Skip to content

v0.1.8 — audit cycle close-out

Choose a tag to compare

View all tags
@courtneyr-dev courtneyr-dev released this 01 May 23:57
· 251 commits to main since this release
v0.1.8
5fe146e

Consolidated audit-cycle release. Eight skill audits (/wordpress-testing, /wordpress-pro, /wordpress-security, /wordpress-performance, /wordpress-plugin-core, /wordpress-accessibility, /wordpress-org-compliance, /wordpress-performance-best-practices) ran against v0.1.4. Five produced concrete shippable improvements; the others either confirmed existing correctness or filed forward-looking checklists.

What works on staging

Same as v0.1.4 — sign in via IndieAuth on /post/, post a note via Micropub, see the new post URL — but now hardened across security, performance, accessibility, and plugin-core hygiene dimensions. Smoke test signed off on iPhone Safari + USB-attached desktop Safari Web Inspector.

Concrete improvements since v0.1.4

  • v0.1.5 — URL-scheme validation hardening. New pwa/src/lib/url-validation.ts with is_safe_http_url(). Used in auth-flow.ts:begin_login (rejects bad me URL before fetch) and micropub.ts:post_note (rejects javascript: / data: Location header from a compromised endpoint or MitM). 28 new tests; vitest 58 → 86.
  • v0.1.6 — Cold-load performance. <link rel="modulepreload"> for the entry JS in the shell head + inline critical layout <style> reserves space pre-mount. Eliminates CLS when JS mounts; starts JS fetch in parallel with HTML/CSS. Cold-load transfer now ~13.6 KB gzipped.
  • v0.1.7 — Plugin-core hygiene. New uninstall.php clears outpost_rewrite_version (the only persistent option Outpost stored). Forward-looking comments mark Phase H / B2 / Phase F cleanup surfaces and a multisite iteration pattern.
  • v0.1.8 — Accessibility (WCAG 3.1.1). <html lang> in all three render paths now reflects the WordPress site locale via get_locale() with BCP 47 substitution, instead of being hardcoded \"en\".

Tooling and process improvements

  • CI workflow (.github/workflows/ci.yml): three jobs gating every push to main and every PR — PHPCS + PHPStan, PHPUnit matrix across PHP 8.2 / 8.3 / 8.4, TypeScript + Vitest + production-build smoke. Composer + npm caches keyed on lockfile hashes; concurrency group cancels in-flight runs.
  • PHPCS + PHPStan configs added: WordPress-Extra ruleset locked to PHP 8.2+ + WP 6.5+, i18n text_domain locked to \"outpost\". PHPStan level 6 with phpstan-wordpress + a tiny bootstrap that mirrors outpost.php's constant block so analysis sees OUTPOST_* when scanning files in isolation.
  • WordPress.org compliance policy locked into CLAUDE.md: GPL v2-or-later, single tier, no license keys, no trials, no quotas. Adapter corollary: integrations may detect paid companions and surface their features, but Outpost's own functionality must never be gated by whether a user has the paid version.

Forward-looking artifacts

Six durable checklists in docs/:

  • docs/security/PHP-SURFACE-CHECKLIST.md — wordpress-pro + wordpress-security patterns mapped to upcoming surfaces (B2 SSRF defense, photo upload pipeline, bookmarklet URL parameter, Phase G CSP, Phase H settings).
  • docs/performance/PERFORMANCE-CHECKLIST.md — surface-by-surface performance gates including the 40 KB gzipped bundle budget for Phase C.
  • docs/accessibility/A11Y-CHECKLIST.md — WCAG 2.1/2.2 AA per-surface audit. Forward gates for A3 contrast, Phase C composer-mode focus management (WAI-ARIA tabs pattern), Phase G axe-core CI, Phase J real-device screen reader testing matrix.
  • docs/A3-REQUIREMENTS.md — A3-1 / A3-2 / A3-3 / A3-4. (A3-4 added by this cycle: token defaults must verify at 4.5:1 contrast.)
  • docs/SMOKE-TESTS.md — device matrix + per-version smoke test plans (B0b + B1).
  • docs/STAGING-DEPLOY.md — gd-wordpress-deployer + git submodule procedure, including the npm run build deploy ritual.

Test surface

Tool Result
Vitest (TypeScript) 86 / 86 ✓
PHPUnit 59 / 59 ✓ (1 skipped — pending wp-env)
PHPCS 0 issues — WordPress-Extra ruleset
PHPStan 0 issues — Level 6 with szepeviktor/phpstan-wordpress
CI Green 5/5 jobs on every commit since e059c9f

Known follow-ups

  • docs/A3-REQUIREMENTS.md items (apple-touch-icon, status-bar-style tuning, icon-192/512.png assets) land with Phase A3.
  • wp-env for integration tests (A2 carryover).
  • Phase C — composer modes (Reply, Photo, Article, Listen group). NoteForm is the foundation; Phase C extends it. Started in this cycle's follow-up commit.

Full changelog

See CHANGELOG.md.

Assets 2
Loading