kristianwindandClaude Opus 5
6114473be0
Kristian reported the infinity sign sitting above centre in the admin menu on the live shop. Security traced it to WordPress's own stylesheet rather than adjusting it by eye: #adminmenu div.wp-menu-image is 36x34 and its :before carries padding 7px 0, which is exactly 7 + 20 + 7 for a 20px dashicon at line-height 1. The 1.2.0 rule set line-height 1.4 and inherited that padding, so the pseudo-element was 42px tall inside a 34px parent. 1.2.1 reproduces the box, drops the padding and centres with flex — geometry rather than a nudge, because U+221E sits on the maths axis instead of filling its em box. It is the same half-done abstraction as the escaping fix: the filter made the character configurable and left the geometry tuned for one specific character. Nothing could fail, because the only value anyone ever passed was the one it was tuned for. Verified before copying, including the part that makes the check meaningful: Security predicted php -w WOULD differ this round, since the executable code changed — so equal stripped hashes would have meant the wrong file. They differ, and the diff is the version constant plus the CSS geometry, with wpmgr_css_escape untouched. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
91 lines
4.8 KiB
Plaintext
91 lines
4.8 KiB
Plaintext
# The only file under ci/ that knows anything about this particular plugin.
|
|
#
|
|
# Everything else in ci/ is plugin-agnostic on purpose: copying ci/, tests/ and
|
|
# the two workflow roots into another plugin and rewriting these six lines is
|
|
# the whole port. docs/REUSE.md walks through it.
|
|
|
|
# Directory name the plugin gets inside wp-content/plugins, and the name of the
|
|
# built zip. WordPress identifies a plugin by "<slug>/<main file>", so changing
|
|
# this after release orphans every installed copy.
|
|
#
|
|
# 🔴 THIS DELIBERATELY DOES NOT MATCH THE REPOSITORY NAME, and it must not be
|
|
# "tidied up" to. The repo is woo-discount-manager; the installed directory has
|
|
# been woocommerce-email-discount-manager since the first release and is on a
|
|
# live shop. Renaming it would not move that installation — it would put a
|
|
# SECOND copy beside it and leave the old one active. The repo name is free to
|
|
# change (Gitea keeps a 301, measured), the installed slug never is.
|
|
PLUGIN_SLUG=woocommerce-email-discount-manager
|
|
|
|
# The file carrying the plugin header. Version: in here is the version.
|
|
PLUGIN_MAIN=woocommerce-email-discount-manager.php
|
|
|
|
# Every __() and esc_html__() call must use this domain or the translation is
|
|
# silently dropped at runtime.
|
|
TEXT_DOMAIN=wc-email-discount
|
|
|
|
# WooCommerce is installed into the test site before the plugin is activated.
|
|
# Set to no for a plugin that does not need it, and the site comes up faster.
|
|
NEEDS_WOOCOMMERCE=yes
|
|
|
|
# Run inside the live test site with `wp eval-file`, in this order. Fixtures
|
|
# create the data; the smoke files assert against it. A non-zero exit or an
|
|
# uncaught error fails the build.
|
|
SITE_TESTS="tests/fixtures.php tests/smoke.php"
|
|
|
|
# Plausibility floors for the hygiene checks. They exist because a check that
|
|
# examined NOTHING prints the same reassuring line as one that examined
|
|
# everything, and only the passing side can tell them apart — a pattern that is
|
|
# too broad fails loudly on first contact with real code, one that finds nothing
|
|
# survives verification forever.
|
|
#
|
|
# Both are deliberately far below the real numbers. They are not assertions
|
|
# about this plugin's size: a tight number goes red on ordinary churn and gets
|
|
# raised until it means nothing. They assert that the scan still finds this
|
|
# plugin at all.
|
|
#
|
|
# Real counts when these were set (2026-09-17): 13 shipped PHP files, 142
|
|
# translation calls across 17 files. Both floors were broken once and watched to
|
|
# fail before being believed.
|
|
MIN_SHIPPED_PHP_FILES=5
|
|
|
|
# Set to 0 for a plugin with no translatable strings: the check then warns
|
|
# instead of failing, so zero is never silent either way.
|
|
MIN_TRANSLATION_CALLS=60
|
|
|
|
# Where releases are published, when that is not the repository running the
|
|
# workflow. The source repo is kw/nolimit-discounts; the plugin's update feed
|
|
# is a separate PUBLIC repo holding built zips only, so a shop can fetch
|
|
# updates without credentials and without the source being readable.
|
|
#
|
|
# 🔴 This and the "Update URI:" header in the plugin file must name the same
|
|
# repository. ci/static.sh fails when they disagree — a feed that moves while
|
|
# the header stands still is how every installed copy silently stops receiving
|
|
# updates, and nothing announces it because latest_release() just returns false.
|
|
#
|
|
# Publishing here needs a token with write access to that OTHER repository. The
|
|
# job token only covers the repo it runs in, so this is a cross-repo PAT and
|
|
# Kristian's to add.
|
|
RELEASE_REPO=kw/nolimit-discounts-dist
|
|
|
|
# The sha256 of includes/shared-menu.php, which is byte-identical in all six
|
|
# plugins. Which copy a site loads is decided by activation order and PHP
|
|
# cannot un-declare a function, so the first one wins for the whole request —
|
|
# a shop with two plugins on one version and three on another gets whichever
|
|
# booted first, while every repository's own check is green on its own side.
|
|
# The frozen hash is therefore a family-wide fact, not a local one, and taking
|
|
# a new one is something all six do in the same window.
|
|
#
|
|
# 678f1f03 = contract 1.2.1: the glyph is centred with flex inside an explicit
|
|
# 36x34 box instead of inheriting WordPress's 7px padding, which made the
|
|
# pseudo-element 42px tall inside a 34px parent and pushed the sign above
|
|
# centre. Kristian reported it from the live shop.
|
|
# Earlier: 9012fe98 = contract 1.2.0. The glyph is now emitted as CSS numeric escapes
|
|
# rather than through esc_attr(): HTML entities are not decoded by the CSS
|
|
# parser, so esc_attr was protecting by coincidence — and a backslash, which it
|
|
# leaves alone, IS a CSS escape and swallowed the closing quote. Changing the
|
|
# alphabet beats filtering the input: what is emitted is nothing but
|
|
# backslashes, hex digits and spaces, so there is nothing left to leave the
|
|
# string with. Verified here against seven hostile inputs.
|
|
# Earlier frozen hashes: 184cebdc = 1.1.0, f4862d5c = 1.0.0.
|
|
WPMGR_MENU_SHA=678f1f0368fcc781ce34c0289f6470a6bb0491bc32c0598e859c7ceba66e5e2a
|