Merge branch 'develop' into feature/naked-link-rule

Author: SteveJonesDev

.babelrc

@@ -0,0 +1,11 @@
+{
+	"presets": [
+		"@babel/preset-env",
+		[
+			"@babel/preset-react",
+			{
+				"runtime": "automatic"
+			}
+		]
+	]
+}

.coderabbit.yaml

@@ -0,0 +1,6 @@
+reviews:
+  branches:
+    include:
+      - main
+      - develop
+      - release/**

.eslintrc

@@ -3,12 +3,28 @@
 	"env": {
 		"browser": true,
 		"node": false,
-		"jest": true,
+		"jest": true
 	},
 	"globals": {
 		"wp": true,
 		"jQuery": true,
 		"edac_script_vars": true,
 		"ajaxurl": true
-	}
+	},
+	"overrides": [
+		{
+			"files": [ "src/sidebar/**/*.js", "src/sidebar/**/*.jsx", "src/issueModal/**/*.js", "src/issueModal/**/*.jsx" ],
+			"plugins": [ "react" ],
+			"parserOptions": {
+				"ecmaVersion": 2021,
+				"sourceType": "module",
+				"ecmaFeatures": {
+					"jsx": true
+				}
+			},
+			"rules": {
+				"react/jsx-uses-vars": "error"
+			}
+		}
+	]
 }

.github/agents/bug-hunter.yml

@@ -0,0 +1,114 @@
+name: bug-hunter
+description: Automated bug finder and fixer for Accessibility Checker plugin
+instructions: |
+  You are a specialized bug hunter for the Accessibility Checker WordPress plugin.
+
+  ## CRITICAL: Avoid Duplicate Work
+
+  **ALWAYS check the task context for**:
+  - Files already being fixed in open PRs - SKIP these completely
+  - Bug types already identified - DO NOT create duplicate fixes
+  - Recently changed files - PRIORITIZE these for analysis
+
+  **Before creating ANY PR**:
+  1. Verify the bug is NOT mentioned in existing open PRs
+  2. Verify the files you're changing are NOT in open PRs
+  3. Only create a PR if you found a NEW, DISTINCT bug
+
+  ## Analysis Focus
+  - Scan PHP files for WordPress plugin bugs (security, logic, performance)
+  - Check for WPCS compliance issues that could cause bugs
+  - Find undefined variables, incorrect hook usage
+  - Spot database query issues or SQL injection vulnerabilities
+  - Check for missing nonce verification or capability checks
+  - **SKIP any files listed in the "Files already in open PRs" context**
+
+  ## Bug Severity Priority (fix in this order)
+
+  **CRITICAL** (fix immediately):
+  - SQL injection vulnerabilities
+  - XSS vulnerabilities (unsanitized output)
+  - Authentication bypass
+  - Privilege escalation
+  - Arbitrary file upload
+  - Remote code execution
+  - Fatal PHP errors (application crashes)
+
+  **HIGH** (fix if no critical):
+  - CSRF vulnerabilities (missing nonces)
+  - Missing capability checks
+  - Path traversal vulnerabilities
+  - Input validation failures leading to security issues
+  - Unhandled exceptions that could expose sensitive data
+
+  **MEDIUM** (fix if no high):
+  - Logic errors causing incorrect behavior
+  - PHP warnings (deprecated functions, undefined variables, etc.)
+  - Performance issues (N+1 queries, inefficient loops)
+  - Memory leaks
+  - Deprecated function usage
+  - Incorrect hook usage
+  - Type mismatches that don't cause errors yet
+
+  **LOW** (fix only if nothing else):
+  - Code style inconsistencies that could lead to bugs
+  - Missing type hints that could prevent future errors
+  - Unclear variable names causing confusion
+  - PHP notices (less severe than warnings)
+
+  ## Coding Standards
+  - Follow WordPress coding standards (WPCS)
+  - Use EqualizeDigital\AccessibilityChecker namespace for class files
+  - Use `edac_` prefix ONLY for functions in global namespace (hooks, template functions)
+  - Avoid adding new global functions - prefer namespaced classes
+  - PHP 7.4+ compatibility
+  - Security best practices (sanitization, validation, nonces)
+
+  ## Fix Approach
+  - Fix ONLY ONE bug per run (even if you find multiple)
+  - Make minimal, focused changes
+  - Add PHPUnit tests for the bug fix:
+    * Create test in tests/phpunit/ directory
+    * Name test class matching the fixed file (e.g., AdminTest.php)
+    * Include a test that reproduces the bug (demonstrates the issue)
+    * Include a test that verifies the fix works
+    * Follow WordPress test framework patterns
+  - **RUN the tests to verify they pass**:
+    * Execute `npm run test:php`
+    * Ensure the bug reproduction test fails before the fix
+    * Ensure all tests pass after the fix
+    * Fix any test failures before creating PR
+  - Use branch name: `copilot/automated-bug-fix/{short-description-of-bug-fixed}`
+  - **Only create PR if all tests pass**
+
+  ## Test-Driven Bug Fix Workflow
+  1. **Write failing test** - Create test that reproduces the bug (should fail)
+  2. **Verify test fails** - Run tests to confirm the bug is caught
+  3. **Implement fix** - Make minimal code changes to fix the bug
+  4. **Run all tests** - Execute full test suite to verify fix works
+  5. **Check for regressions** - Ensure no existing tests broke
+  6. **Create DRAFT PR** - Only if all tests pass successfully
+
+  ## PR Creation
+  - **Always create as DRAFT** - PRs should be drafts initially for human review
+  - Add label `automated-bug-fix` (workflow will add this)
+  - Include clear description of bug and fix
+  - Reference any related issues if applicable
+  - Human reviewers can mark as "Ready for review" after validation
+
+  ## What NOT to Fix
+  - Don't refactor working code without a bug
+  - Don't change code style without fixing a bug
+  - Don't add new features (this is bug fixing only)
+  - Don't modify third-party dependencies
+  - Don't change database schema
+  - Don't update documentation only (unless it causes bugs)
+  - Don't fix bugs in files already being modified in open PRs
+
+  ## When to Exit Without PR
+  - All found bugs are already in open PRs
+  - The files with bugs are already being modified in open PRs
+  - No bugs found in recently changed files
+  - Unable to verify the bug is new/distinct
+
+  Only create a PR if you find a **legitimate, NEW bug** not covered by existing PRs.

.github/copilot-instructions.md

@@ -46,7 +46,24 @@ This is a WordPress plugin called "Accessibility Checker" developed by Equalize
 
 ## Development Workflow
 
-Commit lock files (`composer.lock`, `package-lock.json`) only when adding or updating packages. Run `composer install` and `npm install` to get dependencies matching the lock file.
+### Dependency Management
+
+**IMPORTANT: Do not commit lock files unless you have added, updated, or removed packages.**
+
+Only commit `composer.lock` and `package-lock.json` when:
+- Adding a new package/dependency
+- Updating an existing package/dependency
+- Removing a package/dependency
+
+If you only modified PHP or JavaScript code without touching `composer.json` or `package.json`, do NOT commit these lock files.
+
+To install dependencies matching existing lock files, run:
+```bash
+composer install
+npm install
+```
+
+### Code Quality & Testing
 
 Code should always be linted by phpcs and eslint before committing. Tests should be added for new functionality. Tests should also be added for any bug fixes. Use the following commands to run tests and linting:
 

.github/workflows/backport-to-develop.yml

@@ -25,38 +25,48 @@ jobs:
 
       - name: Get merged branch name
         id: get-branch
+        env:
+          BRANCH_NAME: ${{ github.event.pull_request.head.ref }}
+          HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
         run: |
-          # Get the head branch name from the merged PR
-          BRANCH_NAME="${{ github.event.pull_request.head.ref }}"
+          # Get the head branch name and repo from the merged PR
           echo "branch-name=$BRANCH_NAME" >> $GITHUB_OUTPUT
-          echo "Merged branch: $BRANCH_NAME"
+          echo "head-repo=$HEAD_REPO" >> $GITHUB_OUTPUT
+          echo "Merged branch: $BRANCH_NAME from $HEAD_REPO"
 
       - name: Check if branch exists
         id: check-branch
+        env:
+          HEAD_REF: ${{ steps.get-branch.outputs.branch-name }}
+          HEAD_REPO: ${{ steps.get-branch.outputs.head-repo }}
         run: |
-          BRANCH_NAME="${{ steps.get-branch.outputs.branch-name }}"
-          
-          # Check if the branch still exists on the remote
-          if git ls-remote --heads origin "$BRANCH_NAME" | grep -q "$BRANCH_NAME"; then
+          # Check if the branch still exists on the fork remote
+          if git ls-remote "https://github.com/${HEAD_REPO}.git" "refs/heads/${HEAD_REF}" | grep -q "refs/heads/${HEAD_REF}"; then
             echo "branch-exists=true" >> $GITHUB_OUTPUT
-            echo "Branch $BRANCH_NAME exists and can be used for backport"
+            echo "Branch $HEAD_REF exists in $HEAD_REPO and can be used for backport"
           else
             echo "branch-exists=false" >> $GITHUB_OUTPUT
-            echo "Branch $BRANCH_NAME no longer exists, cannot create backport PR"
+            echo "Branch $HEAD_REF no longer exists in $HEAD_REPO, cannot create backport PR"
           fi
 
       - name: Create backport PR
         if: steps.check-branch.outputs.branch-exists == 'true'
         uses: actions/github-script@v7
+        env:
+          BRANCH_NAME: ${{ steps.get-branch.outputs.branch-name }}
+          ORIGINAL_PR_NUMBER: ${{ github.event.pull_request.number }}
+          ORIGINAL_PR_TITLE: ${{ github.event.pull_request.title }}
+          ORIGINAL_PR_BODY: ${{ github.event.pull_request.body }}
+          ORIGINAL_PR_AUTHOR: ${{ github.event.pull_request.user.login }}
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
-            const branchName = '${{ steps.get-branch.outputs.branch-name }}';
-            const originalPrNumber = context.payload.pull_request.number;
-            const originalPrTitle = context.payload.pull_request.title;
-            const originalPrBody = context.payload.pull_request.body || '';
-            const originalPrAuthor = context.payload.pull_request.user.login;
-            
+            const branchName = process.env.BRANCH_NAME;
+            const originalPrNumber = process.env.ORIGINAL_PR_NUMBER;
+            const originalPrTitle = process.env.ORIGINAL_PR_TITLE;
+            const originalPrBody = process.env.ORIGINAL_PR_BODY || '';
+            const originalPrAuthor = process.env.ORIGINAL_PR_AUTHOR;
+
             // Create the backport PR
             try {
               const response = await github.rest.pulls.create({