[ahegyes]

Summary

Five fixes from the v2 re-audit:

• the release let a plugin ship with a Requires PHP below its own composer.json floor, and it packed phpunit.dist.xml;

• four release steps and the PHPStan path discovery had no test;

• the Node baselines assume TypeScript 6 but declared no typescript peer;

• the README stated floors as numbers that its manifests own.

• Release floor: the header check reads the project's own composer.json beside the shipped packages, so Requires PHP must cover the plugin's own floor too. docs/workflows.md says so.

• phpunit.dist.xml: the baseline .distignore and the archive's forbidden-entry check match phpunit*.xml*, so phpunit.dist.xml, PHPUnit's default name, stays out of the zip.

• Release-gate tests: new rows run four steps that had none:

  • "Assert scoped packages bundled", with a complete archive, a missing autoloader or package, and a build whose scoping never ran;
  • "Verify required workflows passed", with every, one or no required workflow among the push runs, a malformed list and an unavailable API;
  • the release-notes extraction, with dated, bracketed and absent sections, a heading whose dots are not wildcards, and no changelog;
  • phpstan.dist.neon.php's path discovery, over a plugin-shaped directory.

• TypeScript peer: typescript >=6.0.0 joins the tool peers. node/tsconfig.base.json carries only deltas from TypeScript 6's strict defaults, so TypeScript 5 silently turned strict mode off. The lock moves only its root entry.

• Docs and comments: the README and AGENTS.md name each floor by the file and key that hold it, and six workflow comments each state their why in one sentence.

Workflows +12 −29 (4 files), tests +193 (2 files), docs +6 −6 (3 files), .distignore +1 −1, npm manifest and lock +4 −3.

Type of change

• PHP source (Composer scripts, php-scoper config)
• Reusable workflow (.github/workflows/reusable-*.yml)
• PHPCS / PHPStan ruleset (php/quality-assurance/)
• Node config (eslint, stylelint, playwright, tsconfig)
• Documentation
• Other

Checklist

• Tests added or updated (PHPUnit suites under tests/Unit/):
  • ReleaseWorkflowTest: a root composer.json requiring PHP 8.5 against Requires PHP: 7.4, and an archive holding phpunit.dist.xml, both passed the old steps and fail the new ones;
  • the scoped-package, provenance and release-notes rows pin what those steps accept and refuse;
  • PhpstanConfigTest: path discovery adds the conventional root files and source directories and scans vendor-prefixed/.
• composer test passes locally:
  • composer quality-check: PHPCS on both profiles, PHPStan and 149 tests;
  • npm run lint:scripts, npm run lint:config, actionlint and zizmor pass.
• If this changes a reusable workflow's inputs/outputs, docs/workflows.md is updated to reflect the new contract. There are no input or output changes; the release's floor rule in docs/workflows.md names the project's own composer.json.
• If this changes a ruleset, downstream consumer behavior is considered (no ruleset changes)

Breaking changes for downstream consumers

• Release floor: a release whose entry file's Requires PHP is below the project's own require.php now fails its build, because the header understated the plugin's floor.
• TypeScript peer: a consumer that installs TypeScript 5 beside the Node baselines now has an unmet typescript >=6.0.0 peer, which npm reports as a conflict.

Not in this PR: the release's archive tools (WP-CLI, dist-archive-command and the i18n command behind wp i18n make-pot) still install unlocked. Locking them needs a decision on where the lock lives, because a consumer of reusable-release.yml need not install this package and a reusable workflow cannot read its own commit.