Feat/audit remediation

.editorconfig

@@ -0,0 +1,28 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = tab
+indent_size = 4
+
+[*.{json,yml,yaml,neon,dist,md}]
+indent_style = space
+indent_size = 2
+
+[*.md]
+# Two trailing spaces are a hard line break in Markdown.
+trim_trailing_whitespace = false
+
+[symbols/*.php]
+# Generated by scripts/extract-symbols.php. Anything that reformats these files starts a diff
+# fight with the generator, and every regeneration becomes a 300 KB review.
+trim_trailing_whitespace = false
+insert_final_newline = true
+
+[tests/fixtures/**]
+# Fixtures are byte-for-byte inputs to golden-file assertions. Reformatting one is a test failure.
+trim_trailing_whitespace = false
+insert_final_newline = false

.gitattributes

@@ -0,0 +1,37 @@
+# Keep dist archives to what the plugin actually loads at runtime.
+#
+# Everything under /scripts is development-only: extract-symbols.php and the SymbolExtractor
+# behind it regenerate symbols/*.php from the WordPress sources, and nothing in src/, bin/ or
+# config/ references them. (This was not always true - scripts/postinstall.php used to be read
+# at runtime. Check again before adding a file here.)
+
+/.editorconfig          export-ignore
+/.gitattributes         export-ignore
+/.github                export-ignore
+/.gitignore             export-ignore
+/.php-cs-fixer.dist.php export-ignore
+/docs                   export-ignore
+/phpstan.neon           export-ignore
+/phpunit.xml.dist       export-ignore
+/scripts                export-ignore
+/tests                  export-ignore
+
+# Contributor-facing documents. They are read on GitHub, never from inside a consumer's vendor/,
+# and the seven pages under /docs are already ignored above for the same reason.
+#
+# README.md, LICENSE and CHANGELOG.md deliberately stay in the dist archive: the first two are what
+# a consumer looks for when they open vendor/wpify/scoper, and GPL-2.0 requires the licence to
+# travel with the distribution.
+/CODE_OF_CONDUCT.md     export-ignore
+/CONTRIBUTING.md        export-ignore
+/SECURITY.md            export-ignore
+
+# Generated symbol tables.
+#
+# `linguist-generated=true` collapses them in GitHub pull request diffs, which is what makes the
+# scheduled regeneration PRs reviewable at all - a WordPress release moves thousands of lines.
+# `-diff` keeps git itself from trying to produce a textual diff of a 300 KB var_export dump.
+/symbols/*.php          linguist-generated=true -diff
+
+# The golden files and scoped-output fixtures are compared byte for byte.
+/tests/fixtures/**      -text

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,110 @@
+name: Bug report
+description: Something the scoper does is wrong, or something it produces is broken.
+labels: [ bug ]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before filing: most reports are answered by
+        [Troubleshooting](https://github.com/wpify/scoper/blob/master/docs/troubleshooting.md),
+        and upgrades from 3.2 are covered by
+        [Upgrading to 4.0](https://github.com/wpify/scoper/blob/master/docs/upgrading-to-4.md).
+
+        **Do not report security issues here.** See
+        [SECURITY.md](https://github.com/wpify/scoper/blob/master/SECURITY.md).
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: What did you expect, and what did you get instead?
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. ...
+        2. run `composer install`
+        3. ...
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: wpify/scoper version
+      description: "`composer global show wpify/scoper` or `composer show wpify/scoper`"
+      placeholder: "4.0.0"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: install-type
+    attributes:
+      label: How is it installed?
+      options:
+        - Globally (composer global require)
+        - As a dev dependency (require-dev)
+        - Both
+        - Not sure
+    validations:
+      required: true
+
+  - type: input
+    id: php-version
+    attributes:
+      label: PHP version
+      description: "`php -v`. If it differs from your `config.platform.php`, say so."
+      placeholder: "8.2.20"
+    validations:
+      required: true
+
+  - type: textarea
+    id: extra-block
+    attributes:
+      label: Your extra.wpify-scoper block
+      description: The `extra.wpify-scoper` section of your composer.json. Redact private package names if you must, but keep the structure.
+      render: json
+    validations:
+      required: true
+
+  - type: textarea
+    id: deps-manifest
+    attributes:
+      label: Your composer-deps.json
+      render: json
+    validations:
+      required: true
+
+  - type: textarea
+    id: verbose-output
+    attributes:
+      label: Output with -v
+      description: |
+        Run the failing command again with `-v` and paste the full output — `composer install -v`,
+        or `composer wpify-scoper install -v`. Use `-vvv` if `-v` is not revealing.
+
+        This is the single most useful thing in the report. It shows the configuration the scoper
+        actually resolved, which customization file it loaded, and every process it spawned.
+      render: shell
+    validations:
+      required: true
+
+  - type: textarea
+    id: custom-config
+    attributes:
+      label: Your scoper.custom.php, if you have one
+      render: php
+    validations:
+      required: false
+
+  - type: textarea
+    id: anything-else
+    attributes:
+      label: Anything else
+      description: Unusual layout (Bedrock, monorepo, path repositories, symlinked `deps/`), a non-default `vendor-dir`, exported `COMPOSER*` environment variables — anything that makes your setup not the default.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,14 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Troubleshooting
+    url: https://github.com/wpify/scoper/blob/master/docs/troubleshooting.md
+    about: Symptom, cause, fix. Most reports are answered here — start with running your command again with -v.
+  - name: Upgrading from 3.2
+    url: https://github.com/wpify/scoper/blob/master/docs/upgrading-to-4.md
+    about: New errors after upgrading to 4.0 are almost certainly covered here.
+  - name: Documentation
+    url: https://github.com/wpify/scoper/tree/master/docs
+    about: Configuration reference, deployment recipes, and how the pipeline is put together.
+  - name: Report a security issue
+    url: https://github.com/wpify/scoper/security/advisories/new
+    about: Privately, never in a public issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,34 @@
+name: Feature request
+description: Suggest a change to how the scoper works.
+labels: [ enhancement ]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem
+      description: What are you trying to do that you cannot do today? Describe the situation, not the solution you have in mind.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What you would like instead
+    validations:
+      required: true
+
+  - type: textarea
+    id: workaround
+    attributes:
+      label: What you are doing now
+      description: A `scoper.custom.php` patcher, a post-install script, manual edits — whatever the current workaround is. If there is none, say so.
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: output-impact
+    attributes:
+      label: Impact on generated output
+      options:
+        - label: I understand that anything changing what lands in `deps/` is at least a minor release, because consumers cannot see that their scoped tree changed until something fatals in production.
+          required: true

.github/ISSUE_TEMPLATE/symbol_report.yml

@@ -0,0 +1,92 @@
+name: Missing or wrongly scoped symbol
+description: A WordPress, WooCommerce, Action Scheduler or WP-CLI name was prefixed when it should not have been (or the reverse).
+labels: [ bug, symbols ]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        This is the most serious class of bug in this project: a symbol that should have stayed
+        unprefixed produces a call to a function that does not exist, on a production site, with
+        nothing in the build to warn you.
+
+        Use this form rather than the general bug report — it needs different information.
+
+  - type: input
+    id: symbol
+    attributes:
+      label: The symbol
+      description: The exact name, as declared upstream.
+      placeholder: "wp_get_environment_type"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: kind
+    attributes:
+      label: What kind of symbol is it?
+      options:
+        - Function
+        - Class / interface / trait / enum
+        - Constant
+        - Namespace
+    validations:
+      required: true
+
+  - type: dropdown
+    id: direction
+    attributes:
+      label: What went wrong?
+      options:
+        - It was prefixed, and should not have been
+        - It was left unprefixed, and should have been scoped
+    validations:
+      required: true
+
+  - type: dropdown
+    id: source
+    attributes:
+      label: Which project declares it?
+      options:
+        - WordPress core
+        - WooCommerce
+        - Action Scheduler
+        - WP-CLI
+        - None of these (it is my own or a dependency's)
+    validations:
+      required: true
+
+  - type: input
+    id: upstream-version
+    attributes:
+      label: Version of that project on the affected site
+      placeholder: "WordPress 6.9.1"
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: wpify/scoper version
+      placeholder: "4.0.0"
+    validations:
+      required: true
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Evidence
+      description: |
+        The fatal error or wrong behaviour, plus the offending line from your scoped tree —
+        `grep -rn "<symbol>" deps/ | head`.
+      render: shell
+    validations:
+      required: true
+
+  - type: textarea
+    id: globals
+    attributes:
+      label: Your extra.wpify-scoper block
+      description: In particular the `globals` list, if you set one.
+      render: json
+    validations:
+      required: true

.github/pull_request_template.md

@@ -0,0 +1,40 @@
+## What this changes
+
+<!-- And why. Link the issue if there is one. -->
+
+## Checks
+
+<!-- See CONTRIBUTING.md. CI runs all of these, but running them locally is faster than a red pipeline. -->
+
+- [ ] `composer validate --strict`
+- [ ] `composer analyse` — PHPStan level 9, no baseline
+- [ ] `composer cs` — code style
+- [ ] `composer test` — unit and golden-file
+- [ ] `composer test:integration` — end-to-end
+
+## Does this change what lands in `deps/`?
+
+- [ ] **No** — the generated scoped output is byte-identical.
+- [ ] **Yes** — and I have added a `CHANGELOG.md` entry saying so.
+
+If yes: this is at least a **minor** release, never a patch, even when the diff is three
+characters. Consumers cannot see that their scoped tree changed until something fatals in
+production.
+
+## Symbol lists
+
+<!-- Delete this section if symbols/*.php is untouched. -->
+
+- [ ] Generated with `composer extract`, not edited by hand.
+- [ ] Counts checked against the baseline:
+
+```
+php scripts/symbol-guard.php snapshot /tmp/before.json
+composer extract
+php scripts/symbol-guard.php compare /tmp/before.json 1.0
+```
+
+## Documentation
+
+- [ ] User-facing behaviour changed, and `docs/` is updated to match.
+- [ ] Not needed.