Prepare for WordPress.org transfer

.github/typos.toml

@@ -0,0 +1,3 @@
+[files]
+# Auto-generated by release-please; contains git commit SHAs that trigger false positives.
+extend-exclude = ["CHANGELOG.md"]

.github/workflows/ci.yml

@@ -2,40 +2,42 @@ name: CI
 
 on:
   push:
-    branches:
-      - main
+    branches: [ main ]
   pull_request:
-    branches:
-      - main
+    branches: [ main ]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
-  lint:
-    name: Lint
-    runs-on: ubuntu-latest
+  gate:
+    runs-on: ubuntu-24.04
+    if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.ref, 'refs/heads/release-please--') }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: shivammathur/setup-php@v2
-        with:
-          php-version: '8.0'
-      - name: Install dependencies
-        run: composer install
-      - name: PHPCS
-        run: composer phpcs
-      - name: PHPStan
-        run: composer phpstan
-
-  test:
-    name: Test PHP ${{ matrix.php }}
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        php: ['8.0', '8.1', '8.2', '8.3']
-    steps:
-      - uses: actions/checkout@v4
-      - uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php }}
-      - name: Install dependencies
-        run: composer install
-      - name: Run tests
-        run: echo "Tests coming soon"
+      - run: true
+
+  phpcs:
+    needs: gate
+    uses: ./.github/workflows/phpcs.yml
+
+  phpstan:
+    needs: gate
+    uses: ./.github/workflows/phpstan.yml
+
+  phpunit:
+    needs: gate
+    uses: ./.github/workflows/phpunit.yml
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
+  plugin-check:
+    needs: gate
+    uses: ./.github/workflows/plugin-check.yml
+
+  typos:
+    needs: gate
+    uses: ./.github/workflows/typos.yml

.github/workflows/codeql.yml

@@ -0,0 +1,49 @@
+name: CodeQL
+
+# GitHub-managed security analysis. Scans our CI workflow definitions on
+# every PR, every push to main, and weekly so the local CodeQL database
+# refreshes against newly-published query packs even on code that hasn't
+# changed.
+#
+# PHP support is currently in beta on CodeQL. We scan the GitHub Actions
+# DSL (`actions`) today, and should add PHP once the language pack is stable.
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  schedule:
+    - cron: '0 6 * * 1'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-24.04
+    if: ${{ !startsWith(github.head_ref, 'release-please--') }}
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'actions' ]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # init and analyze must stay on the same version.
+      - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          languages: ${{ matrix.language }}
+
+      - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/lint-pr.yml

@@ -0,0 +1,87 @@
+name: Lint Pull Request
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - edited
+      - synchronize
+
+permissions:
+  contents: read
+
+jobs:
+  # The merge commit's body is this pull request's title, and release-please
+  # parses it alongside the branch commits, so a conventional title puts this
+  # change in the changelog however the branch commits happen to be written.
+  title:
+    name: Validate pull request title
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    # The action reports its result as a commit status, which needs
+    # `statuses: write`. The default token does not have it on
+    # `pull_request_target`, and without it the action fails with
+    # "Resource not accessible by integration" even for a valid title.
+    permissions:
+      pull-requests: read
+      statuses: write
+    steps:
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          # Mirrors the `type` keys in release-please-config.json. A type that
+          # is valid here but missing there would be dropped from the changelog
+          # silently, so the two lists have to stay in sync.
+          types: |
+            build
+            chore
+            ci
+            docs
+            feat
+            fix
+            perf
+            refactor
+            revert
+            style
+            test
+          requireScope: false
+          ignoreLabels: |
+            bot
+            ignore-semantic-pull-request
+
+  # `!` triggers a major bump, but only on types release-please releases from.
+  # `ci!:` or `chore!:` reads as a breaking change in the git history while
+  # bumping nothing, so reject the combination rather than let it mislead.
+  breaking-change:
+    name: Validate breaking change marker
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - name: Check for breaking change marker on non-releasing types
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          ALLOWED_BREAKING_TYPES="feat|fix|perf"
+
+          # Matches "type!:", "type(scope)!:" and "type!(scope):".
+          if [[ "$PR_TITLE" =~ ^([a-z]+)!(\(.+\))?:|^([a-z]+)(\(.+\))?!: ]]; then
+            TYPE="${BASH_REMATCH[1]:-${BASH_REMATCH[3]}}"
+
+            if [[ ! "$TYPE" =~ ^($ALLOWED_BREAKING_TYPES)$ ]]; then
+              echo "::error::Breaking change marker (!) cannot be used with the '$TYPE' prefix."
+              echo ""
+              echo "'!' marks a BREAKING CHANGE and triggers a major version bump, but"
+              echo "'$TYPE' commits do not trigger a release at all, so the marker is ambiguous."
+              echo ""
+              echo "Use 'feat!:', 'fix!:' or 'perf!:' if this is a breaking change,"
+              echo "or drop the '!' if it is not."
+              echo ""
+              echo "Current title: $PR_TITLE"
+              exit 1
+            fi
+          fi
+
+          echo "PR title is valid."

.github/workflows/phpcs.yml

@@ -0,0 +1,25 @@
+name: PHPCS
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  phpcs:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        with:
+          php-version: '8.3'
+          tools: composer
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        with:
+          path: ~/.composer/cache
+          key: composer-${{ hashFiles('composer.json') }}
+      - run: composer install --no-interaction
+      - run: ./vendor/bin/phpcs --standard=phpcs.xml.dist

.github/workflows/phpstan.yml

@@ -0,0 +1,27 @@
+name: PHPStan
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  phpstan:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        with:
+          php-version: '8.3'
+          tools: composer
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+        with:
+          path: ~/.composer/cache
+          key: composer-${{ hashFiles('composer.json') }}
+      - run: composer install --no-interaction
+      # `--error-format=github` renders findings as inline PR annotations
+      # on the diff, the same shape PHPCS uses via its own GitHub formatter.
+      - run: ./vendor/bin/phpstan analyse --no-progress --error-format=github

.github/workflows/phpunit.yml

@@ -0,0 +1,64 @@
+name: PHPUnit
+
+on:
+  workflow_call:
+    secrets:
+      CODECOV_TOKEN:
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  phpunit:
+    name: PHP ${{ matrix.php }}
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        php: [ '7.4', '8.3' ]
+        include:
+          - php: '8.3'
+            coverage: true
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        with:
+          php-version: ${{ matrix.php }}
+          tools: composer
+      - run: npm ci
+      - name: Authenticate composer to GitHub
+        run: composer config --global --auth github-oauth.github.com '${{ secrets.GITHUB_TOKEN }}'
+      - name: Install Composer dependencies
+        run: composer install --no-interaction
+      - name: Build Gutenberg trunk and start wp-env
+        run: bash build-gutenberg.sh && npx wp-env start ${{ matrix.coverage && '--xdebug=coverage' || '' }}
+        env:
+          WP_ENV_PHP_VERSION: ${{ matrix.php }}
+      - run: npx wp-env run tests-cli --env-cwd='wp-content/plugins/realtime-collaboration' -- ./vendor/bin/phpunit ${{ matrix.coverage && '--coverage-clover coverage.xml' || '' }}
+      - name: Upload coverage to Codecov
+        if: ${{ matrix.coverage }}
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: coverage.xml
+          flags: phpunit
+      # Multisite testing - RTC plugin needs to verify multisite table creation
+      # and cleanup behavior. The network provisioning lives in lib/install.php
+      # and would show as uncovered without this run.
+      - name: Run the suite as multisite
+        if: ${{ matrix.coverage }}
+        run: npx wp-env run tests-cli --env-cwd='wp-content/plugins/realtime-collaboration' -- env WP_MULTISITE=1 ./vendor/bin/phpunit --coverage-clover coverage-multisite.xml
+      - name: Upload multisite coverage to Codecov
+        if: ${{ matrix.coverage }}
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: coverage-multisite.xml
+          flags: multisite

.github/workflows/playground-preview.yml

@@ -57,9 +57,9 @@ jobs:
           set -euo pipefail
           jq -e '
             (.steps | length > 0)
-            and (.steps | all(.step | IN("installPlugin")))
-            and (.steps | map(select(.step == "installPlugin" and (.pluginData.resource // "") == "url")) | length == 1)
-            and (.steps | map(select(.step == "installPlugin" and (.pluginData.resource // "") == "wordpress.org/plugins")) | length == 1)
+            and (.steps | all(.step | IN("login", "installPlugin", "defineWpConfigConsts", "runPHP")))
+            and (.steps | map(select(.step == "installPlugin" and (.pluginZipFile.resource // "") == "url")) | length == 1)
+            and (.steps | map(select(.step == "installPlugin" and (.pluginZipFile.resource // "") == "wordpress.org/plugins")) | length == 2)
           ' blueprint.json > /dev/null
 
       - name: Stage release assets