Port Linked Orders to the v2 framework and re-base the monorepo on the template

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -7,9 +7,7 @@ body:
     attributes:
       label: Affected plugin (or scaffold)
       options:
-        - internal-comments
         - linked-orders-for-woocommerce
-        - locked-payment-methods-for-woocommerce
         - Monorepo scaffold (root composer/npm scripts, wp-env, CI workflows)
         - Other / unsure
     validations:
@@ -57,15 +55,15 @@ body:
     id: wc-version
     attributes:
       label: WooCommerce version (if applicable)
-      placeholder: '10.7.0'
+      placeholder: '11.2.1'
 
   - type: textarea
     id: reproduction
     attributes:
       label: Steps to reproduce
       placeholder: |
         1. `git clone … && cd wordpress-plugins`
-        2. `npm run install:all && npm run wp-env:start`
+        2. `npm run setup && npm run wp-env:tests:start`
         3. Observe Z
     validations:
       required: true

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -7,9 +7,7 @@ body:
     attributes:
       label: Target plugin (or scaffold)
       options:
-        - internal-comments
         - linked-orders-for-woocommerce
-        - locked-payment-methods-for-woocommerce
         - Monorepo scaffold (root composer/npm scripts, wp-env, CI workflows)
         - New plugin proposal
     validations:

.github/PULL_REQUEST_TEMPLATE.md

@@ -11,21 +11,13 @@
 - [ ] Documentation
 - [ ] Dependency update
 
-## Affected plugin(s)
-
-- [ ] internal-comments
-- [ ] linked-orders-for-woocommerce
-- [ ] locked-payment-methods-for-woocommerce
-- [ ] Monorepo scaffold (root scripts, wp-env, CI workflows)
-
 ## Checklist
 
-- [ ] Changelog fragment added (`composer changelog:add` at root, or in the affected plugin dir)
+- [ ] Changelog fragment added (`composer changelog:add` in the changed plugin's directory, or at the root for the monorepo itself)
 - [ ] Tests added/updated
-- [ ] `composer plugins:quality-check` (or per-plugin `composer quality-check`) passes locally
-- [ ] Plugin header + `readme.txt` updated if runtime requirements changed
-
-## Breaking changes for mirror consumers
+- [ ] `composer quality-check` passes locally in every changed plugin
+- [ ] Plugin header and `readme.txt` updated if runtime requirements changed
 
-<!-- Fill in if this PR changes the scoping pipeline, composer scripts, CI workflow contracts, or anything that downstream consumers of the split-published mirrors (wp-internal-comments / wc-linked-orders / wc-locked-payment-methods) would notice. Otherwise delete. -->
+## Breaking changes
 
+<!-- Fill in if this PR changes a plugin's public contract (hooks, functions, option or meta keys, capabilities), the scoping pipeline or the CI workflows. Otherwise delete. -->

.github/dependabot.yml

@@ -1,120 +1,55 @@
 version: 2
 updates:
-  # Root tooling
+  # The mirrors are read-only, so the plugins' dependencies and workflow pins are updated here.
   - package-ecosystem: composer
-    directory: /
+    directories:
+      - /
+      - /plugins/*
     schedule:
       interval: weekly
       day: monday
       time: '06:00'
       timezone: UTC
     open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
     groups:
-      php-dev-deps-root:
-        patterns: ['*']
+      php-dev-deps:
+        patterns:
+          - '*'
         dependency-type: development
 
   - package-ecosystem: npm
-    directory: /
+    directories:
+      - /
+      - /plugins/*
     schedule:
       interval: weekly
       day: monday
       time: '06:00'
       timezone: UTC
     open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
     groups:
-      npm-dev-deps-root:
-        patterns: ['*']
+      npm-dev-deps:
+        patterns:
+          - '*'
         dependency-type: development
 
   - package-ecosystem: github-actions
-    directory: /
+    directories:
+      - /
+      - /plugins/*
     schedule:
       interval: weekly
       day: monday
       time: '06:00'
       timezone: UTC
     open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
     groups:
       github-actions:
-        patterns: ['*']
-
-  # Per-plugin Composer
-  - package-ecosystem: composer
-    directory: /plugins/internal-comments
-    schedule:
-      interval: weekly
-      day: monday
-      time: '06:00'
-      timezone: UTC
-    open-pull-requests-limit: 5
-    groups:
-      php-dev-deps-internal-comments:
-        patterns: ['*']
-        dependency-type: development
-
-  - package-ecosystem: composer
-    directory: /plugins/linked-orders-for-woocommerce
-    schedule:
-      interval: weekly
-      day: monday
-      time: '06:00'
-      timezone: UTC
-    open-pull-requests-limit: 5
-    groups:
-      php-dev-deps-linked-orders-for-woocommerce:
-        patterns: ['*']
-        dependency-type: development
-
-  - package-ecosystem: composer
-    directory: /plugins/locked-payment-methods-for-woocommerce
-    schedule:
-      interval: weekly
-      day: monday
-      time: '06:00'
-      timezone: UTC
-    open-pull-requests-limit: 5
-    groups:
-      php-dev-deps-locked-payment-methods-for-woocommerce:
-        patterns: ['*']
-        dependency-type: development
-
-  # Per-plugin npm
-  - package-ecosystem: npm
-    directory: /plugins/internal-comments
-    schedule:
-      interval: weekly
-      day: monday
-      time: '06:00'
-      timezone: UTC
-    open-pull-requests-limit: 5
-    groups:
-      npm-dev-deps-internal-comments:
-        patterns: ['*']
-        dependency-type: development
-
-  - package-ecosystem: npm
-    directory: /plugins/linked-orders-for-woocommerce
-    schedule:
-      interval: weekly
-      day: monday
-      time: '06:00'
-      timezone: UTC
-    open-pull-requests-limit: 5
-    groups:
-      npm-dev-deps-linked-orders-for-woocommerce:
-        patterns: ['*']
-        dependency-type: development
-
-  - package-ecosystem: npm
-    directory: /plugins/locked-payment-methods-for-woocommerce
-    schedule:
-      interval: weekly
-      day: monday
-      time: '06:00'
-      timezone: UTC
-    open-pull-requests-limit: 5
-    groups:
-      npm-dev-deps-locked-payment-methods-for-woocommerce:
-        patterns: ['*']
-        dependency-type: development
+        patterns:
+          - '*'

.github/workflows/audit.yml

@@ -0,0 +1,31 @@
+name: Supply-Chain Audit
+
+on:
+  push:
+    branches: [trunk]
+  pull_request:
+  schedule:
+    # Weekly Monday at 07:00 UTC — staggered after dependabot (06:00) so PRs from
+    # dependency bumps surface audit results in the same morning batch.
+    - cron: '0 7 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  plugins:
+    name: Plugins
+    uses: ./.github/workflows/plugins.yml
+
+  audit:
+    name: Audit (${{ matrix.project }})
+    needs: plugins
+    strategy:
+      fail-fast: false
+      matrix:
+        project: ${{ fromJSON(needs.plugins.outputs.projects) }}
+    # npm gate audits production deps only — the dev-tooling graph (wp-scripts/playwright trees) is advisory via dependabot alerts.
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-supply-chain-audit.yml@8d53efd292e4abee4a9c57b0e379434f54bedbe9
+    with:
+      project-path: ${{ matrix.project }}
+      npm-audit-flags: '--omit=dev --audit-level=high'

.github/workflows/codeql.yml

@@ -8,27 +8,16 @@ on:
   schedule:
     - cron: '0 6 * * 1'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
 jobs:
   analyze:
-    name: Analyze (${{ matrix.language }})
-    runs-on: ubuntu-latest
     permissions:
       actions: read
       contents: read
       security-events: write
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [actions]
-        # PHP scanning will be added once CodeQL's PHP support stabilizes.
-        # Track at https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: github/codeql-action/init@v4
-        with:
-          languages: ${{ matrix.language }}
-
-      - uses: github/codeql-action/analyze@v4
-        with:
-          category: '/language:${{ matrix.language }}'
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-codeql.yml@8d53efd292e4abee4a9c57b0e379434f54bedbe9

.github/workflows/plugins.yml

@@ -0,0 +1,86 @@
+name: Plugins
+
+# Every directory under plugins/ is a plugin whose main file and mirror its own files name, so a new plugin joins every lane without an edit to the workflows that call this one.
+on:
+  workflow_call:
+    outputs:
+      plugins:
+        description: 'JSON array of the plugin directories under plugins/, each named after its slug.'
+        value: ${{ jobs.list.outputs.plugins }}
+      projects:
+        description: 'JSON array of the Composer projects: the repository root, then each plugin directory.'
+        value: ${{ jobs.list.outputs.projects }}
+      readmes:
+        description: 'JSON array of the plugin directories that hold a readme.txt, which wordpress.org distribution needs.'
+        value: ${{ jobs.list.outputs.readmes }}
+      mirrors:
+        description: 'JSON array of { plugin, repo } objects, the mirror each plugin splits to, as its composer.json name gives it.'
+        value: ${{ jobs.list.outputs.mirrors }}
+      wordpress:
+        description: 'JSON array of { plugin, wp } objects: the newest WordPress release of every branch from each plugin''s Requires at least up.'
+        value: ${{ jobs.list.outputs.wordpress }}
+
+permissions:
+  contents: read
+
+jobs:
+  list:
+    name: List the plugins
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      plugins: ${{ steps.plugins.outputs.plugins }}
+      projects: ${{ steps.plugins.outputs.projects }}
+      readmes: ${{ steps.plugins.outputs.readmes }}
+      mirrors: ${{ steps.plugins.outputs.mirrors }}
+      wordpress: ${{ steps.wordpress.outputs.wordpress }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: List the plugin directories
+        id: plugins
+        run: |
+          plugins=$(find plugins -mindepth 1 -maxdepth 1 -type d -printf '%f\n' | sort | jq -Rsc 'split("\n") | map(select(length > 0)) | if length == 0 then error("plugins/ holds no plugin.") else . end')
+          mirrors='[]'
+          readmes='[]'
+          for plugin in $(jq -r '.[]' <<< "$plugins"); do
+            if ! [[ "$plugin" =~ ^[a-z0-9]+(-[a-z0-9]+)*$ ]] || [ ! -f "plugins/$plugin/$plugin.php" ]; then
+              echo "::error::plugins/$plugin must be a kebab-case slug holding its main file, $plugin.php."
+              exit 1
+            fi
+            repo=$(jq -r '.name // empty' "plugins/$plugin/composer.json")
+            if ! [[ "$repo" =~ ^ahegyes/[a-z0-9]+(-[a-z0-9]+)*$ ]]; then
+              echo "::error::plugins/$plugin/composer.json's name must be its mirror, ahegyes/<repository> — got '$repo'."
+              exit 1
+            fi
+            mirrors=$(jq -c --arg plugin "$plugin" --arg repo "${repo#ahegyes/}" '. + [{ plugin: $plugin, repo: $repo }]' <<< "$mirrors")
+            if [ -f "plugins/$plugin/readme.txt" ]; then
+              readmes=$(jq -c --arg plugin "$plugin" '. + [$plugin]' <<< "$readmes")
+            fi
+          done
+          {
+            echo "plugins=$plugins"
+            echo "projects=$(jq -c '["."] + map("plugins/" + .)' <<< "$plugins")"
+            echo "readmes=$readmes"
+            echo "mirrors=$mirrors"
+          } >> "$GITHUB_OUTPUT"
+
+      # WordPress's version API offers the newest release of every branch, so new releases and raised floors join without an edit here.
+      - name: List the newest WordPress release of every branch from each plugin's floor up
+        id: wordpress
+        env:
+          PLUGINS: ${{ steps.plugins.outputs.plugins }}
+        run: |
+          offers=$(curl -fsS https://api.wordpress.org/core/version-check/1.7/)
+          pairs='[]'
+          for plugin in $(jq -r '.[]' <<< "$PLUGINS"); do
+            floor=$(sed -nE 's|^[[:space:]/*#@]*Requires at least:[[:space:]]*([0-9]+(\.[0-9]+)*).*$|\1|p' "plugins/$plugin/$plugin.php" | head -n 1)
+            if [ -z "$floor" ]; then
+              echo "::error::plugins/$plugin/$plugin.php declares no Requires at least header."
+              exit 1
+            fi
+            pairs=$(printf '%s' "$offers" | jq -c --arg floor "$floor" --arg plugin "$plugin" --argjson pairs "$pairs" '[.offers[].version | select((split(".")[0:2] | map(tonumber)) >= ($floor | split(".")[0:2] | map(tonumber)))] | unique | if length == 0 then error("No WordPress release at or above \($floor) for \($plugin).") else $pairs + map({ plugin: $plugin, wp: . }) end')
+          done
+          echo "wordpress=$pairs" >> "$GITHUB_OUTPUT"