Merge remote-tracking branch 'origin/trunk' into add/ci-workflow-for-unit-tests

Author: priethor

.codecov.yml

@@ -24,6 +24,7 @@ coverage:
                 target: 70%
                 threshold: 5%
                 if_ci_failed: ignore
+                only_pulls: true
 
 ignore:
     - '*.min.css'

.github/workflows/e2e.yml

@@ -3,18 +3,52 @@ name: E2E Tests
 on:
     pull_request:
         branches: [trunk]
+    push:
+        branches: [trunk]
+    # Allow manually triggering the workflow
+    workflow_dispatch:
+
+# Cancels all previous workflow runs for pull requests that have not completed
+concurrency:
+    group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }}
+    cancel-in-progress: true
+
+# Disable permissions for all available scopes by default
+permissions: {}
 
 jobs:
     test:
-        name: Playwright e2e Tests
+        name: Node ${{ matrix.node }} / WP ${{ matrix.wp }}
         runs-on: ubuntu-latest
+        permissions:
+            contents: read
+
+        strategy:
+            fail-fast: false
+            matrix:
+                event: ['${{ github.event_name }}']
+                node: ['22', '24']
+                wp: ['6.2', 'latest', 'trunk']
+                exclude:
+                    # On PRs: only test Node 22 + WP trunk for fast feedback
+                    # On trunk: full matrix with minimum and latest WP versions
+                    - event: 'pull_request'
+                      node: '24'
+                    - event: 'pull_request'
+                      wp: '6.2'
+                    - event: 'pull_request'
+                      wp: 'trunk'
+
+        env:
+            WP_ENV_CORE: ${{ matrix.wp == 'trunk' && 'WordPress/WordPress' || (matrix.wp != 'latest' && format('WordPress/WordPress#{0}', matrix.wp) || null) }}
+
         steps:
             - uses: actions/checkout@v4
 
             - name: Setup Node.js
               uses: actions/setup-node@v4
               with:
-                  node-version-file: '.nvmrc'
+                  node-version: ${{ matrix.node }}
                   cache: 'npm'
 
             - name: Install dependencies

.github/workflows/phpunit.yml

@@ -16,13 +16,20 @@ jobs:
     runs-on: ubuntu-latest
 
     strategy:
-      matrix:
-        include:
-          # Minimum supported PHP
-          - php: '7.4'
-          # Latest stable PHP
-          - php: '8.4'
       fail-fast: false
+      matrix:
+        event: ['${{ github.event_name }}']
+        php: ['7.4', '8.0', '8.1', '8.2', '8.3', '8.4']
+        exclude:
+          # On PRs: only test minimum and latest PHP versions
+          - event: 'pull_request'
+            php: '8.0'
+          - event: 'pull_request'
+            php: '8.1'
+          - event: 'pull_request'
+            php: '8.2'
+          - event: 'pull_request'
+            php: '8.3'
 
     steps:
       - name: Checkout code

.phpcs.xml.dist

@@ -24,6 +24,8 @@
 		<!-- Refactoring of this scale is not in scope yet.-->
 		<exclude name="WordPress.Files.FileName" />
 		<!-- Exclude the entire filename rule -->
+		<exclude name="WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents" />
+		<!-- file_get_contents is safe for reading local plugin files bundled with the plugin. -->
 	</rule>
 
 	<rule ref="WordPress.Security.EscapeOutput">

assets/src/js/_acf-validation.js

@@ -1162,9 +1162,11 @@
 											'editor-post-publish-panel'
 										)[ 0 ];
 									if ( publishPanel ) {
+										// See https://github.com/WordPress/secure-custom-fields/pull/272
+										// `togglePublishSidebar` was only introduced in WP 6.6, it should be optional
 										wp.data
 											.dispatch( 'core/editor' )
-											.togglePublishSidebar();
+											.togglePublishSidebar?.();
 									}
 
 									// Add block to errors array

docs/bin/manifest.json

@@ -29,11 +29,6 @@
         "parent": null,
         "markdown_source": "https://github.com/wordpress/secure-custom-fields/blob/trunk/docs/welcome/index.md"
     },
-    "code-reference/abilities": {
-        "slug": "abilities",
-        "parent": "code-reference",
-        "markdown_source": "https://github.com/wordpress/secure-custom-fields/blob/trunk/docs/code-reference/abilities/index.md"
-    },
     "code-reference/acf-bidirectional-functions-file": {
         "slug": "acf-bidirectional-functions-file",
         "parent": "code-reference",
@@ -284,11 +279,6 @@
         "parent": "welcome",
         "markdown_source": "https://github.com/wordpress/secure-custom-fields/blob/trunk/docs/welcome/quick-start.md"
     },
-    "code-reference/abilities/class-scf-post-type-abilities-file": {
-        "slug": "class-scf-post-type-abilities-file",
-        "parent": "abilities",
-        "markdown_source": "https://github.com/wordpress/secure-custom-fields/blob/trunk/docs/code-reference/abilities/class-scf-post-type-abilities-file.md"
-    },
     "code-reference/admin/admin-commands-file": {
         "slug": "admin-commands-file",
         "parent": "admin",

docs/code-reference/abilities/class-scf-post-type-abilities-file.md

@@ -16,6 +16,7 @@
 	 * Handles integration with WordPress Abilities API.
 	 *
 	 * @since 6.6.0
+	 * @codeCoverageIgnore Glue code tested implicitly via E2E tests.
 	 */
 	class SCF_Abilities_Integration {
 
@@ -38,7 +39,9 @@ public function init() {
 				return;
 			}
 
+			acf_include( 'includes/abilities/class-scf-internal-post-type-abilities.php' );
 			acf_include( 'includes/abilities/class-scf-post-type-abilities.php' );
+			acf_include( 'includes/abilities/class-scf-taxonomy-abilities.php' );
 		}
 
 		/**