kristianwindandClaude Opus 5
eca2851d35
Three things this repository could not do: prove the plugin still works on a
WordPress or WooCommerce released after it, get a fix onto a shop without
someone uploading a zip, and do either of those for the next plugin without
starting over.
ci/ is the test harness. ci/site-test.sh builds a throwaway WordPress +
WooCommerce in containers at any versions you name — including `nightly` and
`beta` — installs exactly the files the release zip will contain, and runs
tests/smoke.php inside it with wp eval-file. Real cart, real coupons, real
WC_Shipping_Rate objects: a mocked cart keeps passing after WooCommerce has
changed underneath it, which is the one failure worth catching here. WP_DEBUG
is on and any notice logged from this plugin's directory fails the build,
because that is the shape an upgrade actually breaks in — nothing fails, a
notice appears, and two releases later it is a fatal.
compat.yml runs that weekly against today's releases, the next WordPress and
the next WooCommerce, the oldest PHP the header promises and the newest PHP.
When it is green it opens a PR bumping "Tested up to" and "WC tested up to" —
only when green, because WooCommerce shows that second value to the shop owner
as an untested-plugin banner, and that banner is what they read before deciding
whether to press update.
includes/class-updater.php is the distribution half. It hooks
update_plugins_{hostname} for the host in the new "Update URI" header and reads
the Gitea release API, so WordPress handles the notice, the download, the
"Enable auto-updates" link and wp plugin update with no further code. Update
URI earns its place twice: since 5.8 a plugin that declares one is never asked
about on wordpress.org, so a .org plugin sharing this slug cannot be pushed
onto a shop running this one. The check sends nothing about the site and
overrides WordPress's default user agent, which carries the site's own URL.
release.yml tags, tests, builds, publishes — then reads the feed back with no
credentials. A private repository and a release with no zip attached both leave
a page that looks perfect to anyone logged in and an update no shop is ever
offered.
Measured before committing, all green: WP 7.1 + WC 11.1 on PHP 8.3 and 7.4,
WP 7.2-alpha on 8.3, and the beta cell falling back to stable on 8.4. No
deprecations from this plugin on any of them.
Three guards are there because the bug they catch is invisible without them:
the annotated tag is re-fetched before its message is read (checkout turns it
into a lightweight tag pointing at the merge commit), the two workflow roots
are kept in sync (.gitea/workflows hides .github/workflows entirely), and every
file the code loads must be in the release zip — which caught class-updater.php
being referenced and uncommitted while every local test passed.
docs/REUSE.md is the port to the next plugin: copy ci/, rewrite five lines.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
79 lines
2.8 KiB
Bash
Executable File
79 lines
2.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Build the installable plugin zip and check it is actually installable.
|
|
#
|
|
# Writes build/<slug>.zip, containing a single top-level <slug>/ directory —
|
|
# WordPress identifies an installed plugin by that folder name, so a zip that
|
|
# unpacks to anything else installs a second copy alongside the first instead
|
|
# of updating it.
|
|
set -euo pipefail
|
|
|
|
cd "$(dirname "$0")/.."
|
|
. ci/lib.sh
|
|
ci_load_conf
|
|
|
|
version=$(ci_plugin_version)
|
|
[ -n "$version" ] || { echo "Could not read Version: from $PLUGIN_MAIN." >&2; exit 1; }
|
|
|
|
rm -rf build
|
|
mkdir -p "build/$PLUGIN_SLUG"
|
|
|
|
# One list, shared with the hygiene checks and the test site, so a file cannot
|
|
# be excluded from the tests and included in the release.
|
|
./ci/dist-files.sh | while IFS= read -r f; do
|
|
mkdir -p "build/$PLUGIN_SLUG/$(dirname "$f")"
|
|
cp "$f" "build/$PLUGIN_SLUG/$f"
|
|
done
|
|
|
|
# `zip` is on GitHub's runners but not in every Gitea runner image, and a
|
|
# release that fails on the packaging step is the most annoying possible place
|
|
# to discover a missing tool. python3 is present in both.
|
|
(
|
|
cd build
|
|
if command -v zip >/dev/null 2>&1; then
|
|
zip -rq "$PLUGIN_SLUG.zip" "$PLUGIN_SLUG"
|
|
elif command -v python3 >/dev/null 2>&1; then
|
|
python3 -m zipfile -c "$PLUGIN_SLUG.zip" "$PLUGIN_SLUG"
|
|
else
|
|
echo "Neither zip nor python3 is available to build the archive." >&2
|
|
exit 1
|
|
fi
|
|
)
|
|
|
|
# Listing entries by name rather than parsing `unzip -l` output, with the same
|
|
# python3 fallback as above because unzip is not guaranteed on a runner either.
|
|
zip_entries() {
|
|
if command -v unzip >/dev/null 2>&1; then
|
|
unzip -Z1 "build/$PLUGIN_SLUG.zip"
|
|
else
|
|
python3 -c 'import sys,zipfile;print("\n".join(zipfile.ZipFile(sys.argv[1]).namelist()))' \
|
|
"build/$PLUGIN_SLUG.zip"
|
|
fi
|
|
}
|
|
|
|
ci_step "what the zip contains"
|
|
zip_entries | sed 's/^/ /'
|
|
|
|
ci_step "checks"
|
|
zip_entries | grep -qx "$PLUGIN_SLUG/$PLUGIN_MAIN" \
|
|
|| { echo "The main plugin file is not in the zip." >&2; exit 1; }
|
|
echo " the main file is present"
|
|
|
|
# A leaked ci/ or tests/ directory is not merely untidy: everything under
|
|
# wp-content/plugins/ can in principle be fetched over HTTP from a live shop.
|
|
for unwanted in ci tests docs .git .github .gitea; do
|
|
if zip_entries | grep -q "^$PLUGIN_SLUG/$unwanted/"; then
|
|
echo "The zip contains $unwanted/, which must never reach a shop." >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
echo " no tooling, tests or git files leaked in"
|
|
|
|
# Every entry sits under exactly one top-level directory named for the slug.
|
|
strays=$(zip_entries | grep -v "^$PLUGIN_SLUG/" || true)
|
|
[ -z "$strays" ] || { echo "Files outside $PLUGIN_SLUG/ in the zip:" >&2; echo "$strays" >&2; exit 1; }
|
|
echo " everything unpacks into $PLUGIN_SLUG/"
|
|
|
|
size=$(du -h "build/$PLUGIN_SLUG.zip" | cut -f1)
|
|
echo
|
|
echo "build/$PLUGIN_SLUG.zip — version $version, $size"
|