[repile]

Fixes #1207

Makes composer lint:phpcs pass, so the code-standards gate can block the WordPress.org deploy again.

Changes

• .phpcs.xml: based on publishpress-future's ruleset.
  • The three naming sniffs are excluded (PSR1.Methods.CamelCapsMethodName, Squiz.Classes.ValidClassName, PSR1.Classes.ClassDeclaration.MissingNamespace). The comment says they wait for a major version, because Pro and third-party code use those class and method names.
  • The vendor, lib/vendor, dist, node_modules, tests and similar folders are excluded, plus .cache, which dev-workspace creates inside the repo in CI (its wp_test mu-plugin made the first CI run fail).
• .phpcs-plugin-review.xml: lint:phpcs in dev-workspace 1.7.0 runs a second pass with the WordPress.org plugin-review (Plugin Check) rules. Without this file that pass fails with "You must supply at least one file". It's modelled on Future's file.
• Constants: 36 class constants now say public. Requires PHP is 7.2.5, and Pro only overrides these constants as implicit-public const, so nothing breaks.
• Small findings: these were fixed instead of ignored:
  • parse_url() → wp_parse_url()
  • json_encode() → wp_json_encode() (only used to build cache keys; the output is the same)
  • STYLESHEETPATH/TEMPLATEPATH → get_stylesheet_directory()/get_template_directory()
  • one missing wp_unslash()
  • an isset() guard on $_POST['requirement'] in the OpenAI AJAX handler
  • a leftover debug comment removed
  • the } // comment elseif layout in Openai_item::clean_up_content()
• Intentional findings: annotated with a reason:
  • the plugin's error_log() in its error handler
  • the 60 s OpenAI timeout
  • strip_tags() in the word count (switching would change counts)
  • exclude in the tag term query
  • direct queries in uninstall.php
• Workflows:
  • needs: [code-check] is back on deploy-wp-org in deploy-free.yml.
  • code-standards.yml now also runs on pull_request. Before, it only ran when called from another workflow or started by hand, so PRs never got a run.
• Build: the three phpcs config files are left out of the plugin zip (.rsync-filters-pre-build).

phpcs counts (latest development, PHP 8.3)

	Before (Future's .phpcs.xml as is)	After
Pass 1 (.phpcs.xml)	589 errors, 114 warnings in 67 files (703 findings)	0
Pass 2 (plugin review)	config missing, so the pass fails; 82 findings once the file exists	0

Breakdown of pass 1:

• 287 naming findings, now excluded until a major version
• 64 nonce findings (53 Recommended, 11 Missing)
• 36 constants without visibility
• 240 phpcbf-fixable formatting findings
• about 40 other findings

composer check:php, composer lint:php and composer lint:phpcs pass locally on PHP 8.3.

Nonce findings (all 64 reviewed)

No real security issue was found. Every path that changes state already checks both a nonce and a capability: settings save, global checklist save, the post meta box save, and the AJAX handlers. No new issues were opened.

Where	What it does	How it's handled
checklists.php save_global_checklist() (1 Missing)	Read $_POST to see whether the form was sent, then checked the nonce. Nothing was saved without a valid nonce and manage_checklists.	Fixed: the nonce is now checked first. The result is the same either way: it returns without saving.
Custom_item::filter_settings_validate(), permissions.php validateRequirementSettings() (2 Missing)	Read $_POST from the publishpress_checklists_validate_requirement_settings filter, which only runs inside save_global_checklist()	phpcs:ignore, citing the nonce and capability checks done there
Module::isWhitelistedSettingsView() (7 Recommended)	Compares page/module to known slugs	phpcs:disable/enable, read-only routing
Module::printDefaultHeader(), settings.php options_page_controller() (19 Recommended, 8 Missing)	module/message/error args pick a tab and a notice from a fixed list, escaped on output	phpcs:disable/enable, read-only display
Util::getCurrentPostType() (5)	post/post_type args tell which post type the screen is for	phpcs:disable/enable, read-only
LegacyPlugin and checklists.php Classic Editor checks (4)	Classic Editor's own classic-editor / classic-editor__forget args	phpcs:ignore, read-only editor detection
Asset enqueue in checklists.php/settings.php (10)	page arg decides which assets load	phpcs:ignore, read-only
Quick Edit rows in settings.php (4)	post_type arg decides whether to hide a Quick Edit field	phpcs:ignore, read-only
helper_print_error_or_description() (2)	Shows a form error, escaped	phpcs:disable/enable; also added the missing wp_unslash()
Global checklists success flag (2)	Shows the "saved" notice after the redirect	phpcs:ignore, read-only

Formatting: excluded for now, no phpcbf pass

The 240 remaining formatting findings are all auto-fixable, but phpcbf would rewrite 61 files right before the 2.30 release. Instead, the 31 exact sniff codes are excluded in .phpcs.xml under a TODO: phpcbf pass after 2.30 comment. This keeps the PR to annotations, constant visibility and a few one-line changes. The trade-off is that new formatting slips in those 31 codes won't be caught until the phpcbf pass is done.

Deferred

• Naming sniffs: class and method renames (e.g. PPCH_Reviews, Base_counter, Meta_Description::init_language) belong in a major version, with a deprecation path for Pro and third-party code.
• phpcbf pass: the 240 formatting findings in 61 files go in their own PR with a full test pass. Remove the exclusions from .phpcs.xml as part of it.

Testing

Smoke-tested on a fresh SandyWP sandbox (latest WordPress, PHP 8.3, Classic Editor plugin):

• Settings page save: works, the options stay objects.
• Global checklist save: Title count set to Required with a minimum of 40; it saved and stays a stdClass object.
• Block editor: publishing is blocked and the pre-publish panel lists the incomplete required task; it publishes once the task is done.
• Classic Editor: the checklist meta box shows, and publishing is blocked by the "Please complete the following tasks" dialog; it publishes once the task is done.
• Logs: no JS errors and no HTTP 4xx/5xx responses; the PHP debug log has nothing from the plugin.

The sandbox has been deleted.

🤖 Generated with Claude Code