[Fix] Stop a Gutenberg build from spawning processes without bound (#275)

.agents/skills/self-review/SKILL.md

@@ -7,39 +7,22 @@ description: Review the current branch against this repo's architecture, securit
 
 Run the repo's review standard against the working branch, **before** the PR exists.
 
-Nothing runs this in CI. It is the only review a change gets before a human reads it, which is why
-it happens now rather than after: a finding fixed here costs one message, the same finding on the PR
-costs a review cycle.
+Nothing runs this in CI. It is the only review a change gets before a human reads it, which is why it happens now rather than after: a finding fixed here costs one message, the same finding on the PR costs a review cycle.
 
 ## Procedure
 
-**Read [`.github/instructions/code-review.instructions.md`](../../../.github/instructions/code-review.instructions.md)
-and follow it.** It is the specification for this task, not background reading — it carries the
-procedure (establish the diff, run `npm run lint` and `npm test`, then the five dimensions) as well
-as the invariants and the reporting bar. Do not restate it here; run it.
+**Read [`.github/instructions/code-review.instructions.md`](../../../.github/instructions/code-review.instructions.md) and follow it.** It is the specification for this task, not background reading — it carries the procedure (establish the diff, run `npm run lint` and `npm test`, then the five dimensions) as well as the invariants and the reporting bar. Do not restate it here; run it.
 
-That file is the single copy of the standard. It lives under `.github/instructions/` so Copilot code
-review picks it up natively; every other agent, this one included, reaches it from here. Changes to
-how reviews work go there, not into this wrapper.
+That file is the single copy of the standard. It lives under `.github/instructions/` so Copilot code review picks it up natively; every other agent, this one included, reaches it from here. Changes to how reviews work go there, not into this wrapper.
 
 Two things this skill adds on top, both agent-neutral — apply whichever your agent can:
 
-**Run the judgement pass in a fresh context.** The diff and the deterministic layer
-(`npm run lint`, `npm test`) run inline. The five dimensions should be reviewed by a context that
-did not write the change — a subagent, or a separate pass given only the diff and the instructions
-file. If the session that wrote the code also grades it, it reviews its own reasoning and finds it
-sound.
+**Run the judgement pass in a fresh context.** The diff and the deterministic layer (`npm run lint`, `npm test`) run inline. The five dimensions should be reviewed by a context that did not write the change — a subagent, or a separate pass given only the diff and the instructions file. If the session that wrote the code also grades it, it reviews its own reasoning and finds it sound.
 
-**Report, don't apply.** Surface findings in the chat. No GitHub comments, no files written — the PR
-does not exist yet. Then offer; the author decides what is a real finding.
+**Report, don't apply.** Surface findings in the chat. No GitHub comments, no files written — the PR does not exist yet. Then offer; the author decides what is a real finding.
 
 ## Notes
 
-- This is the same skill as [`.claude/skills/self-review/`](../../../.claude/skills/self-review/),
-  placed here because agents built on the Agent Skills open standard (Command Code and others)
-  discover skills under `.agents/skills/` rather than `.claude/skills/`. Both are thin wrappers over
-  the one instructions file — neither is a second copy of the standard.
-- The repo-specific knowledge this adds over a generic review: Electron's bundled Node,
-  `isomorphic-git`, `electron-store`, loopback binding, the Windows spawn shims.
-- If a finding reveals a rule the instructions file does not yet cover, say so. It is meant to
-  accumulate what the project learns.
+- This is the same skill as [`.claude/skills/self-review/`](../../../.claude/skills/self-review/), placed here because agents built on the Agent Skills open standard (Command Code and others) discover skills under `.agents/skills/` rather than `.claude/skills/`. Both are thin wrappers over the one instructions file — neither is a second copy of the standard.
+- The repo-specific knowledge this adds over a generic review: Electron's bundled Node, `isomorphic-git`, `electron-store`, loopback binding, the Windows spawn shims.
+- If a finding reveals a rule the instructions file does not yet cover, say so. It is meant to accumulate what the project learns.

.buildkite/commands/setup_macos_code_signing.sh

@@ -11,8 +11,23 @@ bundle exec fastlane setup_code_signing
 echo "Expose signing config to electron-builder..."
 # Export necessary env vars for `electron-builder` to find those for its `notarize` option
 # See https://www.electron.build/mac#notarize
-mkdir -p .codesigning/
-echo "$APP_STORE_CONNECT_API_KEY_KEY" >.codesigning/apple_api_key
-export APPLE_API_KEY=".codesigning/apple_api_key"
+#
+# The Buildkite step sources this script, so the shebang's `-eu` never applies. Return explicitly
+# so callers without `errexit` still receive materialization failures instead of continuing.
+MACOS_NOTARIZATION_TEMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/wordpress-contributor-toolkit-signing.XXXXXX")" || return 1
+export APPLE_API_KEY="$MACOS_NOTARIZATION_TEMP_DIR/apple_api_key"
+
+cleanup_macos_notarization_key() {
+	rm -rf "$MACOS_NOTARIZATION_TEMP_DIR"
+}
+trap cleanup_macos_notarization_key EXIT
+
+# `printenv` keeps the key itself out of shell traces, while the private temporary directory and
+# restrictive file mode keep it unavailable to other users on the build agent. Unlike `echo` under
+# `set -u`, `printenv` exits quietly when the variable is missing — hence the explicit guard.
+( umask 077; printenv APP_STORE_CONNECT_API_KEY_KEY >"$APPLE_API_KEY" ) || {
+	echo "APP_STORE_CONNECT_API_KEY_KEY is unset or could not be written to $APPLE_API_KEY" >&2
+	return 1
+}
 export APPLE_API_KEY_ID="$APP_STORE_CONNECT_API_KEY_KEY_ID"
 export APPLE_API_ISSUER="$APP_STORE_CONNECT_API_KEY_ISSUER_ID"

.claude/skills/self-review/SKILL.md

@@ -7,36 +7,21 @@ description: Review the current branch against this repo's architecture, securit
 
 Run the repo's review standard against the working branch, **before** the PR exists.
 
-Nothing runs this in CI. It is the only automated pass a change gets before a human reads it, which
-is why it happens now rather than after: a finding fixed here costs one message, the same finding on
-the PR costs a review cycle.
+Nothing runs this in CI. It is the only automated pass a change gets before a human reads it, which is why it happens now rather than after: a finding fixed here costs one message, the same finding on the PR costs a review cycle.
 
 ## Procedure
 
-**Read `.github/instructions/code-review.instructions.md` and follow it.** It is the specification
-for this task, not background reading — it carries the procedure (establish the diff, run
-`npm run lint` and `npm test`, then the five dimensions) as well as the invariants and the
-reporting bar. Do not restate it here; run it.
+**Read `.github/instructions/code-review.instructions.md` and follow it.** It is the specification for this task, not background reading — it carries the procedure (establish the diff, run `npm run lint` and `npm test`, then the five dimensions) as well as the invariants and the reporting bar. Do not restate it here; run it.
 
-That file sits under `.github/instructions/` so Copilot code review picks it up natively rather
-than needing a condensed second copy. It is the only copy of the standard; changes to how reviews
-work go there, not here.
+That file sits under `.github/instructions/` so Copilot code review picks it up natively rather than needing a condensed second copy. It is the only copy of the standard; changes to how reviews work go there, not here.
 
 Two things this skill adds on top:
 
-**Dispatch the judgement pass to a subagent.** Steps 1-2 of the procedure — the diff and the
-deterministic layer — run inline. Step 3, the five dimensions, goes to an `Explore` subagent given
-the diff and the instructions file, and nothing else from this conversation. If the session that
-wrote the code also reviews it, it reviews its own reasoning and finds it sound. Collect the
-subagent's findings and report them.
+**Dispatch the judgement pass to a subagent.** Steps 1-2 of the procedure — the diff and the deterministic layer — run inline. Step 3, the five dimensions, goes to an `Explore` subagent given the diff and the instructions file, and nothing else from this conversation. If the session that wrote the code also reviews it, it reviews its own reasoning and finds it sound. Collect the subagent's findings and report them.
 
-**Report in the chat and stop there.** No GitHub comments, no files written — the PR does not exist
-yet. Then offer; do not apply. The author decides what is a real finding.
+**Report in the chat and stop there.** No GitHub comments, no files written — the PR does not exist yet. Then offer; do not apply. The author decides what is a real finding.
 
 ## Notes
 
-- Complements the built-in `/code-review` and `/security-review`. What this adds is the
-  repo-specific knowledge: Electron's bundled Node, `isomorphic-git`, `electron-store`, loopback
-  binding, the Windows spawn shims.
-- If a finding reveals a rule the instructions file does not yet cover, say so. It is meant to
-  accumulate what the project learns.
+- Complements the built-in `/code-review` and `/security-review`. What this adds is the repo-specific knowledge: Electron's bundled Node, `isomorphic-git`, `electron-store`, loopback binding, the Windows spawn shims.
+- If a finding reveals a rule the instructions file does not yet cover, say so. It is meant to accumulate what the project learns.

.editorconfig

@@ -26,3 +26,5 @@ indent_size = 2
 
 [*.md]
 trim_trailing_whitespace = false
+# Prose is not wrapped here — one paragraph is one line. See AGENTS.md.
+max_line_length = off

.github/ISSUE_TEMPLATE/Bug_report.yml

@@ -64,7 +64,7 @@ body:
     id: existing
     attributes:
       label: Please confirm that you have searched existing issues in the repo.
-      description: You can do this by searching https://github.com/WordPress/experimental-wp-dev-env/issues
+      description: You can do this by searching https://github.com/WordPress/contributor-toolkit/issues
       options:
         - label: "Yes"
           required: true

.github/ISSUE_TEMPLATE/installation-bug.yml

@@ -40,7 +40,7 @@ body:
     attributes:
       label: Where did you download the app from?
       description: Please provide the exact URL or describe where you got it (e.g. GitHub Releases page, a blog post link, etc.).
-      placeholder: "e.g. https://github.com/WordPress/experimental-wp-dev-env/releases/tag/v1.0.0"
+      placeholder: "e.g. https://github.com/WordPress/contributor-toolkit/releases/tag/v1.0.0"
     validations:
       required: true