From 8ad0b72fbc9a6c77372b9453332418c4e44111e3 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Sun, 5 Jul 2026 13:26:33 +0000 Subject: [PATCH 1/7] chore(release): 3.4.1 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 9d9ef38..3f4b1ad 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@bsu/wp-coding-standards", - "version": "3.4.0", + "version": "3.4.1", "description": "PHP tool binaries for BSU WordPress development \u2014 ships PHPCS, WPCS, PHPStan, and PHPUnit", "author": "BSU|NTC Web Services", "license": "Copyright Web Services, Bemidji State University - All Rights Reserved. Unauthorized copying of any files or code in this package, via any medium is strictly prohibited.", From 0273126c734f8cff20e0f406568f13250f0fb4e4 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Wed, 8 Jul 2026 17:03:51 +0000 Subject: [PATCH 2/7] chore(release): 3.4.2 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 3f4b1ad..840bd6a 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@bsu/wp-coding-standards", - "version": "3.4.1", + "version": "3.4.2", "description": "PHP tool binaries for BSU WordPress development \u2014 ships PHPCS, WPCS, PHPStan, and PHPUnit", "author": "BSU|NTC Web Services", "license": "Copyright Web Services, Bemidji State University - All Rights Reserved. Unauthorized copying of any files or code in this package, via any medium is strictly prohibited.", From 7d6b196325c7020f6b27f83ab59b5f3ca2121453 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Thu, 20 Aug 2026 14:31:39 +0000 Subject: [PATCH 3/7] chore(release): 3.4.3 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 840bd6a..fb363cf 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@bsu/wp-coding-standards", - "version": "3.4.2", + "version": "3.4.3", "description": "PHP tool binaries for BSU WordPress development \u2014 ships PHPCS, WPCS, PHPStan, and PHPUnit", "author": "BSU|NTC Web Services", "license": "Copyright Web Services, Bemidji State University - All Rights Reserved. Unauthorized copying of any files or code in this package, via any medium is strictly prohibited.", From dd4890f9cab0ce4b50a6260e8ed6581584223e20 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Thu, 20 Aug 2026 15:48:19 +0000 Subject: [PATCH 4/7] chore(release): 3.4.4 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index fb363cf..dfe3e60 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@bsu/wp-coding-standards", - "version": "3.4.3", + "version": "3.4.4", "description": "PHP tool binaries for BSU WordPress development \u2014 ships PHPCS, WPCS, PHPStan, and PHPUnit", "author": "BSU|NTC Web Services", "license": "Copyright Web Services, Bemidji State University - All Rights Reserved. Unauthorized copying of any files or code in this package, via any medium is strictly prohibited.", From 2375ca0a9e8a9f31a84da186f4aa95c368180bf2 Mon Sep 17 00:00:00 2001 From: Kody Hagen Date: Tue, 1 Sep 2026 19:17:38 -0500 Subject: [PATCH 5/7] build(config): publish as @bemidjistate/wp-coding-standards with the GitHub Packages registry --- package.json | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/package.json b/package.json index dfe3e60..3497ba2 100644 --- a/package.json +++ b/package.json @@ -1,5 +1,5 @@ { - "name": "@bsu/wp-coding-standards", + "name": "@bemidjistate/wp-coding-standards", "version": "3.4.4", "description": "PHP tool binaries for BSU WordPress development \u2014 ships PHPCS, WPCS, PHPStan, and PHPUnit", "author": "BSU|NTC Web Services", @@ -9,6 +9,9 @@ "url": "git+https://github.com/BemidjiState/wp-coding-standards.git" }, "homepage": "https://www.bemidjistate.edu", + "publishConfig": { + "registry": "https://npm.pkg.github.com" + }, "engines": { "node": ">=24.12", "npm": ">=11.10" From 8d7829863edbf9ee6888446859d64496ea3ffffe Mon Sep 17 00:00:00 2001 From: Kody Hagen Date: Tue, 1 Sep 2026 19:17:44 -0500 Subject: [PATCH 6/7] ci(ci): publish the tagged version to GitHub Packages --- .github/workflows/publish-package.yml | 43 +++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 .github/workflows/publish-package.yml diff --git a/.github/workflows/publish-package.yml b/.github/workflows/publish-package.yml new file mode 100644 index 0000000..5d9b1ad --- /dev/null +++ b/.github/workflows/publish-package.yml @@ -0,0 +1,43 @@ +# Publishes the package to GitHub Packages (npm.pkg.github.com) whenever the +# release workflow pushes a semver tag — the tagged commit already carries the +# matching package.json version. workflow_dispatch allows re-publishing a tag +# by hand (run it from the tag's ref). +name: "Release: Publish to GitHub Packages" + +on: + push: + tags: + - "[0-9]+.[0-9]+.[0-9]+" + workflow_dispatch: + +permissions: + contents: read + packages: write + +jobs: + publish: + timeout-minutes: 15 + runs-on: ubuntu-latest + steps: + + - name: Checkout source + uses: actions/checkout@v6 + + - name: Set up Node.js + uses: actions/setup-node@v6 + with: + node-version-file: '.nvmrc' + registry-url: 'https://npm.pkg.github.com' + + # --ignore-scripts skips the husky prepare hook, which has no place in + # CI. The allow-directory override is scoped to this step: npm 11.16's + # pack trips the repo's allow-directory policy on the root project + # itself even though no directory dependency exists. There is + # deliberately no .npmignore: the tarball must match what the git + # dependency delivered — the committed vendor/ toolchain included — + # so the default pack rules apply. The tarball is ~59 MB. + - name: Publish + env: + NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + npm_config_allow_directory: all + run: npm publish --ignore-scripts From 40ccb92d48221b9f2d31661ca860732c40dbcdd7 Mon Sep 17 00:00:00 2001 From: Kody Hagen Date: Tue, 1 Sep 2026 19:17:45 -0500 Subject: [PATCH 7/7] docs(docs): document consumption from GitHub Packages via the @bsu alias --- README.md | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 781e7b3..df2bb50 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# @bsu/wp-coding-standards +# wp-coding-standards PHP tool binaries for BSU WordPress development. Installed via npm, ships the following tools in `vendor/bin/`: @@ -8,16 +8,33 @@ PHP tool binaries for BSU WordPress development. Installed via npm, ships the fo | `phpcbf` | 4.x | PHP Code Beautifier — auto-fixes PHPCS violations | | `phpstan` | 1.x | PHPStan — static analysis for type safety and correctness | -## Usage in bsuwp +## Consuming the Package -These binaries are referenced directly by path in `bsuwp/package.json` scripts: +Published to GitHub Packages as `@bemidjistate/wp-coding-standards` and +consumed under the `@bsu/wp-coding-standards` alias, so script paths keep the +short name: + +```json +"@bsu/wp-coding-standards": "npm:@bemidjistate/wp-coding-standards@3.4.4" +``` + +The consumer's `.npmrc` routes the scope to GitHub Packages +(`@bemidjistate:registry=https://npm.pkg.github.com`); installing requires a +GitHub personal access token (classic) with `read:packages` in `~/.npmrc`, +and CI uses its workflow `GITHUB_TOKEN` via the package's Actions access list. + +Consumers reference the binaries directly by path in `package.json` scripts: ```bash -npm run lint:php # phpcs via this package -npm run fix:php # phpcbf via this package -npm run analyse:php # phpstan via this package +node_modules/@bsu/wp-coding-standards/vendor/bin/phpcs +node_modules/@bsu/wp-coding-standards/vendor/bin/phpcbf +node_modules/@bsu/wp-coding-standards/vendor/bin/phpstan ``` +There is deliberately no `.npmignore`: the published tarball carries the +committed `vendor/` toolchain — the same content the git dependency +delivered. + ## Updating To update tool versions, modify `composer.json` and run `composer update`, then commit the updated `composer.lock` and `vendor/` in a PR to `release`.