v1.1.1

1.1.1 (2026-11-11)

Fixed

• close the known wp-ci bugs (#64) (99377f6)

v1.1.0

1.1.0 (2026-11-05)

Added

• ci: forward wp-ci inputs to leaves and resolve Node from .nvmrc (#47) (dc513ff)
• ci: install wp-tooling from npm (#48) (aae2bb7)

Fixed

• cd: read release-please changelogs and attach to existing releases (#46) (13832e2)
• ci: use ramsey/composer-install and drop checkout credentials (#49) (5a7c9fa)

v1.0.0

First tagged release. Consumers pin @v1.

Changed

• Every reusable workflow takes its runner from a new runs-on input (JSON: a label or a list of labels), defaulting to GitHub-hosted "ubuntu-latest", and wp-ci.yml and wp-cd.yml forward it to every workflow they call. Hard-coding [self-hosted] left public callers (and this public repository's own CI) queued with no runner, since a reusable workflow's jobs run in the calling repository. rtCamp's private repositories pass '["self-hosted"]', as the org runner policy requires. ci-self-check.yml runs on ubuntu-latest, and bin/check-workflows.sh now requires reusable workflows to use and forward the input instead of checking a label allow-list.

• Caller values no longer reach a run: body through ${{ }} interpolation — a convention AGENTS.md already documented but sixteen steps across eight workflows broke. Value inputs (composer-flags, phpstan-level) now travel through step env: and become argv, so shell metacharacters in them stay literal instead of executing. Command inputs (build-command, test-command, phpcs-command, phpstan-command, lint-command, and cd-built-branch.yml's per-target equivalents) also travel through env: and are run as bash -eo pipefail -c "$COMMAND": executing them is the contract, but routing them through the environment stops render-time splicing, where a newline in the value injects extra lines into the generated script. -eo pipefail is not optional — a bare bash -c does not inherit set -e, so a failing command would exit 0 and pass a job green. bin/check-workflows.sh now fails on any ${{ inputs. }}/${{ matrix. }} inside a run: body, so the convention is verified rather than merely documented.

• cd-github-release.yml packages the release asset instead of attaching the artifact's top-level entries directly. gh release create only accepts files, but download-artifact unpacks a directory artifact, so any plugin with a subdirectory — including the shape examples/cd-github-release.yml produces — failed at the upload. A directory artifact is now re-rooted under <slug>/ and zipped to a single <slug>.zip that installs through wp-admin; an artifact that is already a single archive is attached untouched, so a pre-zipped artifact-path keeps working. The two cases are told apart by archive extension rather than file count, so a single-file plugin still gets packaged. Adds an optional slug input (defaults to artifact-name).

• ci-test-js.yml's enable-cache now caches something. Jest has no JEST_CACHE_DIRECTORY environment variable, so the previous wiring cached an always-empty directory, and the fixed jest-<os> key was written once and never updated again. The cache directory is now passed as a real --cacheDirectory argument and the key includes the working-dir-scoped lockfile hash with a restore-keys fallback. A custom test-command must forward its arguments for the flag to land; the default does.

• ci-self-check.yml runs yamllint over the whole repository rather than just .github/workflows/ and examples/, matching the yamllint . that AGENTS.md tells contributors to run — previously .yamllint.yml and .github/actionlint.yaml could fail locally while CI stayed green.

• cd-built-branch.yml's published and published-sha output descriptions now cover every no-push outcome. A run superseded by a newer one also reports published=false with an empty SHA, so false never meant "dry run" on its own. The job summary distinguishes the two cases as well, instead of reporting a superseded run as "Publish did not complete".

• AGENTS.md and CONTRIBUTING.md describe bin/ as Bash, not POSIX shell — bin/check-workflows.sh uses BASH_SOURCE, [[ ]], arrays and process substitution, so the POSIX label gave contributors the wrong portability contract.

• Documentation restructured for a public main. Caller examples move out of README.md into examples/, one runnable file per workflow, verified in CI by bin/check-workflows.sh. README.md is now a workflow index plus a versioning guide, and no longer duplicates the input tables — each workflow's workflow_call block is the single source of truth, and GitHub renders those descriptions when a caller is configured. Repo conventions move to a tool-agnostic AGENTS.md, which CLAUDE.md imports. Adds LICENSE (GPL-2.0-or-later, previously declared but absent) and CONTRIBUTING.md.

• version-monitor.yml now pins actions/checkout and actions/setup-node to the same SHAs as the other fifteen workflows, and its job carries an explicit name:.

• The wp-tooling-token secret is removed from ci-detect-changes.yml, version-monitor.yml and wp-ci.yml. rtCamp/wp-tooling is public, so the CLI now installs straight from its npm/wp-tooling branch with no token. This secret never appeared in a tagged release, so v1.0.0 simply ships without it — no major bump is owed. Anyone pinned to a branch ref for pre-release smoke testing must still delete the line, or the call fails with Invalid input, wp-tooling-token is not defined in the referenced workflow. A new wp-tooling-ref input (forwarded through wp-ci.yml) pins the install to a commit SHA and installs with --ignore-scripts, so a change on that branch cannot alter what your CI runs; override it to track the tip. The package is still not on the npm registry, so the install remains a git ref.

• The packages-token secret is removed from ci-lint-php.yml, ci-test-php.yml and wp-ci.yml. rtCamp/wp-framework is public, so no known private Composer dependency is left to authenticate. It was added in 6274f32 and removed here, both within the unreleased v1.0.0 cycle, so no tagged release ever accepted it. Anyone pinned to a branch ref must delete the line, or the call fails with Invalid input, packages-token is not defined in the referenced workflow. setup-php still receives github-token: ${{ github.token }} for the API rate limit, which never depended on the secret, and ci-test-php.yml drops the wp-env Composer-auth step that existed only to forward it into the container.

• Monorepo fixes across the CI leaves. All six setup-node steps that use cache: npm now pass cache-dependency-path, and ci-lint-php.yml's Composer cache key is scoped to <working-dir>/composer.lock. ci-build-artifact-gate.yml normalises and regex-escapes working-dir before anchoring its pattern — previously a ./-prefixed or metacharacter-containing value matched nothing, so the gate passed green on a PR that committed build output. ci-test-build-artifact.yml gains working-dir.

• cd-github-release.yml and cd-wp-org.yml gain working-dir as a path prefix, not a working directory: it scopes only the source-tree paths they read (changelog-path, assets-path), since the deployed files come from an already unit-scoped artifact. Both previously fell back to the repo root in a monorepo and failed silently — another unit's CHANGELOG.md still parses, and a missing .wordpress-org only emits a notice. Both now reject absolute and .. paths. cd-s3.yml is unchanged.

• cd-github-release.yml, cd-wp-org.yml and cd-s3.yml fail fast in a first validation step when a required input arrives empty: tag and artifact-name everywhere, plus slug for wporg and bucket for s3. required: true does not reject an empty string, and an empty artifact-name makes download-artifact fetch every artifact in the run; an empty slug would fall back to the deploy action's repo-name default and could deploy to the wrong wordpress.org plugin, and an empty tag would upload to <prefix>.zip. cd-wp-org.yml and cd-s3.yml also presence-check their secrets as booleans, since a caller mapping an unset secret satisfies GitHub's required-secret check with an empty value.

• Every job runs on runs-on: [self-hosted], per rtCamp's policy for private repositories. A reusable workflow's jobs run in the calling repository, so the caller needs access to the org's self-hosted runner group. bin/check-workflows.sh applies the same label allow-list as the org's runner-policy scanner, which stops checking a repository once it is public. These runners do not ship the AWS CLI, so cd-s3.yml installs a pinned, checksum-verified one when the runner has none.

• ci-detect-changes.yml, and so wp-ci.yml, now fetch an explicit base-ref before diffing. The CLI diffs an explicit base as-is, and the depth-2 checkout never holds a branch such as main, so the diff failed, the CLI reported zero changes, and every downstream job skipped while the run passed green. The step also fails when the CLI reports a failed diff in any mode, instead of passing with nothing checked.

• ci-test-build-artifact.yml pins wp-cli/doctor-command to 2.3.1. @stable resolved to v3.0.0 (released 2026-08-04), which requires wp-cli ^3.0, while the wp-env cli container ships 2.12, so the job failed at the package install for every caller.

• AGENTS.md and CONTRIBUTING.md now base task branches and pull requests on main, add pipx to the install line because pipx run yamllint needs it, and list Docker Compose v2 as missing on the self-hosted runners.

Added

• cd-built-branch.yml: reusable workflow that builds a project and force-pushes source plus generated output (Composer vendor/, compiled assets/build/) to a dedicated branch, for platforms that deploy from a git branch rather than an artifact. Three jobs: discover resolves the targets JSON into a build matrix, build builds each target in parallel, and publish force-pushes a single commit whose parent is the source commit — so git diff <source>..<target> is exactly the generated files, and rollback is a dispatch with source-ref plus allow-rewind: true. Every run republishes every target, so the branch is always a complete tree; a target whose dir is miss...