Generate random salts in the prepared wp-tests-config.php

[ekamran]

Fixes #217

The sample config ships eight put your unique phrase here salt placeholders, and prepare.php only replaced the database values, so every generated wp-tests-config.php kept the placeholders.

This is not a security fix. WordPress treats those placeholders as undefined and generates salts in the database on first use, so the test suite already ran with random salts. Core's own local environment and wp-cli's install-wp-tests.sh leave the placeholders in place too. The change makes the generated config follow its own instructions and saves the test install from priming salt options: each placeholder is replaced with a fresh 64 character hex value, which is safe inside the single quotes and unique per run.

Verified by applying the same replacement to the current core wp-tests-config-sample.php: 0 placeholders remain, all 8 values are distinct, the generated file lints and loads, and two runs produce different values. phpcs clean.

Use of AI

AI assistance: Yes
Tool(s): Claude Code and Codex
Used for: Investigation, implementation, verification harness, and PR wording. I reviewed the reasoning and test results, and I take responsibility for the contribution.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: ekamran <ekamran@git.wordpress.org>
Co-authored-by: mindctrl <mindctrl@git.wordpress.org>
Co-authored-by: ramonfincken <ramon-fincken@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[mindctrl]

This seems fine, but it's a small departure from how core and wp-cli do it today. Both leave the placeholders and let core do the work. The mismatch could lead to confusion and inconsistent behavior if certain types of tests are added to core in the future.

[ekamran]

Fair point. I would rather keep the runner consistent with core and wp-cli than be the one place that behaves differently.

For the record, no core test observes where the salts come from today. The only practical difference is that core writes the generated salts to the options table when the placeholders are left in place. Not worth a divergence.

Two ways to resolve #217, your call:

1. Close this PR, and note on Proper use of salts #217 that the placeholders are expected and core generates the salts, so it can be closed as working as designed.
2. Keep this PR if you would rather have the generated config carry real values.

Happy either way.

[mindctrl]

@ekamran thanks. I vote for consistency too, but curious to hear other opinions.