Coding Standards and Static Analysis

<?xml version="1.0"?>
<ruleset name="Lumen Catalog">
	<description>WordPress Coding Standards for Lumen Catalog.</description>

	<file>.</file>

	<exclude-pattern>/vendor/*</exclude-pattern>
	<exclude-pattern>/node_modules/*</exclude-pattern>
	<exclude-pattern>/build/*</exclude-pattern>
	<exclude-pattern>/artifacts/*</exclude-pattern>

	<arg name="extensions" value="php"/>
	<arg name="basepath" value="."/>
	<arg name="parallel" value="8"/>
	<arg value="sp"/>

	<!-- Keep in sync with the Requires PHP and Requires at least headers. -->
	<config name="testVersion" value="7.4-"/>
	<config name="minimum_wp_version" value="6.9"/>

	<rule ref="WordPress-Extra"/>
	<rule ref="WordPress-Docs"/>
	<rule ref="PHPCompatibilityWP"/>

	<!-- From the full WordPress standard: unslash and sanitize every superglobal read. -->
	<rule ref="WordPress.Security.ValidatedSanitizedInput"/>

	<rule ref="WordPress.WP.I18n">
		<properties>
			<property name="text_domain" type="array">
				<element value="lumen-catalog"/>
			</property>
		</properties>
	</rule>

	<rule ref="WordPress.NamingConventions.PrefixAllGlobals">
		<properties>
			<property name="prefixes" type="array">
				<element value="lumen_catalog"/>
				<element value="Lumen\Catalog"/>
			</property>
		</properties>
	</rule>

	<!-- Capabilities the plugin registers, so WordPress.WP.Capabilities does not report them as unknown. -->
	<rule ref="WordPress.WP.Capabilities">
		<properties>
			<property name="custom_capabilities" type="array">
				<element value="manage_lumen_catalog"/>
				<element value="manage_lp_terms"/>
				<element value="publish_lp_books"/>
			</property>
		</properties>
	</rule>

	<!-- PSR-4: class files are named after their class, not class-*.php. -->
	<rule ref="WordPress.Files.FileName">
		<exclude-pattern>/src/*</exclude-pattern>
		<exclude-pattern>/tests/*</exclude-pattern>
	</rule>
</ruleset>

<?php
namespace Lumen\Catalog\Admin;

class StockReport {

    public static function boot() {
        add_action( 'admin_menu', [ self::class, 'menu' ] );
    }

    public static function menu() {
        add_submenu_page( 'edit.php?post_type=lp_book', __( 'Stock history', 'lumen' ), __( 'Stock', 'lumen-catalog' ), 'manage_lumen_catalog', 'lp-stock', [ self::class, 'render' ] );
    }

    public static function render() {
        global $wpdb;
        $book = $_GET['book'];
        $rows = $wpdb->get_results( "SELECT changed_at, delta FROM {$wpdb->prefix}lp_stock WHERE book_id = $book" );
        echo '<h1>' . __( 'Stock history', 'lumen-catalog' ) . '</h1><table>';
        foreach ( $rows as $row ) {
            echo "<tr><td>$row->changed_at</td><td>$row->delta</td></tr>";
        }
        echo '</table>';
        if ( current_user_can( 'publish_lp_books' ) ) {
            echo '<p>' . esc_html( self::total( $rows ) ) . '</p>';
        }
        /**
         * Fires after the stock history table.
         */
        do_action( 'stock_report_after', $book );
    }

    public static function total( $rows ) {
        return array_sum( array_column( $rows, 'delta' ) );
    }

    public static function last_changed( int $book_id ): ?string {
        $post = get_post( $book_id );
        return $post?->post_modified;
    }
}

docker run --rm -v "$PWD":/app -w /app composer:2 composer install
docker run --rm -v "$PWD":/app -w /app php:8.4-cli vendor/bin/phpcs --report=summary
docker run --rm -v "$PWD":/app -w /app php:8.4-cli vendor/bin/phpcbf
docker run --rm -v "$PWD":/app -w /app php:8.4-cli vendor/bin/phpcs --report=emacs -q

src/Admin/StockReport.php:1:1: error - Missing file doc comment (Squiz.Commenting.FileComment.Missing)
src/Admin/StockReport.php:4:1: error - Missing doc comment for class StockReport (Squiz.Commenting.ClassComment.Missing)
src/Admin/StockReport.php:11:78: error - Mismatched text domain. Expected 'lumen-catalog' but got 'lumen'. (WordPress.WP.I18n.TextDomainMismatch)
src/Admin/StockReport.php:16:17: warning - Processing form data without nonce verification. (WordPress.Security.NonceVerification.Recommended)
src/Admin/StockReport.php:16:17: error - Detected usage of a possibly undefined superglobal array index: $_GET['book']. Check that the array index exists before using it. (WordPress.Security.ValidatedSanitizedInput.InputNotValidated)
src/Admin/StockReport.php:16:17: error - $_GET['book'] not unslashed before sanitization. Use wp_unslash() or similar (WordPress.Security.ValidatedSanitizedInput.MissingUnslash)
src/Admin/StockReport.php:16:17: error - Detected usage of a non-sanitized input variable: $_GET['book'] (WordPress.Security.ValidatedSanitizedInput.InputNotSanitized)
src/Admin/StockReport.php:17:37: error - Use placeholders and $wpdb->prepare(); found interpolated variable $book at "SELECT changed_at, delta FROM {$wpdb->prefix}lp_stock WHERE book_id = $book" (WordPress.DB.PreparedSQL.InterpolatedNotPrepared)
src/Admin/StockReport.php:18:23: error - All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '__'. (WordPress.Security.EscapeOutput.OutputNotEscaped)
src/Admin/StockReport.php:20:18: error - All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"<tr><td>$row->changed_at</td><td>$row->delta</td></tr>"'. (WordPress.Security.EscapeOutput.OutputNotEscaped)
src/Admin/StockReport.php:29:20: error - Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "stock_report_after". (WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound)

	/**
	 * Prints the stock movements of the book given in the "book" query argument.
	 */
	public static function render(): void {
		global $wpdb;

		// A read-only screen behind a capability check: no state changes, so no nonce.
		$book_id = isset( $_GET['book'] ) ? absint( $_GET['book'] ) : 0; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
		$rows    = $wpdb->get_results( // phpcs:ignore WordPress.DB.DirectDatabaseQuery
			$wpdb->prepare( "SELECT changed_at, delta FROM {$wpdb->prefix}lp_stock WHERE book_id = %d ORDER BY changed_at DESC", $book_id ),
			ARRAY_A
		);

		echo '<h1>' . esc_html__( 'Stock history', 'lumen-catalog' ) . '</h1><table>';
		foreach ( $rows as $row ) {
			printf( '<tr><td>%s</td><td>%s</td></tr>', esc_html( $row['changed_at'] ), esc_html( $row['delta'] ) );
		}
		echo '</table>';
		if ( current_user_can( 'publish_lp_books' ) ) {
			echo '<p>' . esc_html( self::total( $rows ) ) . '</p>';
		}

		/**
		 * Fires after the stock history table.
		 *
		 * @param string $book_id ID of the book shown.
		 */
		do_action( 'lumen_catalog_stock_report_after', $book_id );
	}

docker run --rm -v "$PWD":/app -w /app php:7.4-cli php -l src/Admin/StockReport.php

Parse error: syntax error, unexpected '->' (T_OBJECT_OPERATOR) in src/Admin/StockReport.php on line 38
Errors parsing src/Admin/StockReport.php

# szepeviktor/phpstan-wordpress is registered by phpstan/extension-installer.
parameters:
    level: 6
    paths:
        - lumen-catalog.php
        - uninstall.php
        - src
    excludePaths:
        # render.php reads $attributes and $block, which WordPress injects.
        - src/blocks

docker run --rm -v "$PWD":/app -w /app php:8.4-cli vendor/bin/phpstan analyse --memory-limit=1G --no-progress --error-format=raw

/app/src/Admin/StockReport.php:57:Parameter #1 $text of function esc_html expects string, int given.
/app/src/Admin/StockReport.php:65:@param string $book_id does not accept actual type of parameter: int<0, max>.

{
	"scripts": {
		"lint:js": "wp-scripts lint-js src",
		"lint:style": "wp-scripts lint-style \"src/**/*.{css,scss}\"",
		"format": "wp-scripts format src"
	}
}

const defaultConfig = require( '@wordpress/scripts/config/eslint.config.cjs' );

module.exports = [
	...defaultConfig,
	{
		rules: {
			'@wordpress/i18n-text-domain': [
				'error',
				{ allowedTextDomain: 'lumen-catalog' },
			],
		},
	},
];

src/blocks/book-card/edit.js
   5:44  error    'setAttributes' is defined but never used                                                                  no-unused-vars
   8:9   error    Unexpected console statement                                                                               no-console
   9:8   warning  React Hook useEffect has a missing dependency: 'isbn'. Either include it or remove the dependency array    react-hooks/exhaustive-deps
  13:13  error    img elements must have an alt prop, either with meaningful text, or an empty string for decorative images  jsx-a11y/alt-text
  14:17  error    Invalid text domain 'lumen'                                                                                @wordpress/i18n-text-domain
  14:17  error    Translations should not contain flanking whitespace (whitespace)                                           @wordpress/i18n-no-flanking-whitespace

name: Quality

on:
  pull_request:
  push:
    branches: [ main ]

jobs:
  php:
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        php: [ '7.4', '8.4' ]
    steps:
      - uses: actions/checkout@v7
      - uses: shivammathur/setup-php@2.40.0
        with:
          php-version: ${{ matrix.php }}
          tools: composer:v2
          coverage: none
      - run: composer install --no-interaction --no-progress
      - run: find . -name '*.php' -not -path './vendor/*' -not -path './node_modules/*' -print0 | xargs -0 -n1 php -l
      - run: composer format:check
      - run: composer lint -- --no-progress --error-format=github

  js:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: npm
      - run: npm ci
      - run: npm run lint:js
      - run: npm run lint:style
      - run: npm run format && git diff --exit-code