From 68048b23fd5338a607487c661c6d717bacb7a493 Mon Sep 17 00:00:00 2001 From: Nikolay Strikhar Date: Thu, 13 Aug 2026 15:10:19 +0200 Subject: [PATCH 1/4] Keep the agent working directories out of a consumer's install .claude/ and .superpowers/ stayed out of the tree only because this machine's global excludes happen to cover them. On a fresh checkout they are untracked and one git add away from shipping, with no export-ignore behind them. --- .gitattributes | 2 ++ .gitignore | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.gitattributes b/.gitattributes index 5a786f2..4cc18ad 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,6 +1,8 @@ * text=auto eol=lf +/.claude export-ignore /.github export-ignore +/.superpowers export-ignore /docs export-ignore /tests export-ignore /.editorconfig export-ignore diff --git a/.gitignore b/.gitignore index 8c5075c..aca07b6 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,5 @@ .DS_Store .idea/ .vscode/ +/.claude/ +/.superpowers/ From a6b817ea2abf22cb6c82924050b4c5812342aa58 Mon Sep 17 00:00:00 2001 From: Nikolay Strikhar Date: Thu, 13 Aug 2026 15:10:19 +0200 Subject: [PATCH 2/4] Name the support channels and pin the analysis tools to a minor composer.lock is deliberately uncommitted and static analysis resolves dependency-versions: highest, so a phpstan 1.x minor that adds a level 9 rule turns the gate red on a branch nobody touched. ~1.12.0 makes that a deliberate bump instead of a surprise. keywords and support are what Packagist renders. --- composer.json | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/composer.json b/composer.json index 0cf224e..5c28716 100644 --- a/composer.json +++ b/composer.json @@ -4,12 +4,23 @@ "type": "library", "license": "GPL-2.0-or-later", "minimum-stability": "stable", + "keywords": [ + "wordpress", + "plugin", + "bundled", + "loader", + "stellarwp" + ], "authors": [ { "name": "StellarWP", "email": "dev@stellarwp.com" } ], + "support": { + "issues": "https://github.com/stellarwp/plugin-absorber/issues", + "source": "https://github.com/stellarwp/plugin-absorber" + }, "require": { "php": ">=7.4", "stellarwp/container-contract": "^1.0" @@ -20,9 +31,9 @@ "lucatume/di52": "^3.0", "lucatume/wp-browser": "^3.6.5", "php-stubs/wordpress-stubs": "~6.4.0", - "phpstan/phpstan": "^1.10", + "phpstan/phpstan": "~1.12.0", "phpunit/phpunit": "^9.5", - "szepeviktor/phpstan-wordpress": "^1.3" + "szepeviktor/phpstan-wordpress": "~1.3.0" }, "autoload": { "psr-4": { From 0310b8b4e829e874ec8e68bc5f36bc94e84dd7da Mon Sep 17 00:00:00 2001 From: Nikolay Strikhar Date: Thu, 13 Aug 2026 15:10:19 +0200 Subject: [PATCH 3/4] Validate the manifest once, strictly, instead of four times leniently composer validate does not vary by PHP or WordPress version, so running it on every leg of a 2x2 matrix bought nothing and skipped --strict, which is the half that promotes what a consumer reads on Packagist to a failure. Also records why the 8.5 leg has a test harness at all: wp-browser 3.8.1 declares php <8.0 and installs only because config.platform pins resolution to 7.4. Bypassed rather than satisfied, deliberately, and green today. --- .github/workflows/static-analysis.yml | 19 +++++++++++++++++++ .github/workflows/tests-php.yml | 8 +++++++- 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml index eefcd88..07fd218 100644 --- a/.github/workflows/static-analysis.yml +++ b/.github/workflows/static-analysis.yml @@ -40,6 +40,25 @@ jobs: extensions: mbstring, intl coverage: none + # Manifest validity does not vary by PHP or WordPress version, so it is + # asserted once here rather than on all four legs of the test matrix. + # --strict promotes the advisory notices -- a missing description, a + # non-canonical license string -- to failures, since those are what a + # consumer reads on Packagist. --no-check-lock because composer.lock is + # deliberately not committed for a library. + - name: Validate composer.json + run: composer validate --strict --no-check-lock + + # cspell.json is checked in and every workflow carries `# cspell:ignore` + # directives, so something is expected to read it. Until this step existed + # nothing did, and the dictionary was decorative. Run before the composer + # install so vendor/ is absent and the ignorePaths entry for it is belt + # rather than braces. The major version is pinned: a minor cspell release + # that widens its dictionaries would otherwise turn a comment red without + # a commit here. + - name: Spellcheck + run: npx --yes cspell@8 lint --no-progress . + # ext-* only, never the blanket --ignore-platform-reqs. The blanket form # also switches off the config.platform.php pin, which resolves dev # dependencies requiring PHP 8.1+ that cannot run here at all -- PHPStan diff --git a/.github/workflows/tests-php.yml b/.github/workflows/tests-php.yml index a990b21..cf7e007 100644 --- a/.github/workflows/tests-php.yml +++ b/.github/workflows/tests-php.yml @@ -34,6 +34,13 @@ jobs: # PHP version fires on every later one, so 8.5 catches what 8.0-8.4 # would, and every leg resolves identical dependencies because # config.platform.php pins resolution to 7.4 regardless of runtime. + # + # That pin is also the only reason the 8.5 leg has a test harness at + # all: wp-browser 3.8.1 declares php ">=7.1 <8.0", so it installs + # because resolution sees 7.4, then executes on 8.5. Its constraint is + # bypassed rather than satisfied. That is deliberate -- wp-browser 4.x + # is unreachable while 7.4 is the floor -- and the leg passes today. If + # it ever stops passing, drop the column rather than chasing it. php: - "7.4" - "8.5" @@ -109,7 +116,6 @@ jobs: run: | ${SLIC_BIN} use ${{ github.event.repository.name }} ${SLIC_BIN} composer set-version 2 - ${SLIC_BIN} composer validate ${SLIC_BIN} composer install # The slic image ships a fixed WordPress that varies by PHP version, and From eb242ea93cba92e6054c1622701ff6eb128af327 Mon Sep 17 00:00:00 2001 From: Nikolay Strikhar Date: Thu, 13 Aug 2026 15:10:19 +0200 Subject: [PATCH 4/4] Give cspell.json something to do The file was checked in and both workflows carried cspell:ignore directives, so a reader would assume a gate existed. None did. Curating the 40 words the tree already uses costs less than the false impression, and this repository argues about prose often enough to want the check. --- cspell.json | 55 ++++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 52 insertions(+), 3 deletions(-) diff --git a/cspell.json b/cspell.json index 08d7c31..5c7e7da 100644 --- a/cspell.json +++ b/cspell.json @@ -2,50 +2,99 @@ "version": "0.2", "language": "en,en-GB", "words": [ + "ABSPATH", "absorber", + "adbario", + "akismet", + "alloptions", "assertable", + "autowirability", + "autowirable", + "autowires", + "autonumber", + "basenames", "codeception", "docblocks", + "fataled", + "fataling", "fatals", "invokable", "kadence", "kses", "learndash", "lucatume", + "mbstring", "multisite", + "mysqli", "nexcess", "packagist", + "pagenow", + "phpdotenv", "phpstan", "phpunit", "propanel", + "rebindable", "redirector", "referer", "sapi", "sfwd", "singlesite", + "sitemeta", "sitewide", "slic", + "standalones", "stellarwp", "strauss", + "subclassing", + "subsite", + "szepeviktor", + "superadmin", + "superglobal", "togglable", + "twentytwenty", + "unbooted", + "unbuildable", "unbuilt", "uncallable", + "universalframework", "uncastable", + "unconfigured", "ungated", "unnegated", "unreviewed", + "unsets", + "unslash", + "unslashed", + "unstubbed", + "unwire", + "unwires", + "unwiring", "uopz", + "upgrader", + "vlucas", "worktree", "wpautop", + "wpdb", + "WPMU", "wpunit" ], "ignoreWords": [ "ance", - "defered" + "Brien", + "defered", + "Dpage", + "giverecurring", + "mstest", + "экспорт" ], "ignorePaths": [ - "vendor/**", + ".git/**", + "LICENSE", + "composer.lock", + "node_modules/**", + "phpstan-cache/**", "tests/_output/**", - "composer.lock" + "tests/_support/_generated/**", + "vendor/**" ] }