From 76c8fffe08832dd23322c2c19b2914cd4e779da4 Mon Sep 17 00:00:00 2001 From: Aigars Silkalns Date: Fri, 7 Aug 2026 11:55:00 +0300 Subject: [PATCH 1/3] Replace the Grunt toolchain with npm scripts, phpcs and CI Tooling only. No shipped file changes, no version bump, nothing for users. The Grunt setup still worked - it produced a byte-identical package - but it pulled 293 packages and 5 vulnerabilities (2 high: braces and micromatch ReDoS, both via grunt-cli) to do one job, copy files and zip them, while none of the tasks that actually caused friction were covered. before: 8 direct deps -> 293 packages, 5 vulnerabilities after: 2 direct deps -> 34 packages, 0 vulnerabilities What is now automated that was not: npm run build:assets minification, previously ad-hoc `npx terser` invocations npm run verify:assets fails when a .min file is stale npm run i18n .pot / .mo / .l10n.php via wp-cli npm run package the zip, plus version and dev-file checks composer phpcs escaping, sanitisation, nonces, i18n, PHP 7.4-8.5 composer lint php -l over every file Two guards encode mistakes that already happened. verify:assets rebuilds each minified file and byte-compares, because the .min files are what visitors actually get - editing fancybox.css without rebuilding would silently ship the old stylesheet. package refuses to build unless the plugin header, FBFW_VERSION, the readme Stable tag and package.json agree, which is exactly the drift that let package.json sit at 3.3.5 for three releases. .distignore becomes the single source of truth for packaging. bin/package.mjs and the deploy workflow both feed it to `rsync --exclude-from`, so a local build and a published release contain the same files. Gruntfile.js carried a second exclude list that had to be hand-synced, and is removed. .github/workflows/deploy.yml publishes to WordPress.org SVN on a version tag. This is the important one: 3.3.7 shipped to WordPress.org and was never committed here, and 3.4.1 shipped while master still said 3.4.0. Releasing from a tag makes git the source of truth and removes the manual step where both happened. It needs SVN_USERNAME and SVN_PASSWORD repository secrets before it can run. phpcs.xml.dist deliberately runs a subset of the WordPress standard. The full ruleset reports 293 violations on this codebase, every one whitespace, array alignment or a missing docblock, and zero security, i18n or compatibility problems. Enforcing formatting would mean reflowing ~250 lines across a plugin with 30k installs for no functional gain, so the rules kept are the ones that catch real defects - and they pass clean today. The file documents how to adopt full formatting later. Also un-ignores package-lock.json, which .gitignore excluded: CI installs with `npm ci`, which cannot run without it. Verified: a fresh clone running `npm ci && npm run package` produces a zip byte-identical to the published 3.4.1, phpcs reports 0 errors across all 11 PHP files, and both guards exit non-zero when tripped. Co-Authored-By: Claude Opus 5 (1M context) --- .distignore | 20 +- .github/workflows/ci.yml | 87 +++++ .github/workflows/deploy.yml | 71 ++++ .gitignore | 17 +- CLAUDE.md | 28 +- Gruntfile.js | 118 ------- bin/package.mjs | 65 ++++ bin/verify-assets.mjs | 75 ++++ composer.json | 31 ++ composer.lock | 650 +++++++++++++++++++++++++++++++++++ package-lock.json | 493 ++++++++++++++++++++++++++ package.json | 39 ++- phpcs.xml.dist | 68 ++++ 13 files changed, 1621 insertions(+), 141 deletions(-) create mode 100644 .github/workflows/ci.yml create mode 100644 .github/workflows/deploy.yml delete mode 100644 Gruntfile.js create mode 100644 bin/package.mjs create mode 100644 bin/verify-assets.mjs create mode 100644 composer.json create mode 100644 composer.lock create mode 100644 package-lock.json create mode 100644 phpcs.xml.dist diff --git a/.distignore b/.distignore index 8ab76ba..3c8c144 100644 --- a/.distignore +++ b/.distignore @@ -1,16 +1,30 @@ -# Files that must not ship in the WordPress.org package. -# Honoured by `wp dist-archive` and the 10up/action-wordpress-plugin-deploy action. +# The single source of truth for what ships to WordPress.org. +# +# Honoured by `npm run package` (bin/package.mjs) and by the deploy workflow's +# 10up/action-wordpress-plugin-deploy step, so a local build and a published +# release contain exactly the same files. Do not add a second exclude list. .git +.github .gitignore .distignore .DS_Store .sass-cache node_modules +vendor +build -# Development notes, not product documentation. +# Development notes and tooling, not product documentation. CLAUDE.md .claude +bin +package.json +package-lock.json +composer.json +composer.lock +phpcs.xml.dist +phpcs.xml +.editorconfig # Source maps are never shipped. *.map diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..9314f6d --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,87 @@ +name: CI + +on: + push: + branches: [ master ] + pull_request: + workflow_dispatch: + +permissions: + contents: read + +jobs: + php-lint: + name: PHP ${{ matrix.php }} syntax + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + # Floor is the plugin's "Requires PHP"; ceiling is the newest release, which + # is where the PHP 8 breakage fixed in 3.4.0 would have shown up first. + php: [ '7.4', '8.0', '8.2', '8.4', '8.5' ] + steps: + - uses: actions/checkout@v4 + - uses: shivammathur/setup-php@v2 + with: + php-version: ${{ matrix.php }} + coverage: none + - name: Lint every PHP file + run: | + find . -path ./vendor -prune -o -path ./node_modules -prune -o -name '*.php' -print \ + | xargs -n1 -P4 php -l + + phpcs: + name: WordPress coding standards + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: shivammathur/setup-php@v2 + with: + php-version: '8.2' + coverage: none + tools: composer + - run: composer install --prefer-dist --no-progress + - run: composer phpcs + + assets: + name: Minified assets are current + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version: '20' + cache: npm + - run: npm ci + # Catches the case where fancybox.css is edited but the .min is not rebuilt - + # the minified file is what actually ships to visitors. + - run: npm run verify:assets + + package: + name: Package builds cleanly + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version: '20' + # Also asserts the plugin header, FBFW_VERSION, readme Stable tag and + # package.json all agree, and that no dev file leaked into the zip. + - run: npm run package + - uses: actions/upload-artifact@v4 + with: + name: plugin-zip + path: build/*.zip + + plugin-check: + name: WordPress.org Plugin Check + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + path: fancybox-for-wordpress + - uses: wordpress/plugin-check-action@v1 + with: + build-dir: ./fancybox-for-wordpress + # Warnings are informational here; errors fail the run. + ignore-warnings: true diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml new file mode 100644 index 0000000..b3665ac --- /dev/null +++ b/.github/workflows/deploy.yml @@ -0,0 +1,71 @@ +name: Deploy to WordPress.org + +# Pushing a version tag publishes that exact commit to the plugin directory. +# +# This exists because the two repositories have drifted before: 3.3.7 shipped to +# WordPress.org and was never committed here, and 3.4.1 shipped while master still +# said 3.4.0. Releasing from a tag makes git the source of truth and removes the +# manual SVN step where that drift crept in. +# +# Requires two repository secrets: SVN_USERNAME and SVN_PASSWORD (a WordPress.org +# account with commit access to the plugin). + +on: + push: + tags: + - '[0-9]+.[0-9]+.[0-9]+' + workflow_dispatch: + inputs: + dry_run: + description: 'Build and validate without publishing' + type: boolean + default: true + +permissions: + contents: read + +jobs: + verify: + name: Pre-flight + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version: '20' + cache: npm + - run: npm ci + + - name: Minified assets are current + run: npm run verify:assets + + - name: Versions agree and no dev files ship + run: npm run package + + - name: Tag matches the plugin version + if: startsWith(github.ref, 'refs/tags/') + run: | + TAG="${GITHUB_REF#refs/tags/}" + VERSION=$(grep -m1 -oE '^\s*\*\s*Version:\s*[0-9.]+' fancybox.php | grep -oE '[0-9.]+$') + STABLE=$(grep -m1 -oE '^Stable tag:\s*[0-9.]+' readme.txt | grep -oE '[0-9.]+$') + echo "tag=$TAG header=$VERSION stable=$STABLE" + if [ "$TAG" != "$VERSION" ] || [ "$TAG" != "$STABLE" ]; then + echo "::error::Tag $TAG does not match the plugin header ($VERSION) / Stable tag ($STABLE)" + exit 1 + fi + + deploy: + name: Publish + needs: verify + runs-on: ubuntu-latest + if: startsWith(github.ref, 'refs/tags/') && github.event_name == 'push' + environment: wordpress-org + steps: + - uses: actions/checkout@v4 + - name: Deploy to the plugin directory + uses: 10up/action-wordpress-plugin-deploy@stable + env: + SVN_USERNAME: ${{ secrets.SVN_USERNAME }} + SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }} + SLUG: fancybox-for-wordpress + # Honours .distignore, the same list `npm run package` uses. diff --git a/.gitignore b/.gitignore index 23d8494..958beef 100644 --- a/.gitignore +++ b/.gitignore @@ -1,7 +1,16 @@ Thumbs.db -node_modules/* -.idea/* -*.zip .DS_Store -package-lock.json +.idea/* .standard.json + +# Dependencies. The lockfiles are committed on purpose: CI installs with +# `npm ci` and `composer install`, both of which need them to be reproducible. +node_modules/ +vendor/ + +# Build output. +build/ +*.zip + +# Local development notes. +.claude/ diff --git a/CLAUDE.md b/CLAUDE.md index 593ec57..048dc49 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -6,12 +6,32 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co `FancyBox for WordPress` — a WordPress.org plugin (slug `fancybox-for-wordpress`, text domain `mfbfw`) by Colorlib that wires fancyBox 3 into any WordPress site. Requires PHP 7.4+ / WP 5.6+. -There is **no test suite and no linter**, and PHP/CSS/JS are edited directly rather than compiled. There *is* a Grunt build — `Gruntfile.js` + `package.json` — but it lives only in the [GitHub repo](https://github.com/ColorlibHQ/fancybox-for-wordpress) and is excluded from the distributed package, so it is absent from a working copy unzipped from WordPress.org. It provides: +PHP/CSS/JS are edited directly rather than compiled, and there is no test suite. The tooling lives only in the [GitHub repo](https://github.com/ColorlibHQ/fancybox-for-wordpress) and is excluded from the distributed package, so it is absent from a working copy unzipped from WordPress.org. -- `grunt i18n` — `checktextdomain` (already configured to expect `fancybox-for-wordpress`) plus `makepot` -- `grunt build-archive` — copies to `build/`, minus dev files, and zips it +```bash +npm install && composer install + +npm run build:assets # regenerate the .min files (REQUIRED after editing a source asset) +npm run verify:assets # fail if a .min file is stale — this is what CI enforces +npm run i18n # regenerate .pot, .mo and .l10n.php (needs wp-cli on PATH) +npm run package # build build/fancybox-for-wordpress-.zip +npm run release:check # verify:assets + composer lint + package +composer phpcs # escaping, sanitisation, nonces, i18n, PHP 7.4–8.5 compatibility +composer lint # php -l across every file +``` + +`.distignore` is the **single source of truth** for what ships. `bin/package.mjs` and the deploy workflow both feed it to `rsync --exclude-from`, so a local build and a published release contain the same files. Do not introduce a second exclude list — the old `Gruntfile.js` had one and it had to be hand-synced. + +Two guards worth knowing about, because both encode mistakes that actually happened: + +- **`verify:assets`** rebuilds each `.min` file into a temp location and byte-compares. The minified assets are what visitors get (`mfbfw_asset_suffix()` only serves sources under `SCRIPT_DEBUG`), so editing `fancybox.css` without rebuilding silently ships the old stylesheet. +- **`package`** refuses to build unless the plugin header, `FBFW_VERSION`, the readme `Stable tag` and `package.json` all agree, and fails if a dev file lands in the zip. + +### Releasing + +Push a version tag and `.github/workflows/deploy.yml` publishes that commit to WordPress.org SVN. It needs the `SVN_USERNAME` / `SVN_PASSWORD` repository secrets. **Do not release by hand** — 3.3.7 shipped to WordPress.org and was never committed to git, and 3.4.1 shipped while `master` still said 3.4.0. Releasing from a tag makes git the source of truth and removes the step where that drift occurred. -Its `copy.build` exclude list is the authority on what ships when releasing from GitHub; `.distignore` covers the same ground for `wp dist-archive` and the wp.org deploy action. **Keep the two in sync** — a file excluded from one but not the other will leak into some builds and not others. +`phpcs.xml.dist` deliberately runs a **subset** of the WordPress standard. The full `WordPress` ruleset reports 293 violations here, all of them whitespace, array alignment or missing docblocks, and zero security/i18n/compatibility problems. The rules kept are the ones that catch real defects; see the file's own `` for how to adopt full formatting later. ## Development workflow diff --git a/Gruntfile.js b/Gruntfile.js deleted file mode 100644 index 884b49c..0000000 --- a/Gruntfile.js +++ /dev/null @@ -1,118 +0,0 @@ -module.exports = function(grunt) { - // load all tasks - require('load-grunt-tasks')(grunt, {scope: 'devDependencies'}); - - grunt.initConfig({ - pkg: grunt.file.readJSON('package.json'), - checktextdomain: { - standard: { - options:{ - text_domain: [ 'fancybox-for-wordpress' ], //Specify allowed domain(s) - create_report_file: "true", - keywords: [ //List keyword specifications - '__:1,2d', - '_e:1,2d', - '_x:1,2c,3d', - 'esc_html__:1,2d', - 'esc_html_e:1,2d', - 'esc_html_x:1,2c,3d', - 'esc_attr__:1,2d', - 'esc_attr_e:1,2d', - 'esc_attr_x:1,2c,3d', - '_ex:1,2c,3d', - '_n:1,2,4d', - '_nx:1,2,4c,5d', - '_n_noop:1,2,3d', - '_nx_noop:1,2,3c,4d' - ] - }, - files: [{ - src: [ - '**/*.php', - '!**/node_modules/**', - ], //all php - expand: true, - }], - } - }, - makepot: { - target: { - options: { - cwd: '', // Directory of files to internationalize. - domainPath: 'languages/', // Where to save the POT file. - exclude: [], // List of files or directories to ignore. - include: [], // List of files or directories to include. - mainFile: 'fancybox.php', // Main project file. - potComments: '', // The copyright at the beginning of the POT file. - potFilename: 'fancybox-for-wordpress.po', // Name of the POT file. - potHeaders: { - poedit: true, // Includes common Poedit headers. - 'x-poedit-keywordslist': true // Include a list of all possible gettext functions. - }, // Headers to add to the generated POT file. - processPot: null, // A callback function for manipulating the POT file. - type: 'wp-plugin', // Type of project (wp-plugin or wp-theme). - updateTimestamp: true, // Whether the POT-Creation-Date should be updated without other changes. - updatePoFiles: false // Whether to update PO files in the same directory as the POT file. - } - } - }, - clean: { - init: { - src: ['build/'] - }, - build: { - src: [ - 'build/*', - '!build/<%= pkg.name %>.zip' - ] - } - }, - copy: { - build: { - expand: true, - src: [ - '**', - '!node_modules/**', - '!vendor/**', - '!build/**', - '!readme.md', - '!README.md', - '!phpcs.ruleset.xml', - '!Gruntfile.js', - '!package.json', - '!package-lock.json', - '!composer.json', - '!composer.lock', - '!set_tags.sh', - '!fancybox-for-wordpress.zip', - '!nbproject/**', - '!CLAUDE.md', - '!.distignore', - '!.claude/**' ], - dest: 'build/' - } - }, - compress: { - build: { - options: { - pretty: true, // Pretty print file sizes when logging. - archive: '<%= pkg.name %>-<%= pkg.version %>.zip' - }, - expand: true, - cwd: 'build/', - src: ['**/*'], - dest: '<%= pkg.name %>/' - } - }, - }); - - grunt.registerTask( 'i18n', ['checktextdomain', 'makepot']); - // Build task - grunt.registerTask( 'build-archive', [ - // 'i18n', - 'clean:init', - 'copy', - 'compress:build', - 'clean:init' - ]); -}; \ No newline at end of file diff --git a/bin/package.mjs b/bin/package.mjs new file mode 100644 index 0000000..0b84d64 --- /dev/null +++ b/bin/package.mjs @@ -0,0 +1,65 @@ +#!/usr/bin/env node +/** + * Builds the distributable zip. + * + * Uses `rsync --exclude-from=.distignore`, which is exactly what the WordPress.org + * deploy action does, so what you test locally is what gets published. .distignore + * is the single source of truth for packaging — there is deliberately no second + * exclude list to keep in sync. + */ +import { execFileSync } from 'node:child_process'; +import { existsSync, mkdirSync, readFileSync, rmSync, statSync } from 'node:fs'; +import { join } from 'node:path'; + +const pkg = JSON.parse( readFileSync( 'package.json', 'utf8' ) ); +const slug = 'fancybox-for-wordpress'; +const mainFile = 'fancybox.php'; + +// The plugin header is authoritative; these four drifting apart is a long-standing +// failure mode here, so treat a mismatch as an error rather than shipping it. +const header = readFileSync( mainFile, 'utf8' ); +const headerVersion = header.match( /^\s*\*\s*Version:\s*(.+)$/m )?.[ 1 ].trim(); +const constVersion = header.match( /FBFW_VERSION',\s*'([^']+)'/ )?.[ 1 ]; +const readme = readFileSync( 'readme.txt', 'utf8' ); +const stableTag = readme.match( /^Stable tag:\s*(.+)$/m )?.[ 1 ].trim(); + +const versions = { 'plugin header': headerVersion, FBFW_VERSION: constVersion, 'readme Stable tag': stableTag, 'package.json': pkg.version }; +const unique = [ ...new Set( Object.values( versions ) ) ]; +if ( unique.length !== 1 ) { + console.error( 'Version mismatch:' ); + for ( const [ k, v ] of Object.entries( versions ) ) { + console.error( ` ${ k.padEnd( 20 ) } ${ v }` ); + } + process.exit( 1 ); +} +const version = unique[ 0 ]; + +const buildDir = 'build'; +const stage = join( buildDir, slug ); +rmSync( buildDir, { recursive: true, force: true } ); +mkdirSync( stage, { recursive: true } ); + +if ( ! existsSync( '.distignore' ) ) { + console.error( '.distignore is missing; refusing to guess what should ship.' ); + process.exit( 1 ); +} + +execFileSync( 'rsync', [ '-a', '--exclude-from=.distignore', '--exclude=build', './', `${ stage }/` ], { stdio: 'inherit' } ); + +const zipName = `${ slug }-${ version }.zip`; +rmSync( join( buildDir, zipName ), { force: true } ); +execFileSync( 'zip', [ '-qr', zipName, slug ], { cwd: buildDir, stdio: 'inherit' } ); + +const bytes = statSync( join( buildDir, zipName ) ).size; +const files = execFileSync( 'find', [ stage, '-type', 'f' ] ).toString().trim().split( '\n' ).length; + +console.log( `\n ${ join( buildDir, zipName ) }` ); +console.log( ` version ${ version } · ${ files } files · ${ ( bytes / 1024 ).toFixed( 0 ) } KB` ); + +// A dev file in the package is the mistake worth catching automatically. +const leaked = execFileSync( 'find', [ stage, '-name', 'CLAUDE.md', '-o', '-name', '.distignore', '-o', '-name', 'Gruntfile.js', '-o', '-name', 'package.json', '-o', '-name', 'composer.json', '-o', '-name', 'node_modules' ] ).toString().trim(); +if ( leaked ) { + console.error( `\nDevelopment files leaked into the package:\n${ leaked }` ); + process.exit( 1 ); +} +console.log( ' no development files in the package' ); diff --git a/bin/verify-assets.mjs b/bin/verify-assets.mjs new file mode 100644 index 0000000..ba23021 --- /dev/null +++ b/bin/verify-assets.mjs @@ -0,0 +1,75 @@ +#!/usr/bin/env node +/** + * Fails if a committed *.min.* file is out of date with its source. + * + * The minified assets are what actually ship (mfbfw_asset_suffix() only serves the + * readable sources under SCRIPT_DEBUG), so an edit to fancybox.css that forgets the + * rebuild silently ships the old stylesheet to every visitor. This rebuilds each + * pair into a temp file and byte-compares. + */ +import { execFileSync } from 'node:child_process'; +import { mkdtempSync, readFileSync, rmSync } from 'node:fs'; +import { tmpdir } from 'node:os'; +import { join } from 'node:path'; + +const PAIRS = [ + { + source: 'assets/js/jquery.fancybox.js', + minified: 'assets/js/jquery.fancybox.min.js', + build: (src, out) => [ + 'terser', + [ src, '--compress', '--mangle', '--comments', '/^!|licen[cs]e|fancyBox v/i', '-o', out ], + ], + }, + { + source: 'assets/css/fancybox.css', + minified: 'assets/css/fancybox.min.css', + build: ( src, out ) => [ 'cleancss', [ '-O2', '-o', out, src ] ], + }, +]; + +const tmp = mkdtempSync( join( tmpdir(), 'fbfw-assets-' ) ); +let failed = 0; + +try { + for ( const pair of PAIRS ) { + const out = join( tmp, pair.minified.replace( /\//g, '_' ) ); + const [ cmd, args ] = pair.build( pair.source, out ); + + try { + execFileSync( join( 'node_modules', '.bin', cmd ), args, { stdio: 'pipe' } ); + } catch ( e ) { + console.error( ` ERROR ${ pair.minified } — could not run ${ cmd }. Did you run \`npm install\`?` ); + failed++; + continue; + } + + const fresh = readFileSync( out ); + let committed; + try { + committed = readFileSync( pair.minified ); + } catch { + console.error( ` STALE ${ pair.minified } is missing — run \`npm run build:assets\`` ); + failed++; + continue; + } + + if ( fresh.equals( committed ) ) { + console.log( ` ok ${ pair.minified } (${ committed.length } bytes) matches ${ pair.source }` ); + } else { + console.error( + ` STALE ${ pair.minified } does not match ${ pair.source } ` + + `(committed ${ committed.length } bytes, rebuild ${ fresh.length }) — run \`npm run build:assets\`` + ); + failed++; + } + } +} finally { + rmSync( tmp, { recursive: true, force: true } ); +} + +if ( failed ) { + console.error( `\n${ failed } asset(s) out of date.` ); + process.exit( 1 ); +} +console.log( '\nAll minified assets are current.' ); diff --git a/composer.json b/composer.json new file mode 100644 index 0000000..8e3b905 --- /dev/null +++ b/composer.json @@ -0,0 +1,31 @@ +{ + "name": "colorlibhq/fancybox-for-wordpress", + "description": "Integrates FancyBox 3 into WordPress.", + "type": "wordpress-plugin", + "license": "GPL-3.0-or-later", + "homepage": "https://wordpress.org/plugins/fancybox-for-wordpress/", + "require": { + "php": ">=7.4" + }, + "require-dev": { + "squizlabs/php_codesniffer": "^3.10", + "wp-coding-standards/wpcs": "^3.1", + "phpcompatibility/phpcompatibility-wp": "^2.1", + "dealerdirect/phpcodesniffer-composer-installer": "^1.0" + }, + "config": { + "allow-plugins": { + "dealerdirect/phpcodesniffer-composer-installer": true + } + }, + "scripts": { + "lint": "find . -path ./vendor -prune -o -path ./node_modules -prune -o -path ./build -prune -o -name '*.php' -print0 | xargs -0 -n1 -P4 php -l", + "phpcs": "phpcs", + "phpcbf": "phpcbf" + }, + "scripts-descriptions": { + "lint": "Check every PHP file for syntax errors.", + "phpcs": "Check coding standards, escaping, sanitisation and PHP cross-version compatibility.", + "phpcbf": "Auto-fix what phpcs can fix." + } +} diff --git a/composer.lock b/composer.lock new file mode 100644 index 0000000..bc0b661 --- /dev/null +++ b/composer.lock @@ -0,0 +1,650 @@ +{ + "_readme": [ + "This file locks the dependencies of your project to a known state", + "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", + "This file is @generated automatically" + ], + "content-hash": "e0ceeab637b2d3e47300baa90f3a2031", + "packages": [], + "packages-dev": [ + { + "name": "dealerdirect/phpcodesniffer-composer-installer", + "version": "v1.2.1", + "source": { + "type": "git", + "url": "https://github.com/PHPCSStandards/composer-installer.git", + "reference": "963f0c67bffde0eac41b56be71ac0e8ba132f0bd" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/PHPCSStandards/composer-installer/zipball/963f0c67bffde0eac41b56be71ac0e8ba132f0bd", + "reference": "963f0c67bffde0eac41b56be71ac0e8ba132f0bd", + "shasum": "" + }, + "require": { + "composer-plugin-api": "^2.2", + "php": ">=5.4", + "squizlabs/php_codesniffer": "^3.1.0 || ^4.0" + }, + "require-dev": { + "composer/composer": "^2.2", + "ext-json": "*", + "ext-zip": "*", + "php-parallel-lint/php-parallel-lint": "^1.4.0", + "phpcompatibility/php-compatibility": "^9.0 || ^10.0.0@dev", + "yoast/phpunit-polyfills": "^1.0" + }, + "type": "composer-plugin", + "extra": { + "class": "PHPCSStandards\\Composer\\Plugin\\Installers\\PHPCodeSniffer\\Plugin" + }, + "autoload": { + "psr-4": { + "PHPCSStandards\\Composer\\Plugin\\Installers\\PHPCodeSniffer\\": "src/" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Franck Nijhof", + "email": "opensource@frenck.dev", + "homepage": "https://frenck.dev", + "role": "Open source developer" + }, + { + "name": "Contributors", + "homepage": "https://github.com/PHPCSStandards/composer-installer/graphs/contributors" + } + ], + "description": "PHP_CodeSniffer Standards Composer Installer Plugin", + "keywords": [ + "PHPCodeSniffer", + "PHP_CodeSniffer", + "code quality", + "codesniffer", + "composer", + "installer", + "phpcbf", + "phpcs", + "plugin", + "qa", + "quality", + "standard", + "standards", + "style guide", + "stylecheck", + "tests" + ], + "support": { + "issues": "https://github.com/PHPCSStandards/composer-installer/issues", + "security": "https://github.com/PHPCSStandards/composer-installer/security/policy", + "source": "https://github.com/PHPCSStandards/composer-installer" + }, + "funding": [ + { + "url": "https://github.com/PHPCSStandards", + "type": "github" + }, + { + "url": "https://github.com/jrfnl", + "type": "github" + }, + { + "url": "https://opencollective.com/php_codesniffer", + "type": "open_collective" + }, + { + "url": "https://thanks.dev/u/gh/phpcsstandards", + "type": "thanks_dev" + } + ], + "time": "2026-05-06T08:26:05+00:00" + }, + { + "name": "phpcompatibility/php-compatibility", + "version": "9.3.5", + "source": { + "type": "git", + "url": "https://github.com/PHPCompatibility/PHPCompatibility.git", + "reference": "9fb324479acf6f39452e0655d2429cc0d3914243" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/PHPCompatibility/PHPCompatibility/zipball/9fb324479acf6f39452e0655d2429cc0d3914243", + "reference": "9fb324479acf6f39452e0655d2429cc0d3914243", + "shasum": "" + }, + "require": { + "php": ">=5.3", + "squizlabs/php_codesniffer": "^2.3 || ^3.0.2" + }, + "conflict": { + "squizlabs/php_codesniffer": "2.6.2" + }, + "require-dev": { + "phpunit/phpunit": "~4.5 || ^5.0 || ^6.0 || ^7.0" + }, + "suggest": { + "dealerdirect/phpcodesniffer-composer-installer": "^0.5 || This Composer plugin will sort out the PHPCS 'installed_paths' automatically.", + "roave/security-advisories": "dev-master || Helps prevent installing dependencies with known security issues." + }, + "type": "phpcodesniffer-standard", + "notification-url": "https://packagist.org/downloads/", + "license": [ + "LGPL-3.0-or-later" + ], + "authors": [ + { + "name": "Wim Godden", + "homepage": "https://github.com/wimg", + "role": "lead" + }, + { + "name": "Juliette Reinders Folmer", + "homepage": "https://github.com/jrfnl", + "role": "lead" + }, + { + "name": "Contributors", + "homepage": "https://github.com/PHPCompatibility/PHPCompatibility/graphs/contributors" + } + ], + "description": "A set of sniffs for PHP_CodeSniffer that checks for PHP cross-version compatibility.", + "homepage": "http://techblog.wimgodden.be/tag/codesniffer/", + "keywords": [ + "compatibility", + "phpcs", + "standards" + ], + "support": { + "issues": "https://github.com/PHPCompatibility/PHPCompatibility/issues", + "source": "https://github.com/PHPCompatibility/PHPCompatibility" + }, + "time": "2019-12-27T09:44:58+00:00" + }, + { + "name": "phpcompatibility/phpcompatibility-paragonie", + "version": "1.3.4", + "source": { + "type": "git", + "url": "https://github.com/PHPCompatibility/PHPCompatibilityParagonie.git", + "reference": "244d7b04fc4bc2117c15f5abe23eb933b5f02bbf" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/PHPCompatibility/PHPCompatibilityParagonie/zipball/244d7b04fc4bc2117c15f5abe23eb933b5f02bbf", + "reference": "244d7b04fc4bc2117c15f5abe23eb933b5f02bbf", + "shasum": "" + }, + "require": { + "phpcompatibility/php-compatibility": "^9.0" + }, + "require-dev": { + "dealerdirect/phpcodesniffer-composer-installer": "^1.0", + "paragonie/random_compat": "dev-master", + "paragonie/sodium_compat": "dev-master" + }, + "suggest": { + "dealerdirect/phpcodesniffer-composer-installer": "^1.0 || This Composer plugin will sort out the PHP_CodeSniffer 'installed_paths' automatically.", + "roave/security-advisories": "dev-master || Helps prevent installing dependencies with known security issues." + }, + "type": "phpcodesniffer-standard", + "notification-url": "https://packagist.org/downloads/", + "license": [ + "LGPL-3.0-or-later" + ], + "authors": [ + { + "name": "Wim Godden", + "role": "lead" + }, + { + "name": "Juliette Reinders Folmer", + "role": "lead" + } + ], + "description": "A set of rulesets for PHP_CodeSniffer to check for PHP cross-version compatibility issues in projects, while accounting for polyfills provided by the Paragonie polyfill libraries.", + "homepage": "http://phpcompatibility.com/", + "keywords": [ + "compatibility", + "paragonie", + "phpcs", + "polyfill", + "standards", + "static analysis" + ], + "support": { + "issues": "https://github.com/PHPCompatibility/PHPCompatibilityParagonie/issues", + "security": "https://github.com/PHPCompatibility/PHPCompatibilityParagonie/security/policy", + "source": "https://github.com/PHPCompatibility/PHPCompatibilityParagonie" + }, + "funding": [ + { + "url": "https://github.com/PHPCompatibility", + "type": "github" + }, + { + "url": "https://github.com/jrfnl", + "type": "github" + }, + { + "url": "https://opencollective.com/php_codesniffer", + "type": "open_collective" + }, + { + "url": "https://thanks.dev/u/gh/phpcompatibility", + "type": "thanks_dev" + } + ], + "time": "2025-09-19T17:43:28+00:00" + }, + { + "name": "phpcompatibility/phpcompatibility-wp", + "version": "2.1.8", + "source": { + "type": "git", + "url": "https://github.com/PHPCompatibility/PHPCompatibilityWP.git", + "reference": "7c8d18b4d90dac9e86b0869a608fa09158e168fa" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/PHPCompatibility/PHPCompatibilityWP/zipball/7c8d18b4d90dac9e86b0869a608fa09158e168fa", + "reference": "7c8d18b4d90dac9e86b0869a608fa09158e168fa", + "shasum": "" + }, + "require": { + "phpcompatibility/php-compatibility": "^9.0", + "phpcompatibility/phpcompatibility-paragonie": "^1.0", + "squizlabs/php_codesniffer": "^3.3" + }, + "require-dev": { + "dealerdirect/phpcodesniffer-composer-installer": "^1.0" + }, + "suggest": { + "dealerdirect/phpcodesniffer-composer-installer": "^1.0 || This Composer plugin will sort out the PHP_CodeSniffer 'installed_paths' automatically.", + "roave/security-advisories": "dev-master || Helps prevent installing dependencies with known security issues." + }, + "type": "phpcodesniffer-standard", + "notification-url": "https://packagist.org/downloads/", + "license": [ + "LGPL-3.0-or-later" + ], + "authors": [ + { + "name": "Wim Godden", + "role": "lead" + }, + { + "name": "Juliette Reinders Folmer", + "role": "lead" + } + ], + "description": "A ruleset for PHP_CodeSniffer to check for PHP cross-version compatibility issues in projects, while accounting for polyfills provided by WordPress.", + "homepage": "http://phpcompatibility.com/", + "keywords": [ + "compatibility", + "phpcs", + "standards", + "static analysis", + "wordpress" + ], + "support": { + "issues": "https://github.com/PHPCompatibility/PHPCompatibilityWP/issues", + "security": "https://github.com/PHPCompatibility/PHPCompatibilityWP/security/policy", + "source": "https://github.com/PHPCompatibility/PHPCompatibilityWP" + }, + "funding": [ + { + "url": "https://github.com/PHPCompatibility", + "type": "github" + }, + { + "url": "https://github.com/jrfnl", + "type": "github" + }, + { + "url": "https://opencollective.com/php_codesniffer", + "type": "open_collective" + }, + { + "url": "https://thanks.dev/u/gh/phpcompatibility", + "type": "thanks_dev" + } + ], + "time": "2025-10-18T00:05:59+00:00" + }, + { + "name": "phpcsstandards/phpcsextra", + "version": "1.5.1", + "source": { + "type": "git", + "url": "https://github.com/PHPCSStandards/PHPCSExtra.git", + "reference": "39467533fdb742446d68c1d10ac33d625ee0311c" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/PHPCSStandards/PHPCSExtra/zipball/39467533fdb742446d68c1d10ac33d625ee0311c", + "reference": "39467533fdb742446d68c1d10ac33d625ee0311c", + "shasum": "" + }, + "require": { + "php": ">=5.4", + "phpcsstandards/phpcsutils": "^1.2.3", + "squizlabs/php_codesniffer": "^3.13.5 || ^4.0.1" + }, + "require-dev": { + "php-parallel-lint/php-console-highlighter": "^1.0", + "php-parallel-lint/php-parallel-lint": "^1.4.0", + "phpcsstandards/phpcsdevcs": "^1.2.0", + "phpcsstandards/phpcsdevtools": "^1.2.1", + "phpunit/phpunit": "^4.5 || ^5.0 || ^6.0 || ^7.0 || ^8.0 || ^9.3.4" + }, + "type": "phpcodesniffer-standard", + "extra": { + "branch-alias": { + "dev-stable": "1.x-dev", + "dev-develop": "1.x-dev" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "LGPL-3.0-or-later" + ], + "authors": [ + { + "name": "Juliette Reinders Folmer", + "homepage": "https://github.com/jrfnl", + "role": "lead" + }, + { + "name": "Contributors", + "homepage": "https://github.com/PHPCSStandards/PHPCSExtra/graphs/contributors" + } + ], + "description": "A collection of sniffs and standards for use with PHP_CodeSniffer.", + "keywords": [ + "PHP_CodeSniffer", + "phpcbf", + "phpcodesniffer-standard", + "phpcs", + "standards", + "static analysis" + ], + "support": { + "issues": "https://github.com/PHPCSStandards/PHPCSExtra/issues", + "security": "https://github.com/PHPCSStandards/PHPCSExtra/security/policy", + "source": "https://github.com/PHPCSStandards/PHPCSExtra" + }, + "funding": [ + { + "url": "https://github.com/PHPCSStandards", + "type": "github" + }, + { + "url": "https://github.com/jrfnl", + "type": "github" + }, + { + "url": "https://opencollective.com/php_codesniffer", + "type": "open_collective" + }, + { + "url": "https://thanks.dev/u/gh/phpcsstandards", + "type": "thanks_dev" + } + ], + "time": "2026-07-27T11:13:17+00:00" + }, + { + "name": "phpcsstandards/phpcsutils", + "version": "1.2.3", + "source": { + "type": "git", + "url": "https://github.com/PHPCSStandards/PHPCSUtils.git", + "reference": "5f35d9408c54d7b529501f3c688b6eae562aea1f" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/PHPCSStandards/PHPCSUtils/zipball/5f35d9408c54d7b529501f3c688b6eae562aea1f", + "reference": "5f35d9408c54d7b529501f3c688b6eae562aea1f", + "shasum": "" + }, + "require": { + "dealerdirect/phpcodesniffer-composer-installer": "^0.4.1 || ^0.5 || ^0.6.2 || ^0.7 || ^1.0", + "php": ">=5.4", + "squizlabs/php_codesniffer": "^3.13.5 || ^4.0.1" + }, + "require-dev": { + "ext-filter": "*", + "php-parallel-lint/php-console-highlighter": "^1.0", + "php-parallel-lint/php-parallel-lint": "^1.4.0", + "phpcsstandards/phpcsdevcs": "^1.2.0", + "yoast/phpunit-polyfills": "^1.1.0 || ^2.0.0 || ^3.0.0" + }, + "type": "phpcodesniffer-standard", + "extra": { + "branch-alias": { + "dev-stable": "1.x-dev", + "dev-develop": "1.x-dev" + } + }, + "autoload": { + "classmap": [ + "PHPCSUtils/" + ] + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "LGPL-3.0-or-later" + ], + "authors": [ + { + "name": "Juliette Reinders Folmer", + "homepage": "https://github.com/jrfnl", + "role": "lead" + }, + { + "name": "Contributors", + "homepage": "https://github.com/PHPCSStandards/PHPCSUtils/graphs/contributors" + } + ], + "description": "A suite of utility functions for use with PHP_CodeSniffer", + "homepage": "https://phpcsutils.com/", + "keywords": [ + "PHP_CodeSniffer", + "phpcbf", + "phpcodesniffer-standard", + "phpcs", + "phpcs3", + "phpcs4", + "standards", + "static analysis", + "tokens", + "utility" + ], + "support": { + "docs": "https://phpcsutils.com/", + "issues": "https://github.com/PHPCSStandards/PHPCSUtils/issues", + "security": "https://github.com/PHPCSStandards/PHPCSUtils/security/policy", + "source": "https://github.com/PHPCSStandards/PHPCSUtils" + }, + "funding": [ + { + "url": "https://github.com/PHPCSStandards", + "type": "github" + }, + { + "url": "https://github.com/jrfnl", + "type": "github" + }, + { + "url": "https://opencollective.com/php_codesniffer", + "type": "open_collective" + }, + { + "url": "https://thanks.dev/u/gh/phpcsstandards", + "type": "thanks_dev" + } + ], + "time": "2026-07-27T10:28:41+00:00" + }, + { + "name": "squizlabs/php_codesniffer", + "version": "3.13.6", + "source": { + "type": "git", + "url": "https://github.com/PHPCSStandards/PHP_CodeSniffer.git", + "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/4c378e1a528ea066890fc2397cbdd2f94eb2fc91", + "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91", + "shasum": "" + }, + "require": { + "ext-simplexml": "*", + "ext-tokenizer": "*", + "ext-xmlwriter": "*", + "php": ">=5.4.0" + }, + "require-dev": { + "phpunit/phpunit": "^4.0 || ^5.0 || ^6.0 || ^7.0 || ^8.0 || ^9.3.4" + }, + "bin": [ + "bin/phpcbf", + "bin/phpcs" + ], + "type": "library", + "notification-url": "https://packagist.org/downloads/", + "license": [ + "BSD-3-Clause" + ], + "authors": [ + { + "name": "Greg Sherwood", + "role": "Former lead" + }, + { + "name": "Juliette Reinders Folmer", + "role": "Current lead" + }, + { + "name": "Contributors", + "homepage": "https://github.com/PHPCSStandards/PHP_CodeSniffer/graphs/contributors" + } + ], + "description": "PHP_CodeSniffer tokenizes PHP, JavaScript and CSS files and detects violations of a defined set of coding standards.", + "homepage": "https://github.com/PHPCSStandards/PHP_CodeSniffer", + "keywords": [ + "phpcs", + "standards", + "static analysis" + ], + "support": { + "issues": "https://github.com/PHPCSStandards/PHP_CodeSniffer/issues", + "security": "https://github.com/PHPCSStandards/PHP_CodeSniffer/security/policy", + "source": "https://github.com/PHPCSStandards/PHP_CodeSniffer", + "wiki": "https://github.com/PHPCSStandards/PHP_CodeSniffer/wiki" + }, + "funding": [ + { + "url": "https://github.com/PHPCSStandards", + "type": "github" + }, + { + "url": "https://github.com/jrfnl", + "type": "github" + }, + { + "url": "https://opencollective.com/php_codesniffer", + "type": "open_collective" + }, + { + "url": "https://thanks.dev/u/gh/phpcsstandards", + "type": "thanks_dev" + } + ], + "time": "2026-08-06T00:17:32+00:00" + }, + { + "name": "wp-coding-standards/wpcs", + "version": "3.4.1", + "source": { + "type": "git", + "url": "https://github.com/WordPress/WordPress-Coding-Standards.git", + "reference": "ec2ff942335f33683a5957a85d138753876a05cf" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/WordPress/WordPress-Coding-Standards/zipball/ec2ff942335f33683a5957a85d138753876a05cf", + "reference": "ec2ff942335f33683a5957a85d138753876a05cf", + "shasum": "" + }, + "require": { + "ext-filter": "*", + "ext-libxml": "*", + "ext-tokenizer": "*", + "ext-xmlreader": "*", + "php": ">=7.2", + "phpcsstandards/phpcsextra": "^1.5.1", + "phpcsstandards/phpcsutils": "^1.2.3", + "squizlabs/php_codesniffer": "^3.13.5" + }, + "require-dev": { + "php-parallel-lint/php-console-highlighter": "^1.0.0", + "php-parallel-lint/php-parallel-lint": "^1.4.0", + "phpcompatibility/php-compatibility": "^10.0.0@dev", + "phpcsstandards/phpcsdevtools": "^1.2.0", + "phpunit/phpunit": "^8.0 || ^9.0" + }, + "suggest": { + "ext-iconv": "For improved results", + "ext-mbstring": "For improved results" + }, + "type": "phpcodesniffer-standard", + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Contributors", + "homepage": "https://github.com/WordPress/WordPress-Coding-Standards/graphs/contributors" + } + ], + "description": "PHP_CodeSniffer rules (sniffs) to enforce WordPress coding conventions", + "keywords": [ + "phpcs", + "standards", + "static analysis", + "wordpress" + ], + "support": { + "issues": "https://github.com/WordPress/WordPress-Coding-Standards/issues", + "source": "https://github.com/WordPress/WordPress-Coding-Standards", + "wiki": "https://github.com/WordPress/WordPress-Coding-Standards/wiki" + }, + "funding": [ + { + "url": "https://opencollective.com/php_codesniffer", + "type": "custom" + } + ], + "time": "2026-07-27T11:53:23+00:00" + } + ], + "aliases": [], + "minimum-stability": "stable", + "stability-flags": {}, + "prefer-stable": false, + "prefer-lowest": false, + "platform": { + "php": ">=7.4" + }, + "platform-dev": {}, + "plugin-api-version": "2.9.0" +} diff --git a/package-lock.json b/package-lock.json new file mode 100644 index 0000000..9b9821a --- /dev/null +++ b/package-lock.json @@ -0,0 +1,493 @@ +{ + "name": "fancybox-for-wordpress", + "version": "3.4.1", + "lockfileVersion": 3, + "requires": true, + "packages": { + "": { + "name": "fancybox-for-wordpress", + "version": "3.4.1", + "license": "GPL-3.0-or-later", + "devDependencies": { + "clean-css-cli": "^5.6.3", + "terser": "^5.44.0" + }, + "engines": { + "node": ">=18" + } + }, + "node_modules/@jridgewell/gen-mapping": { + "version": "0.3.13", + "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz", + "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==", + "dev": true, + "license": "MIT", + "dependencies": { + "@jridgewell/sourcemap-codec": "^1.5.0", + "@jridgewell/trace-mapping": "^0.3.24" + } + }, + "node_modules/@jridgewell/resolve-uri": { + "version": "3.1.2", + "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz", + "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=6.0.0" + } + }, + "node_modules/@jridgewell/source-map": { + "version": "0.3.11", + "resolved": "https://registry.npmjs.org/@jridgewell/source-map/-/source-map-0.3.11.tgz", + "integrity": "sha512-ZMp1V8ZFcPG5dIWnQLr3NSI1MiCU7UETdS/A0G8V/XWHvJv3ZsFqutJn1Y5RPmAPX6F3BiE397OqveU/9NCuIA==", + "dev": true, + "license": "MIT", + "dependencies": { + "@jridgewell/gen-mapping": "^0.3.5", + "@jridgewell/trace-mapping": "^0.3.25" + } + }, + "node_modules/@jridgewell/sourcemap-codec": { + "version": "1.5.5", + "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz", + "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==", + "dev": true, + "license": "MIT" + }, + "node_modules/@jridgewell/trace-mapping": { + "version": "0.3.31", + "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz", + "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==", + "dev": true, + "license": "MIT", + "dependencies": { + "@jridgewell/resolve-uri": "^3.1.0", + "@jridgewell/sourcemap-codec": "^1.4.14" + } + }, + "node_modules/acorn": { + "version": "8.18.0", + "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.18.0.tgz", + "integrity": "sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==", + "dev": true, + "license": "MIT", + "bin": { + "acorn": "bin/acorn" + }, + "engines": { + "node": ">=0.4.0" + } + }, + "node_modules/anymatch": { + "version": "3.1.3", + "resolved": "https://registry.npmjs.org/anymatch/-/anymatch-3.1.3.tgz", + "integrity": "sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==", + "dev": true, + "license": "ISC", + "dependencies": { + "normalize-path": "^3.0.0", + "picomatch": "^2.0.4" + }, + "engines": { + "node": ">= 8" + } + }, + "node_modules/balanced-match": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", + "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", + "dev": true, + "license": "MIT" + }, + "node_modules/binary-extensions": { + "version": "2.3.0", + "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.3.0.tgz", + "integrity": "sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=8" + }, + "funding": { + "url": "https://github.com/sponsors/sindresorhus" + } + }, + "node_modules/brace-expansion": { + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^1.0.0", + "concat-map": "0.0.1" + } + }, + "node_modules/braces": { + "version": "3.0.3", + "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz", + "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==", + "dev": true, + "license": "MIT", + "dependencies": { + "fill-range": "^7.1.1" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/buffer-from": { + "version": "1.1.2", + "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz", + "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==", + "dev": true, + "license": "MIT" + }, + "node_modules/chokidar": { + "version": "3.6.0", + "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.6.0.tgz", + "integrity": "sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==", + "dev": true, + "license": "MIT", + "dependencies": { + "anymatch": "~3.1.2", + "braces": "~3.0.2", + "glob-parent": "~5.1.2", + "is-binary-path": "~2.1.0", + "is-glob": "~4.0.1", + "normalize-path": "~3.0.0", + "readdirp": "~3.6.0" + }, + "engines": { + "node": ">= 8.10.0" + }, + "funding": { + "url": "https://paulmillr.com/funding/" + }, + "optionalDependencies": { + "fsevents": "~2.3.2" + } + }, + "node_modules/clean-css": { + "version": "5.3.3", + "resolved": "https://registry.npmjs.org/clean-css/-/clean-css-5.3.3.tgz", + "integrity": "sha512-D5J+kHaVb/wKSFcyyV75uCn8fiY4sV38XJoe4CUyGQ+mOU/fMVYUdH1hJC+CJQ5uY3EnW27SbJYS4X8BiLrAFg==", + "dev": true, + "license": "MIT", + "dependencies": { + "source-map": "~0.6.0" + }, + "engines": { + "node": ">= 10.0" + } + }, + "node_modules/clean-css-cli": { + "version": "5.6.3", + "resolved": "https://registry.npmjs.org/clean-css-cli/-/clean-css-cli-5.6.3.tgz", + "integrity": "sha512-MUAta8pEqA/d2DKQwtZU5nm0Og8TCyAglOx3GlWwjhGdKBwY4kVF6E5M6LU/jmmuswv+HbYqG/dKKkq5p1dD0A==", + "dev": true, + "license": "MIT", + "dependencies": { + "chokidar": "^3.5.2", + "clean-css": "^5.3.3", + "commander": "7.x", + "glob": "^7.1.6" + }, + "bin": { + "cleancss": "bin/cleancss" + }, + "engines": { + "node": ">= 10.12.0" + } + }, + "node_modules/commander": { + "version": "7.2.0", + "resolved": "https://registry.npmjs.org/commander/-/commander-7.2.0.tgz", + "integrity": "sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">= 10" + } + }, + "node_modules/concat-map": { + "version": "0.0.1", + "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz", + "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==", + "dev": true, + "license": "MIT" + }, + "node_modules/fill-range": { + "version": "7.1.1", + "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz", + "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==", + "dev": true, + "license": "MIT", + "dependencies": { + "to-regex-range": "^5.0.1" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/fs.realpath": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz", + "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==", + "dev": true, + "license": "ISC" + }, + "node_modules/fsevents": { + "version": "2.3.3", + "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz", + "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==", + "dev": true, + "hasInstallScript": true, + "license": "MIT", + "optional": true, + "os": [ + "darwin" + ], + "engines": { + "node": "^8.16.0 || ^10.6.0 || >=11.0.0" + } + }, + "node_modules/glob": { + "version": "7.2.3", + "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz", + "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==", + "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me", + "dev": true, + "license": "ISC", + "dependencies": { + "fs.realpath": "^1.0.0", + "inflight": "^1.0.4", + "inherits": "2", + "minimatch": "^3.1.1", + "once": "^1.3.0", + "path-is-absolute": "^1.0.0" + }, + "engines": { + "node": "*" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, + "node_modules/glob-parent": { + "version": "5.1.2", + "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz", + "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==", + "dev": true, + "license": "ISC", + "dependencies": { + "is-glob": "^4.0.1" + }, + "engines": { + "node": ">= 6" + } + }, + "node_modules/inflight": { + "version": "1.0.6", + "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz", + "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==", + "deprecated": "This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.", + "dev": true, + "license": "ISC", + "dependencies": { + "once": "^1.3.0", + "wrappy": "1" + } + }, + "node_modules/inherits": { + "version": "2.0.4", + "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz", + "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==", + "dev": true, + "license": "ISC" + }, + "node_modules/is-binary-path": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/is-binary-path/-/is-binary-path-2.1.0.tgz", + "integrity": "sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==", + "dev": true, + "license": "MIT", + "dependencies": { + "binary-extensions": "^2.0.0" + }, + "engines": { + "node": ">=8" + } + }, + "node_modules/is-extglob": { + "version": "2.1.1", + "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz", + "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/is-glob": { + "version": "4.0.3", + "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz", + "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==", + "dev": true, + "license": "MIT", + "dependencies": { + "is-extglob": "^2.1.1" + }, + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/is-number": { + "version": "7.0.0", + "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz", + "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=0.12.0" + } + }, + "node_modules/minimatch": { + "version": "3.1.5", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz", + "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==", + "dev": true, + "license": "ISC", + "dependencies": { + "brace-expansion": "^1.1.7" + }, + "engines": { + "node": "*" + } + }, + "node_modules/normalize-path": { + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz", + "integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/once": { + "version": "1.4.0", + "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz", + "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==", + "dev": true, + "license": "ISC", + "dependencies": { + "wrappy": "1" + } + }, + "node_modules/path-is-absolute": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz", + "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/picomatch": { + "version": "2.3.2", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz", + "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=8.6" + }, + "funding": { + "url": "https://github.com/sponsors/jonschlinkert" + } + }, + "node_modules/readdirp": { + "version": "3.6.0", + "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz", + "integrity": "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==", + "dev": true, + "license": "MIT", + "dependencies": { + "picomatch": "^2.2.1" + }, + "engines": { + "node": ">=8.10.0" + } + }, + "node_modules/source-map": { + "version": "0.6.1", + "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz", + "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==", + "dev": true, + "license": "BSD-3-Clause", + "engines": { + "node": ">=0.10.0" + } + }, + "node_modules/source-map-support": { + "version": "0.5.21", + "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz", + "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==", + "dev": true, + "license": "MIT", + "dependencies": { + "buffer-from": "^1.0.0", + "source-map": "^0.6.0" + } + }, + "node_modules/terser": { + "version": "5.49.2", + "resolved": "https://registry.npmjs.org/terser/-/terser-5.49.2.tgz", + "integrity": "sha512-rGbJiKeQ4WDe3EXlDAIaQcwftVfv2Q8o1awFNfvXolJYKkb1AuZY1RTOmqx4LJXZENbWZA7eIsYGHuEzHsi1nQ==", + "dev": true, + "license": "BSD-2-Clause", + "dependencies": { + "@jridgewell/source-map": "^0.3.3", + "acorn": "^8.15.0", + "commander": "^2.20.0", + "source-map-support": "~0.5.20" + }, + "bin": { + "terser": "bin/terser" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/terser/node_modules/commander": { + "version": "2.20.3", + "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz", + "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==", + "dev": true, + "license": "MIT" + }, + "node_modules/to-regex-range": { + "version": "5.0.1", + "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz", + "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==", + "dev": true, + "license": "MIT", + "dependencies": { + "is-number": "^7.0.0" + }, + "engines": { + "node": ">=8.0" + } + }, + "node_modules/wrappy": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz", + "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==", + "dev": true, + "license": "ISC" + } + } +} diff --git a/package.json b/package.json index c59de17..b2ff8c7 100644 --- a/package.json +++ b/package.json @@ -1,19 +1,34 @@ { "name": "fancybox-for-wordpress", - "main": "Gruntfile.js", "version": "3.4.1", - "homepage": "https://www.colorlib.com", + "description": "Integrates FancyBox 3 into WordPress.", + "homepage": "https://wordpress.org/plugins/fancybox-for-wordpress/", "author": "Colorlib", - "license": "GPL v3", - "repository": "https://github.com/ColorlibHQ/fancybox-for-wordpress", + "license": "GPL-3.0-or-later", + "private": true, + "repository": { + "type": "git", + "url": "https://github.com/ColorlibHQ/fancybox-for-wordpress.git" + }, + "engines": { + "node": ">=18" + }, + "scripts": { + "build:js": "terser assets/js/jquery.fancybox.js --compress --mangle --comments \"/^!|licen[cs]e|fancyBox v/i\" -o assets/js/jquery.fancybox.min.js", + "build:css": "cleancss -O2 -o assets/css/fancybox.min.css assets/css/fancybox.css", + "build:assets": "npm run build:js && npm run build:css", + "verify:assets": "node bin/verify-assets.mjs", + "i18n:pot": "wp i18n make-pot . languages/fancybox-for-wordpress.pot --slug=fancybox-for-wordpress --domain=fancybox-for-wordpress --exclude=assets/js/jquery.fancybox.js,assets/js/jquery.fancybox.min.js,assets/js/purify.js,assets/js/purify.min.js,bin --headers='{\"Report-Msgid-Bugs-To\":\"https://wordpress.org/support/plugin/fancybox-for-wordpress/\",\"Last-Translator\":\"\",\"Language-Team\":\"\"}'", + "i18n:php": "wp i18n make-php languages", + "i18n:mo": "wp i18n make-mo languages", + "i18n": "npm run i18n:pot && npm run i18n:mo && npm run i18n:php", + "lint:php": "composer lint", + "lint:phpcs": "composer phpcs", + "package": "node bin/package.mjs", + "release:check": "npm run verify:assets && npm run lint:php && npm run package" + }, "devDependencies": { - "grunt": "^1.0.4", - "grunt-checktextdomain": "^1.0.1", - "grunt-cli": "~1.3.2", - "grunt-contrib-clean": "^2.0.0", - "grunt-contrib-compress": "^1.4.3", - "grunt-contrib-copy": "^1.0.0", - "grunt-wp-i18n": "^1.0.3", - "load-grunt-tasks": "^4.0.0" + "clean-css-cli": "^5.6.3", + "terser": "^5.44.0" } } diff --git a/phpcs.xml.dist b/phpcs.xml.dist new file mode 100644 index 0000000..c87ff44 --- /dev/null +++ b/phpcs.xml.dist @@ -0,0 +1,68 @@ + + + + Correctness rules for FancyBox for WordPress: escaping, sanitisation, nonces, + i18n and PHP cross-version compatibility. + + Deliberately NOT the full WordPress standard. A first run of `WordPress` + against this codebase reports 293 violations, every one of them whitespace, + array alignment or a missing docblock - and zero security, i18n or + compatibility problems. Reflowing ~250 lines across a plugin with 30k active + installs buys nothing and makes every future diff harder to review, so the + rules below are the ones kept enforceable and green. + + To adopt full formatting later: `composer phpcbf -- --standard=WordPress` + in its own commit, then swap the rules here for ``. + + + . + + + */assets/js/jquery.fancybox*.js + */assets/js/purify*.js + */languages/* + */node_modules/* + */vendor/* + */build/* + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + From 83bb529080cd06a62d1ab36d903cdccc618b37c4 Mon Sep 17 00:00:00 2001 From: Aigars Silkalns Date: Fri, 7 Aug 2026 11:58:44 +0300 Subject: [PATCH 2/3] Run Plugin Check against the built package, not the repository The job failed on its first run with a single error: FILE: phpcs.xml.dist ERROR application_detected: Application files are not permitted. Pointing the action at the repository root makes it judge files that never ship - phpcs.xml.dist, bin/, CLAUDE.md - and says nothing about what users install. It now builds the distributable first and checks that, which is both correct and the thing worth gating on. The directory name has to be the plugin slug: the text-domain check compares against it, which is why `npm run package` staging into build/fancybox-for-wordpress matters. Verified locally against the built package: 0 errors, and the only warnings are the known long-standing ones - unprefixed globals kept for backwards compatibility, "WordPress" in the grandfathered plugin name, and load_plugin_textdomain, which is required while translations are bundled. Also grants the job pull-requests: write so the action can post its findings as a PR comment; it warned "Resource not accessible by integration" without it. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/ci.yml | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9314f6d..5b7c1ea 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -76,12 +76,28 @@ jobs: plugin-check: name: WordPress.org Plugin Check runs-on: ubuntu-latest + permissions: + contents: read + # Lets the action post its findings as a PR comment. + pull-requests: write steps: - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 with: - path: fancybox-for-wordpress + node-version: '20' + cache: npm + - run: npm ci + + # Check the built package, not the repository. Running it against the repo + # root judges files that never ship - phpcs.xml.dist alone fails it with + # "Application files are not permitted" - and tells you nothing about what + # users actually install. The directory name must be the plugin slug, + # because that is what the text-domain check compares against. + - name: Build the distributable + run: npm run package + - uses: wordpress/plugin-check-action@v1 with: - build-dir: ./fancybox-for-wordpress - # Warnings are informational here; errors fail the run. + build-dir: ./build/fancybox-for-wordpress + # Warnings are informational; errors fail the run. ignore-warnings: true From c9e600006a90bd8b99c353588e86b48c25413b47 Mon Sep 17 00:00:00 2001 From: Aigars Silkalns Date: Fri, 7 Aug 2026 12:01:34 +0300 Subject: [PATCH 3/3] Fail the deploy with a readable message when SVN secrets are missing Neither SVN_USERNAME nor SVN_PASSWORD is configured on this repository yet, so the first tag push would have died deep inside the 10up deploy action with an authentication error that does not say what is actually wrong. The job now checks up front and names the missing secrets, where to add them, and the fact that the tag is already pushed so the workflow can simply be re-run once they exist. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/deploy.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index b3665ac..d4b81a8 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -62,6 +62,26 @@ jobs: environment: wordpress-org steps: - uses: actions/checkout@v4 + + # Without this the run dies deep inside the SVN step with an authentication + # error that does not say what is actually wrong. + - name: Check WordPress.org credentials are configured + env: + SVN_USERNAME: ${{ secrets.SVN_USERNAME }} + SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }} + run: | + missing="" + [ -z "$SVN_USERNAME" ] && missing="$missing SVN_USERNAME" + [ -z "$SVN_PASSWORD" ] && missing="$missing SVN_PASSWORD" + if [ -n "$missing" ]; then + echo "::error::Missing repository secret(s):$missing" + echo "Add them under Settings → Secrets and variables → Actions." + echo "Use a WordPress.org account with commit access to the plugin." + echo "The tag is already pushed, so re-run this workflow once they exist." + exit 1 + fi + echo "Credentials present for '$SVN_USERNAME'." + - name: Deploy to the plugin directory uses: 10up/action-wordpress-plugin-deploy@stable env: