WP Plugin Starter 1.0.0: a fresh start

The parts every wpallstars plugin needs: settings screen with search and an empty General tab, Read Me tab, features as classes, replaced plugins, the shared GitHub updater, release and check scripts, CI and the shared rules. scripts/rename-plugin.sh starts a new plugin; scripts/sync-core.sh keeps plugins' core files in step with this starter. Built with aidevops (https://aidevops.sh).

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,62 @@
+name: Bug report
+description: Something in WP Plugin Starter does not work as it should.
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Security problems: please do not report them here. See SECURITY.md.
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened
+      description: What you saw, and what you expected instead.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: The feature involved, its settings, and what you clicked.
+      placeholder: |
+        1. Turn on …
+        2. Open …
+        3. See …
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: WP Plugin Starter version
+      description: Shown on the Plugins screen.
+    validations:
+      required: true
+  - type: dropdown
+    id: source
+    attributes:
+      label: Installed from
+      options:
+        - GitHub release
+        - WordPress.org
+        - Other
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: WordPress and PHP versions
+      description: Tools → Site Health → Info shows both.
+      placeholder: WordPress 6.8, PHP 8.3
+    validations:
+      required: true
+  - type: textarea
+    id: log
+    attributes:
+      label: Messages in debug.log
+      description: Lines from wp-content/debug.log that mention wpstarter, if any. Remove anything private first.
+      render: text
+  - type: textarea
+    id: more
+    attributes:
+      label: Anything else
+      description: Theme, other plugins involved, multisite, screenshots.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security problem
+    url: https://github.com/wpallstars/wp-plugin-starter-template-for-ai-coding/blob/main/SECURITY.md
+    about: Report security problems privately, never in a public issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,27 @@
+name: Feature request
+description: Suggest a feature or an improvement.
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem
+      description: What is slow, missing or annoying today, and for whom.
+    validations:
+      required: true
+  - type: textarea
+    id: idea
+    attributes:
+      label: What WP Plugin Starter could do
+      description: What it would do on its own, without new settings where possible.
+    validations:
+      required: true
+  - type: input
+    id: replaces
+    attributes:
+      label: Plugin it would replace
+      description: If another plugin does this now, its name and WordPress.org page.
+  - type: textarea
+    id: more
+    attributes:
+      label: Anything else

.github/dependabot.yml

@@ -0,0 +1,21 @@
+# Weekly updates for the pinned GitHub Actions and the Composer development
+# tools (composer.json; the plugin itself has no Composer dependencies).
+# Each ecosystem's updates come grouped in one pull request.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ["*"]
+
+  - package-ecosystem: composer
+    directory: /
+    schedule:
+      interval: weekly
+    versioning-strategy: lockfile-only
+    groups:
+      dev-tools:
+        patterns: ["*"]

.github/pull_request_template.md

@@ -0,0 +1,19 @@
+## What and why
+
+<!-- What changed, and the problem it solves. Link the issue: Resolves #123. -->
+
+## How it was tested
+
+<!-- The steps you took on a real WordPress site, and what you saw. -->
+
+- [ ] `scripts/lint.sh` passes.
+- [ ] Tested the changed feature on a WordPress site, with no new messages
+      mentioning `wpstarter` in `debug.log`.
+- [ ] WordPress 6.2 with PHP 7.4, if this uses a core function. <!-- or n/a -->
+- [ ] Kadence light and dark mode, if this changes front-end styles. <!-- or n/a -->
+
+## Checklist
+
+- [ ] Changelog lines in `README.md`, `changelog.txt` and `readme.txt`.
+- [ ] New options, post meta, transients or cron hooks are removed in `uninstall.php`.
+- [ ] New features are off by default.

.github/workflows/ci.yml

@@ -0,0 +1,138 @@
+# Checks for every pull request and every push to main. Run the same checks
+# locally with scripts/lint.sh, scripts/preflight-release.sh,
+# scripts/plugin-check.sh and scripts/smoke-test.sh (DEVELOPMENT.md).
+#
+# Lint runs on every push. The release and smoke-test jobs take longer, so
+# draft pull requests skip them until they are marked ready for review.
+# Actions are pinned to commit SHAs; Dependabot keeps them up to date.
+name: CI
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: Lint (PHP 7.4)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        with:
+          php-version: "7.4"
+          coverage: none
+          tools: composer:v2
+
+      - name: Composer cache folder
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: composer-${{ hashFiles('composer.lock') }}
+          restore-keys: composer-
+
+      - name: Install development tools
+        run: composer install --no-interaction --no-progress --prefer-dist
+
+      # PHPStan's result cache: the latest run's is restored, so only files
+      # changed since then are analysed again.
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .cache/phpstan
+          key: phpstan-${{ github.run_id }}
+          restore-keys: phpstan-
+
+      - name: PHP syntax (7.4), JavaScript syntax, ShellCheck, PHPCS, PHPStan
+        run: scripts/lint.sh php js shell phpcs phpstan
+
+      - name: actionlint
+        run: docker run --rm -v "$PWD:/repo" --workdir /repo rhysd/actionlint:1.7.12 -color
+
+  release:
+    name: Release build, preflight and Plugin Check
+    needs: lint
+    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        with:
+          php-version: "7.4"
+          coverage: none
+          tools: none
+
+      - name: Preflight
+        run: scripts/preflight-release.sh --offline --no-docker
+
+      - name: Build both zips
+        run: scripts/build-release.sh --out dist
+
+      - name: Plugin Check
+        run: |
+          args=()
+          for zip in dist/*.zip; do
+            args+=(--zip "$zip")
+          done
+          scripts/plugin-check.sh "${args[@]}" --keep-output dist/plugin-check
+
+      - name: Keep the zips and reports for testing
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ${{ github.event.repository.name }}-build-${{ github.sha }}
+          path: dist/
+          retention-days: 7
+          if-no-files-found: ignore
+
+  smoke:
+    name: Smoke test (WordPress ${{ matrix.wp }}, PHP ${{ matrix.php }})
+    needs: lint
+    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Minimums (readme.txt, plugin header).
+          - wp: "6.2"
+            php: "7.4"
+          - wp: latest
+            php: "8.3"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Smoke test
+        run: scripts/smoke-test.sh --wp "${{ matrix.wp }}" --php "${{ matrix.php }}" --keep-log debug.log
+
+      - name: Keep debug.log
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: debug-log-wp${{ matrix.wp }}-php${{ matrix.php }}
+          path: debug.log
+          retention-days: 7
+          if-no-files-found: ignore