Release 0.10.0

.distignore

@@ -0,0 +1,47 @@
+# Directories
+/.git/
+/.github/
+/.claude/
+/.phpunit.cache/
+/artifacts/
+/bin/
+/dist/
+/documentation/
+/node_modules/
+/tests/
+/vendor/
+
+# Development configuration
+.distignore
+.editorconfig
+.gitattributes
+.gitignore
+.nvmrc
+.phpcs.xml.dist
+.prettierignore
+.prettierrc
+.svnignore
+.wp-env.json
+.wp-env.override.json
+
+# Build tooling
+babel.config.js
+eslint.config.js
+jest.config.js
+playwright.config.js
+webpack.config.js
+
+# Package management
+composer.json
+composer.lock
+package.json
+package-lock.json
+
+# Documentation (not needed in plugin distribution)
+CHANGELOG.md
+CONTRIBUTING.md
+PUBLISHING.md
+SECURITY.md
+
+# Test configuration
+phpunit.xml.dist

.editorconfig

@@ -14,7 +14,7 @@ insert_final_newline = true
 trim_trailing_whitespace = true
 indent_style = tab
 
-[{*.yml,*.feature}]
+[*.yml]
 indent_style = space
 indent_size = 2
 

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# The following teams will get auto-tagged for a review.
+# See https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+* @Automattic/vip-plugins

.github/dependabot.yml

@@ -0,0 +1,64 @@
+# Configuration for Dependabot version updates
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    groups:
+      actions:
+        patterns: ["*"]
+    labels:
+      - "dependencies"
+    commit-message:
+      prefix: "Actions"
+      include: "scope"
+    open-pull-requests-limit: 5
+
+  # Maintain dependencies for Composer
+  - package-ecosystem: "composer"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "tuesday"
+    groups:
+      dev-dependencies:
+        patterns:
+          - "automattic/*"
+          - "dealerdirect/*"
+          - "php-parallel-lint/*"
+          - "phpcompatibility/*"
+          - "phpunit/*"
+          - "squizlabs/*"
+          - "yoast/*"
+    labels:
+      - "dependencies"
+    commit-message:
+      prefix: "Composer"
+      include: "scope"
+    open-pull-requests-limit: 5
+    versioning-strategy: increase-if-necessary
+
+  # Maintain dependencies for npm
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+    groups:
+      dev-dependencies:
+        patterns:
+          - "@wordpress/*"
+          - "eslint*"
+          - "prettier*"
+          - "@types/*"
+    labels:
+      - "dependencies"
+    commit-message:
+      prefix: "npm"
+      include: "scope"
+    open-pull-requests-limit: 5

.github/workflows/deploy.yml

@@ -0,0 +1,57 @@
+name: Deploy to WordPress.org
+
+on:
+  release:
+    types: [released]
+  workflow_dispatch:
+
+# Workflow-level permissions set to none; jobs declare their own minimal permissions
+permissions: {}
+
+jobs:
+  release:
+    name: Deploy to WordPress.org
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write # Required to upload release assets to the GitHub release
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        with:
+          node-version: '20'
+          # Disabled to prevent cache poisoning in release workflows
+          package-manager-cache: false
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build assets
+        run: npm run build
+
+      - name: Install SVN
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y subversion
+
+      - name: Deploy to WordPress.org
+        uses: 10up/action-wordpress-plugin-deploy@54bd289b8525fd23a5c365ec369185f2966529c2 # v2.3.0
+        with:
+          generate-zip: true
+        env:
+          SLUG: edit-flow
+          SVN_USERNAME: ${{ secrets.SVN_USERNAME }}
+          SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }}
+
+      - name: Upload release asset
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
+        with:
+          files: ${{ github.workspace }}/${{ github.event.repository.name }}.zip
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/e2e-and-js-tests.yml

@@ -1,42 +1,110 @@
 name: E2E and JS tests
 
-on: push
+on:
+  pull_request:
+  push:
+    branches-ignore:
+      - develop
+      - main
+
+# Disable all permissions by default; grant minimal permissions per job
+permissions: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  test:
+  build:
+    name: Build and Lint
     runs-on: ubuntu-latest
-    continue-on-error: false
-
-    strategy:
-      fail-fast: true
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up NodeJS 20
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
         with:
           node-version: '20'
           cache: npm
 
-      - name: Build Edit Flow
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build assets
+        run: npm run build
+
+      - name: Verify built assets exist
         run: |
-          npm ci
-          npm run build
+          echo "Checking custom-status assets..."
+          test -f build/custom-status-block.js || (echo "Missing: build/custom-status-block.js" && exit 1)
+          test -f build/custom-status-block.css || (echo "Missing: build/custom-status-block.css" && exit 1)
 
-      - name: Install WordPress with wp-env
-        run: npm run wp-env start
+          echo "Checking calendar assets..."
+          test -f build/calendar-react.js || (echo "Missing: build/calendar-react.js" && exit 1)
+          test -f build/calendar-react.css || (echo "Missing: build/calendar-react.css" && exit 1)
+
+          echo "All expected assets present!"
+
+      - name: Report asset sizes
+        run: |
+          echo "### Asset Sizes" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "| File | Size |" >> $GITHUB_STEP_SUMMARY
+          echo "|------|------|" >> $GITHUB_STEP_SUMMARY
+          echo "| custom-status-block.js | $(du -h build/custom-status-block.js | cut -f1) |" >> $GITHUB_STEP_SUMMARY
+          echo "| calendar-react.js | $(du -h build/calendar-react.js | cut -f1) |" >> $GITHUB_STEP_SUMMARY
 
       - name: Run Lint JS
         run: npm run lint-js
 
-      - name: Run Jest tests
-        run: npm run test-jest
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: build-artifacts
+          path: build/
+          retention-days: 1
+
+  test:
+    name: E2E and Jest tests
+    # Pin to ubuntu-22.04 for Playwright compatibility
+    # ubuntu-latest (24.04) has library version mismatches with Playwright's WebKit dependencies
+    runs-on: ubuntu-22.04
+    needs: build
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up NodeJS 20
+        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        with:
+          node-version: '20'
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Download build artifacts
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: build-artifacts
+          path: build/
+
+      - name: Install Playwright browsers and system dependencies
+        run: npx playwright install --with-deps chromium
+
+      - name: Install WordPress with wp-env
+        run: npm run wp-env start
 
-      - name: Run E2E tests
-        run: npm run test-e2e
+      - name: Run tests
+        run: npm run test