coded-letter · Ys-sudo · Aug 27, 2026 · Aug 27, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -0,0 +1,55 @@
+name: WordPress theme CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262c # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: "22"
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        with:
+          php-version: "8.1"
+          coverage: none
+      - name: Reject symbolic links
+        run: test -z "$(find . -type l -not -path './.git/*' -print -quit)"
+      - name: Install theme build dependencies
+        run: npm ci
+      - name: Build native theme assets
+        run: npm run build
+      - name: Verify committed assets are reproducible
+        run: git diff --exit-code
+      - name: Parse all theme PHP
+        run: npm run lint:php
+      - name: Prepare the WordPress.org package
+        run: node scripts/prepare-wordpress-org-package.mjs --out "$RUNNER_TEMP/wordpress-org/funkycommerce-headless"
+      - name: Validate packaged PHP syntax
+        run: find "$RUNNER_TEMP/wordpress-org/funkycommerce-headless" -type f -name '*.php' -print0 | xargs -0 -n1 php -l
+
+  wordpress-org-preflight:
+    if: vars.WPORG_PREFLIGHT_ENABLED == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262c # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: "22"
+      - name: Prepare the WordPress.org package
+        run: node scripts/prepare-wordpress-org-package.mjs --out "$RUNNER_TEMP/wordpress-org/funkycommerce-headless"
+      - name: Run the WordPress Theme Review checks
+        uses: WordPress/theme-review-action@84400b232998116c9d1651502575c60262cceef9
+        with:
+          root-folder: ${{ runner.temp }}/wordpress-org/funkycommerce-headless
+          accessible-ready: false
+          ui-debug: false
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -0,0 +1,160 @@
+name: Publish WordPress theme
+
+on:
+  workflow_run:
+    workflows: ["WordPress theme CI"]
+    branches: [main]
+    types: [completed]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: publish-wordpress-theme
+  cancel-in-progress: false
+
+env:
+  PACKAGE_SLUG: funkycommerce-headless
+  VERSION_FILE: style.css
+  WPORG_SLUG: funkycommerce-headless
+
+jobs:
+  release:
+    if: github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_repository.full_name == github.repository)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    outputs:
+      archive: ${{ steps.package.outputs.archive }}
+      publish: ${{ steps.package.outputs.publish }}
+      source-sha: ${{ steps.source.outputs.sha }}
+      version: ${{ steps.package.outputs.version }}
+      wordpress-org-archive: ${{ steps.package.outputs.wordpress-org-archive }}
+    steps:
+      - id: source
+        name: Resolve the validated source commit
+        env:
+          VALIDATED_SHA: ${{ github.event.workflow_run.head_sha }}
+        run: |
+          sha="${VALIDATED_SHA:-$GITHUB_SHA}"
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262c # v4
+        with:
+          ref: ${{ steps.source.outputs.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: "22"
+      - id: package
+        name: Build the release archive
+        run: |
+          version="$(grep -m1 -E '^Version:' "$VERSION_FILE" | sed -E 's/^[^:]+:[[:space:]]*//')"
+          stable="$(grep -m1 -E '^Stable tag:' readme.txt | sed -E 's/^[^:]+:[[:space:]]*//')"
+          if ! printf '%s' "$version" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "::error::Invalid package version: $version"
+            exit 1
+          fi
+          if [ "$version" != "$stable" ]; then
+            echo "::error::Version $version does not match readme Stable tag $stable."
+            exit 1
+          fi
+          archive="$PACKAGE_SLUG-$version.zip"
+          wordpress_org_archive="$PACKAGE_SLUG-$version-wordpress-org.zip"
+          if git ls-remote --exit-code --tags origin "refs/tags/v$version" >/dev/null; then
+            echo "publish=false" >> "$GITHUB_OUTPUT"
+            echo "version=$version" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          public_stage="$RUNNER_TEMP/public-package/$PACKAGE_SLUG"
+          mkdir -p "$public_stage"
+          rsync -a ./ "$public_stage/" \
+            --exclude '.git*' \
+            --exclude '.github' \
+            --exclude '.monorepo-source.json' \
+            --exclude '.wordpress-org' \
+            --exclude 'CODE_OF_CONDUCT.md' \
+            --exclude 'CONTRIBUTING.md' \
+            --exclude 'EXTRACTION_STATUS.md' \
+            --exclude 'README.md' \
+            --exclude 'SECURITY.md' \
+            --exclude 'docs' \
+            --exclude 'scripts'
+          stage="$RUNNER_TEMP/package/$PACKAGE_SLUG"
+          node scripts/prepare-wordpress-org-package.mjs --out "$stage"
+          if find "$stage" -type l -print -quit | grep -q .; then
+            echo "::error::Release packages must not contain symbolic links."
+            exit 1
+          fi
+          (cd "$(dirname "$public_stage")" && zip -X -q -r "$GITHUB_WORKSPACE/$archive" "$PACKAGE_SLUG")
+          (cd "$(dirname "$stage")" && zip -X -q -r "$GITHUB_WORKSPACE/$wordpress_org_archive" "$PACKAGE_SLUG")
+          echo "archive=$archive" >> "$GITHUB_OUTPUT"
+          echo "publish=true" >> "$GITHUB_OUTPUT"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "wordpress-org-archive=$wordpress_org_archive" >> "$GITHUB_OUTPUT"
+      - name: Publish the GitHub release
+        if: steps.package.outputs.publish == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SOURCE_SHA: ${{ steps.source.outputs.sha }}
+          VERSION: ${{ steps.package.outputs.version }}
+        run: |
+          gh release create "v$VERSION" \
+            "${{ steps.package.outputs.archive }}" \
+            "${{ steps.package.outputs.wordpress-org-archive }}" \
+            --target "$SOURCE_SHA" \
+            --title "$PACKAGE_SLUG $VERSION" \
+            --generate-notes
+      - name: Preserve the WordPress.org submission package
+        if: steps.package.outputs.publish == 'true'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: funkycommerce-headless-${{ steps.package.outputs.version }}
+          path: ${{ steps.package.outputs.wordpress-org-archive }}
+          if-no-files-found: error
+
+  wordpress-org:
+    if: needs.release.outputs.publish == 'true' && vars.WPORG_DEPLOY_ENABLED == 'true' && false
+    needs: release
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment: wordpress-org
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262c # v4
+        with:
+          ref: ${{ needs.release.outputs.source-sha }}
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: "22"
+      - name: Require WordPress.org credentials
+        env:
+          WPORG_SVN_PASSWORD: ${{ secrets.WPORG_SVN_PASSWORD }}
+          WPORG_USERNAME: ${{ secrets.WPORG_USERNAME }}
+        run: |
+          test -n "$WPORG_USERNAME" || { echo "::error::Missing WPORG_USERNAME."; exit 1; }
+          test -n "$WPORG_SVN_PASSWORD" || { echo "::error::Missing WPORG_SVN_PASSWORD."; exit 1; }
+      - name: Deploy the approved theme release to WordPress.org
+        env:
+          VERSION: ${{ needs.release.outputs.version }}
+          WPORG_SVN_PASSWORD: ${{ secrets.WPORG_SVN_PASSWORD }}
+          WPORG_USERNAME: ${{ secrets.WPORG_USERNAME }}
+        run: |
+          svn_root="$RUNNER_TEMP/wordpress-org"
+          stage="$RUNNER_TEMP/package/$PACKAGE_SLUG"
+          node scripts/prepare-wordpress-org-package.mjs --out "$stage"
+          svn checkout "https://themes.svn.wordpress.org/$WPORG_SLUG" "$svn_root"
+          if svn info "https://themes.svn.wordpress.org/$WPORG_SLUG/$VERSION" >/dev/null 2>&1; then
+            echo "::error::WordPress.org version $VERSION already exists and cannot be overwritten."
+            exit 1
+          fi
+          mkdir "$svn_root/$VERSION"
+          rsync -a "$stage/" "$svn_root/$VERSION/"
+          svn add "$svn_root/$VERSION"
+          svn commit "$svn_root" \
+            --message "Release $VERSION from GitHub commit ${{ needs.release.outputs.source-sha }}" \
+            --username "$WPORG_USERNAME" \
+            --password "$WPORG_SVN_PASSWORD" \
+            --no-auth-cache \
+            --non-interactive
diff --git a/.monorepo-source.json b/.monorepo-source.json
@@ -0,0 +1,14 @@
+{
+  "productId": "funkycommerce-headless",
+  "repository": "coded-letter/superfunky-theme",
+  "source": "coded-letter/coded-letter-monorepo@0aebd69d9cf0616630e4f090c3e4579abe17c63d",
+  "sourcePath": "workspace/backend/wordpress/themes/free/funkycommerce-headless",
+  "installSlug": "funkycommerce-headless",
+  "kind": "theme",
+  "versionFile": "style.css",
+  "wordpressOrg": {
+    "deploySupported": false,
+    "slug": "funkycommerce-headless",
+    "status": "blocked-theme-plugin-territory"
+  }
+}
diff --git a/EXTRACTION_STATUS.md b/EXTRACTION_STATUS.md
@@ -7,6 +7,7 @@ free-tier-only code.
 | Date | Module | Status |
 |---|---|---|
 | 2025-08-03 | Full theme (v0.7.0) | ✅ Complete — all PHP files, templates, and schema published |
+| 2026-08-27 | Full theme (v1.2.6) | Complete — synchronized from `coded-letter/coded-letter-monorepo@0aebd69d9cf0616630e4f090c3e4579abe17c63d` |
 
 ## Free/Pro Tier Summary
 
@@ -32,6 +33,6 @@ When Pro is not active, `funkycommerce_is_pro()` returns `false` and:
 ## Process
 
 1. Changes are developed in the private monorepo.
-2. Free-tier code is manually extracted and reviewed.
-3. Premium plugin references and secrets are verified absent.
-4. Code is pushed to this repo with an updated status entry.
+2. The catalog-allowlisted exporter replaces the public package files.
+3. Premium implementation and secrets are verified absent before and after export.
+4. A provenance-stamped pull request is reviewed and independently validated here.