Merge pull request #4 from MrDemonWolf/claude/sharp-lamarr-4d9b7f

Code audit: deduplication, security hardening, and CI improvements

Author: nathanialhenniges

.github/workflows/ci.yml

@@ -20,6 +20,12 @@ jobs:
       - name: PHP syntax check
         run: php -l theme/functions.php
 
+      - name: PHP Code Sniffer (WordPress-Core, errors only)
+        run: |
+          composer global config allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
+          composer global require wp-coding-standards/wpcs:"^3" --no-progress --no-interaction -q
+          ~/.composer/vendor/bin/phpcs --standard=WordPress-Core -n --extensions=php theme/functions.php
+
       - name: Check for leftover Nexus references
         run: |
           ! grep -ri "nexus" theme/ supplementary/ --include="*.php" --include="*.css" --include="*.js" --include="*.json" --include="*.xml"

CHANGELOG.md

@@ -0,0 +1,30 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.0.0] - 2026-04-17
+
+Initial public release.
+
+### Added
+- `service` custom post type with icon metabox.
+- Shortcodes: `[mrdemonwolf_breadcrumbs]`, `[mrdemonwolf_tags]`, `[mrdemonwolf_social_share]`.
+- Bundled Magnific Popup 1.1.0 for video popups.
+- Cleanup mu-plugin notice on theme deactivation.
+- CI (PHP lint, phpcs with WordPress Coding Standards, Nexus reference check, zip build) and tagged release workflow.
+- CSS custom properties `--mdw-bg` and `--mdw-border` for neutral palette.
+- Dedicated `theme/assets/admin-service-metabox.js` with `wp_localize_script` for i18n strings; scoped to the service edit screen via `admin_enqueue_scripts`.
+- Breadcrumb helpers `mrdemonwolf_breadcrumb_link()`, `mrdemonwolf_breadcrumb_current()`, and `mrdemonwolf_primary_term_link()`.
+- `mrdemonwolf_mu_dir()` helper for mu-plugins path resolution.
+- README documentation for the Magnific Popup pin and upgrade path.
+
+### Changed
+- Breadcrumbs shortcode refactored to use the new helpers — removes duplicated anchor/span escaping across WooCommerce, post, project, page, category, and archive branches.
+- Social share shortcode uses `rawurlencode()` instead of `urlencode()` for query-string URL components.
+- Hardcoded `#EEF2F7` and `#C8D3E0` values in `style.css` replaced with `var(--mdw-bg)` / `var(--mdw-border)`.
+
+### Security / Robustness
+- `file_put_contents()` return value is now checked when writing the cleanup mu-plugin; failures are reported via `error_log()`.

README.md

@@ -265,6 +265,8 @@ times.
 | Lightbox  | Magnific Popup 1.1.0 (bundled)      |
 | Migration | WP-CLI                              |
 
+> Magnific Popup is pinned to [v1.1.0](https://github.com/dimsemenov/Magnific-Popup/releases/tag/1.1.0) and bundled under `theme/assets/`. To upgrade, replace `jquery.magnific-popup.min.js` and `magnific-popup.min.css` from the upstream release and bump the version string in `theme/functions.php`.
+
 ## Development
 
 ### Prerequisites

theme/assets/admin-service-metabox.js

@@ -0,0 +1,34 @@
+jQuery(function ($) {
+	var cfg = window.mdwServiceMetabox || {};
+	var frame;
+
+	$('#mdw-service-upload-btn').on('click', function (e) {
+		e.preventDefault();
+
+		if (frame) {
+			frame.open();
+			return;
+		}
+
+		frame = wp.media({
+			title: cfg.title || 'Select Image',
+			button: { text: cfg.buttonText || 'Use this image' },
+			multiple: false
+		});
+
+		frame.on('select', function () {
+			var attachment = frame.state().get('selection').first().toJSON();
+			$('#mdw-service-image').val(attachment.url);
+			$('#mdw-service-image-preview').attr('src', attachment.url).show();
+			$('#mdw-service-remove-btn').show();
+		});
+
+		frame.open();
+	});
+
+	$('#mdw-service-remove-btn').on('click', function () {
+		$('#mdw-service-image').val('');
+		$('#mdw-service-image-preview').hide();
+		$(this).hide();
+	});
+});