Release 0.5.0 - #32
Merged
Merged
Conversation
Bumps the actions group with 3 updates in the / directory: [shivammathur/setup-php](https://github.com/shivammathur/setup-php), [korelstar/xmllint-problem-matcher](https://github.com/korelstar/xmllint-problem-matcher) and [actions/checkout](https://github.com/actions/checkout). Updates `shivammathur/setup-php` from 2.37.1 to 2.37.2 - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](shivammathur/setup-php@7c071df...f3e473d) Updates `korelstar/xmllint-problem-matcher` from 1.2.0 to 1.3.0 - [Release notes](https://github.com/korelstar/xmllint-problem-matcher/releases) - [Commits](korelstar/xmllint-problem-matcher@1bd292d...dd2ad21) Updates `actions/checkout` from 6.0.2 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...3d3c42e) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: korelstar/xmllint-problem-matcher dependency-version: 1.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: shivammathur/setup-php dependency-version: 2.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
…ons-5b00dae100 Actions(deps): Bump the actions group across 1 directory with 3 updates
With the PHPCS fixes from #13 merged, only five violations remained in shipped code, all auto-fixable and all behaviour-preserving: four stand-alone post-increments become pre-increments, and a stray blank line before the class closing brace is removed. Applied via phpcbf. The ruleset gains the standard build, node_modules and vendor exclusion patterns. The PHPUnit bootstrap is also excluded, since it necessarily declares unprefixed globals and functions that the WordPress test suite requires by name; the exclusion is deliberately scoped to that one file rather than all of tests/, so any tests written later are still checked. phpcs now reports a clean run, which lets CI enforce the standard.
The PHPCS gate has been commented out since the WPCS 3.x upgrade, on the grounds that the plugin carried a backlog of violations. That backlog is gone, so the repository was shipping a full VIPCS ruleset that nothing enforced. Re-enable the two steps: phpcs writes a checkstyle report, and cs2pr turns it into inline diff annotations and fails the job when anything is found. ramsey/composer-install was still pinned to a v1 commit, three majors behind, and was the one action the SHA-pinning pass left stale. Move it to 4.0.0 in both workflows with the documented --prefer-dist --no-progress options. Linting moves to PHP 8.2. The minimum supported version is asserted statically by PHPCompatibilityWP's testVersion setting, so the runtime used to run the sniffs does not need to match it.
Enforce code standards in CI
The plugin shipped no LICENSE file despite being GPL, and the header declared neither a minimum WordPress version nor a minimum PHP version. WordPress therefore allowed installation on any version, even though the toolchain has required PHP 7.4 since the dependency modernisation, so an install on an older PHP would fail at runtime rather than being blocked up front. Add the full GPL-2.0 text, and declare Requires at least, Requires PHP, License URI and Text Domain in the plugin header. The readme.txt header carried the same problem in the form users actually see on WordPress.org: it advertised support back to WordPress 3.3 and claimed testing only up to 5.0, which reads as abandoned. Both now match the constraints the code and tooling genuinely enforce. The tag list is also trimmed to the five WordPress.org actually uses.
Nothing governed the contents of a release. GitHub's generated tarballs and any WordPress.org deploy would have carried the workflows, test harness, coding-standards config and Composer manifest, none of which belong in an installed plugin. Add .gitattributes with export-ignore rules and a matching .distignore for the WordPress.org SVN payload. The four screenshots move to .wordpress-org/, which is where the deploy tooling expects assets to live and which keeps roughly 155KB of images out of the plugin users download; the readme.md links are updated to suit. .gitignore grows from two lines to the documented set, covering build output, the wp-env override, PHPUnit and PHPCS caches and reports, and log files.
The status badge pointed at a workflow named integrate.yml, which has never existed in this repository, so it rendered as permanently unknown. Replace it with badges for the two workflows that do exist. The shared description also read "the moderator can decide whether or not he want to approve the comment or not", which is both ungrammatical and needlessly gendered for a generic moderator. Reword it in both readmes.
Add licence, version requirements and packaging config
The public flag_comment AJAX handler checked only that comment_id was numeric and carried the global report nonce. That nonce is shared by every anonymous visitor and is not bound to a comment, so any numeric ID could be reported, including records that merely share the comments table such as WooCommerce order notes. Once the threshold was reached these hidden entries were moved to moderation even though no report link was ever rendered for them. Gate flagging on a new is_reportable_comment() helper so only existing, ordinary comment types are actionable, and expose filters to adjust the reportable types or veto a target. Add a regression test covering order notes, pingbacks, trackbacks, missing comments and the filters.
Prevent flagging of hidden comments such as order notes
Backfill a Keep a Changelog formatted history for the five published versions (0.3 through 0.4.1) so the content can be reused to populate GitHub Release notes, which the project has never had.
Add CHANGELOG.md for the published versions
The repository carried two near-identical readme files: a WordPress.org readme.txt and a GitHub readme.md. Maintaining both invites drift and duplicates effort. Consolidate into a single README.md that doubles as the WordPress.org readme. The WordPress.org plugin headers (contributors, tags, version requirements, licence) now sit at the top, so the separate Credits, Licence, and Requirements sections are no longer needed. Drop the CI badges, which are meaningless once the file is published to the plugin directory, and point the Changelog at the canonical CHANGELOG.md on GitHub rather than duplicating entries that would otherwise fall out of sync. Screenshots reference their new home under .wordpress-org/.
…iles Consolidate readme.txt and readme.md into a single README.md
Reporting a comment that had already been marked as spam by Akismet or trashed by a moderator would push it straight back into the moderation queue once the report threshold was reached, because mark_flagged() set the status to hold without checking the comment's current state. The existing moderated guard only covered comments that had been approved, so anything sent directly to spam or trash was left unprotected. Restrict the status change to comments that are currently approved, so already-actioned comments are left where the moderator put them. Fixes #16
WordPress.org remains the primary distribution channel for this plugin, yet there was no automated path from a GitHub release to the SVN repo, leaving the trunk and tags to be updated by hand. Manual SVN commits are easy to forget and easy to get wrong. Publishing a release now pushes the build to WordPress.org via the 10up deploy action, keeping GitHub and WordPress.org in step. The existing .distignore controls what ships, and screenshots are taken from the .wordpress-org assets directory. Authentication uses the SVN_USERNAME and SVN_PASSWORD repository secrets.
…kflow Automate WordPress.org SVN deployment on release
Keep spam and trash comments out of the moderation queue
Stop excluding the readme from the plugin distribution. WordPress.org reads README.md when no readme.txt is present, so it must reach both the SVN trunk and the release archives to build the plugin page. Remove the readme entry from .distignore so it survives the SVN deploy and rsync-based builds, and drop its export-ignore in .gitattributes so it is included in git archive output and GitHub release ZIPs. The old entries also used a lowercase readme.md that never matched the actual README.md on case-sensitive targets, so they were misleading as well.
…andards Keep README.md in plugin distributions and archives
The report link was injected by parsing the theme-rendered comment reply-link markup with a regular expression. Any theme that alters that markup broke the match and silently dropped the link; Twenty Twenty, for example, prepends a `do-not-scroll` class, which is the failure reported in #14. The link is now appended to the comment via the `comment_text` filter and moved next to the reply link in the browser, keyed off the reply link's core `data-commentid` attribute, so placement no longer depends on any particular markup. This also covers comments at the maximum threading depth, which have no reply link, and block themes that render comments with the Comment Content block, neither of which the previous approach handled reliably. Resolves #14.
Make the report link appear reliably across all themes
The front-end flagging messages and the "Report comment" link text were hard-coded English, so sites could not translate them. Neither could be wrapped in __() where they lived: PHP forbids function calls in property and parameter defaults, and assigning them in the constructor would call __() before init, triggering WordPress 6.7's early-translation notice. Defaults are now assigned on init via set_default_messages(), which also runs the existing message filters, and the link text is translated lazily in get_flagging_link().
Internationalise user-facing strings
Releases require a refreshed translation template, but the project had no repeatable way to produce one. Add an `i18n` Composer script wrapping `wp i18n make-pot`, pinning `--slug` and `--domain` to the plugin so the generated headers (such as `Report-Msgid-Bugs-To`) never fall back to the working directory's name, which in a Conductor worktree is not the plugin slug.
GaryJones
force-pushed
the
GaryJones/release-0-5-0
branch
from
August 20, 2026 00:39
87cac77 to
abe6583
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This is the 0.5.0 release, the first tagged version since 0.4.1. It collects the fixes and hardening merged to
developtogether with the release housekeeping, and formalises the plugin's minimum requirements as WordPress 6.4 and PHP 7.4.The headline change is how the report link is placed. Earlier versions injected the link by parsing the theme-rendered comment reply-link markup with a regular expression, which broke silently whenever a theme altered that markup (Twenty Twenty, for example, prepends a class). The link is now appended via the
comment_textfilter and moved next to the reply link in the browser, keyed off the reply link's coredata-commentidattribute. Placement no longer depends on theme markup, and the link now also appears at the maximum threading depth, where there is no reply link, and in block themes that render comments with the Comment Content block. The obsoleteadd_flagging_link()method andsafe_report_comments_comment_reply_linkfilter have been removed.Several reporting bugs are fixed alongside it. Flagging is now restricted to genuine public comment types, so an arbitrary numeric ID that merely shares the comments table (such as a WooCommerce order note) can no longer be forced into moderation. Comments already marked as spam or trashed are no longer pushed back into the moderation queue when reported. And the flag cookie is decoded correctly again, restoring per-visitor deduplication so the same person can no longer report a comment repeatedly.
Internationalisation is completed as well. The front-end flagging messages and the "Report comment" link text were hard-coded English and could not be translated; they are now wrapped for translation, with defaults assigned on
initso they load without tripping WordPress 6.7's early-translation notice. The release ships a generated translation template (languages/safe-report-comments.pot) covering all user-facing strings.The release also carries the accumulated repository modernisation from
develop: documentation consolidated intoREADME.md, a CHANGELOG, WordPress.org SVN deploy and GitHub Release automation, CI and code-standards hardening, and dependency bumps.Four commits cover the release itself: the expanded changelog, the generated
.pot, the version bump to 0.5.0, and a newi18nComposer script that pins the plugin slug and text domain so the template's headers do not derive from the working-directory name. Full detail is in the## [0.5.0]section ofCHANGELOG.md.Releasing
Once merged, tagging
0.5.0at the merge commit onmaintriggers the GitHub Release (with ZIP) and the WordPress.org SVN deploy workflows.mainshould then be synced back todevelop.Verifying the headline change