Three jobs, each earning its place:
- php -l across PHP 7.4 through 8.4. The cheapest useful signal here: the plugin's recent
history is PHP 8 compatibility work and it advertises support in readme.txt, but nothing
has ever verified that on more than whichever interpreter the maintainer happened to run.
- PHPUnit on 8.2-8.4.
- PHPCS with the WordPress security and prepared-SQL sniffs.
The PHPCS job is scoped to the files a pull request actually changes. This is the difference
between the job being useful and being ignored: an unscoped run reports thousands of
pre-existing findings across decade-old code, which would make it permanently red and train
everyone to skip past it. Scoped, it only speaks up about code someone is touching now.
The ruleset is likewise narrow on purpose -- WordPress.Security, PreparedSQL,
PreparedSQLPlaceholders and EnqueuedResources -- rather than the full WordPress-Extra. Those
are the sniffs matching the bug classes this plugin has actually had. Widening it is a
separate decision from turning it on.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
coraislovely-code