Pass the full WordPress coding standard and run PHPCS on pull requests - #22

Summary

Brings the codebase to zero errors and zero warnings against the full WordPress standard, and adds a GitHub Action that runs PHPCS on every PR.

CI

• phpcs.xml.dist checks the WordPress standard, shows sniff codes and uses colored output. It registers the custom organiser and use_do_action_tools capabilities and excludes the bundled third-party akismet.fuspam.php. It replaces phpcs-security.xml.dist, which is now covered by the full standard.
• .github/workflows/phpcs.yml runs on PHP 8.5, installs WPCS with Composer and runs phpcs.

Behavior-relevant changes (worth a look)

• Non-profit edit link in the event editor: it was shown to users with the administrator or editor role. It now checks the edit_others_posts capability, which both roles have in core. The existing edit_post check on the nonprofit still applies first.
• Strict comparisons: almost all compare strings to strings. Where types differ, both sides are cast first:
  • select_multi / checkbox_multi / radio / select: option keys are integer post IDs, while saved values can be ints (nonprofits) or strings (sponsors), so both sides are compared as strings.
  • Non-profit author check: compared as (int).
• Admin datepicker CSS: now versioned with the plugin version instead of false, which used the WordPress version.

Bug fixes

• Do_Action_Tools read $this->_version, which doesn't exist. It now uses $this->parent->version.
• can_export was set twice in the post type args. Removed the duplicate (both were true).

Other fixes (no behavior change)

• Class names: do_action, do_action_tools, etc. become Do_Action, Do_Action_Tools, etc. PHP class names are case-insensitive, so nothing breaks.
• Renames: $_version / $_token / $_instance / _log_version_number() lose their underscore prefix (all references updated). Reserved-keyword parameters are renamed ($echo → $display, $parent → $plugin).
• Unused hook parameters removed, with add_action() / add_filter() arg counts updated.
• Output escaping: esc_attr_e( $var ) / esc_html_e( $var ) → echo esc_attr( $var ) / echo esc_html( $var ). This stops running variables through translation; the output is the same.
• At a Glance counts: _n() used non-literal strings and a placeholder your_textdomain domain that has no translations, so it always fell back to English. It now picks the label with 1 === $published, which gives the same output.
• date() → gmdate(): identical, because WordPress sets PHP's default timezone to UTC.
• IP lookup: the duplicated short-ternary chain is now one get_user_ip() helper with the same fallback order and result.
• Scripts: $in_footer is set explicitly to false, which was already the behavior.
• Smaller fixes: split multiple assignments, Yoda conditions, removed one unneeded return; and a commented-out if.
• Comments: file, class and function docblocks, complete @param / @return tags, and full stops on inline comments. This commit only changes comments; token comparison confirms the code is unchanged.
• Targeted phpcs:ignore / disable, each with a reason:
  • meta queries on event date
  • fclose() on php://output
  • the intentional singular/plural placeholders in the bulk messages

Testing

• phpcs reports no errors or warnings, locally and in CI.
• The PHPUnit suite passes (23 tests, 57 assertions), run in wp-env with PHP 8.3 and PHPUnit 9.6.
• The test bootstrap now loads the plugin on muplugins_loaded. It used to load it during init at priority 0, which skipped the plugin's own priority 0 init callbacks added in Fix PHP deprecation notices and early textdomain loading #20. As a result, 19 tests had been erroring on trunk since Fix PHP deprecation notices and early textdomain loading #20. Production was unaffected, because WordPress loads plugins before init.
• Still worth a manual check of:
  • the event edit screen: non-profit and sponsor multi-selects keep their selections, and the non-profit edit links appear
  • the signup and application forms
  • the tools page and CSV export

🤖 Generated with Claude Code