Skip to content

v0.7.0 — First Public Release

Pre-release
Pre-release

Choose a tag to compare

View all tags
@joshdaugherty joshdaugherty released this 26 Oct 15:39
· 18 commits to main since this release
v0.7.0
ec67149
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

First release cut from the public repository. It carries the plugin forward from the archived predecessor's v0.6.1, serves Workday and Epic DEP identifiers in a new identifiers block, withholds more credential-bearing options from GET /options, and adds required status checks, a CI aggregate job, and a single-site test process.

Marked pre-release. Nothing pins this repository: wordpress-importer reads it over HTTP rather than as a package.

Changes merged in the archived predecessor after v0.6.1 reached this repository in its initial commit, so they link to that commit.

What's new

  • Serve the Workday identifiers and location Epic DEP IDs in an identifiers block fd933d0

Security

  • Withhold the Gravity Forms File Upload add-on's purchase_code from GET /options fd933d0
  • Withhold credentials inside JSON strings nested in options, starting with Formidable's license-check caches fd933d0
  • Pin the 25 plugins reviewed in option_denylist_reviewed_against fd933d0

Maintenance and tooling

  • Bump the plugin version to 0.7.0 #21
  • Check that every CI job is in the CI job's needs #18
  • State the WordPress 6.8.11 floor #17
  • Run the Integration suite on a single-site install as well as a multisite #16
  • Pin php-stubs/wordpress-stubs to production's WordPress 6.8 #15
  • Run the synced-files, handed-back, and download-archive checks in CI #12
  • Pass PHPStan on both the 6.9 and 7.1 WordPress stubs #11
  • Require CI, Attribution footer, and Closing keywords on main #9
  • Make the PHPStan job pass without the Integration Composer setup #3
  • Bump pestphp/pest from 5.3.2 to 5.3.3 in the composer-minor-and-patch group across 1 directory #1
  • Keep the GitHub download to what the plugin runs fd933d0
  • Add the GPL-2.0-or-later LICENSE file fd933d0
  • Pin the Side-by-Side block's Blockquote with Citation layouts in tests fd933d0
  • Describe the credential-bearing options in D-032 without naming them fd933d0
  • Split the key-shaped test fixtures so push protection accepts the public snapshot fd933d0

Verification at this tag

The repository is public, so its GitHub Actions chain runs on every pull request and main requires the CI aggregate, Attribution footer, and Closing keywords checks; release validation no longer rests on the local chain alone. Both passed on the validated head 8252ab22e of #21: the remote chain, including the CI aggregate, Pest (Unit + Integration), and PHPStan, and npm run ci:local, 16 of 16 jobs. The tagged commit is the squash merge ec671497e; its tree (6d5837dc4) is identical to the validated head's, checked with git diff --quiet (exit 0).

Known gaps

See the Known gaps section of AGENTS.md.

Assets 2
Loading