BUG: Tests failing from the WordPress 7.0 Release and the recent GitHub Token Format Rollout

[ZacharyRener]

Describe the bug

This is to keep a record and address any test failures caused directly by the WordPress 7.0 release and the recent GitHub Token Format Rollout.

Most e2e tests are currently failing in the action runner because of the GitHub token format change. Others are failing because of 7.0. Here's a baseline test to show this: #4322

7.0

Unit Tests:

TestInstantResults::test_requirements_status

Expected: "...href='https://elasticpress.io'..."
Actual: "...href="https://elasticpress.io"..."
Source: $status->message[] = wp_kses_post( __( "...href='https://elasticpress.io'...", 'elasticpress' ) );

Cause: Core update to wp_kses_hair which is called via wp_kses_post

e2e Tests:

• protected-content.spec.ts
• search/search.spec.ts

Cause: iFrame editor-canvas update rolled out in WP 7.0

New GitHub Token Format Rollout

https://github.blog/changelog/2026-04-24-notice-about-upcoming-new-format-for-github-app-installation-tokens/

GitHub just rolled out a new format for the GITHUB_TOKEN that gets automatically injected into the ci runners.

They warned:

There are no regexes in your codebase such as ghs_[A-Za-z0-9]{36} that validate a token. These may not match the new tokens.

The composer/composer package version 2.8.5 we're on, which is a dependency of brianhenryie/strauss, does exactly that, and breaks the ci test runners for nearly all e2e tests. This was fixed in version 2.9.8.

The Issue:

The majority of e2e tests ran on GitHub are now failing by default, with this error in the composer install step:
[error] Your github oauth token for github.com contains invalid characters: "***"

The Fix:

composer update composer/composer -W, updates to 2.10.0

An additional issue this leads to:

The test runners (playwright.yml, test.yml) are set to PHP 8.2.x.

Updating with composer/composer -W will update the following symfony packages to versions that only support PHP 8.4.x:

symfony/filesystem, symfony/process, symfony/finder

So, we need to either:

1. Lock the three packages to ^7.0
2. Upgrade the runners to 8.4.x

This change chooses option 1 for the sake of not changing any php requirements (although they are require-dev only).

Steps to Reproduce

WP 7.0:

1. Set WordPress version to 6.9.x latest
2. Run the full unit test suite
3. Confirm all tests pass
4. Upgrade to 7.0
5. Run the full unit test suite
6. Confirm that TestInstantResults::test_requirements_status fails

GitHub Token Update:

1. Create a PR to develop with any tiny change
2. Verify many tests fail:
   [error] Your github oauth token for github.com contains invalid characters: "***"

Screenshots, screen recording, code snippet

No response

Environment information

No response

WordPress and ElasticPress information

No response

Code of Conduct

• I agree to follow this project's Code of Conduct