Release: Prepare Emulsify Wordpress 2.1.x release by callinmullaney · Pull Request #47 · emulsify-ds/emulsify-wordpress

callinmullaney · 2026-10-22T20:50:46Z

This PR does the following:

Prepares the WordPress 2.1.0 parity update against Emulsify Drupal 7.2.2 plus its 7.3.0 release work, adapted to WordPress-native integration.

Adds optional YouTube and Vimeo privacy rewrites and JavaScript-free click-to-load posters. Both default to off. Render-time oEmbed filters preserve player parameters, including unlisted Vimeo hashes; projects can choose provider thumbnails or neutral posters and override the parent Twig fallback.
Adds public site_header, main, and page_title Twig blocks while preserving existing block names, boundaries, WordPress hooks, and default output. Freshly generated themes inherit parent templates without shipping a page override.
Aligns project component resolution with Core 4.5: ordered direct candidates, .html.twig support, breadth-first grouped discovery, deterministic duplicates, skipped directories, and root containment. Each child root is searched completely before parent roots.
Fixes pagination current-page marking, literal translated ellipses, query-string escaping, and hidden “Page” prefixes. Menu links mark only the current item. Corrects document language markup and Timber helper registration without weakening field autoescaping.
Adds PHP/JavaScript Twig helper characterization with explicit expectations for known differences. Fixes argumentless bem() and add_attributes() calls accidentally consuming unrelated context.
Raises the minimum WordPress version to 6.8 to match locked Timber 2.5.1. Sets Tested up to to 7.1 after successful packaged validation on 7.1.3. PHP and Timber dependency constraints remain unchanged.
Updates generated themes to Core ^4.5.0 and documents its effective Node.js minimum of 24.13.0.
Makes lint and format wrappers preserve every failure. Enables native ESM Jest tests and project coverage, and makes empty test suites fail.
Replaces the copied accessibility engine with a thin wrapper around Core’s bounded runner, retaining WordPress’s empty-audit failure and Chrome’s sandbox. Incorporates fix(scripts): keep generated audit JSON output parseable #42’s audit-wrapper fix so documentation footers no longer corrupt JSON stdout.
Ships contributor and generated-theme AI guidance, a library-neutral WordPress integration guide, and an integration skill. Generation contracts protect hidden .agents files, copy integrity, frontmatter, links, and documented commands.
Adds rendered accessibility checks for seven WordPress routes, including archive page 2 and video posters. Audits retain HTML and axe JSON, verify current menu/pager items, and use WCAG tags through 2.2 AA with only target-size disabled.
Removes invalid link-state color declarations and the normal link color that failed contrast. Existing presets and other theme.json styles remain for maintainer review; no replacement page stylesheet is added.
Replaces the forced-2.0.0 release machinery with prepared-version validation. Committed version metadata must match semantic-release’s calculation; unprepared releases skip successfully. Adds stale-draft/latest-release checks and honors release:check -- --skip-smoke.
Pins workflow actions to commit SHAs, updates artifact/cache actions, enables Actions Dependabot, and protects blocking WordPress/PHP coverage with a matrix contract. Updates compatible vulnerable tooling dependencies, corrects README assets, and records remaining dependency findings.
Records the Drupal sync, intentional platform differences, release checklist, and required versus optional upgrade actions.

Related Issue(s)

Sister release: Release: Prepare Emulsify Drupal 7.3 release emulsify-drupal#382
Incorporates audit-wrapper work from fix(scripts): keep generated audit JSON output parseable #42.

Notes:

This PR does not bump or publish 2.1.0. Package, theme, and starter lineage versions remain at 2.0.0. Release preparation must update every derived version together and verify semantic-release computes the same version.
Sites on WordPress 6.7 must upgrade WordPress before updating the parent. PHP remains 8.3 or newer. Generated frontend tooling requires Node.js 24.13.0 or newer through Core; the existing >=24 engine and .nvmrc value remain unchanged.
Existing children inherit parent runtime fixes, but parent updates do not replace copied scripts, dependencies, Jest configuration, documentation, or guidance. Adoption steps are separated into required and optional actions in UPGRADE.md.
Existing parent-extending templates/page.twig overrides can stay. Search project CSS for the machine-name page wrapper before deleting one. Use @emulsify-tpl to extend a parent template; extending the same path through @templates recurses.
Projects with duplicate component names should review Core’s resolution precedence. Flat templates precede nested candidates, and child grouped components take precedence over parent direct matches.
Projects own target size, screen-reader-text, and focus styles. Drupal’s target-size stylesheet is deliberately not ported. The opt-in poster’s accessibility CSS stays inside its iframe document; existing page-level theme.json styles are listed below.
Media options are off by default. Provider posters request a thumbnail before activation; neutral posters avoid that browser request. Providers receive data when playback loads. The srcdoc poster inherits the page’s CSP, including inline-style restrictions; see media embeds.
WordPress minimum and current stable coverage are blocking; nightly is advisory. Practical PHP 8.3, 8.4, and 8.5 checks are blocking.
The October 23 dependency audit records a reduction from 10 to 7 vulnerable root package entries. Six high and one moderate development-only entries remain in semantic-release’s bundled npm dependency tree. The root runtime audit reports zero; this does not establish a clean generated-theme dependency audit.
The sync log documents WordPress adaptations and Drupal-only omissions.

Retained parent theme.json styles for maintainer review

These existing styles are unchanged. Presets and editor configuration under settings remain.

Location	Remaining style
Root spacing	Left/right `1rem` padding and associated WordPress global-padding rules.
Links	Visited color `brand-primary-dark` (`#00202E`).
Headings `h1`–`h6`	Black text, primary font family, and size presets `12`, `10`, `8`, `7`, `3`, `2`.
`core/button`	Zero border radius/width; vertical `0.5rem` and horizontal `1rem` padding.
`core/quote`	Light-blue text, primary font, size preset `7`, weight `400`, and margins.
Quote citations	Dark text, primary font, size preset `3`, weight `400`, and top margin.

The malformed button border.color object and unresolved spacing--medium references remain untouched. Empty link border/spacing/typography objects emit no styles.

Functional Testing:

* origin/codex/audit-wrapper-json-contract: fix(scripts): keep generated audit JSON output parseable

Build the ZIP once in read-only readiness, then pass its checksum bundle to WordPress fixtures and publishing. Verify both transport digest and SHA-256 before use instead of rebuilding after tests. Disable persisted checkout credentials and remove PHP and Composer from publishing. Expose the write token only to the release commands.

Prevent accidental npm publication and remove the npm script that bypassed the guarded release runner. Verify a nonempty ZIP before semantic-release can create a tag, including during local dry runs.

Override commit and tag signing in fixture Git calls rather than changing maintainers' global configuration. The complete test suite passes even when both signing settings are enabled and the signing program fails.

Avoid requesting the unavailable Projects secret for fork or Dependabot pull requests. Keep the existing issue and manual triggers.

Centralize pushed-branch, attached-HEAD, push-token and tested-ZIP requirements. Remove the claim that unpushed commits can be dry-run. Describe partial release recovery, full readiness, artifact reuse, scoped credentials, dependency audit policy and local Husky installation.

Block readiness on the locked production Composer dependency audit. Generate an ephemeral Whisk lock snapshot before its informational audit so the check examines dependencies instead of failing with ENOLOCK.

Install hooks with Husky's current prepare command, including worktrees, and run commitlint from a real commit-msg hook with a quoted message path. Remove the ignored legacy config and deprecated pre-commit bootstrap. Actual npm installs and bad-message commits in a scratch clone and linked worktree exercised both the PHP lint hook and commit-message rejection.

Have the existing install emit its lock with a forwarded npm option so the advisory audit examines that exact dependency tree. Remove the extra lock-resolution step that could introduce an audit-only release gate. Require the lock option and audit ordering in the workflow contract.

Use the standalone WordPress fixture to test a rebuilt expired artifact. The historical draft at an existing release tag must still fail the unreleased-draft contract, so ordinary release readiness is not a usable recovery instruction there. Keep that publishing contract unchanged.

Use WordPress's assembled markup when parsed fragments contain child placeholders. Preserve leaf behavior and saved wrappers without rendering children again or dropping their final filters and short-circuited output. Generic child render filters run before later block-name processing, so capturing them cannot reconstruct the final bytes reliably. Document the full-content fallback instead of promising wrapper-free children.

Reuse global Timber context and resolve each block's post without setup(), preserving Query Loop globals and avoiding repeated the_post callbacks. Cache unchanged map normalization while retaining dynamic and late filters. Require real template files and fall back to WordPress markup on reentry, resetting the guard in finally. Document route-specific context migration and cover real WordPress children, post isolation and recursive content.

Try the optional front-page template for static or posts front pages. Separate posts pages use home then index, and protected static front pages retain password-form priority. Wire isolated controller tests into the existing template-extension smoke and exercise actual HTTP routing and fallbacks in the WordPress fixture.

Choose an archive template from the queried post type even without posts. Match WordPress's single-type array behavior and keep multiple types on generic fallbacks. Format day titles with the site's date_format option. Keep month and year formatting unchanged and cover empty type archives and configured day dates through controller and real WordPress tests.

…uteBag

Reject noncanonical standalone names because Emulsify CLI creates the target directory before this hook. Preserve JSON objects, rewrite nested patterns and fail staging atomically on invalid metadata.

Use the supported WordPress APIs and share asset roots, records, versions and manifest paths. Keep context keys while computing body classes once in the parent and resolving logout URLs on demand; JSON keys retain their nonce-sensitive value.

Reject HTML before starter writes rather than approximating PHP tag stripping. Exercise the WordPress generator against the fixture core formatting functions.

github-actions · 2026-10-29T18:07:39Z

🎉 This PR is included in version 2.1.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

Callin Mullaney added 5 commits September 9, 2026 15:22

fix(scripts): keep generated audit JSON output parseable

75ec902

fix(release): support prepared stable releases

afb8591

fix(templates): correct fallback pagination markup and URLs

a085460

fix(a11y): mark the current fallback menu item

d564eb8

test(templates): cover fallback navigation and search pagination

3addd33

callinmullaney changed the title ~~fix(release): support prepared stable releases~~ fix: prepare releases and correct fallback navigation Oct 22, 2026

fix(twig): resolve grouped project components like Emulsify Core

ab8b1b4

callinmullaney changed the title ~~fix: prepare releases and correct fallback navigation~~ fix: prepare releases and align WordPress component rendering Oct 22, 2026

fix(compat): raise the minimum WordPress version to 6.8

6392ff5

callinmullaney changed the title ~~fix: prepare releases and align WordPress component rendering~~ fix: prepare releases and align WordPress runtime compatibility Oct 23, 2026

Callin Mullaney added 5 commits October 22, 2026 21:08

fix(theme): remove link state styles that never applied

a67113b

fix(scripts): integrate generated audit wrapper JSON contract

a918a51

* origin/codex/audit-wrapper-json-contract: fix(scripts): keep generated audit JSON output parseable

build(deps): update Whisk to Emulsify Core 4.5.0

f7075d8

fix(whisk): align copied scripts and project test runners

015b0df

ci: validate Whisk tests and sandboxed runner Chrome

28db7c3

callinmullaney changed the title ~~fix: prepare releases and align WordPress runtime compatibility~~ fix: align WordPress runtime, starter tooling, and releases Oct 23, 2026

Callin Mullaney added 4 commits October 22, 2026 22:18

test(templates): capture parent layout output before extension blocks

5ea0d6b

feat(templates): add stable parent layout extension blocks

9056a3d

fix(whisk): inherit parent templates without starter overrides

6bd2cd9

docs: document parent Twig extension and starter inheritance

48304b7

callinmullaney changed the title ~~fix: align WordPress runtime, starter tooling, and releases~~ feat: add parent Twig extension points and align WordPress tooling Oct 23, 2026

Callin Mullaney added 3 commits October 22, 2026 22:43

feat(whisk): ship AI guidance with generated child themes

04f765e

docs: add WordPress contributor guidance

951cdf1

fix(whisk): contain guidance links within generated themes

9c91e96

callinmullaney changed the title ~~feat: add parent Twig extension points and align WordPress tooling~~ feat: add Twig extension points and generated theme guidance Oct 23, 2026

Callin Mullaney added 5 commits October 22, 2026 22:56

fix(a11y): prefix numbered pagination links with Page

b169657

fix(a11y): preserve language attributes and inherit link colors

925b667

fix(a11y): render pager prefix attributes through the theme helper

5caab31

ci: audit rendered WordPress pages with sandboxed Chrome

72df473

docs: explain rendered accessibility audits and project styling

eda8cca

Callin Mullaney added 26 commits October 29, 2026 09:40

chore: mark the package private and require the release ZIP

d2aca19

Prevent accidental npm publication and remove the npm script that bypassed the guarded release runner. Verify a nonempty ZIP before semantic-release can create a tag, including during local dry runs.

test(release): disable signing in release test fixtures

0d16996

Override commit and tag signing in fixture Git calls rather than changing maintainers' global configuration. The complete test suite passes even when both signing settings are enabled and the signing program fails.

ci: skip add-to-project for forks and Dependabot

70493c8

Avoid requesting the unavailable Projects secret for fork or Dependabot pull requests. Keep the existing issue and manual triggers.

ci: audit shipped Composer and Whisk dependencies

1b9c459

Block readiness on the locked production Composer dependency audit. Generate an ephemeral Whisk lock snapshot before its informational audit so the check examines dependencies instead of failing with ENOLOCK.

fix(twig): block script URLs and framework event attributes in Attrib…

22d900a

…uteBag

fix(runtime): let robots, feeds and sitemaps load without Timber

75add7f

fix(cli): share one machine-name rule between the generators

0aeb6bf

Reject noncanonical standalone names because Emulsify CLI creates the target directory before this hook. Preserve JSON objects, rewrite nested patterns and fail staging atomically on invalid metadata.

fix(build): package only committed files without symlinks

eb2f448

fix(assets): keep scoped subfolder assets off unrelated pages

ab7c083

fix(cli): handle symlinked starter directories

ac8e8b2

fix(templates): fire get_footer before wp_footer

39194d6

fix(twig): match Twig's template freshness check

d9f0590

fix(cli): require plain text in standalone generation metadata

3e3aa37

Reject HTML before starter writes rather than approximating PHP tag stripping. Exercise the WordPress generator against the fixture core formatting functions.

test: align release assertions with shared runtime helpers

88043e1

fix(assets): normalize scoped metadata asset paths

bf81a06

docs: finalize the 2.1.0 notes after the October 28 fixes

bd9df57

callinmullaney marked this pull request as ready for review October 29, 2026 18:00

callinmullaney merged commit b0cb7fd into main Oct 29, 2026
8 checks passed

github-actions Bot added the released label Oct 29, 2026

Navigation Menu

Repository navigation

Release: Prepare Emulsify Wordpress 2.1.x release - #47

Release: Prepare Emulsify Wordpress 2.1.x release#47
callinmullaney merged 101 commits into
mainfrom
release-2.1.x

callinmullaney commented Oct 22, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

callinmullaney commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Related Issue(s)

Notes:

Functional Testing:

Uh oh!

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

callinmullaney commented Oct 22, 2026 •

edited

Loading