wordpress.org readiness + CI/release pipeline

.claude/launch.json

@@ -3,8 +3,8 @@
 	"configurations": [
 		{
 			"name": "playground",
-			"runtimeExecutable": "npx",
-			"runtimeArgs": ["-y", "@wp-playground/cli@latest", "server", "--port=9400", "--mount=./outbox-mail-log:/wordpress/wp-content/plugins/outbox-mail-log", "--blueprint=./tools-playground-blueprint.json", "--login"],
+			"runtimeExecutable": "node",
+			"runtimeArgs": ["scripts/playground-server.mjs", "--port", "9400"],
 			"port": 9400
 		}
 	]

.gitattributes

@@ -0,0 +1,15 @@
+# LF everywhere: reproducible release ZIPs (Windows and CI builds are byte-identical) and stable PHPCS results.
+* text=auto eol=lf
+
+*.png binary
+*.jpg binary
+*.gif binary
+*.mo binary
+*.zip binary
+
+# Not part of `git archive` exports (the release ZIP is built by scripts/build-zip.mjs anyway).
+/.github export-ignore
+/tests export-ignore
+/scripts export-ignore
+/i18n export-ignore
+/.wordpress-org export-ignore

.githooks/pre-push

@@ -0,0 +1,4 @@
+#!/bin/sh
+# Fast local checks before every push (static analysis, unit tests, readiness, ZIP). Enable once with:
+#   git config core.hooksPath .githooks
+exec node scripts/verify.mjs --fast

.github/dependabot.yml

@@ -0,0 +1,45 @@
+# Keeps the pinned actions (SHA + version comment), the Composer dev tools and the npm dev tools current.
+# One grouped PR per ecosystem and week; every PR runs the full CI. cooldown: new versions are only proposed
+# after 7 days – compromised releases are usually caught within the first days. Security updates ignore it.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns: ['*']
+
+  - package-ecosystem: composer
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    cooldown:
+      default-days: 7
+    versioning-strategy: lockfile-only
+    ignore:
+      # Major jumps (PHPUnit 10+, …) need a deliberate migration.
+      - dependency-name: '*'
+        update-types: ['version-update:semver-major']
+    groups:
+      dev-tools:
+        patterns: ['*']
+
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    cooldown:
+      default-days: 7
+    ignore:
+      - dependency-name: '*'
+        update-types: ['version-update:semver-major']
+    groups:
+      npm-dev-tools:
+        patterns: ['*']