '$.buckaroo_key') IS NOT NULL
+          ) keys_found
+          WHERE bkey NOT IN (
+            SELECT REPLACE(REPLACE(configuration_key, 'BuckarooPayments.config.', ''), 'Enabled', '')
+            FROM system_config WHERE configuration_key LIKE 'BuckarooPayments.config.%Enabled'
+          );
+          SQL
+
+          attached=$(docker exec -u root shop mysql -uroot -proot shopware -N -e "SELECT COUNT(*) FROM sales_channel_payment_method scpm JOIN payment_method pm ON scpm.payment_method_id = pm.id JOIN plugin p ON pm.plugin_id = p.id WHERE p.name = 'BuckarooPayments';")
+          enabled=$(docker exec -u root shop mysql -uroot -proot shopware -N -e "SELECT COUNT(*) FROM system_config WHERE configuration_key LIKE 'BuckarooPayments.config.%Enabled';")
+          echo "buckaroo methods attached to sales channels: $attached"
+          echo "buckaroo methods enabled in config: $enabled"
+          # Fail here rather than letting the suite report a confusing template
+          # failure when the real problem is an unconfigured shop.
+          if [ "$attached" -eq 0 ] || [ "$enabled" -eq 0 ]; then
+            echo "::error::buckaroo methods could not be made selectable (attached=$attached enabled=$enabled)"
+            exit 1
+          fi
+          docker exec -u www-data -w /var/www/html shop bin/console cache:clear
+
+      # First hit on a cold shop pays for cache + theme generation and can take
+      # minutes on 6.5/6.6. Warm it here so the suite's own timeouts are not
+      # measuring container start-up.
+      - name: Warm the storefront
+        run: |
+          for path in / /account/register /checkout/cart; do
+            curl -s -o /dev/null -w "warmed $path -> %{http_code}\n" --max-time 180 "http://localhost$path" || true
+          done
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Install Playwright
+        working-directory: plugin/tests/e2e
+        run: |
+          npm ci || npm install
+          npx playwright install chromium --with-deps
+
+      - name: Run E2E suite
+        working-directory: plugin/tests/e2e
+        env:
+          SHOP_BASE_URL: http://localhost
+          CI: 'true'
+        run: npx playwright test
+
+      - name: Shop logs on failure
+        if: failure()
+        run: docker logs shop | tail -100
+
+      - name: Upload Playwright report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report-${{ inputs.shopware }}
+          path: |
+            plugin/tests/e2e/playwright-report
+            plugin/tests/e2e/test-results
+          retention-days: 7
+          if-no-files-found: ignore

.github/workflows/e2e.yml

@@ -0,0 +1,35 @@
+name: E2E
+
+# Fast gate: only the newest supported Shopware. The full range runs nightly.
+on:
+  pull_request:
+    branches: [ main, master, develop ]
+  workflow_dispatch:
+    inputs:
+      shopware:
+        description: 'Shopware version to test (blank = newest 6.7 on dockware)'
+        required: false
+
+jobs:
+  # The version is resolved at run time, not pinned. A pinned default meant a
+  # new Shopware patch went untested until somebody edited this file.
+  resolve:
+    runs-on: ubuntu-latest
+    outputs:
+      shopware: ${{ steps.pick.outputs.tag }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: pick
+        run: |
+          tag="${{ github.event.inputs.shopware }}"
+          if [ -z "$tag" ]; then
+            tag=$(python3 .github/scripts/resolve-dockware-tag.py 6.7)
+          fi
+          echo "resolved Shopware image tag: $tag"
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+
+  latest:
+    needs: resolve
+    uses: ./.github/workflows/e2e-shopware.yml
+    with:
+      shopware: ${{ needs.resolve.outputs.shopware }}

.github/workflows/extension-verifier.yml

@@ -0,0 +1,24 @@
+name: Extension Verifier
+
+# Runs the same static validation the Shopware Store applies on upload, so
+# store-blocking findings surface here instead of at submission time.
+on:
+  pull_request:
+    branches: [ main, master, develop ]
+  workflow_dispatch:
+
+jobs:
+  validate:
+    name: shopware-cli extension validate
+    runs-on: ubuntu-latest
+    # Non-blocking until the existing baseline of findings is cleared, then
+    # remove this line so it gates like the Store does.
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup shopware-cli
+        uses: shopware/shopware-cli-action@v1
+
+      - name: Validate extension
+        run: shopware-cli extension validate .

.gitignore

@@ -4,4 +4,9 @@
 vendor/
 composer.lock
 node_modules/
-src/Resources/app/administration/.tmp/
+src/Resources/app/administration/.tmp/
+# E2E (Playwright) generated output
+tests/e2e/test-results/
+tests/e2e/playwright-report/
+tests/e2e/playwright/.cache/
+.phpunit.result.cache

CHANGELOG.md

@@ -448,4 +448,25 @@ Compatible from Shopware 6.5.0 up to 6.5.6.1
 
 - BTI-901 Add support for Shopware 6.7.9.1 & 6.6.10.16
 - BTI-776 Add support for native refunds.
-- BTI-906 Rest API support for the “Capture on shipment” setting for Klarna (MoR).
+- BTI-906 Rest API support for the “Capture on shipment” setting for Klarna (MoR).
+
+# 3.5.0 
+
+- BTI-1391 Add support for Shopware 6.7.13.1 & 6.6.10.23.
+- BTI-1374 Added support for Shopware 6.7.13.
+- BTI-1230 Added support for Shopware 6.7.12.
+- BTI-1149 Added a general language setting for the payment gateway, so the checkout language can be set centrally instead of per payment method.
+- BTI-1060 Added sandbox environment support for PayPal Express.
+- BTI-1133 Added Apple Pay support for all web browsers instead of Safari only.
+- BTI-1134 Added support for Klarna (MoR) cancellations triggered from Shopware.
+- BTI-1176 Removed the optional customer fields for Billink in the checkout, reducing the number of steps for the consumer.
+- BTI-1258 Improved the design of the iDEAL | Wero Fast Checkout button so it matches the rest of the storefront.
+- BTI-1384 Add automated compatibility testing against Shopware versions.
+- BTI-1288 Updated the README.md file.
+- BTI-1340 We’ve removed the payment method GoSettle (discontinued).
+- BTI-970 Fixed Apple Pay not being visible in the checkout for a specific merchant configuration.
+- BTI-1046 Fixed Credit Card Hosted Fields not being editable during checkout on Shopware 6.5.
+- BTI-1069 Fixed the culture in the transaction request always being sent as en-GB instead of the actual checkout language.
+- BTI-1256 Fixed inconsistent express checkout button heights across the storefront pages.
+- BTI-1257 Fixed the Apple Pay express button always being displayed on the checkout page, even when it should be hidden.
+- BTI-1365 Fixed the Auto Capture and Capture on Shipment settings causing incorrect capture and refund handling for KlarnaKP.