Docs

Development

Last updatedView as Markdown

Build, test and release the plugin from a checkout of linchpin/consepo-csp-scanner.

Requirements

  • PHP 8.3 and Composer, with access to packagist.linchpin.com for linchpin/coding-standards.
  • Node 24.13 or later (.nvmrc pins 24.13.0) and npm.

Set up and build

Install and build bash 
composer install && npm install && npm run build

npm run build writes build/admin.js, build/admin.css and build/admin.asset.php. npm run start rebuilds on change.

Run it in WordPress

WordPress Playground bash 
npm run playground:start
Ready! WordPress is running on http://127.0.0.1:9400 (6 workers)

This starts WordPress 7.1 on PHP 8.3 at http://localhost:9400 with the checkout mounted as the plugin, logged in, activated, and opened on the Consepo screen (playground/blueprint.json).

Quality gates

CommandRuns
composer testphp-lint, phpcs (Linchpin standard), fixer:test, phpstan (level 5), then phpunit
composer lintThe same, without PHPUnit
composer check-branch-csPHPCS on only the lines this branch changed, as CI does
npm run lint:jsESLint through wp-scripts
npm run lint:cssStylelint through wp-scripts

The PHPUnit suite needs no database: it covers hashing against the MDN SRI and CSP vectors, PKCE against RFC 7636, policy parsing and header-injection safety, credential sealing, and local asset resolution including path traversal. Husky runs lint-staged before each commit and commitlint on each message.

Release

  1. Merge to main

    Conventional commits with a task key as the scope. release-please opens or updates the release pull request.

  2. Merge the release pull request

    release-please tags the release and bumps the version in the plugin header, readme.txt, README.md, package.json and its manifest.

  3. Build and check

    The release workflow runs Plugin Check, builds consepo-csp-scanner.zip with scripts/build.sh, and attaches it to the GitHub release.

  4. Publish

    The zip is installed on packagist.linchpin.com, the workflow confirms the version is served as linchpin/consepo-csp-scanner, and Linchpin Governing opens update pull requests on the sites that use it.

The WordPress.org deploy and asset workflows run only when the repository variable WPORG_DEPLOY is true, which is meant to be set once the listing is approved and SVN_USERNAME and SVN_PASSWORD are available to the repository.

Repository layout

consepo-csp-scanner/ File tree
  • consepo-csp-scanner.php
  • uninstall.php
  • includes/
    • Controller/
      • Admin/
      • Frontend/
      • REST/
      • Cron.php
      • Install.php
    • Core/
    • Helper/
    • Model/
    • Service/
  • src/
    • admin/
      • views/
    • scss/
  • tests/
    • Unit/
  • playground/
  • scripts/
    • build.sh
  • docs/
Controllers under includes/Controller are discovered and booted by Core\Bootstrap.
DirectoryHolds
includes/Controller/AdminThe admin page that mounts the React app and passes it boot data, never a secret
includes/Controller/FrontendThe policy header, and the nonce and integrity attributes on public pages
includes/Controller/RESTThe admin REST API
includes/ServiceThe Consepo API and OAuth clients, the policy builder, the asset hasher, the nonce
includes/ModelStored data
includes/HelperPure PHP: hashing, PKCE, policy parsing, sealing, asset resolution
src/adminThe screens, built on @linchpinagency/ui

Have a question about this page?

Linchpin assistant

Was this helpful?