kristianwindandClaude Opus 5
dccb87d15e
Five files under docs/, the names the family agreed: README, SETUP,
ARCHITECTURE, CONTRACT, RELEASE. Plus ci/check-docs.php, ported from
woo-security-manager 52dd99d, wired into the static job.
CONTRACT.md is generated from the source rather than written from memory, and
that was the right instruction: my first sweep read only single-quoted hook
names and missed two rows, one of them update_plugins_{$hostname} — the hook
behind the live-shop collision, written with interpolation and therefore
invisible to a pattern built from the concept of the line. Nine hooks
documented: six wc_edm_* filters this plugin offers, three wpmgr_* it both
offers and answers through its copy of the frozen shared-menu.php.
Two hooks the checker structurally cannot see are listed by hand with a note
saying so: wc_edm_prune_audit_log (add_action on a class constant) and
update_plugins_{$hostname} (interpolated). A generated list beats a remembered
one and is still a list of what the generator can see.
The checker needed two fixes before it was safe to run here.
🔴 The published version reads HOOK_PREFIX from ci/plugin.conf for the
documented side, and refuses without it — then tests the source side against a
hardcoded 'nlsec_'. Ported verbatim that is not a green over nothing, which
would be easy to spot. Measured in this tree with CONTRACT.md documenting no
hook at all:
3 hook(s) in the shipped source and not in docs/CONTRACT.md:
wpmgr_dashboard_cards, wpmgr_menu_glyph, wpmgr_menu_title
Red, specific, and blind to all six wc_edm_* hooks — because 'wpmgr_' is the
same string in every tree and 'nlsec_' is the one that is not. Fix those three
and it goes green over six undocumented contract hooks, with a red run behind
you as evidence that it works. A partially blind check that fails is more
convincing than one that passes.
Note which step disarmed the guard. The floor at 20 shipped PHP files refused
to run in this 14-file tree, and that refusal was the only thing standing in
the way; the porting instructions were to add HOOK_PREFIX and adjust the floor.
Doing as told is what removed the protection — two wrongs cancelling into a
pass, in the order CLAUDE.md predicts, because the floor is the error you can
see and the prefix is not.
Both numbers now come from the conf (HOOK_PREFIX, MIN_SHIPPED_PHP_FILES) and
both refuse rather than defaulting. The inherited literal 20 is gone: a second
hardcoded number per plugin is a second thing to re-measure on every port.
Ten selftest assertions, 58 total. Four failure modes, the two refusals, the
counts on the pass, and the row that matters most:
🔴 A hook name in a COMMENT must not read as a hook call. CONTRACT.md documents
a filter by showing the apply_filters() a consumer makes, and the same example
sits in a docblock — so a checker that reads comments reports this plugin
consuming a filter it answers, in the file explaining why it must not. That
assertion is a control asserting a PASS, which is the kind that can quietly
become unable to fail, so it names the specific success line rather than
reading an exit code, and it is proven both ways: with token_get_all's
T_COMMENT branch made inert, exactly one of 58 assertions fails and it is that
one.
docs/TESTING-AND-RELEASES.md is folded into RELEASE.md and deleted rather than
left beside it — two copies of a rule is how the copies start to disagree.
Folding surfaced that it still documented the pre-rename Update URI
(kw/woocommerce-email-discount-manager) and still recommended, as future work,
the split into a releases-only repository that has already happened. Both
corrected in place, with the correction dated.
docs/ is not in ci/dist-files.sh — measured, 0 docs files in the zip.
static=0 selftest=0 site=0; site still 69 assertions on WordPress 7.1.2 with
WooCommerce 11.1.2. ci/ and docs/ ship nothing, so no version bump.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
113 lines
6.1 KiB
Plaintext
113 lines
6.1 KiB
Plaintext
# The only file under ci/ that knows anything about this particular plugin.
|
|
#
|
|
# Everything else in ci/ is plugin-agnostic on purpose: copying ci/, tests/ and
|
|
# the two workflow roots into another plugin and rewriting these six lines is
|
|
# the whole port. docs/REUSE.md walks through it.
|
|
|
|
# Directory name the plugin gets inside wp-content/plugins, and the name of the
|
|
# built zip. WordPress identifies a plugin by "<slug>/<main file>", so changing
|
|
# this after release orphans every installed copy.
|
|
#
|
|
# 🔴 THIS DELIBERATELY DOES NOT MATCH THE REPOSITORY NAME, and it must not be
|
|
# "tidied up" to. The repo is woo-discount-manager; the installed directory has
|
|
# been woocommerce-email-discount-manager since the first release and is on a
|
|
# live shop. Renaming it would not move that installation — it would put a
|
|
# SECOND copy beside it and leave the old one active. The repo name is free to
|
|
# change (Gitea keeps a 301, measured), the installed slug never is.
|
|
PLUGIN_SLUG=woocommerce-email-discount-manager
|
|
|
|
# The file carrying the plugin header. Version: in here is the version.
|
|
PLUGIN_MAIN=woocommerce-email-discount-manager.php
|
|
|
|
# Every __() and esc_html__() call must use this domain or the translation is
|
|
# silently dropped at runtime.
|
|
TEXT_DOMAIN=wc-email-discount
|
|
|
|
# WooCommerce is installed into the test site before the plugin is activated.
|
|
# Set to no for a plugin that does not need it, and the site comes up faster.
|
|
NEEDS_WOOCOMMERCE=yes
|
|
|
|
# Run inside the live test site with `wp eval-file`, in this order. Fixtures
|
|
# create the data; the smoke files assert against it. A non-zero exit or an
|
|
# uncaught error fails the build.
|
|
SITE_TESTS="tests/fixtures.php tests/smoke.php"
|
|
|
|
# Plausibility floors for the hygiene checks. They exist because a check that
|
|
# examined NOTHING prints the same reassuring line as one that examined
|
|
# everything, and only the passing side can tell them apart — a pattern that is
|
|
# too broad fails loudly on first contact with real code, one that finds nothing
|
|
# survives verification forever.
|
|
#
|
|
# Both are deliberately far below the real numbers. They are not assertions
|
|
# about this plugin's size: a tight number goes red on ordinary churn and gets
|
|
# raised until it means nothing. They assert that the scan still finds this
|
|
# plugin at all.
|
|
#
|
|
# Real counts when these were set (2026-09-17): 13 shipped PHP files, 142
|
|
# translation calls across 17 files. Both floors were broken once and watched to
|
|
# fail before being believed.
|
|
MIN_SHIPPED_PHP_FILES=5
|
|
|
|
# Set to 0 for a plugin with no translatable strings: the check then warns
|
|
# instead of failing, so zero is never silent either way.
|
|
MIN_TRANSLATION_CALLS=60
|
|
|
|
# Where releases are published, when that is not the repository running the
|
|
# workflow. The source repo is kw/nolimit-discounts; the plugin's update feed
|
|
# is a separate PUBLIC repo holding built zips only, so a shop can fetch
|
|
# updates without credentials and without the source being readable.
|
|
#
|
|
# 🔴 This and the "Update URI:" header in the plugin file must name the same
|
|
# repository. ci/static.sh fails when they disagree — a feed that moves while
|
|
# the header stands still is how every installed copy silently stops receiving
|
|
# updates, and nothing announces it because latest_release() just returns false.
|
|
#
|
|
# Publishing here needs a token with write access to that OTHER repository. The
|
|
# job token only covers the repo it runs in, so this is a cross-repo PAT and
|
|
# Kristian's to add.
|
|
RELEASE_REPO=kw/nolimit-discounts-dist
|
|
|
|
# The sha256 of includes/shared-menu.php, which is byte-identical in all six
|
|
# plugins. Which copy a site loads is decided by activation order and PHP
|
|
# cannot un-declare a function, so the first one wins for the whole request —
|
|
# a shop with two plugins on one version and three on another gets whichever
|
|
# booted first, while every repository's own check is green on its own side.
|
|
# The frozen hash is therefore a family-wide fact, not a local one, and taking
|
|
# a new one is something all six do in the same window.
|
|
#
|
|
# 75b04eb4 = contract 1.2.3: the dashboard status pill is rgba(0,0,0,.18)
|
|
# instead of 22% white. The pill is white 11px text composited over the card
|
|
# colour, and 22% white is a floor: a card has to reach about 7.7:1 before the
|
|
# pill clears 4.5:1. This plugin's #1a7a52 gave 3.50 and now gives 7.15. It
|
|
# could not be fixed by choosing a different card colour — the whole family
|
|
# band fails, including the no-colour fallback.
|
|
# Earlier: 471b0a2a = 1.2.2: the icon box is sized 100%/100% instead of a
|
|
# hardcoded 36x34. WordPress declares that parent three times and they
|
|
# disagree (36x34 open, 35x30 folded, 34x30 under 960px), so a fixed number is
|
|
# right in one state and wrong in the two a laptop is usually in.
|
|
# Withdrawn: 678f1f03 = 1.2.1: the glyph is centred with flex inside an explicit
|
|
# 36x34 box instead of inheriting WordPress's 7px padding, which made the
|
|
# pseudo-element 42px tall inside a 34px parent and pushed the sign above
|
|
# centre. Kristian reported it from the live shop.
|
|
# Earlier: 9012fe98 = contract 1.2.0. The glyph is now emitted as CSS numeric escapes
|
|
# rather than through esc_attr(): HTML entities are not decoded by the CSS
|
|
# parser, so esc_attr was protecting by coincidence — and a backslash, which it
|
|
# leaves alone, IS a CSS escape and swallowed the closing quote. Changing the
|
|
# alphabet beats filtering the input: what is emitted is nothing but
|
|
# backslashes, hex digits and spaces, so there is nothing left to leave the
|
|
# string with. Verified here against seven hostile inputs.
|
|
# Earlier frozen hashes: 184cebdc = 1.1.0, f4862d5c = 1.0.0.
|
|
WPMGR_MENU_SHA=75b04eb4fe9eda0119312075accf2fc77de244e5c6b759d624a8b1d254c0fc99
|
|
|
|
# The name this plugin used before the Nolimit rename. Kept so ci/static.sh
|
|
# can fail when it reappears in text a user reads — a sentence that goes stale
|
|
# breaks nothing by itself, which is why it survives.
|
|
OLD_PLUGIN_NAME="WooCommerce Email Discount Manager"
|
|
|
|
# The fewest assertions a complete run of tests/smoke.php prints. Verified by
|
|
# ci/site-test.sh rather than only inside the file: a smoke file runs in
|
|
# function scope, so a `return` partway through skips its own floor and the
|
|
# run reports green having tested two thirds of what it claims.
|
|
MIN_SITE_ASSERTIONS=60
|
|
HOOK_PREFIX=wc_edm_
|