ci: harden pre-merge checks and supply chain

.github/workflows/ci.yml

@@ -8,14 +8,40 @@ on:
 permissions:
   contents: read
 
+# Cancel superseded runs on the same PR ref so CI only spends minutes on the
+# newest commit. Pushes to main run to completion.
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
+  commitlint:
+    name: Lint commit messages
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - name: Validate PR commits against Conventional Commits
+        run: >-
+          npx --no -- commitlint
+          --from ${{ github.event.pull_request.base.sha }}
+          --to ${{ github.event.pull_request.head.sha }}
+          --verbose
+
   build-editor-app:
     name: Build editor-app
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: 22
           cache: npm
@@ -24,16 +50,19 @@ jobs:
       - name: Install dependencies
         run: npm ci --prefix SLASHED-for-WP/integrations/bricks/editor-app
 
+      - name: Type-check (svelte-check)
+        run: npm --prefix SLASHED-for-WP/integrations/bricks/editor-app run check
+
       - name: Build
         run: npm --prefix SLASHED-for-WP/integrations/bricks/editor-app run build
 
   build-admin-app:
     name: Build admin-app
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: 22
           cache: npm
@@ -42,28 +71,35 @@ jobs:
       - name: Install dependencies
         run: npm ci --prefix SLASHED-for-WP/integrations/bricks/admin-app
 
+      - name: Type-check (svelte-check)
+        run: npm --prefix SLASHED-for-WP/integrations/bricks/admin-app run check
+
       - name: Build
         run: npm --prefix SLASHED-for-WP/integrations/bricks/admin-app run build
 
   quality:
     name: Lint, test, version & drift checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: 22
           cache: npm
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@8358ee0e2e8afe63c2fb8253d1d52085811ab1e5  # v2
         with:
           php-version: '8.2'
           coverage: none
+          tools: composer
 
-      - name: Install dependencies
+      - name: Install npm dependencies
         run: npm ci
 
+      - name: Install PHP dev dependencies
+        run: composer install --no-interaction --no-progress
+
       - name: Unit tests (editor-app libs + version guard)
         run: npm test
 
@@ -73,9 +109,20 @@ jobs:
       - name: Lint CSS (stylelint)
         run: npm run lint:css
 
-      - name: Lint PHP (php -l)
+      - name: Lint PHP syntax (php -l)
         run: npm run lint:php
 
+      - name: Register PHPCS standards
+        run: >-
+          vendor/bin/phpcs --config-set installed_paths
+          vendor/wp-coding-standards/wpcs,vendor/phpcsstandards/phpcsutils,vendor/phpcsstandards/phpcsextra,vendor/phpcompatibility/php-compatibility,vendor/phpcompatibility/phpcompatibility-paragonie,vendor/phpcompatibility/phpcompatibility-wp
+
+      - name: Lint PHP (PHPCS / WordPress standards)
+        run: composer phpcs
+
+      - name: Static analysis (PHPStan)
+        run: composer phpstan
+
       - name: Cheatsheet coverage
         run: npm run check:cheatsheet
 
@@ -85,3 +132,27 @@ jobs:
           echo "Cloning framework $REF for admin-app drift check"
           git clone --depth 1 --branch "$REF" https://github.com/codeslash-dev/SLASHED.git .framework
           SLASHED_FRAMEWORK_DIR=.framework npm run check:admin-app
+
+  dependency-audit:
+    name: Dependency vulnerability audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        with:
+          node-version: 22
+          cache: npm
+
+      # Audit the root toolchain and both bundled Svelte apps. Fail only on
+      # high/critical advisories so routine low-severity noise doesn't block.
+      - name: Audit root dependencies
+        run: npm ci && npm audit --audit-level=high
+      - name: Audit editor-app dependencies
+        run: |
+          npm ci --prefix SLASHED-for-WP/integrations/bricks/editor-app
+          npm audit --audit-level=high --prefix SLASHED-for-WP/integrations/bricks/editor-app
+      - name: Audit admin-app dependencies
+        run: |
+          npm ci --prefix SLASHED-for-WP/integrations/bricks/admin-app
+          npm audit --audit-level=high --prefix SLASHED-for-WP/integrations/bricks/admin-app

.github/workflows/codeql.yml

@@ -21,13 +21,13 @@ jobs:
       matrix:
         language: [javascript-typescript, actions]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
-      - uses: github/codeql-action/init@v3
+      - uses: github/codeql-action/init@b0c4fd77f6c559021d78430ec4d0d169ae74a4eb  # v3
         with:
           languages: ${{ matrix.language }}
           queries: security-extended
 
-      - uses: github/codeql-action/analyze@v3
+      - uses: github/codeql-action/analyze@b0c4fd77f6c559021d78430ec4d0d169ae74a4eb  # v3
         with:
           category: /language:${{ matrix.language }}

.github/workflows/framework-sync.yml

@@ -22,9 +22,9 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: 22
           cache: npm
@@ -41,7 +41,7 @@ jobs:
             npm run update-framework -- --version="$VERSION"
           fi
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@8358ee0e2e8afe63c2fb8253d1d52085811ab1e5  # v2
         with:
           php-version: '8.2'
           coverage: none
@@ -59,7 +59,7 @@ jobs:
           echo "tag=$REF" >> "$GITHUB_OUTPUT"
 
       - name: Open PR if anything changed
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8
         with:
           commit-message: "chore: sync bundled framework CSS to ${{ steps.ref.outputs.tag }}"
           branch: chore/framework-sync

.github/workflows/release.yml

@@ -26,16 +26,18 @@ jobs:
     name: Build & publish WordPress plugin zip
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           fetch-depth: 0
           # For workflow_dispatch, check out the specified tag.
           ref: ${{ github.event.inputs.tag || github.ref }}
 
-      - uses: actions/setup-node@v6
+      # No dependency cache on the release path: a poisoned cache could be
+      # baked into the published plugin zip. Fetch fresh from the registry
+      # with integrity verification (flagged by zizmor: cache-poisoning).
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: 22
-          cache: npm
 
       - name: Install dependencies
         run: npm ci

.gitignore

@@ -19,3 +19,8 @@ SLASHED-for-WP/integrations/bricks/assets/editor-app/*.map
 .DS_Store
 .agents/
 .claude/
+
+
+# PHP Composer dependencies (PHPCS/WPCS + PHPStan tooling).
+# composer.json + composer.lock are tracked; the installed tree is not.
+/vendor/

SLASHED-for-WP/includes/class-admin.php

@@ -18,8 +18,8 @@
  */
 class Slashed_Admin {
 
-	const PAGE_SLUG  = 'slashed';
-	const NONCE_KEY  = 'slashed_settings_save';
+	const PAGE_SLUG    = 'slashed';
+	const NONCE_KEY    = 'slashed_settings_save';
 	const NONCE_ACTION = 'slashed_save_settings';
 
 	public function __construct() {
@@ -94,10 +94,12 @@ public function handle_save() {
 		// phpcs:ignore WordPress.Security.NonceVerification.Missing
 		$raw_class_hints = isset( $_POST['show_class_hints'] );
 
-		Slashed_Token_Store::update_plugin_settings( array(
-			'html_font_size'   => in_array( $raw_font_size, $allowed_font_sizes, true ) ? $raw_font_size : '',
-			'show_class_hints' => $raw_class_hints,
-		) );
+		Slashed_Token_Store::update_plugin_settings(
+			array(
+				'html_font_size'   => in_array( $raw_font_size, $allowed_font_sizes, true ) ? $raw_font_size : '',
+				'show_class_hints' => $raw_class_hints,
+			)
+		);
 
 		wp_safe_redirect(
 			add_query_arg( 'slashed_saved', '1', admin_url( 'admin.php?page=' . self::PAGE_SLUG ) )