I tried to rebuild the wiki, removing as much extensions as possible. The result is the same.

I just tried to create my first Patch Demo, so it is possible I did something wrong.

It looks like a real bug, not you doing something wrong. It seems like the Composer dependency of AbuseFilter wasn’t installed by the point the code tries to add a user – this shouldn’t happen. Is there any chance you still have access to the entire log? If you could paste it here (you can use the ‘lines’ parameter to avoid your post getting too long), maybe I could spot something in it.

In T411926#11438220, @IKhitron wrote:

I tried to rebuild the wiki, removing as much extensions as possible. The result is the same.

Are you sure the result is the exact same? According to https://patchdemo.wmcloud.org/, you have a number of extensions enabled (AntiSpoof, CampaignEvents, CategoryTree, CentralAuth, CheckUser, DarkMode, Echo, EventBus, EventLogging, EventStreamConfig, GlobalPreferences, GlobalWatchlist, IPInfo, Interwiki, JsonConfig, MobileFrontend, OATHAuth, ParserFunctions, Renameuser, Scribunto, SyntaxHighlight_GeSHi, TextExtracts, Thanks, Translate, UniversalLanguageSelector, VisualEditor, WebAuthn, WikiEditor, WikimediaMessages, cldr, wikihiero), but AbuseFilter is no longer one of them, so it’d be quite surprising if the exception still came from there.

On the other hand, it looks a lot more than necessary – extensions like CampaignEvents, CategoryTree, CheckUser, Scribunto, Translate or WikiHiero don’t look necessary for testing a GlobalWatchlist patch.

If you could remove more extensions, maybe it could unblock your workflow before the bug itself gets fixed.

In T411926#11438310, @Tacsipacsi wrote:

Is there any chance you still have access to the entire log? If you could paste it here (you can use the ‘lines’ parameter to avoid your post getting too long), maybe I could spot something in it.

Sorry, I don't.

In T411926#11438220, @IKhitron wrote:

I tried to rebuild the wiki, removing as much extensions as possible. The result is the same.

Are you sure the result is the exact same? According to https://patchdemo.wmcloud.org/, you have a number of extensions enabled (AntiSpoof, CampaignEvents, CategoryTree, CentralAuth, CheckUser, DarkMode, Echo, EventBus, EventLogging, EventStreamConfig, GlobalPreferences, GlobalWatchlist, IPInfo, Interwiki, JsonConfig, MobileFrontend, OATHAuth, ParserFunctions, Renameuser, Scribunto, SyntaxHighlight_GeSHi, TextExtracts, Thanks, Translate, UniversalLanguageSelector, VisualEditor, WebAuthn, WikiEditor, WikimediaMessages, cldr, wikihiero), but AbuseFilter is no longer one of them, so it’d be quite surprising if the exception still came from there.

I have an answer for that. Somewhere today, don't remember when, I saw a message that two extensions need it, I think, don't remember which one was the second one.

On the other hand, it looks a lot more than necessary – extensions like CampaignEvents, CategoryTree, CheckUser, Scribunto, Translate or WikiHiero don’t look necessary for testing a GlobalWatchlist patch.

If you could remove more extensions, maybe it could unblock your workflow before the bug itself gets fixed.

Done. Same. See the full log at P86438. Looks like the second extension is AntiSpoof.

In T411926#11438328, @IKhitron wrote:

Sorry, I don't. […] See the full log at P86438. Looks like the second extension is AntiSpoof.

Thanks! It actually doesn’t really matter which log you paste, as long as the errors are roughly the same. I see there

2025-12-06T19:05:23.229218541Z: + composer require 'oojs/oojs-ui @dev' --update-no-dev
2025-12-06T19:05:23.364972084Z: Composer plugins have been disabled for safety in this non-interactive session.
2025-12-06T19:05:23.365021154Z: Set COMPOSER_ALLOW_SUPERUSER=1 if you want to allow plugins to run as root/super user.
2025-12-06T19:05:23.365033373Z: Do not run Composer as root/super user! See https://getcomposer.org/root for details
2025-12-06T19:05:23.451191122Z: ./composer.json has been updated
2025-12-06T19:05:23.517516264Z: Running composer update oojs/oojs-ui
2025-12-06T19:05:23.560679429Z: > MediaWiki\Composer\VersionChecker::onEvent
2025-12-06T19:05:23.565259267Z: Loading composer repositories with package information
2025-12-06T19:05:23.625277788Z: Updating dependencies
2025-12-06T19:05:23.654601077Z: Lock file operations: 0 installs, 1 update, 21 removals
2025-12-06T19:05:23.654628713Z: - Removing bacon/bacon-qr-code (v3.0.3)
2025-12-06T19:05:23.654636085Z: - Removing brick/math (0.13.1)
2025-12-06T19:05:23.654712876Z: - Removing christian-riesen/base32 (1.6.0)
2025-12-06T19:05:23.654828434Z: - Removing composer/ca-bundle (1.5.9)
2025-12-06T19:05:23.654836252Z: - Removing dasprid/enum (1.0.7)
2025-12-06T19:05:23.654841926Z: - Removing endroid/qr-code (6.0.9)
2025-12-06T19:05:23.654889638Z: - Removing geoip2/geoip2 (v3.3.0)
2025-12-06T19:05:23.655001829Z: - Removing jakobo/hotp-php (v2.0.0)
2025-12-06T19:05:23.655005370Z: - Removing maxmind-db/reader (v1.13.1)
2025-12-06T19:05:23.655044597Z: - Removing maxmind/web-service-common (v0.11.0)
2025-12-06T19:05:23.655578469Z: - Removing paragonie/constant_time_encoding (v3.1.3)
2025-12-06T19:05:23.655597301Z: - Removing psr/event-dispatcher (1.0.0)
2025-12-06T19:05:23.655601938Z: - Removing spomky-labs/cbor-php (3.2.2)
2025-12-06T19:05:23.655605635Z: - Removing spomky-labs/pki-framework (1.4.0)
2025-12-06T19:05:23.655609689Z: - Removing symfony/polyfill-uuid (v1.33.0)
2025-12-06T19:05:23.655613674Z: - Removing symfony/uid (v7.4.0)
2025-12-06T19:05:23.655617602Z: - Removing web-auth/cose-lib (4.4.2)
2025-12-06T19:05:23.655621959Z: - Removing web-auth/webauthn-lib (4.9.2)
2025-12-06T19:05:23.655625775Z: - Removing wikimedia/equivset (1.7.1)
2025-12-06T19:05:23.655630016Z: - Removing wikimedia/idle-dom (v2.1.0)
2025-12-06T19:05:23.655633932Z: - Removing wikimedia/zest-css (4.1.0)
2025-12-06T19:05:23.655673617Z: - Upgrading oojs/oojs-ui (v0.53.0 => dev-3d788261b1daf985a13143594ad3bf08c79534aa)

So the installation of oojs/ui removes a bunch of Composer dependencies, including wikimedia/equivset. I don’t know why this happens, but my next tip for a workaround is that you uncheck oojs/ui in the included repos section. In fact, that won’t remove OOUI, it will just keep it at v0.53.0 and not update it to rGOJU3d788261b1daf985a13143594ad3bf08c79534aa. (Checking it would only be necessary if you would need the latest OOUI version, for example to demo a change in OOUI itself. Yeah, the interface doesn’t make this obvious.)

In T411926#11438333, @Tacsipacsi wrote:

So the installation of oojs/ui removes a bunch of Composer dependencies, including wikimedia/equivset. I don’t know why this happens [...]

This is the reason:

2025-12-06T19:05:23.364972084Z: Composer plugins have been disabled for safety in this non-interactive session.
2025-12-06T19:05:23.365021154Z: Set COMPOSER_ALLOW_SUPERUSER=1 if you want to allow plugins to run as root/super user.
2025-12-06T19:05:23.365033373Z: Do not run Composer as root/super user! See https://getcomposer.org/root for details

composer-merge-plugin is required for composer to pick up dependencies from extensions, and if that does not run then exactly this will happen.

In T411926#11438333, @Tacsipacsi wrote:

So the installation of oojs/ui removes a bunch of Composer dependencies, including wikimedia/equivset. I don’t know why this happens, but my next tip for a workaround is that you uncheck oojs/ui in the included repos section. In fact, that won’t remove OOUI, it will just keep it at v0.53.0 and not update it to rGOJU3d788261b1daf985a13143594ad3bf08c79534aa. (Checking it would only be necessary if you would need the latest OOUI version, for example to demo a change in OOUI itself. Yeah, the interface doesn’t make this obvious.)

Thank you. I tried, but the Patch Demo destroyed the wiki entirely, because I've fixed the patch after your comments, and it needs Jenkins bot approval. And since its my first patch, I'm not allowed to comment "recheck", so I can only wait when somebody will do it.
UPD: Thanks, running.

Thanks a lot, @Tacsipacsi, it works. Part of the patch is fine, part isn't, I'll debug it tomorrow, I think.

In T411926#11438369, @Tacsipacsi wrote:

I tried, but the Patch Demo destroyed the wiki entirely, because I've fixed the patch after your comments, and it needs Jenkins bot approval.

That sounds like another bug: if you’re not allowed to update a patch demo, it should just not do anything, rather than destroying the existing patch demo…

You are absolutely right.

I’m glad it works, but this is just a workaround, the bug itself still needs to be fixed.

I see.

In T411926#11438373, @IKhitron wrote:

In T411926#11438369, @Tacsipacsi wrote:

I tried, but the Patch Demo destroyed the wiki entirely, because I've fixed the patch after your comments, and it needs Jenkins bot approval.

That sounds like another bug: if you’re not allowed to update a patch demo, it should just not do anything, rather than destroying the existing patch demo…

You are absolutely right.

Hrm. I'm unclear what happened here. Let me see if I understand, it sounds like patchdemo failed to make the wiki and so removed it, so you couldn't update but had to recreate from scratch, is that right?

In T411926#11438369, @Tacsipacsi wrote:

In T411926#11438337, @taavi wrote:

This is the reason:

2025-12-06T19:05:23.364972084Z: Composer plugins have been disabled for safety in this non-interactive session.
2025-12-06T19:05:23.365021154Z: Set COMPOSER_ALLOW_SUPERUSER=1 if you want to allow plugins to run as root/super user.
2025-12-06T19:05:23.365033373Z: Do not run Composer as root/super user! See https://getcomposer.org/root for details

composer-merge-plugin is required for composer to pick up dependencies from extensions, and if that does not run then exactly this will happen.

I see, thanks for the explanation! Questions arising are:

• Is it safe to specify COMPOSER_ALLOW_SUPERUSER=1 given that we’re running in a containerized environment? The initial Composer install already specifies it at https://gitlab.wikimedia.org/repos/test-platform/catalyst/ci-charts/-/blob/f97a1d5daa901c93e32c0ae0489c67bcdb2055a6/mediawiki/files/provisioning/composer_install.sh.tmpl#L6 (see the log at P86438#L262).
• How long has this been broken…? I see !104 reorganized the code a bit, but it didn’t change the fact that createAndPromote.php is ran after updating OOUI – that has always been the case since the file was added to Catalyst in !16 (and probably for much longer in the copy in the Patch Demo repo).

Thanks for the insight @taavi! And thanks, as always, for the troubleshooting @Tacsipacsi

As to how long it's been broken, either:

• Since June, when we first noticed that the initialization wasn't using composer-merge (T394392#10945159), or
• Since the PHP 8.3 version bump (two weeks ago) — this same problem happened in a non-patchdemo (but still using catalyst) place: T411372#11419612

It should be OK to set that environment variable, though I want to talk it through with other folks. The containers running these wikis are unprivileged. And Patch Demo is RCE as a service, so there's nothing too sensitive in the containers. I'll talk about it with others on the team.

I filed T411944 to fix composer-merge in Patch Demo.

I thought about this and decided to remove this task as the subtask, because it should be open, but isn't a blocker any more. Hope it's fine, it's all very new for me. I intend to return it after this task will be resolved for the history purposes.

In T411926#11438536, @thcipriani wrote:

In T411926#11438373, @IKhitron wrote:

In T411926#11438369, @Tacsipacsi wrote:

I tried, but the Patch Demo destroyed the wiki entirely, because I've fixed the patch after your comments, and it needs Jenkins bot approval.

That sounds like another bug: if you’re not allowed to update a patch demo, it should just not do anything, rather than destroying the existing patch demo…

You are absolutely right.

Hrm. I'm unclear what happened here. Let me see if I understand, it sounds like patchdemo failed to make the wiki and so removed it, so you couldn't update but had to recreate from scratch, is that right?

Yes, it is. I didn't expect this to happen, so I needed to recreate the extensions list from my memory.

Offtopic: Where can I leave a lot of problems and bugs that I met on Patch Demo, is there a Talk Page somewhere? I don't think I can open a task for each.

In T411926#11441496, @IKhitron wrote:

Offtopic: Where can I leave a lot of problems and bugs that I met on Patch Demo, is there a Talk Page somewhere? I don't think I can open a task for each.

We do talk on https://wikitech.wikimedia.org/wiki/Talk:Catalyst occasionally. But we would prefer talking through problems on Phabricator. We watch and triage Catalyst (PatchDemo) regularly. If there are bugs, we want to fix them, so we'll make a task eventually anyway. If you have a broader topic (i.e., "Get X working on Patch Demo") you could file a task for that and we could break it into subtasks as needed.

In T411926#11465941, @thcipriani wrote:

In T411926#11441496, @IKhitron wrote:

Offtopic: Where can I leave a lot of problems and bugs that I met on Patch Demo, is there a Talk Page somewhere? I don't think I can open a task for each.

We do talk on https://wikitech.wikimedia.org/wiki/Talk:Catalyst occasionally. But we would prefer talking through problems on Phabricator. We watch and triage Catalyst (PatchDemo) regularly. If there are bugs, we want to fix them, so we'll make a task eventually anyway. If you have a broader topic (i.e., "Get X working on Patch Demo") you could file a task for that and we could break it into subtasks as needed.

Thank you, but neither. My question could be something like "is this a bug or a feature?