Move the template onto the current configs and framework, and align its tooling

.distignore

@@ -1,41 +1,53 @@
-.cache
-.distignore
-.editorconfig
+# Baseline wp dist-archive exclusions for WordPress projects.
+
 .git
 .github
-.gitignore
 .idea
 .vscode
-.wp-env.json
-.wp-env.override.json
-.wp-env.tests.json
-
+.editorconfig
+.gitattributes
+.gitignore
+.distignore
 AGENTS.md
-CHANGELOG.md
 CLAUDE.md
 CONTRIBUTING.md
-README.md
-README.scaffold.md
 SECURITY.md
-
-changelog/
-docs/
-
-node_modules/
-tests/
-vendor/bin/
-
+/changelog
+node_modules
+tests
+vendor/bin
 composer.json
 composer.lock
 package.json
 package-lock.json
+.phpcs*.xml*
+phpcs*.xml*
+.phpstan*.neon*
+phpstan*.neon*
+phpunit*.xml*
+.phpunit.result.cache
+.phpunit.cache
+infection.json*
+eslint.config.*
+stylelint.config.*
 tsconfig.json
-eslint.config.mjs
-stylelint.config.js
-phpcs.dist.xml
-phpcs.tests.dist.xml
-phpstan.dist.neon
-phpstan.safeguards.neon
-phpunit.dist.xml
-playwright.config.js
+playwright.config.*
+postcss.config.*
 scoper.inc.php
+.wp-env*
+.wordpress-org
+
+# Secret material, with .pem anchored to the root so certificates bundled under vendor/ still ship.
+.env*
+/*.pem
+*.key
+id_rsa*
+.npmrc
+auth.json
+
+# The plugin's own exclusions, beyond configs' baseline above.
+.cache
+CHANGELOG.md
+README.md
+README.scaffold.md
+docs/

.editorconfig

@@ -12,13 +12,11 @@ end_of_line = lf
 insert_final_newline = true
 trim_trailing_whitespace = true
 indent_style = tab
+indent_size = 4
 
-[*.{yml,yaml,json}]
+[*.{yml,yaml}]
 indent_style = space
 indent_size = 2
 
 [*.md]
 trim_trailing_whitespace = false
-
-[*.txt]
-end_of_line = crlf

.github/scripts/fill-in-scaffold.sh

@@ -11,15 +11,18 @@ grep -Eq '^[A-Za-z][A-Za-z0-9]*$' <<< "$NS" || { echo "::error::php-namespace mu
 # One segment after dws_ keeps every prefix in one plugin's family from starting another plugin's, and the
 # framework's admin notices refuse a prefix over 32 characters or with a network or hidden segment.
 { grep -Eq '^dws_[a-z0-9]{1,28}$' <<< "$PREFIX" && [ "$PREFIX" != dws_network ] && [ "$PREFIX" != dws_hidden ]; } || { echo "::error::prefix must match ^dws_[a-z0-9]{1,28}$ and must not be dws_network or dws_hidden."; exit 1; }
-# Both ports land in JSON numbers, where a leading zero is invalid, and the tests environment takes the next one;
-# neither may be the template's own 8811 or 8812, which the leftover check below refuses.
-{ grep -Eq '^[1-9][0-9]{0,4}$' <<< "$PORT" && [ "$PORT" -le 65534 ] && { [ "$PORT" -lt 8810 ] || [ "$PORT" -gt 8812 ]; }; } || { echo "::error::wp-env-port must be 1-65534 with no leading zero, and neither it nor the next port may be 8811 or 8812."; exit 1; }
+# The ports land in JSON numbers, where a leading zero is invalid, and the tests and multisite environments take the
+# next two; none may be the template's own 8811, 8812 or 8813, which the leftover check below refuses.
+{ grep -Eq '^[1-9][0-9]{0,4}$' <<< "$PORT" && [ "$PORT" -le 65533 ] && { [ "$PORT" -lt 8809 ] || [ "$PORT" -gt 8813 ]; }; } || { echo "::error::wp-env-port must be 1-65533 with no leading zero, and neither it nor the next two ports may be 8811, 8812 or 8813."; exit 1; }
 # The display name lands in single-quoted PHP and JavaScript strings, and in JSX text.
 if printf '%s' "$PLUGIN_NAME" | grep -q "['\\\$/<>{}]"; then echo "::error::plugin-name must not contain \\, \$, /, ', <, >, { or }."; exit 1; fi
 
 export SCREAMING_PREFIX="${PREFIX^^}"
 export TESTS_PORT=$(( PORT + 1 ))
+export MULTISITE_PORT=$(( PORT + 2 ))
 export REPO_NAME="${REPO#*/}"
+# Composer and npm accept only lowercase package names, which the sweep takes from the repository.
+export REPO="${REPO,,}"
 
 git mv --force README.scaffold.md README.md
 # The scaffold README becomes the plugin's README.md, which .distignore already excludes.
@@ -48,7 +51,7 @@ git ls-files -z -- . ':!.github/workflows/' ':!.github/scripts/fill-in-scaffold.
 # shellcheck disable=SC2016
 git ls-files -z -- . ':!.github/workflows/' ':!.github/scripts/fill-in-scaffold.sh' ':!composer.lock' ':!package-lock.json' | xargs -0 perl -pi -e '
 	BEGIN { @ARGV = grep { ! -l $_ } @ARGV }
-	s/\b(881[12])\b/8811 == $1 ? $ENV{PORT} : $ENV{TESTS_PORT}/ge;
+	s/\b(881[123])\b/8811 == $1 ? $ENV{PORT} : 8812 == $1 ? $ENV{TESTS_PORT} : $ENV{MULTISITE_PORT}/ge;
 	s/^(\s*\*\s*\@(?:since|version)\s+)2\.0\.0$/${1}0.1.0/;
 '
 # shellcheck disable=SC2016
@@ -63,21 +66,21 @@ composer validate --strict
 php -l "$SLUG.php"
 php -l uninstall.php
 # shellcheck disable=SC2016
-for swept_json in .wp-env.json .wp-env.tests.json composer.json package.json package-lock.json; do
+for swept_json in .wp-env.json .wp-env.tests.json .wp-env.multisite.json composer.json package.json package-lock.json; do
 	php -r 'json_decode( (string) file_get_contents( $argv[1] ), false, 512, JSON_THROW_ON_ERROR );' "$swept_json"
 done
 
 # A name or slug shorter than the template's leaves wrapped lines that Prettier joins, so the swept scripts are formatted
 # again. Install scripts stay off, because the fill-in job holds a token that can push.
 npm ci --ignore-scripts --no-audit --no-fund
-node_modules/.bin/wp-scripts format '{blocks/src,assets/src,tests/e2e}/**/*.{js,jsx,ts,tsx}'
+node_modules/.bin/wp-scripts format '{blocks/src,assets/src,tests/EndToEnd}/**/*.{js,jsx,ts,tsx}'
 
 status=0
 if git grep -n -I -E 'dws-plugin-template|dws_tpl|DWS_TPL|PluginTemplate|DWS Plugin Template|wordpress-plugin-template' -- . ':!.github/scripts/fill-in-scaffold.sh'; then
 	echo "::error::The fill-in left the template's names above."
 	status=1
 fi
-if git grep -n -I -E '\b881[12]\b' -- . ':!.github/scripts/fill-in-scaffold.sh' ':!composer.lock' ':!package-lock.json'; then
+if git grep -n -I -E '\b881[123]\b' -- . ':!.github/scripts/fill-in-scaffold.sh' ':!composer.lock' ':!package-lock.json'; then
 	echo "::error::The fill-in left the template's ports above."
 	status=1
 fi

.github/workflows/audit.yml

@@ -5,17 +5,18 @@ on:
     branches: [trunk]
   pull_request:
   schedule:
-    # Weekly Monday at 07:00 UTC — staggered after dependabot (06:00) so PRs from
-    # dependency bumps surface audit results in the same morning batch.
+    # Weekly, so advisories published against an unchanged lock surface without a push.
     - cron: '0 7 * * 1'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
 jobs:
   audit:
     name: Audit
-    # npm gate audits production deps only — the dev-tooling graph (wp-scripts/playwright trees) is advisory via dependabot alerts.
-    uses: ahegyes/wordpress-configs/.github/workflows/reusable-supply-chain-audit.yml@8d53efd292e4abee4a9c57b0e379434f54bedbe9
-    with:
-      npm-audit-flags: '--omit=dev --audit-level=high'
+    # Only production npm packages gate the audit, since a release ships none of the development tooling.
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-supply-chain-audit.yml@b107001cce9f2960495d9d50481c8540d228f60c

.github/workflows/codeql.yml

@@ -16,8 +16,11 @@ permissions: {}
 
 jobs:
   analyze:
+    name: CodeQL
     permissions:
       actions: read
       contents: read
       security-events: write
-    uses: ahegyes/wordpress-configs/.github/workflows/reusable-codeql.yml@8d53efd292e4abee4a9c57b0e379434f54bedbe9
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-codeql.yml@b107001cce9f2960495d9d50481c8540d228f60c
+    with:
+      languages: '["actions", "javascript-typescript"]'

.github/workflows/fill-in-scaffold.yml

@@ -4,23 +4,23 @@ on:
   workflow_dispatch:
     inputs:
       plugin-name:
-        description: 'Display name (e.g. "Acme Orders")'
+        description: 'Display name, such as "Acme Orders"'
         required: true
         type: string
       plugin-slug:
-        description: 'Kebab-case slug, also the text domain and the entry file name (e.g. "acme-orders")'
+        description: 'Kebab-case slug, also the text domain and the entry file name, such as "acme-orders"'
         required: true
         type: string
       php-namespace:
-        description: 'PHP namespace segment after DeepWebSolutions\ (e.g. "AcmeOrders")'
+        description: 'PHP namespace segment after DeepWebSolutions\, such as "AcmeOrders"'
         required: true
         type: string
       prefix:
-        description: 'Prefix of the global functions, constants, options and hooks, dws_ plus one segment (e.g. "dws_ao")'
+        description: 'Prefix of the global functions, constants, options and hooks, dws_ plus one segment, such as "dws_ao"'
         required: true
         type: string
       wp-env-port:
-        description: 'Development wp-env port; the tests environment takes the next one (e.g. "8821")'
+        description: 'Development wp-env port, such as "8821"; the tests and multisite environments take the next two'
         required: true
         type: string
 

.github/workflows/quality.yml

@@ -5,26 +5,30 @@ on:
     branches: [trunk]
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
 jobs:
   lint-php:
-    name: PHP Lint
-    uses: ahegyes/wordpress-configs/.github/workflows/reusable-php-lint.yml@8d53efd292e4abee4a9c57b0e379434f54bedbe9
+    name: Lint PHP
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-php-lint.yml@b107001cce9f2960495d9d50481c8540d228f60c
     with:
       php-version: '8.5'
-      scripts: '["lint:php:phpcs", "lint:php:phpcs:tests", "lint:php:phpstan"]'
+      scripts: '["lint:php:phpcs", "lint:php:phpcs:tests", "lint:php:phpstan", "changelog:validate"]'
 
   lint-scripts-styles:
-    name: Scripts and styles lint
-    uses: ahegyes/wordpress-configs/.github/workflows/reusable-scripts-styles-lint.yml@8d53efd292e4abee4a9c57b0e379434f54bedbe9
+    name: Lint scripts and styles
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-scripts-styles-lint.yml@b107001cce9f2960495d9d50481c8540d228f60c
     with:
       scripts: '["lint:scripts", "lint:styles", "lint:types"]'
 
   block-json:
     name: block.json schema
-    uses: ahegyes/wordpress-configs/.github/workflows/reusable-block-json-check.yml@8d53efd292e4abee4a9c57b0e379434f54bedbe9
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-block-json-check.yml@b107001cce9f2960495d9d50481c8540d228f60c
 
   slug:
     name: Plugin slug
@@ -50,26 +54,11 @@ jobs:
   php-syntax:
     name: PHP syntax
     needs: slug
-    uses: ahegyes/wordpress-configs/.github/workflows/reusable-php-syntax-check.yml@8d53efd292e4abee4a9c57b0e379434f54bedbe9
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-php-syntax-check.yml@b107001cce9f2960495d9d50481c8540d228f60c
     with:
       php-versions: '["7.4"]'
       paths: ${{ format('["{0}.php", "uninstall.php", "includes"]', needs.slug.outputs.slug) }}
 
-  changelog:
-    name: Changelog fragments
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
-        with:
-          php-version: '8.5'
-          coverage: none
-          tools: composer:v2
-      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
-      - run: composer changelog:validate
-
   scaffold:
     name: Scaffold rehearsal
     # A plugin generated from the template has filled in its placeholders already, so only the template rehearses the fill-in.
@@ -89,6 +78,8 @@ jobs:
         with:
           node-version-file: package.json
           cache: 'npm'
+      - name: Check the scripts with ShellCheck
+        run: shellcheck .github/scripts/*.sh
       - name: Fill in the scaffold
         env:
           PLUGIN_NAME: Acme Orders

.github/workflows/release.yml

@@ -38,11 +38,13 @@ jobs:
   release:
     name: Release
     needs: slug
-    # A reusable workflow can't elevate above the caller's token; grant the provenance check's and the GitHub Release's scopes here.
+    # A reusable workflow cannot raise the caller's token, so this job grants every scope the release's jobs declare.
     permissions:
       actions: read
+      attestations: write
       contents: write
-    uses: ahegyes/wordpress-configs/.github/workflows/reusable-release.yml@8d53efd292e4abee4a9c57b0e379434f54bedbe9
+      id-token: write
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-release.yml@b107001cce9f2960495d9d50481c8540d228f60c
     with:
       project-path: '.'
       plugin-slug: ${{ needs.slug.outputs.slug }}

.github/workflows/tests-nightly.yml

@@ -12,16 +12,25 @@ permissions:
 jobs:
   integration:
     name: Integration
-    uses: ahegyes/wordpress-configs/.github/workflows/reusable-phpunit.yml@8d53efd292e4abee4a9c57b0e379434f54bedbe9
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-phpunit.yml@b107001cce9f2960495d9d50481c8540d228f60c
     with:
       php-version: '8.5'
       wp-env-core: 'https://wordpress.org/nightly-builds/wordpress-latest.zip'
       composer-script: 'test:integration:run'
       wp-env-config-file: '.wp-env.tests.json'
 
+  integration-multisite:
+    name: Integration (multisite)
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-phpunit.yml@b107001cce9f2960495d9d50481c8540d228f60c
+    with:
+      php-version: '8.5'
+      wp-env-core: 'https://wordpress.org/nightly-builds/wordpress-latest.zip'
+      composer-script: 'test:integration:multisite:run'
+      wp-env-config-file: '.wp-env.multisite.json'
+
   e2e:
     name: E2E
-    uses: ahegyes/wordpress-configs/.github/workflows/reusable-playwright-e2e.yml@8d53efd292e4abee4a9c57b0e379434f54bedbe9
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-playwright-e2e.yml@b107001cce9f2960495d9d50481c8540d228f60c
     with:
       artifact-slug: nightly
       php-version: '8.5'