kristianwindandClaude Opus 5
9b0b0ab475
Four checks in ci/ printed a reassuring line having examined nothing. Found independently by the woo-ai-manager and woo-cache-manager sessions in their own copies of this kit; all four reproduce here. A check that examined nothing prints the same sentence as one that examined everything, and only the passing side can tell them apart. That is why these survived being verified: a pattern that is too broad fails loudly the first time it meets real code, while one that finds nothing passes forever. So every success line now carries a count — the old text domain line could not tell 142 from 0. - static.sh, direct-access guard: counts what the loop examined and fails below MIN_SHIPPED_PHP_FILES. shipped_files() swallows a dist-files.sh failure with `|| true`, so an empty list is one broken .distignore away, and this is the check standing between a PHP file and being requested straight from a browser outside every capability check the code assumes has happened. The floor is above 1 because a pattern that wrongly excludes includes/ collapses the list without emptying it. - static.sh, credential scan: counts what it read, fatal on zero. A pushed key is compromised even after the commit is deleted, so a silent no-op here is not a weak check but the absence of one wearing a green tick. The floor is 1 and is not configurable: this list has no filter that could go partially wrong, so the only way it misreports is by coming out empty. - check-textdomain.php: three zeros, three verdicts. No PHP files at all is always fatal and deliberately not caller-configurable — it says the scan root is wrong, not that the plugin is small. Below --min is fatal. Zero calls with no --min is a warning, since a small plugin may legitimately have no translatable strings, but it is never silent. - check-textdomain.php: fix the annotated path. str_replace( $root, '', $path ) with the default root of "." removed every dot anywhere in the path, so a real error in includes/class-db.php was reported on "includes/class-dbphp" — not a file, not clickable, and not greppable. Every error this script printed with the default root was mangled that way. The floors live in ci/plugin.conf, the only file under ci/ that knows anything about this plugin, rather than hardcoded in static.sh: static.sh is copied verbatim between plugins too, so a number in it would make this plugin's shape everybody's constraint. ci_load_conf now requires them — an unset floor turns its comparison into a no-op and silently restores the bug. Each floor was broken once and watched to fail before being believed: empty shipped list, wrong scan root, --min above the real count, zero calls without --min, empty credential list, and a plugin.conf missing both floors. Static checks green, and now report 13 shipped PHP files, 142 translation calls across 17 files, 44 tracked files read. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
54 lines
2.6 KiB
Plaintext
54 lines
2.6 KiB
Plaintext
# The only file under ci/ that knows anything about this particular plugin.
|
|
#
|
|
# Everything else in ci/ is plugin-agnostic on purpose: copying ci/, tests/ and
|
|
# the two workflow roots into another plugin and rewriting these six lines is
|
|
# the whole port. docs/REUSE.md walks through it.
|
|
|
|
# Directory name the plugin gets inside wp-content/plugins, and the name of the
|
|
# built zip. WordPress identifies a plugin by "<slug>/<main file>", so changing
|
|
# this after release orphans every installed copy.
|
|
#
|
|
# 🔴 THIS DELIBERATELY DOES NOT MATCH THE REPOSITORY NAME, and it must not be
|
|
# "tidied up" to. The repo is woo-discount-manager; the installed directory has
|
|
# been woocommerce-email-discount-manager since the first release and is on a
|
|
# live shop. Renaming it would not move that installation — it would put a
|
|
# SECOND copy beside it and leave the old one active. The repo name is free to
|
|
# change (Gitea keeps a 301, measured), the installed slug never is.
|
|
PLUGIN_SLUG=woocommerce-email-discount-manager
|
|
|
|
# The file carrying the plugin header. Version: in here is the version.
|
|
PLUGIN_MAIN=woocommerce-email-discount-manager.php
|
|
|
|
# Every __() and esc_html__() call must use this domain or the translation is
|
|
# silently dropped at runtime.
|
|
TEXT_DOMAIN=wc-email-discount
|
|
|
|
# WooCommerce is installed into the test site before the plugin is activated.
|
|
# Set to no for a plugin that does not need it, and the site comes up faster.
|
|
NEEDS_WOOCOMMERCE=yes
|
|
|
|
# Run inside the live test site with `wp eval-file`, in this order. Fixtures
|
|
# create the data; the smoke files assert against it. A non-zero exit or an
|
|
# uncaught error fails the build.
|
|
SITE_TESTS="tests/fixtures.php tests/smoke.php"
|
|
|
|
# Plausibility floors for the hygiene checks. They exist because a check that
|
|
# examined NOTHING prints the same reassuring line as one that examined
|
|
# everything, and only the passing side can tell them apart — a pattern that is
|
|
# too broad fails loudly on first contact with real code, one that finds nothing
|
|
# survives verification forever.
|
|
#
|
|
# Both are deliberately far below the real numbers. They are not assertions
|
|
# about this plugin's size: a tight number goes red on ordinary churn and gets
|
|
# raised until it means nothing. They assert that the scan still finds this
|
|
# plugin at all.
|
|
#
|
|
# Real counts when these were set (2026-09-17): 13 shipped PHP files, 142
|
|
# translation calls across 17 files. Both floors were broken once and watched to
|
|
# fail before being believed.
|
|
MIN_SHIPPED_PHP_FILES=5
|
|
|
|
# Set to 0 for a plugin with no translatable strings: the check then warns
|
|
# instead of failing, so zero is never silent either way.
|
|
MIN_TRANSLATION_CALLS=60
|