[CMSP-669] Update pantheon wp coding standards #25

jazzsequence · 2023-09-13T15:57:58Z

Updates Pantheon Mu Plugin to use Pantheon WP Coding Standards 2.0
Fixes all the linting issues highlighted by the updated coding standards
Adds a PANTHEON_MU_PLUGIN_VERSION constant and actually updates the mu-plugin version (which hasn't been done at all since it was added afaict)

Todo

There's no actual linting happening on the repo, we should add GH actions to at least cover linting (and maybe testing later)
A new 1.2.0 release should be created after this is merged (we won't release until we know/understand how releases are handled via Updatinator and how the update will push out to pantheon-systems/WordPress).
we should add a contributing.md file since there are two places to bump versions now
we probably should add a .gitattributes file to exclude non-important files from releases (like the new phpcs.xml, GH actions, contributing, etc)
Prior to merge, we probably should make the changes in update-tool in case WP releases a patch tomorrow.

and add a PANTHEON_MU_PLUGIN_VERSION constant

not breaking this out into separate commits. this is a mix of phpcbf fixes and manual fixes to bring in line with Pantheon WP Coding Standards @2.0

guardrails · 2023-09-13T15:58:23Z

⚠️ We detected 1 security issue in this pull request:

Insecure Processing of Data (1)

Severity

Details

Docs

Medium

Title: Cross-Site Scripting with user input

pantheon-mu-plugin/inc/pantheon-plugin-install-notice.php

Line 23 in 946a3e8

    
           echo wp_kses_post( sprintf( __( 'If you wish to update or add plugins using the WordPress UI, switch your site to SFTP mode from <a href="%s">your Pantheon dashboard</a>.', 'pantheon-systems' ), 'https://dashboard.pantheon.io/sites/' . $_ENV['PANTHEON_SITE'] ) );

📚

More info on how to fix Insecure Processing of Data in PHP.

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

jazzsequence · 2023-09-13T15:58:54Z

🤦 this was meant to be a draft...

jazzsequence · 2023-09-14T14:53:32Z

Note to future selves:

These lines in https://github.com/pantheon-systems/update-tool need to be updated to essentially mirror the .gitattributes file: https://github.com/pantheon-systems/update-tool/blob/master/src/Update/Filters/CopyMuPlugin.php#L55-L60

jazzsequence · 2023-09-14T15:04:11Z

Alternately, we could specify a tag/release in the git path https://github.com/pantheon-systems/update-tool/blob/master/update-tool.yml#L53 but that would require updating Update Tool manually whenever we push a new version of the mu plugin.

and exclude it from release packages

rwagner00 · 2023-09-14T15:35:02Z

CONTRIBUTING.md

+
+Update Tool clones whatever the latest code on `main` is, and manually removes files that are not required for WordPress sites (e.g. `composer.json`, `composer.lock`, `README.md`, etc.). This is then bundled as part of WordPress releases and upstream updates.
+
+Because the WordPress upstream is only updated when a new WordPress release is cut, it's less risky that we don't have an explicit `develop` branch, but `main` should still always be in a stable state in the chance that a WordPress bugfix or security release is pushed unexpectedly.


This feels better for readme than the workflow since it isn't actually a thing that happens, but that's a minor nitpick.

Yeah, but only contributors should really care about it. ¯_(ツ)_/¯

rwagner00

👍

pwtyler · 2023-09-14T16:06:48Z

pantheon.php

 * Author: Pantheon
 * Author URI: https://pantheon.io/
 *
 * @package pantheon
 */

+define( 'PANTHEON_MU_PLUGIN_VERSION', '1.2.0' );


I would put this in README as well

Why 1.2 and not 1.1 (I know this should have been incremented many times along the way)

I consider, since WPCS -> 3.0 is a big deal and we weren't linting at all previously, this to be a larger than patch update.

I would put this in README as well

@pwtyler you mean list the version number in the readme? that would be one more thing we need to update when we cut new releases.

jazzsequence added 5 commits September 13, 2023 09:38

add a phpcs.xml file so we can carve out specific exclusions

b76ca36

use the phpcs.xml

6802185

bump pantheon-wp-coding-standards to 2.0

b234ce7

actually update the mu-plugin version

245d208

and add a PANTHEON_MU_PLUGIN_VERSION constant

linting

c67356f

not breaking this out into separate commits. this is a mix of phpcbf fixes and manual fixes to bring in line with Pantheon WP Coding Standards @2.0

jazzsequence requested a review from a team as a code owner September 13, 2023 15:57

jazzsequence changed the title ~~[CMSP-669] Update pantheon wp coding standards~~ [CMSP-669] Update pantheon wp coding standards [wip] Sep 13, 2023

jazzsequence added 2 commits September 14, 2023 08:31

add .gitattributes to ignore things from packages/releases

aa27cb4

add a linting action

fdad8a3

jazzsequence self-assigned this Sep 14, 2023

add a contributing.md

946a3e8

and exclude it from release packages

jazzsequence changed the title ~~[CMSP-669] Update pantheon wp coding standards [wip]~~ [CMSP-669] Update pantheon wp coding standards Sep 14, 2023

rwagner00 reviewed Sep 14, 2023

View reviewed changes

rwagner00 approved these changes Sep 14, 2023

View reviewed changes

pwtyler reviewed Sep 14, 2023

View reviewed changes

jazzsequence mentioned this pull request Sep 14, 2023

[CMSP-674] adding more files/folders to remove from cloned mu-plugin pantheon-systems/update-tool#112

Merged

jazzsequence merged commit 567c988 into main Sep 14, 2023

jazzsequence deleted the update-pantheon-wp-coding-standards branch September 14, 2023 16:42

jazzsequence mentioned this pull request Feb 14, 2024

Possibly enforce WP coding standards #18

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[CMSP-669] Update pantheon wp coding standards #25

[CMSP-669] Update pantheon wp coding standards #25

jazzsequence commented Sep 13, 2023 •

edited

Loading

guardrails bot commented Sep 13, 2023 •

edited

Loading

jazzsequence commented Sep 13, 2023

jazzsequence commented Sep 14, 2023

jazzsequence commented Sep 14, 2023

rwagner00 Sep 14, 2023

jazzsequence Sep 14, 2023

rwagner00 left a comment

pwtyler Sep 14, 2023

jazzsequence Sep 14, 2023

jazzsequence Sep 14, 2023 •

edited

Loading


		Update Tool clones whatever the latest code on `main` is, and manually removes files that are not required for WordPress sites (e.g. `composer.json`, `composer.lock`, `README.md`, etc.). This is then bundled as part of WordPress releases and upstream updates.

		Because the WordPress upstream is only updated when a new WordPress release is cut, it's less risky that we don't have an explicit `develop` branch, but `main` should still always be in a stable state in the chance that a WordPress bugfix or security release is pushed unexpectedly.

[CMSP-669] Update pantheon wp coding standards #25

[CMSP-669] Update pantheon wp coding standards #25

Conversation

jazzsequence commented Sep 13, 2023 • edited Loading

guardrails bot commented Sep 13, 2023 • edited Loading

jazzsequence commented Sep 13, 2023

jazzsequence commented Sep 14, 2023

jazzsequence commented Sep 14, 2023

rwagner00 Sep 14, 2023

Choose a reason for hiding this comment

jazzsequence Sep 14, 2023

Choose a reason for hiding this comment

rwagner00 left a comment

Choose a reason for hiding this comment

pwtyler Sep 14, 2023

Choose a reason for hiding this comment

jazzsequence Sep 14, 2023

Choose a reason for hiding this comment

jazzsequence Sep 14, 2023 • edited Loading

Choose a reason for hiding this comment

jazzsequence commented Sep 13, 2023 •

edited

Loading

guardrails bot commented Sep 13, 2023 •

edited

Loading

jazzsequence Sep 14, 2023 •

edited

Loading