v0.1.16

Changed

• The Distribution archive gate (QA-06) blocks. It started observed in 0.1.15 so that raising the harness turned no repository red; all the Pollora packages and the framework now run pollora-qa archive --fix clean, so a release archive that carries a development file (tests, CI, tool configuration, agent files) fails the check in enforce mode. A repository that is not ready lists Distribution archive under observed in .harness.json

v0.1.15

Added

• A Distribution archive gate (QA-06): pollora-qa check builds the archive git archive would produce and fails when a development file is in it (tests/, .github/, .claude/, AGENTS.md, .harness.json, api-surface.json, rector.php, composer-dependency-analyser.php, phpstan*.neon, phpunit*.xml, pint.json, renovate.json, .gitignore, .gitattributes…), with the .gitattributes lines to add. It reads the real archive, because an export-ignore on a directory cannot be seen file by file. It runs for the core, framework, integration and wp-plugin profiles: the archive of a template or a project is the product. It is skipped where git archive cannot be built. It starts observed (reported, never blocking, like the npm audit did), so that raising the harness to this version turns no repository red; a repository fixes .gitattributes with pollora-qa archive --fix when it raises it, and the gate will block in a later version
• pollora-qa archive [--fix]: checks the same thing from the command line; --fix adds the missing export-ignore lines to .gitattributes, under one header, and never removes a line
• pollora-qa init keeps the files it creates out of the archive of a core, framework, integration or wp-plugin repository: .claude, .harness.json, AGENTS.md, rector.php, api-surface.json and composer-dependency-analyser.php, plus the tests, .github and tool configuration it finds. .gitattributes lists itself, since a tracked .gitattributes would otherwise travel in the archive

v0.1.14

Fixed

• A file that calls exit() or die() no longer ends a run with a pass. A WordPress plugin starts nearly every file with defined('ABSPATH') || exit;. pollora-qa surface and the Public surface gate load the plugin's classes, so the first guarded file stopped the whole process with status 0, before the summary and the Ratchet gate, and CI read that as a pass. The run now fails with a message that says what happened
• The surface extractor defines ABSPATH and WPINC when WordPress is absent (only if they are not defined), so the guarded files of a plugin load and its attributes, hooks, configuration keys and commands are recorded

v0.1.13

Changed

• SEC-04 also skips three more WordPress core functions that return escaped HTML: get_block_wrapper_attributes(), get_previous_posts_link() and get_next_posts_link(). With them, the Pollora theme template reports nothing for SEC-04, and its observed: security can go
• ARCH-05 has no exception any more: src/ThirdParty/ is no longer excluded from the rule, since the framework moved WooCommerce and WP Rocket to their own packages. A framework that still has code in src/ThirdParty/ that names a plugin is now reported

v0.1.12

Added

• Dependency audit (npm) (SEC-09): pollora-qa check runs npm audit --audit-level=high for every package-lock.json of the repository (the root and up to two levels down, never node_modules, vendor or .worktrees), and template.yml has a matching npm-audit job. Composer's audit does not see these alerts. The gate is observed: it reports and never blocks, in enforce mode too, until a later release makes it blocking

Changed

• SEC-04 no longer reports the outputs that are escaped by construction: {!! !!} followed by an escaping function (esc_attr, esc_html, esc_url, esc_js, esc_textarea, their __, _e and _x forms, wp_kses, wp_kses_post, wp_kses_data, absint, wc_kses_notice, wp_strip_all_tags), a component $slot, or one of the WordPress and WooCommerce functions that return HTML they have escaped themselves (post_class, wc_price, wp_nav_menu, get_search_form…, the list is in presets/semgrep/common.yml). Only the first call is looked at, so {!! esc_html($a) . $b !!} passes: keep the whole expression escaped. Anything else (apply_filters(), do_shortcode(), get_option(), a variable, a theme's own helper) is still reported and needs {{ }}, an escaping function, or a nosemgrep comment that says why. On the Apiary theme the reports go from 310 to 114

v0.1.11

Added

• observed input of template.yml: the gates (secrets, style, security, audit) reported but never blocking, in enforce mode too, as observed does in a package's .harness.json

Fixed

• The style gate of template.yml parses a template: the placeholders the scaffolder fills in (%theme_namespace%) are not PHP and made Pint fail on every file that holds one, whatever its style. Pint runs on a copy where each placeholder is an identifier

v0.1.10

Added

• template.yml, a reusable workflow for a template (the skeleton, a theme, a plugin, a module): secrets, code style, security patterns and dependency audit, run from the outside. The template installs nothing and carries no .harness.json: it only adds .github/workflows/harness.yml, so nothing of the harness is copied into the projects built from it. mode: enforce blocks a merge, observe reports

v0.1.9

See CHANGELOG.md.

v0.1.8

See CHANGELOG.md.

v0.1.7

See CHANGELOG.md.