fix: resolve ShellCheck violations in shell scripts (#91 )

- SC2155 (bin/localwp-setup.sh): declare local variables separately from command substitution assignments to avoid masking return values (13 fixes) - SC2034 (bin/localwp-setup.sh): remove unused PLUGIN_TEXT_DOMAIN variable - SC2162 (bin/localwp-setup.sh): add -r flag to read to avoid backslash mangling - SC2154 (bin/setup-test-env.sh): add shellcheck disable for PHP variables in heredoc that ShellCheck incorrectly identifies as unassigned shell variables - bin/setup-test-env.sh: remove self-modifying chmod +x $0 (unnecessary and bad practice; file permissions should be set once in version control) - bin/setup-test-env.sh: change == to = in POSIX [ ] test expressions - build.sh: add ./ prefix to directory glob copies for clarity - build.sh: use subshell (cd build || exit 1; zip ...) instead of bare cd/cd.. to avoid SC2103 and ensure working directory is always restored Fixes part of #20 (shell script quality issues)
fix: pin all GitHub Actions to full commit SHAs (resolves SonarCloud S7637) (#90 )
2026-03-18 11:47:38 +00:00 · 2026-03-18 04:58:57 +00:00 · 2026-03-17 21:00:19 +00:00 · 2026-03-17 20:50:19 +00:00 · 2026-03-17 20:45:53 +00:00 · 2026-03-17 20:37:05 +00:00
36 changed files with 971 additions and 770 deletions
--- a/.agents/error-checking-feedback-loops.md
+++ b/.agents/error-checking-feedback-loops.md
@@ -23,34 +23,39 @@ AI assistants can directly monitor GitHub Actions workflows using the GitHub API

 This helps identify failures and diagnose issues:

-```
+```text
 github-api /repos/{owner}/{repo}/actions/runs
 ```

 #### Step-by-Step Process

 1. **Get Recent Workflow Runs**:
-   ```
+
+   ```text
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/actions/runs
   ```

 2. **Filter for Failed Runs**:
-   ```
+
+   ```text
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/actions/runs?status=failure
   ```

 3. **Get Details for a Specific Run**:
-   ```
+
+   ```text
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/actions/runs/{run_id}
   ```

 4. **Get Jobs for a Workflow Run**:
-   ```
+
+   ```text
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/actions/runs/{run_id}/jobs
   ```

 5. **Analyze Job Logs** (if accessible via API):
-   ```
+
+   ```text
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/actions/jobs/{job_id}/logs
   ```

@@ -61,6 +66,7 @@ github-api /repos/{owner}/{repo}/actions/runs
 **Error**: `Missing download info for actions/upload-artifact@v3`

 **Solution**: Update to the latest version of the action:
+
 ```yaml
 uses: actions/upload-artifact@v4
 ```
@@ -70,7 +76,8 @@ uses: actions/upload-artifact@v4
 **Error**: `The current host is 127.0.0.1:8888, but WordPress multisites do not support custom ports.`

 **Solution**: Use port 80 for multisite environments:
-```yaml
+
+```bash
 npx @wp-playground/cli server --blueprint playground/multisite-blueprint.json --port 80 --login &
 ```

@@ -79,6 +86,7 @@ npx @wp-playground/cli server --blueprint playground/multisite-blueprint.json --
 **Error**: Invalid path syntax for artifacts

 **Solution**: Use multi-line format for better readability:
+
 ```yaml
 path: |
  cypress/videos
@@ -90,6 +98,7 @@ path: |
 **Problem**: Redundant workflow runs when multiple commits land quickly

 **Solution**: Add concurrency control to cancel in-progress runs:
+
 ```yaml
 concurrency:
  group: playground-tests-${{ github.ref }}
@@ -125,16 +134,19 @@ npm run test:playground:multisite
 ### Capturing and Analyzing Test Output

 1. **Run Tests with Output Capture**:
+
   ```bash
   npm run test:single > test-output.log 2>&1
   ```

 2. **Analyze Output for Errors**:
+
   ```bash
-   cat test-output.log | grep -i 'error\|fail\|exception'
+   grep -i 'error\|fail\|exception' test-output.log
   ```

 3. **Parse Structured Test Results** (if available):
+
   ```bash
   cat cypress/results/results.json
   ```
@@ -146,6 +158,7 @@ npm run test:playground:multisite
 **Error**: `The current host is 127.0.0.1:8888, but WordPress multisites do not support custom ports.`

 **Solution**: Modify the port in the blueprint or test configuration:
+
 ```json
 {
  "features": {
@@ -159,6 +172,7 @@ npm run test:playground:multisite
 **Error**: `Timed out retrying after 4000ms: expected '<body...>' to have class 'wp-admin'`

 **Solution**: Update selectors to be more robust and handle login states:
+
 ```javascript
 cy.get('body').then(($body) => {
  if ($body.hasClass('login')) {
@@ -199,16 +213,19 @@ npm run lint:css
 ### Parsing Code Quality Tool Output

 1. **Run Code Quality Check**:
+
   ```bash
   composer run phpcs > phpcs-output.log 2>&1
   ```

 2. **Analyze Output for Errors**:
+
   ```bash
-   cat phpcs-output.log | grep -i 'ERROR\|WARNING'
+   grep -i 'ERROR\|WARNING' phpcs-output.log
   ```

 3. **Automatically Fix Issues** (when possible):
+
   ```bash
   composer run phpcbf
   ```
@@ -221,13 +238,13 @@ AI assistants can check these comments to identify and address issues.

 #### Accessing PR Comments via GitHub API

-```
+```text
 github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/pulls/{pull_number}/comments
 ```

 #### Accessing PR Review Comments

-```
+```text
 github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/pulls/{pull_number}/reviews
 ```

@@ -236,7 +253,8 @@ github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/pulls/{pul
 CodeRabbit provides AI-powered code review comments via the GitHub API.

 1. **Get PR Comments**:
-   ```
+
+   ```text
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/pulls/{pull_number}/comments
   ```

@@ -254,12 +272,14 @@ CodeRabbit provides AI-powered code review comments via the GitHub API.
 These tools provide automated code quality checks and post results as PR comments.

 1. **Check PR Status Checks**:
-   ```
+
+   ```text
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/commits/{sha}/check-runs
   ```

 2. **Get Detailed Reports** (if available via API):
-   ```
+
+   ```text
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/commits/{sha}/check-runs/{id}
   ```

@@ -275,7 +295,8 @@ These tools provide automated code quality checks and post results as PR comment
 SonarCloud provides detailed code quality and security analysis.

 1. **Check SonarCloud Status**:
-   ```
+
+   ```text
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/commits/{sha}/check-runs?check_name=SonarCloud
   ```

@@ -293,6 +314,7 @@ SonarCloud provides detailed code quality and security analysis.
 **Error**: `ERROR: Expected snake_case for function name, but found camelCase`

 **Solution**: Rename functions to follow snake_case convention:
+
 ```php
 // Before
 function getPluginVersion() { ... }
@@ -306,6 +328,7 @@ function get_plugin_version() { ... }
 **Error**: `ERROR: Missing doc comment for function`

 **Solution**: Add proper docblocks:
+
 ```php
 /**
 * Get the plugin version.
@@ -332,7 +355,8 @@ function get_plugin_version() { ... }
 #### Extracting Actionable Items from PR Comments

 1. **Collect All Feedback**:
-   ```
+
+   ```text
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/pulls/{number}/comments
   github-api /repos/wpallstars/wp-plugin-starter-template-for-ai-coding/pulls/{number}/reviews
   ```
@@ -364,7 +388,7 @@ function get_plugin_version() { ... }

 ### Complete Feedback Loop System

-```
+```text
 Code Changes ──► Local Testing ──► GitHub Actions
     │                │                  │
     ▼                ▼                  ▼
@@ -395,7 +419,7 @@ These can be directly accessed and processed.

 #### Example CodeRabbit Feedback

-```
+```text
 coderabbitai bot left a comment
 Actionable comments posted: 1

@@ -424,14 +448,14 @@ These tools provide structured feedback that can be systematically addressed.

 #### Example SonarCloud Feedback

-```
+```text
 SonarCloud Quality Gate failed
 - 3 Bugs
 - 5 Code Smells
 - 1 Security Hotspot
 ```

-#### Processing Steps
+#### SonarCloud Processing Steps

 1. **Access Detailed Reports**:
   * Use the SonarCloud API or web interface
@@ -479,6 +503,7 @@ AI assistants can contribute fixes upstream.
 ### Workflow for External Contributions

 1. **Clone the Repository Locally**:
+
   ```bash
   cd ~/Git
   git clone https://github.com/owner/repo.git
@@ -487,6 +512,7 @@ AI assistants can contribute fixes upstream.
   ```

 2. **Make Changes and Commit**:
+
   ```bash
   # Make your changes
   git add -A
@@ -498,6 +524,7 @@ AI assistants can contribute fixes upstream.
   ```

 3. **Fork and Push**:
+
   ```bash
   # Create a fork (if not already forked)
   gh repo fork owner/repo --clone=false --remote=true
@@ -510,6 +537,7 @@ AI assistants can contribute fixes upstream.
   ```

 4. **Create Pull Request**:
+
   ```bash
   gh pr create \
     --repo owner/repo \
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -16,9 +16,23 @@ module.exports = {
    sourceType: 'module'
  },
  rules: {
+    'comma-dangle': ['error', 'always-multiline'],
    'no-console': 'warn',
    'no-unused-vars': 'warn'
  },
+  overrides: [
+    {
+      // cypress.config.js uses CommonJS (require/module.exports).
+      // Override sourceType to 'script' so ESLint does not flag require as undefined.
+      files: ['cypress.config.js', 'cypress.config.cjs'],
+      parserOptions: {
+        sourceType: 'script'
+      },
+      env: {
+        node: true
+      }
+    }
+  ],
  globals: {
    cy: 'readonly',
    Cypress: 'readonly',
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -20,7 +20,7 @@ jobs:
          clean: 'true'

      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
        with:
          php-version: '8.1'
          extensions: mbstring, intl, zip
@@ -47,7 +47,7 @@ jobs:
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
        with:
          php-version: '8.1'
          extensions: mbstring, intl, zip
@@ -68,7 +68,7 @@ jobs:
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
        with:
          php-version: '8.1'
          extensions: mbstring, intl, zip
@@ -119,7 +119,7 @@ jobs:
  #
  #     - name: SonarCloud Scan
  #       if: steps.check_sonar_token.outputs.skip != 'true'
-  #       uses: SonarSource/sonarqube-scan-action@master
+  #       uses: SonarSource/sonarqube-scan-action@9598b8a83feef37de07f549027fab50ecffe6a6e # master
  #       env:
  #         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  #         SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
@@ -152,7 +152,7 @@ jobs:
          fi

      - name: Run Codacy Analysis CLI
-        uses: codacy/codacy-analysis-cli-action@v4
+        uses: codacy/codacy-analysis-cli-action@562ee3e92b8e92df8b67e0a5ff8aa8e261919c08 # v4
        with:
          project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
          verbose: true
@@ -167,7 +167,7 @@ jobs:

      - name: Upload SARIF results file
        if: steps.check_codacy_token.outputs.skip_upload != 'true'
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@603b797f8b14b413fe025cd935a91c16c4782713 # v3
        with:
          sarif_file: results.sarif
        continue-on-error: true
--- a/.github/workflows/phpunit.yml
+++ b/.github/workflows/phpunit.yml
@@ -42,7 +42,7 @@ jobs:
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
        with:
          php-version: ${{ matrix.php }}
          extensions: dom, curl, libxml, mbstring, zip, pdo, mysql, pdo_mysql, bcmath, soap, intl, gd, exif, iconv
--- a/.github/workflows/playground-tests-fix.yml
+++ b/.github/workflows/playground-tests-fix.yml
@@ -36,7 +36,7 @@ jobs:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

    - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
      with:
        node-version: '20'
        cache: 'npm'
@@ -98,7 +98,7 @@ jobs:

    - name: Upload Cypress artifacts
      if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
      with:
        name: cypress-playground-results
        path: |
--- a/.github/workflows/playground-tests.yml
+++ b/.github/workflows/playground-tests.yml
@@ -40,7 +40,7 @@ jobs:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

    - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
      with:
        node-version: ${{ matrix.node-version }}
        cache: 'npm'
@@ -67,7 +67,7 @@ jobs:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

    - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
      with:
        node-version: '20'
        cache: 'npm'
@@ -142,7 +142,7 @@ jobs:

    - name: Upload Cypress artifacts
      if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
      with:
        name: cypress-single-site-results
        path: |
@@ -163,7 +163,7 @@ jobs:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

    - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
      with:
        node-version: '20'
        cache: 'npm'
@@ -239,7 +239,7 @@ jobs:

    - name: Upload Cypress artifacts
      if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
      with:
        name: cypress-multisite-results
        path: |
@@ -261,7 +261,7 @@ jobs:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

    - name: WordPress Performance Tests
-      uses: swissspidy/wp-performance-action@v2.0.3
+      uses: swissspidy/wp-performance-action@b7e3ffcf0fc4a48b62492e021e0ebeb51430ff11 # v2.0.3
      with:
        plugins: |
          ./
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,10 +14,10 @@ jobs:
      contents: write
    steps:
      - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
        with:
          php-version: '7.4'
          extensions: mbstring, intl, zip
@@ -62,7 +62,7 @@ jobs:

      - name: Create Release
        id: create_release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
        with:
          files: wp-plugin-starter-template-for-ai-coding-${{ env.VERSION }}.zip
          name: v${{ env.VERSION }} - WordPress Plugin Starter Template
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -49,7 +49,7 @@ jobs:

      - name: SonarCloud Scan
        if: steps.check_token.outputs.skip != 'true'
-        uses: SonarSource/sonarqube-scan-action@master
+        uses: SonarSource/sonarqube-scan-action@9598b8a83feef37de07f549027fab50ecffe6a6e # master
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONARCLOUD_GITHUB }}
--- a/.github/workflows/sync-wiki.yml
+++ b/.github/workflows/sync-wiki.yml
@@ -15,7 +15,7 @@ jobs:
      contents: write
    steps:
      - name: Checkout source code
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0

      - name: Configure Git
        run: |
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -17,12 +17,12 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          clean: 'true'

      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
        with:
          php-version: ${{ matrix.php-versions }}
          extensions: mbstring, intl, zip
@@ -43,12 +43,12 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          clean: 'true'

      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
        with:
          php-version: '7.4'
          extensions: mbstring, intl, zip
--- a/.github/workflows/wordpress-tests.yml
+++ b/.github/workflows/wordpress-tests.yml
@@ -37,7 +37,7 @@ jobs:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

    - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
      with:
        node-version: ${{ matrix.node-version }}
        cache: 'npm'
@@ -73,7 +73,7 @@ jobs:
    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

    - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
      with:
        node-version: '20'
        cache: 'npm'
@@ -124,7 +124,7 @@ jobs:

    - name: Upload Cypress artifacts
      if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
      with:
        name: cypress-results
        path: |
--- a/.gitignore
+++ b/.gitignore
@@ -63,3 +63,6 @@ temp/
 coverage/
 .phpunit.result.cache
 .agents/loop-state/
+
+# Local tool configs
+.superset/
--- a/.markdownlint.json
+++ b/.markdownlint.json
@@ -1,4 +1,7 @@
 {
+  "MD004": {
+    "style": "asterisk"
+  },
  "MD012": false,
  "MD022": false,
  "MD031": false,
--- a/.wiki/Contributing.md
+++ b/.wiki/Contributing.md
@@ -6,11 +6,11 @@ Thank you for considering contributing to this project! This document provides g

 By participating in this project, you agree to abide by our code of conduct:

- Be respectful and inclusive
- Be patient and welcoming
- Be considerate
- Be collaborative
- Be open-minded
+* Be respectful and inclusive
+* Be patient and welcoming
+* Be considerate
+* Be collaborative
+* Be open-minded

 ## How to Contribute

@@ -26,12 +26,12 @@ If you find a bug, please report it by creating an issue on GitHub:

 Please include:

- A clear, descriptive title
- Steps to reproduce the bug
- Expected behavior
- Actual behavior
- Screenshots (if applicable)
- Your environment (WordPress version, PHP version, browser, etc.)
+* A clear, descriptive title
+* Steps to reproduce the bug
+* Expected behavior
+* Actual behavior
+* Screenshots (if applicable)
+* Your environment (WordPress version, PHP version, browser, etc.)

 ### Suggesting Enhancements

@@ -45,10 +45,10 @@ If you have an idea for an enhancement:

 Please include:

- A clear, descriptive title
- A detailed description of the enhancement
- Why this enhancement would be useful
- Any relevant examples or mockups
+* A clear, descriptive title
+* A detailed description of the enhancement
+* Why this enhancement would be useful
+* Any relevant examples or mockups

 ### Pull Requests

--- a/.wiki/Playground-Testing.md
+++ b/.wiki/Playground-Testing.md
@@ -24,9 +24,10 @@ The easiest way to test our plugin with WordPress Playground is to use the onlin
 [playground-single]: https://playground.wordpress.net/?blueprint-url=https://raw.githubusercontent.com/wpallstars/wp-plugin-starter-template-for-ai-coding/main/playground/blueprint.json&_t=2
 [playground-multisite]: https://playground.wordpress.net/?blueprint-url=https://raw.githubusercontent.com/wpallstars/wp-plugin-starter-template-for-ai-coding/main/playground/multisite-blueprint.json&_t=2

-These links automatically set up WordPress with multisite enabled and WP_DEBUG enabled.
+Both links automatically set up WordPress with WP_DEBUG enabled and the Plugin Toggle and
+Kadence Blocks plugins pre-installed and activated.

-Both the Plugin Toggle and Kadence Blocks plugins are pre-activated.
+The multisite link additionally enables WordPress multisite and network-activates both plugins.

 ## WP-CLI Commands for WordPress Playground

@@ -101,14 +102,14 @@ In a WordPress multisite environment, there are two ways to activate plugins:
 1. **Network Activation**: Activates a plugin for all sites in the network
   * In the WordPress admin, go to Network Admin > Plugins
   * Click "Network Activate" under the plugin
-   * Or use WP-CLI: `wp plugin install plugin-name --activate-network`
+   * Or use WP-CLI: `wp plugin activate plugin-name --network` (for installed plugins), or `wp plugin install plugin-name --activate-network` (to install and activate)

 2. **Per-Site Activation**: Activates a plugin for a specific site
   * In the WordPress admin, go to the specific site's admin area
   * Go to Plugins and activate the plugin for that site only
   * Or use WP-CLI: `wp plugin activate plugin-name --url=site-url`

-Our multisite blueprint uses network activation for the Plugin Toggle plugin as an example.
+Our multisite blueprint uses network activation for both the Plugin Toggle and Kadence Blocks plugins.

 ## Running Tests with WordPress Playground

--- a/admin/css/admin-styles.css
+++ b/admin/css/admin-styles.css
@@ -124,7 +124,9 @@
 }

 /* Responsive Styles */
-@media screen and (width <= 782px) {
+
+/* 782px is the WordPress mobile admin breakpoint. */
+@media screen and (max-width: 782px) {
    .wpst-form-table th {
        width: 100%;
        display: block;
--- a/admin/js/admin-scripts.js
+++ b/admin/js/admin-scripts.js
@@ -78,7 +78,7 @@
          data: {
            action: 'wpst_save_settings',
            nonce: wpstData.nonce,
-            formData: formData
+            formData: formData,
          },
          success: function (response) {
            if (response.success) {
@@ -93,8 +93,8 @@
          complete: function () {
            // Re-enable submit button and remove loading state.
            $submitButton.prop( 'disabled', false ).removeClass( 'loading' );
-          }
-        }
+          },
+        },
      );
    },

@@ -105,10 +105,16 @@
 		 * @param {string} message Notice message
 		 */
    showNotice: function (type, message) {
-      const $notice = $( '<div class="wpst-notice ' + type + '"><p>' + message + '</p></div>' );
+      const allowedTypes = [ 'success', 'error', 'warning' ];
+      const safeType     = allowedTypes.includes( type ) ? type : 'error';
+      const $p           = $( '<p>' );
+      const $notice      = $( '<div>' ).addClass( 'wpst-notice ' + safeType ).append( $p );
+
+      // Set message as plain text to prevent XSS.
+      $p.text( message );

      // Add notice to the page.
-      $( '.wpst-notices' ).html( $notice );
+      $( '.wpst-notices' ).empty().append( $notice );

      // Automatically remove notice after 5 seconds.
      setTimeout(
@@ -117,19 +123,19 @@
            300,
            function () {
              $( this ).remove();
-            }
+            },
          );
        },
-        5000
+        5000,
      );
-    }
+    },
  };

  // Initialize when document is ready.
  $( document ).ready(
    function () {
      WPSTAdmin.init();
-    }
+    },
  );

 })( jQuery );
--- a/admin/js/update-source-selector.js
+++ b/admin/js/update-source-selector.js
@@ -48,7 +48,7 @@
          if ($( e.target ).hasClass( 'wpst-modal' )) {
            WPSTUpdateSourceSelector.closeModal();
          }
-        }
+        },
      );

      // Select source option.
@@ -116,7 +116,7 @@
          data: {
            action: 'wpst_set_update_source', // AJAX action hook.
            nonce: wpstModalData.nonce, // Security nonce.
-            source: this.selectedSource
+            source: this.selectedSource,
          },
          success: function (response) {
            if (response.success) {
@@ -127,7 +127,7 @@
                function () {
                  WPSTUpdateSourceSelector.closeModal();
                },
-                1500
+                1500,
              );
            } else {
              WPSTUpdateSourceSelector.showMessage( 'error', response.data.message );
@@ -139,8 +139,8 @@
          complete: function () {
            // Reset button state.
            $saveButton.prop( 'disabled', false ).text( wpstModalData.i18n.confirm );
-          }
-        }
+          },
+        },
      );
    },

@@ -153,26 +153,30 @@
    showMessage: function (type, message) {
      const $message = this.$modal.find( '.wpst-modal-message' );

-      // Set message content and type.
-      $message.html( message ).removeClass( 'success error' ).addClass( type ).show();
+      // Validate type against allow-list to prevent class injection vulnerabilities.
+      const allowedTypes = [ 'success', 'error' ];
+      const safeType = allowedTypes.includes( type ) ? type : 'error';
+
+      // Set message as plain text to prevent XSS, then apply validated type class.
+      $message.text( message ).removeClass( 'success error' ).addClass( safeType ).show();

      // Hide message after a delay for success messages.
-      if (type === 'success') {
+      if (safeType === 'success') {
        setTimeout(
          function () {
            $message.fadeOut( 300 );
          },
-          3000
+          3000,
        );
      }
-    }
+    },
  };

  // Initialize when document is ready.
  $( document ).ready(
    function () {
      WPSTUpdateSourceSelector.init();
-    }
+    },
  );

 })( jQuery );
--- a/admin/templates/modal.php
+++ b/admin/templates/modal.php
@@ -12,11 +12,22 @@ if ( ! defined( 'ABSPATH' ) ) {
 ?>

 <!-- Update Source Modal -->
-<div id="wpst-update-source-modal" class="wpst-modal">
+<div
+    id="wpst-update-source-modal"
+    class="wpst-modal"
+    role="dialog"
+    aria-modal="true"
+    aria-labelledby="wpst-update-source-modal-title"
+    tabindex="-1"
+>
    <div class="wpst-modal-content">
        <div class="wpst-modal-header">
-            <h2 class="wpst-modal-title"><?php esc_html_e( 'Select Update Source', 'wp-plugin-starter-template' ); ?></h2>
-            <span class="wpst-modal-close">&times;</span>
+            <h2 id="wpst-update-source-modal-title" class="wpst-modal-title"><?php esc_html_e( 'Select Update Source', 'wp-plugin-starter-template' ); ?></h2>
+            <button
+                type="button"
+                class="wpst-modal-close"
+                aria-label="<?php esc_attr_e( 'Close dialog', 'wp-plugin-starter-template' ); ?>"
+            >&times;</button>
        </div>
        
        <div class="wpst-modal-body">
--- a/bin/install-wp-tests.sh
+++ b/bin/install-wp-tests.sh
@@ -17,15 +17,19 @@ WP_TESTS_DIR=${WP_TESTS_DIR-/tmp/wordpress-tests-lib}
 WP_CORE_DIR=${WP_CORE_DIR-/tmp/wordpress/}

 download() {
-    if command -v curl > /dev/null; then
-        curl -s "$1" > "$2";
-    elif command -v wget > /dev/null; then
-        wget -nv -O "$2" "$1"
+	if command -v curl >/dev/null 2>&1; then
+		curl -fsSL "$1" -o "$2"
+	elif command -v wget >/dev/null 2>&1; then
+		wget -qO "$2" "$1"
+	else
+		echo "Error: Neither curl nor wget is installed" >&2
+		exit 1
 	fi
 }

 if [[ $WP_VERSION =~ ^[0-9]+\.[0-9]+\-(beta|RC)[0-9]+$ ]]; then
 	WP_BRANCH=${WP_VERSION%\-*}
+	WP_TESTS_TAG="branches/$WP_BRANCH"
 elif [[ $WP_VERSION =~ ^[0-9]+\.[0-9]+$ ]]; then
 	WP_TESTS_TAG="branches/$WP_VERSION"
 elif [[ $WP_VERSION =~ [0-9]+\.[0-9]+\.[0-9]+ ]]; then
@@ -40,20 +44,31 @@ elif [[ $WP_VERSION == 'nightly' || $WP_VERSION == 'trunk' ]]; then
 else
 	# http serves a single offer, whereas https serves multiple. we only want one
 	download http://api.wordpress.org/core/version-check/1.7/ /tmp/wp-latest.json
-	grep '[0-9]+\.[0-9]+(\.[0-9]+)?' /tmp/wp-latest.json
-	LATEST_VERSION=$(grep -o '"version":"[^"]*' /tmp/wp-latest.json | sed 's/"version":"//')
+	LATEST_VERSION=$(grep -o '"version":"[^"]*' /tmp/wp-latest.json | sed 's/"version":"//' | head -1)
 	if [[ -z "$LATEST_VERSION" ]]; then
 		echo "Latest WordPress version could not be found"
 		exit 1
 	fi
 	WP_TESTS_TAG="tags/$LATEST_VERSION"
 fi
+
+# Derive a git ref from WP_TESTS_TAG by stripping the SVN-style prefix.
+# WP_TESTS_TAG uses "tags/X.Y.Z", "branches/X.Y", or "trunk".
+# git clone --branch requires the bare ref name ("X.Y.Z", "X.Y", or "trunk").
+if [[ "$WP_TESTS_TAG" == tags/* ]]; then
+	GIT_REF="${WP_TESTS_TAG#tags/}"
+elif [[ "$WP_TESTS_TAG" == branches/* ]]; then
+	GIT_REF="${WP_TESTS_TAG#branches/}"
+else
+	GIT_REF="$WP_TESTS_TAG"
+fi
+
 set -ex

 install_wp() {

 	if [ -d "$WP_CORE_DIR" ]; then
-		return;
+		return
 	fi

 	mkdir -p "$WP_CORE_DIR"
@@ -71,6 +86,7 @@ install_wp() {
 			if [[ $WP_VERSION =~ [0-9]+\.[0-9]+\.[0] ]]; then
 				LATEST_VERSION=${WP_VERSION%??}
 			else
+				# shellcheck disable=SC2001
 				VERSION_ESCAPED=$(echo "$WP_VERSION" | sed 's/\./\\\\./g')
 				LATEST_VERSION=$(grep -o '"version":"'"$VERSION_ESCAPED"'[^"]*' "$WP_CORE_DIR/wp-latest.json" | sed 's/"version":"//' | head -1)
 			fi
@@ -101,12 +117,22 @@ install_test_suite() {
 	# set up testing suite if it doesn't yet exist
 	if [ ! -d "$WP_TESTS_DIR" ]; then
 		mkdir -p "$WP_TESTS_DIR"
-		git clone --quiet --depth=1 https://github.com/WordPress/wordpress-develop.git /tmp/wordpress-develop
+		rm -rf /tmp/wordpress-develop
+		if ! git clone --quiet --depth=1 --branch "$GIT_REF" https://github.com/WordPress/wordpress-develop.git /tmp/wordpress-develop; then
+			echo "Error: Failed to clone wordpress-develop at branch/tag $GIT_REF" >&2
+			exit 1
+		fi
 		if [ -d /tmp/wordpress-develop/tests/phpunit/includes ]; then
-			cp -r /tmp/wordpress-develop/tests/phpunit/includes "$WP_TESTS_DIR/"
+			if ! cp -r /tmp/wordpress-develop/tests/phpunit/includes "$WP_TESTS_DIR/"; then
+				echo "Error: Failed to copy phpunit includes to $WP_TESTS_DIR" >&2
+				exit 1
+			fi
 		fi
 		if [ -d /tmp/wordpress-develop/tests/phpunit/data ]; then
-			cp -r /tmp/wordpress-develop/tests/phpunit/data "$WP_TESTS_DIR/"
+			if ! cp -r /tmp/wordpress-develop/tests/phpunit/data "$WP_TESTS_DIR/"; then
+				echo "Error: Failed to copy phpunit data to $WP_TESTS_DIR" >&2
+				exit 1
+			fi
 		fi
 	fi

@@ -116,15 +142,15 @@ install_test_suite() {
 		else
 			download https://raw.githubusercontent.com/WordPress/wordpress-develop/master/wp-tests-config-sample.php "$WP_TESTS_DIR"/wp-tests-config.php
 		fi
-		WP_CORE_DIR=$(echo "$WP_CORE_DIR" | sed "s:/\+$::")
-		sed $ioption "s:dirname( __FILE__ ) . '/src/':'$WP_CORE_DIR/':" "$WP_TESTS_DIR"/wp-tests-config.php
-		sed $ioption "s/youremptytestdbnamehere/$DB_NAME/" "$WP_TESTS_DIR"/wp-tests-config.php
-		sed $ioption "s/yourusernamehere/$DB_USER/" "$WP_TESTS_DIR"/wp-tests-config.php
-		sed $ioption "s/yourpasswordhere/$DB_PASS/" "$WP_TESTS_DIR"/wp-tests-config.php
-		sed $ioption "s|localhost|${DB_HOST}|" "$WP_TESTS_DIR"/wp-tests-config.php
+		WP_CORE_DIR="${WP_CORE_DIR%/}"
+		sed "$ioption" "s:dirname( __FILE__ ) . '/src/':'$WP_CORE_DIR/':" "$WP_TESTS_DIR"/wp-tests-config.php
+		sed "$ioption" "s/youremptytestdbnamehere/$DB_NAME/" "$WP_TESTS_DIR"/wp-tests-config.php
+		sed "$ioption" "s/yourusernamehere/$DB_USER/" "$WP_TESTS_DIR"/wp-tests-config.php
+		sed "$ioption" "s/yourpasswordhere/$DB_PASS/" "$WP_TESTS_DIR"/wp-tests-config.php
+		sed "$ioption" "s|localhost|${DB_HOST}|" "$WP_TESTS_DIR"/wp-tests-config.php

 		if [ "$MULTISITE" = "true" ]; then
-			sed $ioption "s:// define( 'WP_TESTS_MULTISITE', true );:define( 'WP_TESTS_MULTISITE', true );:" "$WP_TESTS_DIR"/wp-tests-config.php
+			sed "$ioption" "s:// define( 'WP_TESTS_MULTISITE', true );:define( 'WP_TESTS_MULTISITE', true );:" "$WP_TESTS_DIR"/wp-tests-config.php
 		fi
 	fi

@@ -132,14 +158,14 @@ install_test_suite() {

 install_db() {

-	if [ ${SKIP_DB_CREATE} = "true" ]; then
+	if [ "${SKIP_DB_CREATE}" = "true" ]; then
 		return 0
 	fi

 	local PARTS
 	IFS=':' read -ra PARTS <<<"$DB_HOST"
-	local DB_HOSTNAME=${PARTS[0]};
-	local DB_SOCK_OR_PORT=${PARTS[1]};
+	local DB_HOSTNAME=${PARTS[0]}
+	local DB_SOCK_OR_PORT=${PARTS[1]}
 	local EXTRA=""

 	if [ -n "$DB_HOSTNAME" ]; then
@@ -152,7 +178,7 @@ install_db() {
 		fi
 	fi

-	mysqladmin create "$DB_NAME" --user="$DB_USER" --password="$DB_PASS"$EXTRA || true
+	mysqladmin create "$DB_NAME" --user="$DB_USER" --password="$DB_PASS""$EXTRA" || true
 }

 install_wp
--- a/bin/localwp-setup.sh
+++ b/bin/localwp-setup.sh
@@ -28,7 +28,6 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
 PLUGIN_SLUG="wp-plugin-starter-template"
-PLUGIN_TEXT_DOMAIN="wp-plugin-starter-template"

 # LocalWP paths (macOS)
 LOCAL_SITES_DIR="$HOME/Local Sites"
@@ -83,7 +82,8 @@ check_localwp() {
 		exit 1
 	fi

-    local version=$("$LOCAL_WP_CLI" --version 2>/dev/null || echo "unknown")
+	local version
+	version=$("$LOCAL_WP_CLI" --version 2>/dev/null || echo "unknown")
 	log_info "LocalWP WP-CLI version: $version"
 }

@@ -96,7 +96,8 @@ get_site_path() {
 # Get WordPress path within site
 get_wp_path() {
 	local site_name="$1"
-    local site_path=$(get_site_path "$site_name")
+	local site_path
+	site_path=$(get_site_path "$site_name")

 	# LocalWP uses app/public for WordPress files
 	echo "$site_path/app/public"
@@ -105,21 +106,24 @@ get_wp_path() {
 # Check if site exists
 site_exists() {
 	local site_name="$1"
-    local site_path=$(get_site_path "$site_name")
+	local site_path
+	site_path=$(get_site_path "$site_name")
 	[ -d "$site_path" ]
 }

 # Get plugin destination path
 get_plugin_path() {
 	local site_name="$1"
-    local wp_path=$(get_wp_path "$site_name")
+	local wp_path
+	wp_path=$(get_wp_path "$site_name")
 	echo "$wp_path/wp-content/plugins/$PLUGIN_SLUG"
 }

 # Sync plugin files to LocalWP site
 sync_plugin() {
 	local site_name="$1"
-    local plugin_dest=$(get_plugin_path "$site_name")
+	local plugin_dest
+	plugin_dest=$(get_plugin_path "$site_name")

 	if ! site_exists "$site_name"; then
 		log_error "Site '$site_name' does not exist"
@@ -181,7 +185,8 @@ create_site() {

 	check_localwp

-    local site_path=$(get_site_path "$site_name")
+	local site_path
+	site_path=$(get_site_path "$site_name")

 	if site_exists "$site_name"; then
 		log_warning "Site '$site_name' already exists at: $site_path"
@@ -230,7 +235,7 @@ create_site() {
 	echo ""

 	# Wait for user to create site
-    read -p "Press Enter after you've created the site in LocalWP..."
+	read -r -p "Press Enter after you've created the site in LocalWP..."

 	if site_exists "$site_name"; then
 		log_success "Site detected at: $site_path"
@@ -250,7 +255,8 @@ create_site() {
 # Install recommended plugins (matching Playground blueprint)
 install_recommended_plugins() {
 	local site_name="$1"
-    local wp_path=$(get_wp_path "$site_name")
+	local wp_path
+	wp_path=$(get_wp_path "$site_name")

 	log_info "Note: Install these plugins to match Playground environment:"
 	echo "  - Plugin Toggle (plugin-toggle)"
@@ -265,8 +271,10 @@ show_site_info() {
 	local domain="$2"
 	local multisite="$3"

-    local site_path=$(get_site_path "$site_name")
-    local plugin_path=$(get_plugin_path "$site_name")
+	local site_path
+	site_path=$(get_site_path "$site_name")
+	local plugin_path
+	plugin_path=$(get_plugin_path "$site_name")

 	echo ""
 	echo "============================================"
@@ -305,7 +313,8 @@ reset_site() {
 	echo

 	if [[ $REPLY =~ ^[Yy]$ ]]; then
-        local plugin_path=$(get_plugin_path "$site_name")
+		local plugin_path
+		plugin_path=$(get_plugin_path "$site_name")

 		log_info "Removing plugin files..."
 		rm -rf "$plugin_path"
@@ -345,14 +354,16 @@ show_info() {
 	echo "==============================="

 	for site_name in "$SINGLE_SITE_NAME" "$MULTISITE_NAME"; do
-        local site_path=$(get_site_path "$site_name")
+		local site_path
+		site_path=$(get_site_path "$site_name")

 		if site_exists "$site_name"; then
 			echo ""
 			echo "  ${GREEN}✓${NC} $site_name"
 			echo "    Path: $site_path"

-            local plugin_path=$(get_plugin_path "$site_name")
+			local plugin_path
+			plugin_path=$(get_plugin_path "$site_name")
 			if [ -d "$plugin_path" ]; then
 				echo "    Plugin: ${GREEN}Installed${NC}"
 			else
--- a/bin/setup-test-env.sh
+++ b/bin/setup-test-env.sh
@@ -1,8 +1,5 @@
 #!/bin/bash

-# Make this script executable
-chmod +x "$0"
-
 # Check if environment type is provided
 if [ -z "$1" ]; then
 	echo "Usage: $0 [single|multisite|playground-single|playground-multisite]"
@@ -14,8 +11,24 @@ ENV_TYPE=$1
 # Function to check if a command exists
 command_exists() {
 	command -v "$1" &>/dev/null
+	return $?
 }

+# PID of the background Python HTTP server (set when started).
+PYTHON_PID=""
+
+# Function to clean up resources on exit.
+cleanup() {
+	if [ -n "$PYTHON_PID" ]; then
+		echo "Stopping Python HTTP server (PID: $PYTHON_PID)..."
+		kill "$PYTHON_PID" 2>/dev/null || true
+	fi
+	return 0
+}
+
+# Trap EXIT, INT, and TERM so the server is always stopped on script exit.
+trap cleanup EXIT INT TERM
+
 # Function to install wp-env if needed
 install_wp_env() {
 	if ! command_exists wp-env; then
@@ -33,7 +46,7 @@ install_wp_playground() {
 	fi
 }

-if [ "$ENV_TYPE" == "single" ]; then
+if [ "$ENV_TYPE" = "single" ]; then
 	echo "Setting up single site environment..."

 	# Install wp-env if needed
@@ -67,7 +80,7 @@ if [ "$ENV_TYPE" == "single" ]; then
 	echo "Site: http://localhost:8888"
 	echo "Admin login: admin / password"

-elif [ "$ENV_TYPE" == "multisite" ]; then
+elif [ "$ENV_TYPE" = "multisite" ]; then
 	echo "Setting up multisite environment..."

 	# Install wp-env if needed
@@ -108,7 +121,7 @@ elif [ "$ENV_TYPE" == "multisite" ]; then
 	echo "Test site: http://localhost:8888/testsite"
 	echo "Admin login: admin / password"

-elif [ "$ENV_TYPE" == "playground-single" ]; then
+elif [ "$ENV_TYPE" = "playground-single" ]; then
 	echo "Setting up WordPress Playground single site environment..."

 	# Install wp-playground if needed
@@ -152,6 +165,8 @@ EOF
 	echo "Starting WordPress Playground..."
 	if command_exists python3; then
 		python3 -m http.server 8888 --directory playground &
+		PYTHON_PID=$!
+		echo "Started Python HTTP server with PID: $PYTHON_PID"
 		echo "Opening WordPress Playground in your browser..."
 		if command_exists open; then
 			open http://localhost:8888/index.html
@@ -175,7 +190,7 @@ EOF
 	echo "Admin login: admin / password"
 	echo "Press Ctrl+C to stop the server when done."

-elif [ "$ENV_TYPE" == "playground-multisite" ]; then
+elif [ "$ENV_TYPE" = "playground-multisite" ]; then
 	echo "Setting up WordPress Playground multisite environment..."

 	# Install wp-playground if needed
@@ -187,6 +202,7 @@ elif [ "$ENV_TYPE" == "playground-multisite" ]; then
 	zip -r dist/plugin.zip . -x "node_modules/*" "dist/*" ".git/*"

 	# Update blueprint to use local plugin
+	# shellcheck disable=SC2154
 	cat >playground/multisite-blueprint.json <<EOF
 {
  "landingPage": "/wp-admin/network/",
@@ -259,6 +275,8 @@ EOF
 	echo "Starting WordPress Playground..."
 	if command_exists python3; then
 		python3 -m http.server 8888 --directory playground &
+		PYTHON_PID=$!
+		echo "Started Python HTTP server with PID: $PYTHON_PID"
 		echo "Opening WordPress Playground in your browser..."
 		if command_exists open; then
 			open http://localhost:8888/multisite.html
--- a/build.sh
+++ b/build.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
+set -euo pipefail

 # WordPress Plugin Build Script
 # This script creates a clean build of the plugin for distribution
@@ -39,15 +40,15 @@ composer install --no-dev --optimize-autoloader

 # Copy plugin files to build directory
 echo "Copying plugin files..."
-cp -R *.php "$BUILD_DIR/"
+cp -R ./*.php "$BUILD_DIR/"
 cp -R README.md LICENSE CHANGELOG.md readme.txt composer.json "$BUILD_DIR/"

 # Copy directories
 echo "Copying directories..."
 mkdir -p "$BUILD_DIR/admin" "$BUILD_DIR/includes" "$BUILD_DIR/languages" "$BUILD_DIR/assets"
-cp -R admin/* "$BUILD_DIR/admin/"
-cp -R includes/* "$BUILD_DIR/includes/"
-cp -R languages/* "$BUILD_DIR/languages/"
+cp -R ./admin/* "$BUILD_DIR/admin/"
+cp -R ./includes/* "$BUILD_DIR/includes/"
+cp -R ./languages/* "$BUILD_DIR/languages/"

 # Create assets directory structure
 mkdir -p "$BUILD_DIR/assets/banner" "$BUILD_DIR/assets/icon" "$BUILD_DIR/assets/screenshots"
@@ -72,9 +73,10 @@ fi

 # Create ZIP file.
 echo "Creating ZIP file..."
+(
 	cd build || exit 1
 	zip -r "../$ZIP_FILE" "$PLUGIN_SLUG" -x "*.DS_Store" -x "*.git*" -x "*.github*"
-cd ..
+)

 # Check if ZIP file was created successfully
 if [ -f "$ZIP_FILE" ]; then
@@ -82,8 +84,8 @@ if [ -f "$ZIP_FILE" ]; then
 	echo "File path: $(pwd)/$ZIP_FILE"

 	# Deploy to local WordPress installation if environment variable is set
-	if [ -n "$WP_LOCAL_PLUGIN_DIR" ]; then
-		echo "\nDeploying to local WordPress installation..."
+	if [ -n "${WP_LOCAL_PLUGIN_DIR:-}" ]; then
+		echo ""
 		echo "Deploying to local WordPress installation..."

 		# Remove existing plugin directory.
--- a/cypress/e2e/playground-single-site.cy.js
+++ b/cypress/e2e/playground-single-site.cy.js
@@ -18,6 +18,15 @@ describe('WordPress Playground Single Site Tests', () => {
    cy.visit('/wp-admin/plugins.php', { timeout: 30000 });

    cy.get('body', { timeout: 15000 }).then(($body) => {
+      // Verify the starter template plugin exists and is activated.
+      if ($body.find('tr[data-slug="wp-plugin-starter-template-for-ai-coding"]').length) {
+        cy.get('tr[data-slug="wp-plugin-starter-template-for-ai-coding"]').within(() => {
+          cy.get('.deactivate a').should('exist');
+        });
+      } else {
+        cy.log('Starter template plugin not found by slug, skipping check');
+      }
+
      if ($body.text().includes('Plugin Toggle')) {
        cy.contains('tr', 'Plugin Toggle').should('exist');
        cy.contains('tr', 'Plugin Toggle').find('.deactivate').should('exist');
--- a/cypress/e2e/single-site.cy.js
+++ b/cypress/e2e/single-site.cy.js
@@ -1,3 +1,4 @@
+/* eslint-env mocha, jquery, cypress */
 describe( 'WordPress Single Site Tests', () => {
    it( 'Can access the site', () => {
        cy.visit( '/' );
@@ -11,20 +12,64 @@ describe('WordPress Single Site Tests', () => {
    } );

    it( 'Plugin is activated', () => {
-    // Use our custom command to check and activate the plugin if needed
+        // Use our custom command to check and activate the plugin if needed.
        cy.activatePlugin( 'wp-plugin-starter-template-for-ai-coding' );

-    // Verify it's active
+        // Verify it's active.
        cy.get( 'tr[data-slug="wp-plugin-starter-template-for-ai-coding"] .deactivate' ).should( 'exist' );
    } );

-  it('Plugin settings page loads correctly', () => {
+    it( 'Plugin row is visible on the plugins page', () => {
        cy.loginAsAdmin();
+        cy.visit( '/wp-admin/plugins.php' );

-    // Navigate to the plugin settings page (if it exists)
-    cy.visit('/wp-admin/options-general.php?page=wp-plugin-starter-template');
+        // Verify the plugin row exists with the correct slug.
+        cy.get( 'tr[data-slug="wp-plugin-starter-template-for-ai-coding"]' ).should( 'exist' );

-    // This is a basic check - adjust based on your actual plugin's settings page
-    cy.get('h1').should('contain', 'WP Plugin Starter Template');
+        // Verify the plugin name is displayed.
+        cy.get( 'tr[data-slug="wp-plugin-starter-template-for-ai-coding"] .plugin-title strong' )
+            .should( 'contain', 'WordPress Plugin Starter Template' );
+    } );
+
+    it( 'Update source selector link is present in the plugin row', () => {
+        cy.loginAsAdmin();
+        cy.visit( '/wp-admin/plugins.php' );
+
+        // The update source selector link should be rendered in the plugin row.
+        cy.get( 'tr[data-slug="wp-plugin-starter-template-for-ai-coding"]' )
+            .find( '.wpst-update-source-selector' )
+            .should( 'exist' );
+    } );
+
+    it( 'Update source modal opens and displays source options', () => {
+        cy.loginAsAdmin();
+        cy.visit( '/wp-admin/plugins.php' );
+
+        // Click the update source selector link to open the modal.
+        cy.get( '.wpst-update-source-selector' ).first().click();
+
+        // Modal should be visible.
+        cy.get( '#wpst-update-source-modal' ).should( 'be.visible' );
+
+        // Modal should contain the three update source options.
+        cy.get( '#wpst-update-source-modal input[name="update_source"][value="wordpress.org"]' ).should( 'exist' );
+        cy.get( '#wpst-update-source-modal input[name="update_source"][value="github"]' ).should( 'exist' );
+        cy.get( '#wpst-update-source-modal input[name="update_source"][value="gitea"]' ).should( 'exist' );
+
+        // Save button should be present.
+        cy.get( '#wpst-save-source' ).should( 'exist' );
+    } );
+
+    it( 'Update source modal can be closed', () => {
+        cy.loginAsAdmin();
+        cy.visit( '/wp-admin/plugins.php' );
+
+        // Open the modal.
+        cy.get( '.wpst-update-source-selector' ).first().click();
+        cy.get( '#wpst-update-source-modal' ).should( 'be.visible' );
+
+        // Close the modal via the close button.
+        cy.get( '#wpst-update-source-modal .wpst-modal-close' ).click();
+        cy.get( '#wpst-update-source-modal' ).should( 'not.be.visible' );
    } );
 } );
--- a/includes/Admin/class-admin.php
+++ b/includes/Admin/class-admin.php
@@ -69,10 +69,12 @@ class Admin {
        // Get the plugin version.
        $plugin_version = $this->core->get_plugin_version();

+        $plugin_url = $this->get_plugin_base_url();
+
        // Enqueue styles.
        \wp_enqueue_style(
            'wpst-admin-styles',
-            plugin_dir_url( dirname( __DIR__ ) ) . 'admin/css/admin-styles.css',
+            $plugin_url . 'admin/css/admin-styles.css',
            array(), // Dependencies.
            $plugin_version // Version.
        );
@@ -80,7 +82,7 @@ class Admin {
        // Enqueue admin scripts.
        \wp_enqueue_script(
            'wpst-admin-script',
-            plugin_dir_url( dirname( __DIR__ ) ) . 'admin/js/admin-scripts.js',
+            $plugin_url . 'admin/js/admin-scripts.js',
            array( 'jquery' ),
            $plugin_version, // Version.
            true
@@ -99,4 +101,21 @@ class Admin {
            $data
        );
    }
+
+    /**
+     * Get plugin base URL.
+     *
+     * @return string Plugin base URL with trailing slash.
+     */
+    private function get_plugin_base_url(): string {
+        if ( defined( 'WP_PLUGIN_STARTER_TEMPLATE_URL' ) ) {
+            return WP_PLUGIN_STARTER_TEMPLATE_URL;
+        }
+
+        if ( defined( 'WPST_PLUGIN_URL' ) ) {
+            return WPST_PLUGIN_URL;
+        }
+
+        return \plugin_dir_url( dirname( __DIR__, 2 ) );
+    }
 }
--- a/includes/Multisite/class-multisite.php
+++ b/includes/Multisite/class-multisite.php
@@ -6,10 +6,10 @@
 * Extend this file or create additional classes in this directory
 * to implement multisite features for your plugin.
 *
- * @package WP_Plugin_Starter_Template_For_AI_Coding
+ * @package WPALLSTARS\PluginStarterTemplate
 */

-namespace WP_Plugin_Starter_Template_For_AI_Coding\Multisite;
+namespace WPALLSTARS\PluginStarterTemplate\Multisite;

 // Exit if accessed directly.
 if ( ! defined( 'ABSPATH' ) ) {
--- a/package.json
+++ b/package.json
@@ -29,6 +29,7 @@
    "test:phpunit:multisite": "WP_MULTISITE=1 composer test",
    "build": "./build.sh",
    "lint:js": "eslint cypress/",
+    "lint:css": "stylelint \"**/*.css\" --allow-empty-input",
    "lint:php": "composer run-script phpcs",
    "lint:php:simple": "composer run-script phpcs:simple",
    "lint:phpstan": "composer run-script phpstan",
@@ -38,7 +39,7 @@
    "test:php": "composer run-script test",
    "lint": "composer run-script lint",
    "fix": "composer run-script fix",
-    "quality": "npm run lint && npm run test:php"
+    "quality": "npm run lint && npm run lint:js && npm run lint:css && npm run test:php"
  },
  "repository": {
    "type": "git",
@@ -64,6 +65,8 @@
    "@wp-playground/cli": "^3.0.22",
    "cypress": "^13.17.0",
    "eslint": "^8.57.0",
-    "eslint-plugin-cypress": "^2.15.1"
+    "eslint-plugin-cypress": "^2.15.1",
+    "stylelint": "^16.0.0",
+    "stylelint-config-standard": "^36.0.0"
  }
 }
--- a/phpmd.xml
+++ b/phpmd.xml
@@ -15,6 +15,8 @@
        <exclude name="CamelCaseMethodName" />
        <exclude name="CamelCaseParameterName" />
        <exclude name="CamelCaseVariableName" />
+        <!-- WordPress plugins use filter_input() for production and $_GET for testing; Superglobals rule is not applicable. -->
+        <exclude name="Superglobals" />
    </rule>
    <rule ref="rulesets/design.xml" />
    <rule ref="rulesets/naming.xml">
--- a/phpstan.neon
+++ b/phpstan.neon
@@ -5,13 +5,6 @@ parameters:
        - admin
        - wp-plugin-starter-template.php
    excludePaths:
-        analyse:
-            - vendor
-            - node_modules
-            - tests
-            - bin
-            - build
-            - dist
        analyseAndScan:
            - vendor
            - node_modules
--- a/playground/index.html
+++ b/playground/index.html
@@ -21,6 +21,6 @@
    </style>
 </head>
 <body>
-    <iframe src="https://playground.wordpress.net/?blueprint-url=https://raw.githubusercontent.com/wpallstars/wp-plugin-starter-template-for-ai-coding/main/playground/blueprint.json&_t=2" title="WordPress Playground Single Site Environment"></iframe>
+    <iframe src="https://playground.wordpress.net/?blueprint-url=https://raw.githubusercontent.com/wpallstars/wp-plugin-starter-template-for-ai-coding/main/playground/blueprint.json" title="WordPress Playground Single Site Environment"></iframe>
 </body>
 </html>
--- a/playground/test.html
+++ b/playground/test.html
@@ -68,7 +68,7 @@
            "landingPage": "/wp-admin/",
            "login": true,
            "features": {
-                "networking": true
+                "networking": false
            },
            "steps": [
                {
--- a/tests/phpunit/bootstrap.php
+++ b/tests/phpunit/bootstrap.php
@@ -46,7 +46,7 @@ if ( getenv( 'WP_PHPUNIT__DIR' ) ) {
    // Include plugin files needed for tests.
    require_once WPST_PLUGIN_DIR . 'includes/class-core.php';
    require_once WPST_PLUGIN_DIR . 'includes/class-plugin.php';
-    if ( file_exists( WPST_PLUGIN_DIR . 'admin/lib/admin.php' ) ) {
-        require_once WPST_PLUGIN_DIR . 'admin/lib/admin.php';
+    if ( file_exists( WPST_PLUGIN_DIR . 'includes/Admin/class-admin.php' ) ) {
+        require_once WPST_PLUGIN_DIR . 'includes/Admin/class-admin.php';
    }
 }
--- a/tests/phpunit/test-admin.php
+++ b/tests/phpunit/test-admin.php
@@ -101,17 +101,12 @@ class AdminTest extends \WP_Mock\Tools\TestCase {
            'return' => 'wp_plugin_starter_template_settings',
        ]);

-        // Mock WordPress functions used in the method
-        WP_Mock::userFunction('plugin_dir_url', [
-            'return' => 'http://example.com/wp-content/plugins/wp-plugin-starter-template/includes/Admin/',
-        ]);
-
        // Mock wp_enqueue_style
        WP_Mock::userFunction('wp_enqueue_style', [
            'times' => 1,
            'args' => [
                'wpst-admin-styles',
-                'http://example.com/wp-content/plugins/wp-plugin-starter-template/includes/Admin/../../admin/css/admin-styles.css',
+                'http://example.org/wp-content/plugins/wp-plugin-starter-template/admin/css/admin-styles.css',
                [],
                '1.0.0',
            ],
@@ -122,7 +117,7 @@ class AdminTest extends \WP_Mock\Tools\TestCase {
            'times' => 1,
            'args' => [
                'wpst-admin-script',
-                'http://example.com/wp-content/plugins/wp-plugin-starter-template/includes/Admin/../../admin/js/admin-scripts.js',
+                'http://example.org/wp-content/plugins/wp-plugin-starter-template/admin/js/admin-scripts.js',
                ['jquery'],
                '1.0.0',
                true,
--- a/wp-plugin-starter-template.php
+++ b/wp-plugin-starter-template.php
@@ -55,13 +55,19 @@ spl_autoload_register(
        // Get the relative class name.
        $relative_class = substr( $className, $len );

-        // Convert namespace to path.
-        $file = WP_PLUGIN_STARTER_TEMPLATE_PATH . 'includes/' . str_replace( '\\', '/', $relative_class ) . '.php';
+        // Build class file path using WordPress-style class file names.
+        $relative_path = str_replace( '\\', '/', $relative_class );
+        $path_parts = explode( '/', $relative_path );
+        $class_name = array_pop( $path_parts );
+        $directory = '';

-        // Convert class name format to file name format.
-        $file = str_replace( 'class-', '', $file );
-        $file = preg_replace( '/([a-z])([A-Z])/', '$1-$2', $file );
-        $file = strtolower( $file );
+        if ( ! empty( $path_parts ) ) {
+            $directory = implode( '/', $path_parts ) . '/';
+        }
+
+        $class_file = preg_replace( '/([a-z])([A-Z])/', '$1-$2', $class_name );
+        $class_file = 'class-' . strtolower( $class_file ) . '.php';
+        $file = WP_PLUGIN_STARTER_TEMPLATE_PATH . 'includes/' . $directory . $class_file;

        // If the file exists, require it.
        if ( file_exists( $file ) ) {
Author	SHA1	Message	Date
Marcus Quinn	7d0ee0adea	fix: resolve ShellCheck violations in shell scripts (#91 ) - SC2155 (bin/localwp-setup.sh): declare local variables separately from command substitution assignments to avoid masking return values (13 fixes) - SC2034 (bin/localwp-setup.sh): remove unused PLUGIN_TEXT_DOMAIN variable - SC2162 (bin/localwp-setup.sh): add -r flag to read to avoid backslash mangling - SC2154 (bin/setup-test-env.sh): add shellcheck disable for PHP variables in heredoc that ShellCheck incorrectly identifies as unassigned shell variables - bin/setup-test-env.sh: remove self-modifying chmod +x $0 (unnecessary and bad practice; file permissions should be set once in version control) - bin/setup-test-env.sh: change == to = in POSIX [ ] test expressions - build.sh: add ./ prefix to directory glob copies for clarity - build.sh: use subshell (cd build \|\| exit 1; zip ...) instead of bare cd/cd.. to avoid SC2103 and ensure working directory is always restored Fixes part of #20 (shell script quality issues)	2026-03-18 11:47:38 +00:00
Marcus Quinn	9fdfa7a8a9	fix: pin all GitHub Actions to full commit SHAs (resolves SonarCloud S7637) (#90 ) Pin all floating version tags (@v1, @v2, @v3, @v4, @master) to full commit SHAs across all workflow files to eliminate supply chain security risk. Actions pinned: - actions/checkout@v3 -> f43a0e5 (v3.6.0) in release.yml, sync-wiki.yml - actions/checkout@v4 -> 34e1148 (v4) in tests.yml - shivammathur/setup-php@v2 -> accd612 (v2) in all workflows - actions/setup-node@v4 -> 49933ea (v4) in playground-tests.yml, wordpress-tests.yml - actions/upload-artifact@v4 -> ea165f8 (v4) in playground-tests.yml, wordpress-tests.yml - softprops/action-gh-release@v1 -> de2c0eb (v1) in release.yml - codacy/codacy-analysis-cli-action@v4 -> 562ee3e (v4) in code-quality.yml - github/codeql-action/upload-sarif@v3 -> 603b797 (v3) in code-quality.yml - swissspidy/wp-performance-action@v2.0.3 -> b7e3ffc (v2.0.3) in playground-tests.yml - SonarSource/sonarqube-scan-action@master -> 9598b8a in sonarcloud.yml Closes #89	2026-03-18 04:58:57 +00:00
Marcus Quinn	d6dcda908c	fix: change comma-dangle rule to always-multiline per review feedback (#88 ) Addresses Gemini review feedback from PR #66 (issue #73). Changes 'comma-dangle' from 'never' to 'always-multiline' to improve maintainability — cleaner git diffs and easier line reordering. Updates admin/js files to comply with the new rule. Closes #73	2026-03-17 21:00:19 +00:00
Marcus Quinn	7640f01d0c	quality-debt: document 782px WordPress mobile admin breakpoint (#87 ) * fix: document 782px WordPress mobile admin breakpoint in media query Adds an inline comment explaining that 782px is the WordPress mobile admin breakpoint (wp-admin responsive threshold), addressing the maintainability feedback from Gemini in PR #68. Closes #69 * fix: add empty line before CSS comment to satisfy comment-empty-line-before rule CodeFactor flagged missing empty line before the breakpoint comment (comment-empty-line-before). Also simplifies comment text per Gemini Code Assist suggestion (removes redundant parenthetical). Fixes CodeFactor FAILURE and Codacy ACTION_REQUIRED on PR #87.	2026-03-17 20:50:19 +00:00
Marcus Quinn	632dda5952	fix: address PR #65 review feedback on error-checking-feedback-loops.md (#86 ) - Fix yaml code block to bash at line 80 (shell command, not YAML) - Remove useless cat pipe: use grep directly on test-output.log - Remove useless cat pipe: use grep directly on phpcs-output.log Closes #71	2026-03-17 20:45:53 +00:00
Marcus Quinn	8fda3f1163	fix: add lint:js to quality script (#85 ) Include JavaScript linting in the quality gate alongside PHP and CSS linting, as suggested in PR #55 review feedback (Gemini, medium). Closes #77	2026-03-17 20:37:05 +00:00
Marcus Quinn	79f78882a6	fix: remove redundant existence check, use cy.within() for scoped selector (#84 ) Addresses Gemini review feedback on PR #50 line 23: the .should('exist') check was redundant since the if-condition already confirms element presence. Refactored to use cy.within() to scope the .deactivate a check, eliminating selector repetition and improving readability. Closes #79	2026-03-17 20:29:00 +00:00
Marcus Quinn	e1ee99ac9c	fix: validate type parameter against allow-list in showMessage (#83 ) Adds allow-list validation for the 'type' parameter in showMessage() to prevent class injection vulnerabilities. The type is now checked against ['success', 'error'] before being passed to addClass(), with a safe fallback to 'error' for any unexpected values. Addresses review feedback from PR #47 (gemini-code-assist finding). Closes #76	2026-03-17 19:33:04 +00:00
Marcus Quinn	6300f1c545	fix: remove duplicate deployment echo in build.sh (#80 ) * fix: remove duplicate deployment echo in build.sh Remove duplicate 'Deploying to local WordPress installation...' message. Replace printf with echo "" for blank line separator to avoid \n rendering issues without -e flag. Closes #70 * fix: use ${WP_LOCAL_PLUGIN_DIR:-} for bash nounset safety in build.sh Addresses CodeRabbit Major review feedback on PR #80. Direct dereference of $WP_LOCAL_PLUGIN_DIR under set -u causes the script to exit when the variable is unset, even though local deployment is optional. Using ${WP_LOCAL_PLUGIN_DIR:-} safely handles the unset case without triggering nounset.	2026-03-17 19:33:00 +00:00
Marcus Quinn	c3738a3106	fix: remove stale /tmp/wordpress-develop before git clone (#82 ) Prevents git clone failure on re-runs when the destination directory already exists from a previous test suite installation. Closes #74	2026-03-17 19:26:41 +00:00
Marcus Quinn	e5d2994e40	docs: mention both WP-CLI network activation commands in Playground-Testing.md (#81 ) Address review feedback from PR #63 (gemini-code-assist): document both `wp plugin activate --network` (for installed plugins) and `wp plugin install --activate-network` (to install and activate in one step). Closes #72	2026-03-17 19:22:48 +00:00
marcusquinn	7eb7aedc39	chore: add .superset/ to .gitignore (local tool config)	2026-03-17 03:52:37 +00:00
Marcus Quinn	9cddf28c09	fix: use standard max-width media query syntax in admin-styles.css (issue #43 ) (#68 ) Replace invalid CSS media-feature range notation with universally-supported traditional syntax for better browser compatibility. - admin/css/admin-styles.css:127: (width <= 782px) → (max-width: 782px)	2026-03-17 01:17:05 +00:00
Marcus Quinn	a1e5b166ff	fix: address PR #10 CodeRabbit review feedback (issue #45 ) (#51 ) * fix: address PR #10 CodeRabbit review feedback - Fix SC2115 shellcheck warning in build.sh (use ${var:?} for safe rm -rf) - Fix SC2164 shellcheck warning in build.sh (cd build \|\| exit 1) - Standardise bullet points from hyphens to asterisks in .wiki/Contributing.md - Refine verb formality in readme.txt, README.md, .wiki/Contributing.md, .wiki/Coding-Standards.md - Clarify PHPDoc wording in .wiki/Coding-Standards.md - Add clarifying comment to phpcs-simple.xml arg value * fix: re-enable PHPUnit test step in tests.yml Tests were commented out in PR #10. PHPUnit test files exist in tests/phpunit/ and phpunit.xml is configured. Re-enabling the step so tests actually run in CI. Closes #45 * fix: remove redundant composer require steps in code-quality workflow szepeviktor/phpstan-wordpress, wp-coding-standards/wpcs, and dealerdirect/phpcodesniffer-composer-installer are already declared in composer.json require-dev. The extra 'composer require' steps after 'composer install' caused a second packagist.org network hit that timed out in CI, failing the PHPStan Static Analysis job. Fixes the Code Quality CI failure on PR #51 (issue #45).	2026-03-17 00:04:23 +00:00
Marcus Quinn	79829ddce0	fix: address PR #15 review feedback for error-checking-feedback-loops.md (issue #24 ) (#65 ) - Add blank lines around all fenced code blocks (MD031) - Add language specifiers to all bare fenced code blocks (MD040) - Rename duplicate 'Processing Steps' heading to 'SonarCloud Processing Steps' (MD024) Closes #24	2026-03-16 23:57:57 +00:00
Marcus Quinn	ef43525c4a	docs: fix inaccuracies in Playground-Testing.md (issue #27 ) (#63 ) - Correct blueprint description: single-site does not enable multisite; both blueprints activate Plugin Toggle and Kadence Blocks - Fix incorrect WP-CLI flag: --activate-network → --network - Update multisite blueprint description to name both network-activated plugins	2026-03-16 23:42:34 +00:00
Marcus Quinn	708acc39de	fix: add comma-dangle rule to .eslintrc.js to prevent trailing commas (issue #25 ) (#66 ) Add 'comma-dangle': ['error', 'never'] rule to .eslintrc.js to enforce no trailing commas in JavaScript files. This addresses the Codacy review findings from PR #15 that flagged trailing commas in object and array literals as ErrorProne issues. The rule ensures ESLint catches trailing commas automatically going forward. Closes #25	2026-03-16 23:41:05 +00:00
Marcus Quinn	40f6f596fa	fix: resolve ESLint sourceType mismatch for cypress.config.js (issue #31 ) (#64 ) Add overrides block in .eslintrc.js to parse cypress.config.js as CommonJS (sourceType: 'script') rather than ESM. The global sourceType: 'module' caused ESLint to flag require() as undefined, since require is not available in ESM scope. The project has no 'type: module' in package.json, so CommonJS is correct. Closes #31	2026-03-16 23:40:05 +00:00
Marcus Quinn	0b17fe8ad9	fix: remove stale cache-busting parameter from playground/index.html blueprint URL (#67 ) The CodeRabbit review of PR #15 flagged that playground/index.html had an iframe src pointing to the feature/testing-framework branch. That URL fix was applied in commit `f48276c` (updating to main branch). This commit also removes the stale cache-busting `_t=2` query parameter that was added during development. The blueprint URL now references the canonical main branch path without any ephemeral query parameters. Closes #36	2026-03-16 23:39:31 +00:00
Marcus Quinn	a8f968562c	fix: add graceful termination for Python HTTP server in playground modes (#62 ) Adds PYTHON_PID variable and cleanup() function with EXIT/INT/TERM trap to ensure the background Python HTTP server is always stopped when the script exits, whether normally or due to an unexpected interruption. Applies to both playground-single and playground-multisite branches. Closes #30	2026-03-16 23:08:34 +00:00
Marcus Quinn	595855ce10	fix: add specific plugin functionality tests to single-site.cy.js (issue #33 ) (#61 ) Address CodeRabbit PR #15 review feedback: replace generic settings page stub with tests that verify actual plugin functionality — plugin row visibility, update source selector link presence, modal open/close behaviour, and source option rendering.	2026-03-16 23:08:29 +00:00
Marcus Quinn	1d41af86c3	fix: add dialog semantics and accessible close button to update source modal (#58 ) Addresses PR #18 review feedback (issue #22): - Add role="dialog", aria-modal="true", aria-labelledby to modal container - Add tabindex="-1" to make modal keyboard-focusable - Add unique id to <h2> heading for aria-labelledby reference - Replace <span class="wpst-modal-close"> with <button type="button"> and aria-label Fixes #22	2026-03-16 23:08:09 +00:00
Marcus Quinn	a6db436a48	fix: address bin/install-wp-tests.sh PR #15 review feedback (issue #29 ) (#54 ) * fix: address PR #15 review feedback in bin/install-wp-tests.sh - Harden download(): use curl -fsSL/-o, wget -qO, add else branch for missing curl/wget (HIGH finding from coderabbit) - Fix beta/RC version logic: set WP_TESTS_TAG='branches/$WP_BRANCH' so the computed tag is not silently discarded (MEDIUM finding) - Use --branch "$WP_TESTS_TAG" in git clone so the correct WP version is checked out instead of always pulling master (MEDIUM finding) - Add failure checks (if ! cmd) after git clone and cp operations in install_test_suite (MEDIUM finding) - Quote $ioption in all sed calls to prevent word splitting - Replace sed trailing-slash strip with ${WP_CORE_DIR%/} (SC2001) - Quote ${SKIP_DB_CREATE} and $EXTRA to prevent word splitting (SC2086) - Suppress SC2001 for VERSION_ESCAPED sed (regex dot-escaping requires sed) - ShellCheck: zero violations Closes #29 * fix: strip SVN prefix from WP_TESTS_TAG for git clone --branch WP_TESTS_TAG uses SVN-style paths (tags/X.Y.Z, branches/X.Y, trunk) but git clone --branch requires bare ref names (X.Y.Z, X.Y, trunk). Derive GIT_REF by stripping the tags/ or branches/ prefix before passing to git clone. Also remove the no-op grep line in the latest version lookup and add head -1 to guard against multiple matches. Fixes CI failure: 'fatal: Remote branch tags/6.9.4 not found' Closes #29	2026-03-16 23:08:00 +00:00
Marcus Quinn	4a817ab231	fix: namespace mismatch, XSS in showNotice/showMessage, tab indentation (#47 ) - Fix namespace in includes/Multisite/class-multisite.php from WP_Plugin_Starter_Template_For_AI_Coding\Multisite to WPALLSTARS\PluginStarterTemplate\Multisite so autoloader can resolve the class correctly (critical: breaks multisite autoloading) - Fix XSS in admin/js/admin-scripts.js showNotice(): replace HTML string interpolation with safe jQuery DOM API (.text() + .addClass()) - Fix XSS in admin/js/update-source-selector.js showMessage(): replace .html(message) with .text(message) to prevent admin-side XSS - Fix tab indentation in includes/Admin/class-admin.php (3 comment lines using tabs replaced with 4-space project standard) Closes #19	2026-03-16 23:07:55 +00:00
Marcus Quinn	1f96fe9965	fix: address PR #9 review feedback quality-debt (#59 ) - .markdownlint.json: enforce MD004 asterisk style to match project conventions - .wiki/Contributing.md: convert all dash list markers to asterisks (MD004) - .wiki/Coding-Standards.md: fix PHPDoc bullet wording (add missing preposition) - build.sh: add set -euo pipefail for strict error handling - build.sh: fix SC2115 (use ${var:?} to prevent rm -rf /) - build.sh: fix SC2164 (cd build \|\| exit 1) - build.sh: fix SC2028 (use printf instead of echo for escape sequences) - build.sh: fix SC2035 (use ./*.php glob to avoid dash-named files) Closes #46	2026-03-16 22:44:49 +00:00
Marcus Quinn	5d148f8af9	fix: address CSS quality-debt from PR #15 review feedback (#55 ) - Convert tab indentation to 4 spaces in admin/css/admin-styles.css and admin/css/update-source-selector.css per project coding standards - Add stylelint and stylelint-config-standard to devDependencies - Add lint:css npm script to enable CSS quality checking - Update quality script to include CSS linting The playground/multisite.html CSS rule-empty-line-before fix was already applied in commit `3ca2fe5`. This PR formally closes the quality-debt tracking issue by verifying the fix and adding CSS linting tooling to prevent similar regressions. Closes #38	2026-03-16 22:44:46 +00:00
Marcus Quinn	0e906eb981	fix: remove redundant excludePaths.analyse block in phpstan.neon (#52 ) Addresses CodeRabbit review feedback from PR #13. The excludePaths section had both 'analyse' and 'analyseAndScan' with identical paths, which is redundant. Since analyseAndScan is the superset (excludes from both analysis and file scanning), the 'analyse' block is unnecessary. Closes #44	2026-03-16 22:44:38 +00:00
Marcus Quinn	02a635f72c	fix: address PR review feedback for class-admin.php (issue #41 ) (#49 ) - Fix mixed tab/space indentation on phpcs:disable/enable comment lines - Exclude PHPMD Superglobals rule: WordPress plugins legitimately use $_GET in testing branches with filter_input() for production; the rule produces false positives in this pattern - All other findings (wp_unslash, comment punctuation, else clause) were already addressed in prior commits on main	2026-03-16 22:44:36 +00:00
Marcus Quinn	6625e8ca4a	fix: disable networking in singleSiteBlueprint to prevent multisite (#48 ) Set networking to false in the single site playground blueprint. Networking: true can inadvertently enable multisite behaviour. Closes #39	2026-03-16 21:45:24 +00:00
Marcus Quinn	52632ec322	fix(tests): add plugin activation verification by slug in Cypress test (#50 ) Addresses CodeRabbit review feedback on PR #15 (issue #32): the 'Plugin is activated' test now also checks that the starter template plugin itself (wp-plugin-starter-template-for-ai-coding) exists and has a .deactivate link, confirming it is active rather than just present in the plugins list.	2026-03-16 21:45:23 +00:00
Marcus Quinn	1c1980bb22	chore: improve workflow names and fix CSS indentation consistency (#18 ) * fix: resolve plugin class loading reliability issues * fix: address CodeRabbit XSS and accessibility findings from PR #18 - admin/js/admin-scripts.js: replace HTML string interpolation in showNotice with DOM API construction and .text() to prevent XSS; whitelist type values - admin/js/update-source-selector.js: replace .html(message) with .text(message) in showMessage to prevent XSS from AJAX response content - admin/templates/modal.php: add role=dialog, aria-modal=true, aria-labelledby for screen reader semantics; replace <span> close control with <button> for keyboard operability and proper ARIA role	2026-03-16 18:40:09 +00:00