PHPCS: Allowlist custom capabilities instead of disabling the sniff

[obenland]

Summary

• Replace the blanket <severity>0</severity> override on WordPress.WP.Capabilities.Unknown with an explicit allowlist of all custom capabilities used across the codebase, grouped by plugin.
• Fix four capability bugs surfaced by enabling the sniff:
  • Plugin Directory: ES Status tool used the role name plugin_admin instead of a capability — replaced with plugin_approve.
  • Plugin Directory: Comment row actions checked manage_comments, which is not a WordPress capability — replaced with moderate_comments.
  • Photo Directory: Moderation used the role name photos_moderator instead of a capability — replaced with edit_photos.
  • BuddyPress: Admin redirect checked four role names (contributor, author, editor, administrator) instead of capabilities — replaced with a single edit_posts check.

Test plan

• Run composer install && vendor/bin/phpcs --sniffs=WordPress.WP.Capabilities . and confirm no warnings or errors
• Verify the Plugin Directory ES Index Status tool is still accessible to plugin admins
• Verify Plugin Directory internal note comment actions still work for reviewers
• Verify Photo Directory moderation capabilities still work for photo moderators
• Verify BuddyPress admin redirect still allows contributors and above into wp-admin

🤖 Generated with Claude Code

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props obenland, dd32.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[obenland]

@dd32 Wanted to give you a chance to veto. It's a long allowlist, but it enables catching misuses like the other changes in this PR.

[Copilot]

Pull request overview

This PR enables the WordPress.WP.Capabilities.Unknown sniff by replacing the prior blanket suppression with an explicit allowlist of custom capabilities, and fixes several real capability/role mismatches that the sniff surfaces.

Changes:

• Replace the PHPCS suppression of unknown capabilities with a curated custom_capabilities allowlist (grouped by subsystem).
• Fix Plugin Directory capability checks by replacing the non-capability plugin_admin role checks with the plugin_approve capability.
• Fix several incorrect capability/role checks (manage_comments, photos_moderator, and BuddyPress role-name checks) by switching to appropriate WordPress capabilities.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/tools/class-elasticsearch-status.php	Switch ES Status tool access checks from a role name to the plugin_approve capability (menu + render + AJAX).
wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/class-customizations.php	Fix internal-note comment row actions gating by using moderate_comments (valid WP cap).
wordpress.org/public_html/wp-content/plugins/photo-directory/inc/moderation.php	Replace role-name moderation check with a capability-based check (edit_photos) for moderator logic.
phpcs.xml.dist	Replace disabling the capability sniff with an explicit allowlist of custom capabilities for the environment.
buddypress.org/public_html/wp-content/plugins/buddypress-org/buddypress-dot-org.php	Replace role-name checks with a single edit_posts capability check for wp-admin redirect UX behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.