Sync every plugin with the template and close the cross-plugin audit items

.github/workflows/tests-nightly.yml

@@ -55,6 +55,16 @@ jobs:
       composer-script: 'test:integration:ci'
       wp-env-config-file: '.wp-env.tests.json'
 
+  multisite-integration:
+    name: Integration (multisite)
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-phpunit.yml@b107001cce9f2960495d9d50481c8540d228f60c
+    with:
+      project-path: '.'
+      php-version: '8.5'
+      wp-env-core: 'https://wordpress.org/nightly-builds/wordpress-latest.zip'
+      composer-script: 'test:integration:multisite:ci'
+      wp-env-config-file: '.wp-env.multisite.json'
+
   shared-e2e:
     name: E2E (shared environment)
     uses: ahegyes/wordpress-configs/.github/workflows/reusable-playwright-e2e.yml@b107001cce9f2960495d9d50481c8540d228f60c

.github/workflows/tests.yml

@@ -76,6 +76,17 @@ jobs:
       composer-script: 'test:integration:ci'
       wp-env-config-file: '.wp-env.tests.json'
 
+  multisite-integration:
+    name: Integration (multisite)
+    needs: plugins
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-phpunit.yml@b107001cce9f2960495d9d50481c8540d228f60c
+    with:
+      project-path: '.'
+      php-version: '8.5'
+      wp-version: ${{ needs.plugins.outputs.newest-wordpress }}
+      composer-script: 'test:integration:multisite:ci'
+      wp-env-config-file: '.wp-env.multisite.json'
+
   shared-e2e:
     name: E2E (shared environment)
     needs: plugins

.wp-env.multisite.json

@@ -0,0 +1,22 @@
+{
+	"$schema": "https://schemas.wp.org/trunk/wp-env.json",
+	"core": "WordPress/WordPress#tags/7.1.4",
+	"phpVersion": "8.5",
+	"port": 8821,
+	"testsEnvironment": false,
+	"multisite": true,
+	"mappings": {
+		"wp-content/plugins/linked-orders-for-woocommerce": "./plugins/linked-orders-for-woocommerce",
+		"wp-content/plugins/internal-comments": "./plugins/internal-comments",
+		"wp-content/plugins/locked-payment-methods-for-woocommerce": "./plugins/locked-payment-methods-for-woocommerce",
+		"wp-content/plugins/woocommerce": "./vendor/wp-plugin/woocommerce"
+	},
+	"config": {
+		"WP_DEBUG": true,
+		"SCRIPT_DEBUG": true,
+		"WP_ENVIRONMENT_TYPE": false
+	},
+	"lifecycleScripts": {
+		"afterStart": "node_modules/.bin/wp-env --config .wp-env.multisite.json run cli wp plugin activate woocommerce --network && node_modules/.bin/wp-env --config .wp-env.multisite.json run cli wp wc hpos enable --ignore-plugin-compatibility && node_modules/.bin/wp-env --config .wp-env.multisite.json run cli wp plugin activate linked-orders-for-woocommerce internal-comments locked-payment-methods-for-woocommerce --network"
+	}
+}

AGENTS.md

@@ -14,12 +14,13 @@ wordpress-plugins/
 │   └── EndToEnd/                         the shared environment's checks: every plugin is active and boots, and the plugins work side by side
 ├── .github/workflows/
 │   ├── plugins.yml                       lists the plugins, their mirrors and readmes for the other workflows, checks a release tag names one, and lists each one's WordPress versions for Tests
-│   ├── quality.yml, tests.yml, tests-nightly.yml, audit.yml    the plugins' own lanes, once per plugin; Quality's script lint and the audit also over the root, and Tests and the nightly also over the shared environment
+│   ├── quality.yml, tests.yml, tests-nightly.yml, audit.yml    the plugins' own lanes, once per plugin; Quality's script lint and the audit also over the root, and Tests and the nightly also over the shared and multisite environments
 │   ├── codeql.yml, workflow-checks.yml   the template's, workflow-checks.yml also linting each plugin's workflows
 │   ├── release-rehearsal.yml             rehearses each plugin's release, from build to the built-artifact test, on pull requests and trunk, publishing nothing
 │   └── split-plugins.yml                 splits each plugin to the mirror its composer.json name gives, and forwards <slug>/vX.Y.Z as vX.Y.Z
+├── .wp-env.multisite.json                the multisite environment on port 8821: a network with every plugin and WooCommerce network-activated, as production
 ├── .wp-env.tests.json                    the shared environment on port 8820: every plugin and WooCommerce from vendor/, as production
-├── composer.json                         WooCommerce for the shared environment, the shared Integration run and the plugins:* fan-outs
+├── composer.json                         WooCommerce for the shared environments, their Integration runs and the plugins:* fan-outs
 └── package.json                          wp-env, Playwright and the shared spec's lint, and the plugins:* fan-outs
 ```
 
@@ -29,6 +30,7 @@ wordpress-plugins/
 npm run setup                     # every install, then every plugin's build
 composer plugins:quality-check    # each plugin's quality-check, in its own environments
 composer test:integration         # starts the shared environment and runs each plugin's Integration suite in it
+composer test:integration:multisite  # starts the multisite environment and runs each plugin's multisite group in it
 npm run test:e2e                  # the shared environment's checks
 npm run plugins:test:e2e          # each plugin's end-to-end suite, in its own environment
 npm run lint:all                  # the shared spec's checks, then every plugin's PHP, script, style and type checks
@@ -39,7 +41,7 @@ actionlint .github/workflows/*.yml plugins/*/.github/workflows/*.yml && zizmor .
 ## Conventions
 
 1. **Plugins.** A plugin starts from wordpress-plugin-template's trunk through the template's fill-in script, run in a clone of the template, and its directory keeps the template's tooling, docs and workflows but for `CONTRIBUTING.md`, the pull-request and issue templates, `.github/dependabot.yml` and the fill-in's workflow and script: its mirror is a public repository users land on, while contributions, issues and dependency updates belong here. Its `composer.json` name is its mirror, `ahegyes/wc-<name>` for a WooCommerce plugin and `ahegyes/wp-<name>` otherwise.
-2. **Root lanes.** The root's workflows find the plugins through `plugins.yml`, so a plugin joins every lane without a workflow edit. The `plugins:*` fan-outs, the shared environment's mappings and activation, `test:integration:run`, the shared spec's boot row, the README table, the layout tree above and both issue forms name each plugin.
+2. **Root lanes.** The root's workflows find the plugins through `plugins.yml`, so a plugin joins every lane without a workflow edit. The `plugins:*` fan-outs, the shared and multisite environments' mappings and activation, `test:integration:run`, `test:integration:multisite:run`, the shared spec's boot row, the README table, the layout tree above and both issue forms name each plugin.
 3. **Ports.** wp-env ports are allocated in threes: the shared environment takes 8820 and the root's multisite environment 8821, the three plugins here take their development and tests pairs from 8822 to 8827 and their multisite ports from 8828 to 8830, and a new plugin takes the next free three, from 8831, for its development, tests and multisite sites.
 4. **v1 successors.** A plugin released before v2 keeps its wordpress.org slug, text domain, main file name, capabilities, and every hook, function and constant another plugin can rely on, and starts at 2.0.0. It keeps its option and meta keys too, unless a major version migrates them in a way that preserves the data, with a changelog line and an Upgrade Notice line, as Locked Payment Methods' 2.0.0 does. Its v1 hook literals fire as deprecated beside their v2 names until the next major, and every break is listed in its changelog and its readme's Upgrade Notice.
 5. **Releases.** A plugin releases from its mirror: the tag `<slug>/vX.Y.Z` here reaches the mirror as `vX.Y.Z`, never force-pushed, and the mirror holds the `wp-org-release` environment where the plugin is on wordpress.org. `CONTRIBUTING.md` holds the release step.

README.md

@@ -31,7 +31,7 @@ composer test:integration
 npm run test:e2e
 ```
 
-`composer test:integration` runs each plugin's Integration suite in the shared environment, and `npm run test:e2e` its checks of the plugins side by side.
+`composer test:integration` runs each plugin's Integration suite in the shared environment, `composer test:integration:multisite` each plugin's `multisite` group on a network on <http://localhost:8821>, and `npm run test:e2e` the shared environment's checks of the plugins side by side.
 
 ## Releases
 

SECURITY.md

@@ -4,6 +4,10 @@
 
 Report it privately through [GitHub's security advisory form](https://github.com/ahegyes/wordpress-plugins/security/advisories/new), never in a public issue. The first response comes within 7 days.
 
+## Supported versions
+
+For each plugin, only the latest 2.x release receives security fixes. 1.x receives none.
+
 ## Scope
 
 In scope: every plugin under `plugins/`, its prefixing configuration and its workflows, and the monorepo's own workflows.

composer.json

@@ -1,3 +1,3 @@
 {
 	"name": "ahegyes/wordpress-plugins",
 	"description": "Plugins built on the wp-framework packages are developed side by side here, so a change that crosses plugins lands and is tested in one place, while each plugin still ships from a mirror of its own.",
@@ -46,16 +46,36 @@
 			"Composer\\Config::disableProcessTimeout",
 			"@putenv CI=1",
 			"npm --prefix=. run plugins:build",
-			"node_modules/.bin/wp-env --config .wp-env.tests.json run cli --env-cwd=wp-content/plugins/linked-orders-for-woocommerce vendor/bin/phpunit --testsuite=Integration",
-			"node_modules/.bin/wp-env --config .wp-env.tests.json run cli --env-cwd=wp-content/plugins/internal-comments vendor/bin/phpunit --testsuite=Integration",
-			"node_modules/.bin/wp-env --config .wp-env.tests.json run cli --env-cwd=wp-content/plugins/locked-payment-methods-for-woocommerce vendor/bin/phpunit --testsuite=Integration --exclude-group groups"
+			"node_modules/.bin/wp-env --config .wp-env.tests.json run cli --env-cwd=wp-content/plugins/linked-orders-for-woocommerce vendor/bin/phpunit --testsuite=Integration --exclude-group=multisite",
+			"node_modules/.bin/wp-env --config .wp-env.tests.json run cli --env-cwd=wp-content/plugins/internal-comments vendor/bin/phpunit --testsuite=Integration --exclude-group=multisite",
+			"node_modules/.bin/wp-env --config .wp-env.tests.json run cli --env-cwd=wp-content/plugins/locked-payment-methods-for-woocommerce vendor/bin/phpunit --testsuite=Integration --exclude-group=groups --exclude-group=multisite"
 		],
 		"test:integration:ci": [
 			"Composer\\Config::disableProcessTimeout",
 			"@plugins:packages-install",
 			"npm --prefix=. run plugins:packages-install:ci",
 			"@test:integration:run"
 		],
+		"test:integration:multisite": [
+			"Composer\\Config::disableProcessTimeout",
+			"@putenv CI=1",
+			"npm --prefix=. run wp-env:multisite:start",
+			"@test:integration:multisite:run"
+		],
+		"test:integration:multisite:run": [
+			"Composer\\Config::disableProcessTimeout",
+			"@putenv CI=1",
+			"npm --prefix=. run plugins:build",
+			"node_modules/.bin/wp-env --config .wp-env.multisite.json run cli --env-cwd=wp-content/plugins/linked-orders-for-woocommerce vendor/bin/phpunit --testsuite=Integration --group=multisite",
+			"node_modules/.bin/wp-env --config .wp-env.multisite.json run cli --env-cwd=wp-content/plugins/internal-comments vendor/bin/phpunit --testsuite=Integration --group=multisite",
+			"node_modules/.bin/wp-env --config .wp-env.multisite.json run cli --env-cwd=wp-content/plugins/locked-payment-methods-for-woocommerce vendor/bin/phpunit --testsuite=Integration --group=multisite"
+		],
+		"test:integration:multisite:ci": [
+			"Composer\\Config::disableProcessTimeout",
+			"@plugins:packages-install",
+			"npm --prefix=. run plugins:packages-install:ci",
+			"@test:integration:multisite:run"
+		],
 
 		"quality-check": [
 			"@composer validate --strict",

package.json

@@ -49,6 +49,11 @@
 		"wp-env:tests:update": "wp-env --config .wp-env.tests.json start --update",
 		"wp-env:tests:destroy": "wp-env --config .wp-env.tests.json destroy",
 
+		"wp-env:multisite:start": "wp-env --config .wp-env.multisite.json start",
+		"wp-env:multisite:stop": "wp-env --config .wp-env.multisite.json stop",
+		"wp-env:multisite:update": "wp-env --config .wp-env.multisite.json start --update",
+		"wp-env:multisite:destroy": "wp-env --config .wp-env.multisite.json destroy",
+
 		"audit": "composer audit --locked --abandoned=report && npm audit --omit=dev --audit-level=high",
 		"audit:fix": "npm audit fix",
 		"check:engines": "wp-scripts check-engines",

plugins/internal-comments/.distignore

@@ -1,40 +1,52 @@
-.cache
-.distignore
-.editorconfig
+# Baseline wp dist-archive exclusions for WordPress projects.
+
 .git
 .github
-.gitignore
 .idea
 .vscode
-.wp-env.json
-.wp-env.override.json
-.wp-env.tests.json
-
+.editorconfig
+.gitattributes
+.gitignore
+.distignore
 AGENTS.md
-CHANGELOG.md
 CLAUDE.md
 CONTRIBUTING.md
-README.md
 SECURITY.md
-
-changelog/
-docs/
-
-node_modules/
-tests/
-vendor/bin/
-
+/changelog
+node_modules
+tests
+vendor/bin
 composer.json
 composer.lock
 package.json
 package-lock.json
+.phpcs*.xml*
+phpcs*.xml*
+.phpstan*.neon*
+phpstan*.neon*
+phpunit*.xml*
+.phpunit.result.cache
+.phpunit.cache
+infection.json*
+eslint.config.*
+stylelint.config.*
 tsconfig.json
-eslint.config.mjs
-stylelint.config.js
-phpcs.dist.xml
-phpcs.tests.dist.xml
-phpstan.dist.neon
-phpstan.safeguards.neon
-phpunit.dist.xml
-playwright.config.js
+playwright.config.*
+postcss.config.*
 scoper.inc.php
+.wp-env*
+.wordpress-org
+
+# Secret material, with .pem anchored to the root so certificates bundled under vendor/ still ship.
+.env*
+/*.pem
+*.key
+id_rsa*
+.npmrc
+auth.json
+
+# The plugin's own exclusions, beyond configs' baseline above.
+.cache
+CHANGELOG.md
+README.md
+docs/

plugins/internal-comments/.github/workflows/audit.yml

@@ -5,17 +5,18 @@ on:
     branches: [trunk]
   pull_request:
   schedule:
-    # Weekly Monday at 07:00 UTC — staggered after dependabot (06:00) so PRs from
-    # dependency bumps surface audit results in the same morning batch.
+    # Weekly, so advisories published against an unchanged lock surface without a push.
     - cron: '0 7 * * 1'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
 jobs:
   audit:
     name: Audit
-    # npm gate audits production deps only — the dev-tooling graph (wp-scripts/playwright trees) is advisory via dependabot alerts.
+    # Only production npm packages gate the audit, since a release ships none of the development tooling.
     uses: ahegyes/wordpress-configs/.github/workflows/reusable-supply-chain-audit.yml@b107001cce9f2960495d9d50481c8540d228f60c
-    with:
-      npm-audit-flags: '--omit=dev --audit-level=high'

plugins/internal-comments/.github/workflows/codeql.yml

@@ -16,8 +16,11 @@ permissions: {}
 
 jobs:
   analyze:
+    name: CodeQL
     permissions:
       actions: read
       contents: read
       security-events: write
     uses: ahegyes/wordpress-configs/.github/workflows/reusable-codeql.yml@b107001cce9f2960495d9d50481c8540d228f60c
+    with:
+      languages: '["actions", "javascript-typescript"]'

plugins/internal-comments/.github/workflows/quality.yml

@@ -5,19 +5,23 @@ on:
     branches: [trunk]
   pull_request:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
 jobs:
   lint-php:
-    name: PHP Lint
+    name: Lint PHP
     uses: ahegyes/wordpress-configs/.github/workflows/reusable-php-lint.yml@b107001cce9f2960495d9d50481c8540d228f60c
     with:
       php-version: '8.5'
-      scripts: '["lint:php:phpcs", "lint:php:phpcs:tests", "lint:php:phpstan"]'
+      scripts: '["lint:php:phpcs", "lint:php:phpcs:tests", "lint:php:phpstan", "changelog:validate"]'
 
   lint-scripts-styles:
-    name: Scripts and styles lint
+    name: Lint scripts and styles
     uses: ahegyes/wordpress-configs/.github/workflows/reusable-scripts-styles-lint.yml@b107001cce9f2960495d9d50481c8540d228f60c
     with:
       scripts: '["lint:scripts", "lint:styles", "lint:types"]'
@@ -36,12 +40,12 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      # GitHub refuses a GITHUB_TOKEN push that changes a workflow, so the fill-in leaves workflows alone and they read the slug the plugin declares.
+      # The workflows read the slug the plugin declares, as the template's do, so a change to the template's applies here unedited.
       - name: Read the slug from composer.json
         id: slug
         run: |
           slug=$(jq -r '.extra["text-domain"] // empty' composer.json)
-          if ! [[ "$slug" =~ ^[a-z0-9]+(-[a-z0-9]+)*$ ]]; then
+          if ! [[ "$slug" =~ ^[a-z][a-z0-9]*(-[a-z0-9]+)*$ ]]; then
             echo "::error::composer.json's extra.text-domain must be the plugin's kebab-case slug — got '$slug'."
             exit 1
           fi
@@ -58,6 +62,7 @@ jobs:
   readme-lint:
     name: readme.txt lint
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -66,18 +71,3 @@ jobs:
         with:
           path: readme.txt
           fail-on: error
-
-  changelog:
-    name: Changelog fragments
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
-        with:
-          php-version: '8.5'
-          coverage: none
-          tools: composer:v2
-      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
-      - run: composer changelog:validate

plugins/internal-comments/.github/workflows/release.yml

@@ -24,12 +24,12 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      # GitHub refuses a GITHUB_TOKEN push that changes a workflow, so the fill-in leaves workflows alone and they read the slug the plugin declares.
+      # The workflows read the slug the plugin declares, as the template's do, so a change to the template's applies here unedited.
       - name: Read the slug from composer.json
         id: slug
         run: |
           slug=$(jq -r '.extra["text-domain"] // empty' composer.json)
-          if ! [[ "$slug" =~ ^[a-z0-9]+(-[a-z0-9]+)*$ ]]; then
+          if ! [[ "$slug" =~ ^[a-z][a-z0-9]*(-[a-z0-9]+)*$ ]]; then
             echo "::error::composer.json's extra.text-domain must be the plugin's kebab-case slug — got '$slug'."
             exit 1
           fi

plugins/internal-comments/.github/workflows/tests-nightly.yml

@@ -19,6 +19,15 @@ jobs:
       composer-script: 'test:integration:run'
       wp-env-config-file: '.wp-env.tests.json'
 
+  integration-multisite:
+    name: Integration (multisite)
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-phpunit.yml@b107001cce9f2960495d9d50481c8540d228f60c
+    with:
+      php-version: '8.5'
+      wp-env-core: 'https://wordpress.org/nightly-builds/wordpress-latest.zip'
+      composer-script: 'test:integration:multisite:run'
+      wp-env-config-file: '.wp-env.multisite.json'
+
   e2e:
     name: E2E
     uses: ahegyes/wordpress-configs/.github/workflows/reusable-playwright-e2e.yml@b107001cce9f2960495d9d50481c8540d228f60c