Release 0.5.0

.distignore

@@ -0,0 +1,25 @@
+# Directories
+/.git/
+/.github/
+/.wordpress-org/
+/bin/
+/node_modules/
+/tests/
+/vendor/
+
+# Files
+/.distignore
+/.editorconfig
+/.gitattributes
+/.gitignore
+/.phpcs.xml.dist
+/.wp-env.json
+/.wp-env.override.json
+/CHANGELOG.md
+/composer.json
+/composer.lock
+/phpunit.xml.dist
+
+# Caches and logs
+/.phpunit.cache/
+*.log

.gitattributes

@@ -0,0 +1,40 @@
+# Exclude these files from release archives.
+# This will also make them unavailable when using Composer with `--prefer-dist`.
+# If you develop for this plugin using Composer, use `--prefer-source`.
+# https://blog.madewithlove.be/post/gitattributes/
+
+# Directories
+/.github/                        export-ignore
+/.wordpress-org/                 export-ignore
+/bin/                            export-ignore
+/node_modules/                   export-ignore
+/tests/                          export-ignore
+/vendor/                         export-ignore
+
+# Files
+/.distignore                     export-ignore
+/.editorconfig                   export-ignore
+/.gitattributes                  export-ignore
+/.gitignore                      export-ignore
+/.phpcs.xml.dist                 export-ignore
+/.wp-env.json                    export-ignore
+/.wp-env.override.json           export-ignore
+/CHANGELOG.md                    export-ignore
+/composer.json                   export-ignore
+/composer.lock                   export-ignore
+/phpunit.xml.dist                export-ignore
+
+# Auto detect text files and perform LF normalization
+# https://pablorsk.medium.com/be-a-git-ninja-the-gitattributes-file-e58c07c9e915
+
+* text=auto
+
+# The above will handle all files NOT found below
+
+*.md text
+*.php text
+*.inc text
+*.js text
+*.txt text
+
+*.png binary

.github/workflows/cs-lint.yml

@@ -39,11 +39,13 @@ jobs:
 
     steps:
       - name: Setup PHP
-        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
-          php-version: "7.4"
+          # Linting and CS run on a recent PHP; the minimum supported version is
+          # checked statically by PHPCompatibilityWP via the testVersion config.
+          php-version: "8.2"
           coverage: none
-          tools: cs2pr
+          tools: composer, cs2pr
 
       # Show PHP lint violations inline in the file diff.
       # @link https://github.com/marketplace/actions/xmllint-problem-matcher
@@ -53,10 +55,10 @@ jobs:
       # Show XML violations inline in the file diff.
       # @link https://github.com/marketplace/actions/xmllint-problem-matcher
       - name: Register XML violations to appear as file diff comments
-        uses: korelstar/xmllint-problem-matcher@1bd292d642ddf3d369d02aaa8b262834d61198c0 # v1.2.0
+        uses: korelstar/xmllint-problem-matcher@dd2ad21bd8a2de0187cb621419537f345e7e509c # v1.3.0
 
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -68,7 +70,9 @@ jobs:
       # Install dependencies and handle caching in one go.
       # @link https://github.com/marketplace/actions/install-composer-dependencies
       - name: Install Composer dependencies
-        uses: ramsey/composer-install@994bb194a4fefcf39449ccf0f7766a4318f1ac76 # v1
+        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
+        with:
+          composer-options: "--prefer-dist --no-progress"
 
       # Lint PHP.
       - name: Lint PHP against parse errors
@@ -83,10 +87,11 @@ jobs:
           xml-schema-file: ./vendor/phpunit/phpunit/phpunit.xsd
 
       # Check the code-style consistency of the PHP files.
-      # Temporarily disabled: the plugin carries a backlog of pre-existing WPCS 3.x
-      # violations (see PR #13). Re-enable this gate once that cleanup has landed.
-      # - name: Check PHP code style
-      #   run: composer cs -- --report-full --report-checkstyle=./phpcs-report.xml
-      #
-      # - name: Show PHPCS results in PR
-      #   run: cs2pr ./phpcs-report.xml
+      # continue-on-error lets the next step turn the report into inline
+      # annotations; cs2pr then fails the job if any violations were found.
+      - name: Check PHP code style
+        continue-on-error: true
+        run: composer cs -- --report-full --report-checkstyle=./phpcs-report.xml
+
+      - name: Show PHPCS results in PR
+        run: cs2pr ./phpcs-report.xml

.github/workflows/deploy.yml

@@ -0,0 +1,32 @@
+name: Deploy to WordPress.org
+
+on:
+  release:
+    types: [released] # Trigger when a (non-prerelease) release is published.
+
+# Disable all permissions by default; grant minimal permissions per job.
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    name: Deploy to WordPress.org SVN
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: WordPress.org plugin deploy
+        uses: 10up/action-wordpress-plugin-deploy@54bd289b8525fd23a5c365ec369185f2966529c2 # v2.3.0
+        env:
+          SLUG: safe-report-comments
+          SVN_USERNAME: ${{ secrets.SVN_USERNAME }}
+          SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }}

.github/workflows/integrations.yml

@@ -50,12 +50,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup PHP ${{ matrix.php }}
-        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: ${{ matrix.php }}
           coverage: none
@@ -68,7 +68,9 @@ jobs:
         run: echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json"
 
       - name: Install Composer dependencies
-        uses: ramsey/composer-install@994bb194a4fefcf39449ccf0f7766a4318f1ac76 # v1
+        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
+        with:
+          composer-options: "--prefer-dist --no-progress"
 
       - name: Start MySQL service
         run: sudo systemctl start mysql.service

.gitignore

@@ -1,2 +1,23 @@
-composer.lock
-vendor/
+# Dependencies
+/node_modules/
+/vendor/
+/composer.lock
+
+# Built assets (generated by build process)
+/build/
+
+# WordPress environment
+/.wp-env.override.json
+
+# Tests
+/.phpunit.cache/
+/phpunit.xml
+
+# PHPCS
+/phpcs.xml
+/.phpcs.xml
+/phpcs-report.xml
+
+# Logs
+*.log
+npm-debug.log*

.phpcs.xml.dist

@@ -9,7 +9,12 @@
 	<file>.</file>
 	<!-- Ignoring Files and Folders:
 		https://github.com/squizlabs/PHP_CodeSniffer/wiki/Advanced-Usage#ignoring-files-and-folders -->
-	<exclude-pattern>/vendor/</exclude-pattern>
+	<exclude-pattern>*/build/*</exclude-pattern>
+	<exclude-pattern>*/node_modules/*</exclude-pattern>
+	<exclude-pattern>*/vendor/*</exclude-pattern>
+	<!-- The PHPUnit bootstrap necessarily declares unprefixed globals and
+		functions that the WordPress test suite requires by name. -->
+	<exclude-pattern>*/tests/bootstrap.php</exclude-pattern>
 
 	<!-- How to scan -->
 	<!-- Usage instructions: https://github.com/squizlabs/PHP_CodeSniffer/wiki/Usage -->

CHANGELOG.md

@@ -0,0 +1,67 @@
+# Changelog for Safe Report Comments
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.5.0] - 2026-08-20
+
+This release formalises the plugin's minimum requirements as WordPress 6.4 and PHP 7.4.
+
+### Changed
+
+- In automatic mode the report link is attached via the `comment_text` filter and positioned client-side, instead of via the `comment_reply_link` filter.
+- Front-end flagging messages and the "Report comment" link text are now translatable; they were previously hard-coded in English (#33).
+
+### Removed
+
+- Internal `add_flagging_link()` method and the `safe_report_comments_comment_reply_link` filter, which the new placement mechanism no longer uses.
+
+### Fixed
+
+- Report link no longer disappears on themes that modify the comment reply-link markup, such as Twenty Twenty. It is now positioned in the browser next to the reply link rather than by parsing that markup server-side (#14).
+- Report link now appears on comments at the maximum threading depth, where WordPress renders no reply link.
+- Report link now appears in block themes that render comments with the Comment Content block, not only classic `wp_list_comments()` output.
+- Reporting a comment already marked as spam or trashed no longer pushes it back into the moderation queue; only currently approved comments are moved to hold (#16).
+- A visitor's own report is remembered again via the flag cookie, so the same comment can no longer be reported repeatedly by one person (#15).
+
+### Security
+
+- Flagging is now restricted to genuine, public comment types. Previously any numeric ID that shared the comments table — such as WooCommerce order notes — could be reported and forced into moderation once the threshold was reached, even though no report link was ever shown for it. A new `is_reportable_comment()` helper gates flagging, with filters to adjust the reportable types or veto a target.
+
+## [0.4.1] - 2014-07-23
+
+### Fixed
+
+- Typo fix (props @spencermorin).
+
+## [0.4] - 2014-07-23
+
+### Security
+
+- Security fix (h/t vortfu).
+
+## [0.3.2] - 2013-03-06
+
+### Added
+
+- New `safe_report_comments_allow_moderated_to_be_reflagged` filter allows comments to be reflagged after being moderated.
+
+## [0.3.1] - 2012-11-21
+
+### Fixed
+
+- Use `home_url()` for generating the `ajaxurl` on mapped domains, but `admin_url()` where the domain isn't mapped.
+
+## [0.3] - 2012-11-07
+
+### Changed
+
+- Coding standards and cleanup.
+
+[0.5.0]: https://github.com/Automattic/safe-report-comments/compare/0.4.1...0.5.0
+[0.4.1]: https://github.com/Automattic/safe-report-comments/compare/0.4...0.4.1
+[0.4]: https://github.com/Automattic/safe-report-comments/compare/0.3.2...0.4
+[0.3.2]: https://github.com/Automattic/safe-report-comments/compare/0.3.1...0.3.2
+[0.3.1]: https://github.com/Automattic/safe-report-comments/compare/0.3...0.3.1