[ahegyes]

Summary

Fixes from the v2 re-audit:

• three partial-deploy paths escaped the plugin's build-error handling;

• the greeting's translated default was saved in the saving admin's language;

• the scaffold accepted names that break the block's JSX and never built the filled-in scripts, and a plugin generated with a short name failed its first lint:scripts;

• TypeScript and the Node types were undeclared;

• two recipes lacked a default or a typed read;

• several documents described what the template no longer ships;

• the template's own release zip shipped README.scaffold.md;

• the configs pins lagged behind configs' trunk.

• Partial deploys:

  • uninstall.php called the uninstall engine after its try, so a build missing the engine fataled the uninstall request; it now checks for the engine inside the try.
  • dws_tpl_deactivate() reports a composition root that cannot be built, as dws_tpl_boot() does.
  • functions.php adds its hooks after loading includes/, so an include that throws leaves nothing hooked.

• Greeting: the Message field's default is empty and its placeholder shows the translated greeting. dws_tpl_get_string_option() reads an empty value of an option with a translated default as that default, so an untouched field follows the site's language. includes/migrations.php already keeps translated defaults out of the database for this reason.

• Scaffold:

  • the fill-in also refuses <, >, { and }, which land in the example block's JSX;
  • after the sweep, the fill-in installs the plugin's npm packages with install scripts off, since its job holds a token that can push, and formats the JS and TS files lint:scripts covers. A name shorter than the template's own leaves lines that Prettier joins, so "Acme Orders" had failed lint:scripts;
  • fill-in-scaffold.yml and the Scaffold rehearsal set up Node before the fill-in, and the rehearsal builds the filled-in plugin and runs lint:scripts and lint:types.

• TypeScript: typescript and @types/node, which lint:types and the end-to-end specs need, are declared at the versions the lock already resolved.

• Recipes: both settings recipes' limit fields take their default from DWS_TPL_SETTING_DEFAULTS, and the recurring-jobs recipe reads its repair timestamp through dws_tpl_get_int_option().

• Prose: these now match what the template ships:

  • CONTRIBUTING's release steps, which now set the Version: header;
  • the issue templates' runtime area;
  • the README's empty safeguards slot;
  • the entry file's Description, which takes composer.json's sentence;
  • the scaffold TODO's list of descriptions;
  • SECURITY.md's audit scope;
  • convention 5's boolean read;
  • the tests README's job order.

• Release zip: .distignore excludes README.scaffold.md, and the fill-in drops that line when it moves the file to README.md.

• Configs pins: the workflows, package.json and both locks move from 9f64dc7 to configs 3cbd985. The release now installs its WP-CLI commands from configs' php/release lock, through the template's own development install of configs.

Code +26 −13 (5 files), tests +106 −5 (5 files), workflows, issue templates and fill-in +38 −17 (11 files), docs +13 −9 (7 files), .distignore +1, npm manifest and the two locks +16 −14.

Type of change

• Bug fix
• New feature
• Refactor
• Build / CI / tooling
• Documentation
• Dependency update

Checklist

• Changelog fragment added (composer changelog:add): none; the v2 rebuild ships as "Initial release."
• Tests added/updated:
  • PartialDeployTest runs a missing blocks manifest, an include that throws, a deactivation whose composition root cannot be built, and an uninstall whose engine cannot load, each in its own request;
  • placeholder, untouched-save and empty-read rows are added;
  • the empty-greeting row expects the default.
• composer quality-check passes locally
• Plugin header updated if runtime requirements changed: no runtime requirement changed; the Description takes composer.json's sentence

Breaking changes for forks

• Empty values: dws_tpl_get_string_option() reads an empty value of an option with a translated default as that default, so a cleared Message greets with the default instead of printing nothing. The feature's toggle turns the greeting off.
• Plugin names: the fill-in refuses <, >, { and } in the plugin name.
• Fill-in needs Node: the fill-in runs npm ci and the formatter, so a fork's own fill-in workflow must set up Node first.

Review points.

• Changed files in the checkout: the partial-deploy rows rename or add a file in the checkout for one request and restore it in finally. A run killed mid-row can leave a .hidden file or includes/zz-throws.php behind.
• First CI run of the release tools: this PR's Release dry run is the first CI run of the lock-based WP-CLI install.

Testing.

• composer quality-check passes: validate, changelog validation, PHPCS on both profiles, PHPStan, Unit 6 and Integration 75.
• npm run test:e2e passes (3 of 3). lint:scripts, lint:styles and lint:types are clean, and so are actionlint, zizmor and shellcheck.
• Before the fixes:
  • the include, deactivation, uninstall and greeting rows failed;
  • the deactivation row also fails with only its catch reverted.
• Scaffold names: a scratch fill-in named Acme <Orders> passes trunk's script, then fails the new build and type-lint steps; this branch's script refuses it.
• Short and long names: scratch fill-ins named "Acme Orders" and "Acme Orders for WooCommerce" both pass build, lint:scripts, lint:styles and lint:types. The formatter changes only the two lines the short name shortened.
• Release tools and zip: configs' tool step, run in the template's checkout, installs WP-CLI 2.12.0 from the template's copy of configs, and make-pot and dist-archive run from it. The archive holds no README, and a scratch fill-in drops the .distignore line and keeps its leftover checks green.