Repository navigation
Move the template onto the current configs and framework, and align its tooling - #29
Merged
Merged
Conversation
The template pinned configs at 8d53efd, from before its scoping, workflow, baseline and docs branches, and locked the framework from before its CI, runtime and docs branches. Its Supply-Chain Audit has failed since 2026-11-09 on symfony/filesystem 7.4.21 (GHSA-6prc-h956-hxjq). configs moves to b107001 in the 13 workflow refs, the npm pin and both locks together, and the framework mirrors to 1dfb070's split (X ruling 346). Every lock takes its dependencies' newest releases: symfony 7.4.23 over the advisory, PHPStan 2.3.5, PHPUnit 13.4.6, WooCommerce 11.2.2 and its stubs. The wp-env core pins move to 7.1.4 (A230) and both $schema lines to wp-env.json (A723). The update forces these changes: - WooCommerceRequirement::check() is static. - PluginKernel::$resolved is gone (X ruling 155), so the boot rows read the skipped components, and the scaffold README drops the line that edited the resolved list. - PHPStan 2.3.5 with strict-rules 2.1.1 refuses a bare WP_CLI in uninstall.php's condition, which reads true === WP_CLI. - The rejection sentence reads "... was not saved and keeps its previous value. The other changes were saved." (X ruling 334), in SettingsTest, the settings spec and the recipe. - configs' Playwright base runs tests/EndToEnd, so tests/e2e moves there with every reference to it (X ruling 163). - configs' release declares id-token and attestations, so the release job grants them, and its comment is one sentence (A228). Assisted-by: Claude Code:claude-opus-5-5
The template's .editorconfig set two spaces for JSON, against WordPress core's file, which every repository now copies from configs, and its JSON and NEON files mixed two and four spaces. .editorconfig is configs' file, and every tracked JSON and NEON file, package-lock.json included, is re-indented with tabs (X rulings 190, 314). The change is whitespace only: each JSON file decodes to the same value, npm writes the lock back unchanged, and composer.lock keeps Composer's four spaces. Assisted-by: Claude Code:claude-opus-5-5
uninstall.php let the uninstall engine's exception reach WordPress, so a web request showed the critical-error page and the reason, such as the large-network refusal naming wp plugin uninstall, reached only the error log (A22). The row fails one option's delete, includes uninstall.php as a web request does and expects wp_die() with the engine's message and a 500, with the consent kept for the next uninstall. It fails until the uninstall catches the engine's exception. Assisted-by: Claude Code:claude-opus-5-5
A web uninstall whose engine threw showed WordPress's critical-error page, so the reason reached only the error log (A22, X ruling 169). uninstall.php catches the engine's RuntimeException, rethrows it under WP-CLI and otherwise ends in wp_die() with the escaped message and a 500, as consumer-a's does. wp_die() exits before WordPress deletes the files, and the engine keeps the consent until a pass runs clean, so the next uninstall retries. ARCHITECTURE.md says so. Assisted-by: Claude Code:claude-opus-5-5
The bootstrap updater reads a Tested up to header from the release's entry file and passes it as the offer's and the details screen's tested version, but the entry declared none, so WordPress showed no tested version for an update (A762, X ruling 294). The entry declares Tested up to: 7.1 beside its floors. Assisted-by: Claude Code:claude-opus-5-5
Neither the template nor the plugins it seeds had a multisite lane, so nothing checked that a plugin boots and stores its data on each site of a network (A463, X ruling 132). .wp-env.multisite.json starts a network on 8813 with WooCommerce and the plugin network-activated. A multisite group holds a row that boots the plugin on a second site and checks that its settings are that site's own; the default Integration run skips the group, and test:integration:multisite runs only it, behind wp-env:multisite:*. Tests runs it on every WordPress branch, as Integration (multisite). The fill-in maps 8813 to the port after a plugin's tests port, refuses a port range that touches any of the three, and checks for it among the leftovers; .distignore keeps the config out of the zip. AGENTS.md, tests/README.md and README.md describe the environment and the ports. Assisted-by: Claude Code:claude-opus-5-5
Quality, Tests and Audit let superseded pull-request runs keep running, Workflow Checks skipped changes to dependabot.yml and the fill-in script, the changelog check ran as a job of its own, several comments ran past one sentence or gave reasons the plugin mirrors cannot keep, two callers had no job name, CodeQL analysed only the workflows, and one failed request to WordPress's version API failed every Integration and end-to-end leg. - Quality, Tests and Audit cancel superseded runs on pull requests only (A226). - Workflow Checks runs on .github/**, and the scaffold rehearsal checks the scripts with ShellCheck (A227). - Comments are one sentence each, Audit's as X ruling 151 words them, and the fill-in inputs say "such as" (A228). - The jobs read Lint PHP and Lint scripts and styles, CodeQL and Workflow Checks take the framework's names, and the version job drops the permissions its workflow already grants (A229). - Lint PHP runs changelog:validate, and the separate changelog job goes (X ruling 270). - CodeQL analyses JavaScript and TypeScript beside the workflows (A759). - Audit takes configs' default npm flags (A701). - The version API call retries as the framework's does (X ruling 349). Assisted-by: Claude Code:claude-opus-5-5
The template ignored only the development site's wp-env override, kept no rule against committing secret material, and its toptal block had lost the carriage returns of Icon\r\r, so it ignored every file and folder named Icon (A232, A233, A721). .wp-env*.override.json covers each environment's override; configs' secret-file rules sit above the toptal block, with no exception, since the template tracks no file they match; and the toptal block is toptal's current output for the same templates, byte for byte. Assisted-by: Claude Code:claude-opus-5-5
The lint lanes skipped the ESLint, Stylelint and Playwright configs, the two lint wrappers copied configs' baselines where re-exporting them says the same, the Playwright config repeated the tests site's port, and no sniff enforced the plugin's prefix, since PHPCS's PrefixAllGlobals does nothing without one and the release skips Plugin Check's prefixing check (A235, A236, A237, A239). lint:scripts covers the three configs, and the Playwright config takes Prettier's wrap; the wrappers re-export configs' baselines; the Playwright config reads its port from .wp-env.tests.json; phpcs.dist.xml configures PrefixAllGlobals with dws_tpl and the plugin's namespace, which the fill-in sweeps with the rest of the template's names. Assisted-by: Claude Code:claude-opus-5-5
The template's Composer and npm packages took its slug, so every plugin renamed its Composer package by hand while its npm name kept the slug; its npm scripts kept a raw wp-env pass-through and no format, lint or cross-tool aggregators; the local audit ran other flags than CI's; and npm run start dropped a watcher's failing status (A686, A687, A231, A238). - The packages are ahegyes/wordpress-plugin-template and @ahegyes/wordpress-plugin-template, so the fill-in's repository sweep names both after the plugin's repository; README.md states the rule, and the scaffold README drops the hand step. - The npm scripts follow the workspace order, without the pass-through, and gain format, format:scripts, format:styles, format:all, lint, lint:all, test:all and quality-check:all; format:all survives PHPCBF's fix status (X ruling 283), and quality-check:all runs composer quality-check, then npm run lint and npm run test:e2e (X ruling 318). - audit runs CI's flags (X ruling 319). - start waits for both watchers and exits with a failing one's status. Assisted-by: Claude Code:claude-opus-5-5
The main PHPStan profile analysed includes/safeguards.php at the framework's floors as well as the safeguards profile at the oldest PHP and WordPress the bootstrap package runs on, so a plugin with real safeguards had to exclude them by hand, as LPM did; and models/, where a plugin keeps its data classes, sat outside both profiles (A690, A746). The main profile excludes the safeguards and only scans them for their symbols, leaving their analysis to phpstan.safeguards.neon, and it analyses models/. Assisted-by: Claude Code:claude-opus-5-5
The template kept its own exclusion list, which named each config file and environment by hand, missed every wp-env override but the development site's and carried none of configs' secret-material rules, so a plugin's zip could ship a key or an .npmrc left at its root (A179, A232, X ruling 190). .distignore is configs' baseline, byte for byte, followed by a marked block for the plugin's own documents and caches, whose README.scaffold.md line the fill-in still removes. Every path the old list excluded stays excluded. Assisted-by: Claude Code:claude-opus-5-5
The nightly run on WordPress trunk skipped the Integration suite's multisite group, so a trunk change that breaks the plugin's boot or storage on a network's second site would surface only once that release joined the pull-request matrix (X ruling 350). Tests (nightly) gains Integration (multisite) on WordPress's nightly build, as the framework's nightly runs it, and tests/README.md says so. Assisted-by: Claude Code:claude-opus-5-5
ahegyes
changed the title
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The template pinned configs and the framework from before their audit branches, and its CI, scripts and ignore files had drifted from the framework's and from configs' baselines; its Supply-Chain Audit was red on symfony/filesystem's GHSA-6prc-h956-hxjq. This moves both pins and every lock, takes the changes they force, adds a multisite Integration lane and the npm aggregators, and aligns the workflows, lint configs,
.gitignoreand.distignorewith their baselines.Type of change
Checklist
composer changelog:add): the template takes no fragmentscomposer quality-checkpasses locallyBreaking changes for forks
ahegyes/wordpress-plugin-templateand@ahegyes/wordpress-plugin-template, which the fill-in renames after the new repository, lowercased.tests/e2e/istests/EndToEnd/, where configs' Playwright and ESLint baselines look; the boot rows readPluginKernel::$skipped, since$resolvedis gone..wp-env.multisite.jsonon 8813 runs the Integration suite'smultisitegroup, which the default run skips; the fill-in gives a plugin three consecutive ports.wp-envscript; newformat,format:scripts,format:styles,format:all,lint,lint:all,test:all,quality-check:allandtest:integration:multisite;auditruns CI's flags.id-tokenandattestations.uninstall.phpends a web uninstall whose engine fails with its reason and a 500, keeping the files and the consent; the entry declaresTested up to.