Merge branch 'main' into claude/wp-cli-package-composer-guidance-rve6ct

Author: swissspidy

.github/actionlint.yml

@@ -0,0 +1,13 @@
+# Configuration for actionlint, run by the `actionlint` job in
+# `.github/workflows/reusable-code-quality.yml`.
+paths:
+  .github/workflows/**/*.{yml,yaml}:
+    ignore:
+      # `copilot-requests` is a real permission scope - it is what lets a
+      # workflow authenticate the Copilot CLI with the built-in `GITHUB_TOKEN`
+      # instead of a personal access token - but actionlint's hard-coded scope
+      # list has not caught up with it yet, so it reports every use as unknown.
+      # Drop this entry once actionlint ships the scope, and it will go back to
+      # catching genuine typos in permission names.
+      # See https://docs.github.com/en/copilot/how-tos/copilot-cli/use-copilot-cli-in-actions
+      - 'unknown permission scope "copilot-requests"'

.github/dependabot.yml

@@ -9,6 +9,17 @@ updates:
       - scope:distribution
     cooldown:
       default-days: 7
+  # Only wp-cli-tests carries a package.json, holding the pinned version of the
+  # Gherkin linter. This is a no-op in every other repository.
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - scope:distribution
+    cooldown:
+      default-days: 7
   - package-ecosystem: github-actions
     directory: "/"
     schedule:

.github/workflows/copilot-setup-steps.yml

@@ -19,6 +19,16 @@ jobs:
     permissions:
       contents: read
 
+    env:
+      MYSQL_HOST: 127.0.0.1
+      MYSQL_TCP_PORT: 3306
+      WP_CLI_TEST_DBROOTUSER: root
+      WP_CLI_TEST_DBROOTPASS: root
+      WP_CLI_TEST_DBNAME: wp_cli_test
+      WP_CLI_TEST_DBUSER: wp_cli_test
+      WP_CLI_TEST_DBPASS: password1
+      WP_CLI_TEST_DBHOST: 127.0.0.1:3306
+
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -45,3 +55,28 @@ jobs:
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
         env:
           COMPOSER_ROOT_VERSION: dev-${{ github.event.repository.default_branch }}
+
+      # Without a database the Behat runner silently falls back to SQLite, so the
+      # agent's test runs are not the ones CI will do. Mirrors the setup in
+      # reusable-functional.yml.
+      - name: Check existence of behat.yml file
+        id: check_behat_file
+        run: echo "files_exists=$(test -f behat.yml && echo true || echo false)" >> "$GITHUB_OUTPUT"
+
+      - name: Setup MySQL Server
+        if: steps.check_behat_file.outputs.files_exists == 'true'
+        uses: shogo82148/actions-setup-mysql@62da9377d83991fce27b6ed2a397d3306121e41d # v1
+        with:
+          mysql-version: '8.0' # Standard MySQL version for these tests
+          auto-start: true
+          root-password: ${{ env.WP_CLI_TEST_DBROOTPASS }}
+          user: ${{ env.WP_CLI_TEST_DBUSER }}
+          password: ${{ env.WP_CLI_TEST_DBPASS }}
+
+      - name: Remove system MySQL binary
+        if: steps.check_behat_file.outputs.files_exists == 'true'
+        run: sudo rm -f /usr/bin/mysql /usr/bin/mysqldump
+
+      - name: Prepare test database
+        if: steps.check_behat_file.outputs.files_exists == 'true'
+        run: composer prepare-tests

.github/workflows/deployment.yml

@@ -113,6 +113,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Ghostscript
+        timeout-minutes: 10
         run: |
           sudo apt-get update
           sudo apt-get install ghostscript -y
@@ -152,7 +153,7 @@ jobs:
 
       - name: Setup MySQL Server
         id: setup-mysql
-        uses: shogo82148/actions-setup-mysql@3dcedf762c5e82d781a9e414462785b30208e79c # v1
+        uses: shogo82148/actions-setup-mysql@62da9377d83991fce27b6ed2a397d3306121e41d # v1
         with:
           mysql-version: ${{ matrix.mysql }}
           auto-start: true

.github/workflows/issue-triage.yml

@@ -17,7 +17,10 @@ permissions:
   issues: write
   pull-requests: write
   contents: read
-  models: read
+  # A caller can only cap a reusable workflow's permissions, so the scope the
+  # Copilot CLI needs has to be granted here too. `models: read` was for the
+  # GitHub Models provider, which `actions/ai-inference` v3 removed.
+  copilot-requests: write
   # A caller can only cap a reusable workflow's permissions, never raise them,
   # so `actions: write` has to be granted here for the dispatch job downstream
   # to work at all. The reusable workflow narrows it to that single job, so the

AGENTS.md

@@ -13,9 +13,27 @@ When contributing to this package, please adhere to the following guidelines:
 
 ### Building and running
 
-Before submitting any changes, it is crucial to validate them by running the full suite of static code analysis and tests. To run the full suite of checks, execute the following command: `composer test`.
+Run the narrowest check that covers your change:
 
-This single command ensures that your changes meet all the quality gates of the project. While you can run the individual steps separately, it is highly recommended to use this single command to ensure a comprehensive validation.
+| You changed | Run |
+| --- | --- |
+| Any PHP file | `composer phpcs -- <file>` and `composer phpstan` |
+| Logic with unit test coverage | `composer phpunit -- --filter <TestName>` |
+| One feature file | `composer behat -- features/<name>.feature` |
+| One scenario | `composer behat -- features/<name>.feature:<line>` |
+
+After a failure, `composer behat-rerun` re-runs only the scenarios that failed, and `composer behat -- --stop-on-failure` bails out at the first one instead of working through the rest.
+
+`composer test` runs every suite, the whole Behat suite included. In most packages that means installing WordPress from scratch once per scenario, which takes tens of minutes and needs `jq`, a MySQL or MariaDB client with a prepared test database, and network access to WordPress.org. Run it before opening a pull request when you have touched something cross-cutting. Do not run it to check a two-line change.
+
+Set these first, so the tools report problems compactly instead of drawing progress bars and ANSI color into output you are going to read back:
+
+```bash
+export NO_COLOR=1
+export WP_CLI_TEST_QUIET=1
+```
+
+Note that a green `composer test` is not the same as a green CI. `actionlint` and `typos` also run on every pull request and are not part of it.
 
 ### Useful Composer Commands
 
@@ -24,6 +42,7 @@ The project uses Composer to manage dependencies and run scripts. The following
 * `composer install`: Install dependencies.
 * `composer test`: Run the full test suite, including linting, code style checks, static analysis, and unit/behavior tests.
 * `composer lint`: Check for syntax errors.
+* `composer lint-gherkin`: Check the Behat feature files for style violations.
 * `composer phpcs`: Check for code style violations.
 * `composer phpcbf`: Automatically fix code style violations.
 * `composer phpstan`: Run static analysis.

composer.json

@@ -80,6 +80,7 @@
     "behat": "run-behat-tests",
     "behat-rerun": "rerun-behat-tests",
     "lint": "run-linter-tests",
+    "lint-gherkin": "run-gherkin-lint-tests",
     "phpcs": "run-phpcs-tests",
     "phpstan": "run-phpstan-tests",
     "phpunit": "run-php-unit-tests",
@@ -88,6 +89,7 @@
     "prepare-tests": "install-package-tests",
     "test": [
       "@lint",
+      "@lint-gherkin",
       "@phpcs",
       "@phpstan",
       "@phpunit",