Skip to content

Release: Emulsify Wordpress 2.0 - #29

Open
callinmullaney wants to merge 79 commits into
mainfrom
release-2.x
Open

Release: Emulsify Wordpress 2.0#29
callinmullaney wants to merge 79 commits into
mainfrom
release-2.x

Conversation

@callinmullaney

@callinmullaney callinmullaney commented Jun 27, 2026

Copy link
Copy Markdown

This PR does the following:

  • Prepares Emulsify Wordpress 2.0 as a stable Timber-first WordPress parent theme release
  • Replaces the old unsupported 1.x starter-theme model with a parent theme plus generated child theme architecture
  • Updates the project for WordPress 6.7+, PHP 8.3+, Timber 2, Node 24, Emulsify Core 4, Vite, Storybook, and Twig
  • Adds a bundled Whisk child theme starter with project.emulsify.json configured for platform: "wordpress"
  • Adds WP-CLI child theme generation through wp emulsify, including dry-run, force, machine-name, and activation support
  • Moves reusable WordPress runtime behavior into namespaced classes under includes/
  • Adds parent theme bootstrapping, setup, asset loading, Timber integration, Twig namespaces, Twig helpers, context handling, and missing-Timber handling
  • Adds child-first asset loading from built dist/global and dist/components output
  • Adds Core-style Twig helpers such as bem() and add_attributes()
  • Adds project-machine-name component include support, while preserving legacy @components compatibility
  • Adds optional ACF Local JSON path integration for child themes
  • Adds optional ACF/Twig block registration from component metadata
  • Adds optional native Gutenberg block registration from built block.json files
  • Adds JSON block pattern registration support
  • Adds editor enhancement and editor policy services for project-owned editor behavior
  • Adds release readiness, PR validation, smoke checks, semantic-release workflow support, and WordPress theme readiness CI
  • Adds documentation for upgrading, parent/child architecture, Core 4/Vite workflow, Timber/Twig authoring, block integrations, editor features, asset loading, WP-CLI generation, release process, and sister-project parity
  • Removes legacy Webpack, Storybook 6, Travis, old component examples, and outdated 1.x tooling/configuration

Related Issue(s)

  • N/A

Notes:

  • This is a major release branch and should be treated as a breaking change from the old 1.x starter-theme model.
  • The intended model is: emulsify is the reusable parent runtime, and generated child themes own project components, templates, Sass, JavaScript, built assets, and site-specific overrides.
  • The bundled whisk/ directory is the child theme starter source. Generated projects should activate the child theme, not the parent theme.
  • The standalone Emulsify CLI starter is expected to represent the generated child theme layer from whisk/, not the parent runtime theme root.
  • Current CI status: WordPress Theme Readiness is passing. The PR run completed the practical readiness job successfully; the full WordPress fixture and extended Whisk Storybook/a11y jobs are intentionally skipped on normal PR runs.

Functional Testing:

  • Run npm ci --ignore-scripts.
  • Run composer validate --no-check-publish --strict.
  • Run npm audit --omit=dev.
  • Run npm audit.
  • Run npm run lint:php.
  • Run npm run pr:check.
  • Run npm run release:check.
  • Run npm run publish-test -- --no-ci to confirm the semantic-release dry run targets 2.0.0.
  • In a WordPress install with WP-CLI available, test wp emulsify "Acme Site" --dry-run.
  • Generate a child theme with wp emulsify "Acme Site" --machine-name=acme-site.
  • Confirm the generated child theme has updated theme headers, package metadata, project.emulsify.json, and Template: emulsify.
  • Activate the generated child theme and confirm the parent theme runtime loads through Timber.
  • From the generated child theme, run npm install.
  • From the generated child theme, run npm run build after installing/configuring a component system with Vite input files.
  • Review the new docs for upgrade guidance, parent/child responsibilities, Core 4 workflow, block integrations, and release process.

Callin Mullaney added 28 commits May 7, 2025 16:53
Add configurable parent services for editor policy, pattern registration, ACF Local JSON, editor enhancements, and core block Twig rendering.

Refactor Whisk so generated child themes do not inherit concrete component, Sass, or pattern examples, and update smoke/release coverage to use neutral fixtures.
@callinmullaney
callinmullaney changed the base branch from emulsify-core-integration to main June 28, 2026 17:18
Callin Mullaney and others added 26 commits July 7, 2026 21:14
Address S1/S2 from the release review by enabling HTML autoescaping and restricting ACF block template resolution to discovered component templates.

Trusted WordPress HTML remains raw only at:
- templates/single.twig: post.content
- templates/page.twig: post.content
- templates/partials/comment.twig: comment.content|wpautop
- templates/partials/tease.twig: post.excerpt
fix(ci): unblock release by scoping npm audit gate and patching fast-…
fix(security): enable Twig autoescaping and escape ACF/block context
fix(cli): sanitize theme name, require generatedFrom for --force, mak…
feat(release): build and attach installable theme ZIP with bundled de…
ci: run WordPress fixture and Whisk a11y on PRs and add required PHP …
fix(runtime): log silent asset failures, fall through corrupt manifes…
@callinmullaney

Copy link
Copy Markdown
Author

Release-path certification — PASS

Certified PR head 91ee6632fa6db3a977f705af2641a582debd776d on PHP 8.3.32, Composer 2.10.2, Node 24.18.0, npm 11.16.0, plus WP-CLI/MySQL and Chrome.

  • Fresh/static gates: npm ci --ignore-scripts; strict Composer validation/install; npm run lint:php; and npm audit --omit=dev (0 runtime vulnerabilities).
  • Behavioral gates: node .github/scripts/release-check.cjs, npm run pr:check, and npm run smoke:twig-autoescape all pass. The generator smoke explicitly covers hostile names, refusal to --force without generatedFrom, machine-name mismatch refusal, and partial-copy rollback.
  • Required WordPress fixture: WP_SMOKE_REQUIRED=1 ... npm run release:check passes against MySQL. Generated child activation, block discovery/assets, and all fixture routes rendered successfully.
  • Manual WordPress rendering: page and single content render once (not escaped or double-escaped). An ACF/Twig block value of "><script>alert(1)</script> is escaped exactly once through the real registered render callback.
  • Distribution: npm run build:dist passes. The exact dist-artifact/emulsify.zip was extracted under wp-content/themes and tested without running Composer after extraction. A generated child activated successfully; bundled Timber loaded from the extracted parent vendor tree; no MissingTimber handler/notice appeared; HTTP render returned 200.
  • Whisk a11y: the CI fixture's Storybook build and Pa11y/Axe audit pass with explicit Chrome. A negative control containing an unnamed <button> reported button-name and exited 1, confirming real violations fail the job.
  • Release dry run: npm run publish-test -- --no-ci passes in a disposable main simulation at this exact head, reports The next release version is 2.0.0, and cleans up the temporary baseline tag.
  • Remote CI: all four required checks pass in workflow run 30170230325: Practical theme readiness, PHP coding standards/static analysis, WordPress fixture smoke, and Extended Whisk Storybook/a11y.
  • Branch protection: main and release-2.x both require exactly those four checks with strict up-to-date branches.

Defects found during certification were fixed directly on release-2.x: cb133e2 corrects the inaugural stable release calculation to 2.0.0, and 91ee663 makes Pa11y launch setup-chrome's binary reliably on isolated Linux CI. The full PR check set is green after both fixes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant