package.sh: explicit allow-list of shipped paths instead of deny-list#91
Merged
package.sh: explicit allow-list of shipped paths instead of deny-list#91
Conversation
Previously bin/package.sh ran `git archive HEAD` over the whole repo and relied on `.gitattributes` `export-ignore` rules to keep dev-only content out. Two problems: 1. Anything new committed at the repo root shipped by default unless someone remembered to add it to `.gitattributes` first. That's how the stray `script(1)` recording from #77 ended up in the zip. 2. The mental model was inverted — opt-out, not opt-in — which is the wrong default for release artifacts. Now `bin/package.sh` ships only the explicit allow-list: desktop-mode.php, readme.txt, LICENSE, README.md, assets/, includes/, languages/ Anything else tracked in the repo (build config, tests, docs, dev tooling, stray editor recordings, …) is excluded by default. Adding a new top-level path to a release means consciously appending it to the `include` array. The script also `git cat-file -e`-checks each entry up front so a typo or a removed-but-not-updated path fails the package step rather than producing a silently-incomplete zip. `.gitattributes` deny-list rules stay in place as a second layer — both in case someone runs `git archive HEAD` directly, and to handle paths inside an allow-listed directory that still shouldn't ship.
✅ WordPress Plugin Check Report
📊 ReportAll checks passed! No errors or warnings found. 🤖 Generated by WordPress Plugin Check Action • Learn more about Plugin Check |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
bin/package.shwas runninggit archive HEADover the whole repo and relying on.gitattributesexport-ignorerules to keep dev-only content out of the zip. That model is opt-out: anything new committed at the repo root ships by default unless someone remembers to update.gitattributes. That's how the strayscript(1)recording from #77 ended up insidedesktop-mode.zip(fixed in #90).This PR flips the model.
bin/package.shnow ships only the explicit allow-list:desktop-mode.phpreadme.txtLICENSEREADME.mdassets/includes/languages/Anything else tracked in the repo — build config, tests, docs, dev tooling, accidental root-level files — is excluded by default. Adding a new top-level path to a release now requires consciously appending it to the
includearray in the script.The script also runs
git cat-file -eagainst each allow-listed path up front so a typo or removed-but-not-updated entry fails the package step instead of silently producing an incomplete zip..gitattributesdeny-list rules stay in place as a second layer (in case someone runsgit archive HEADdirectly, or to exclude individual files within an allow-listed directory). The header comment is updated to reflect the new layered model.Verification
Local run, before this change:
After this change:
All 6 Vite-built bundles + 2 hand-written
assets/js/*.jsfiles still get spliced in correctly.Test plan
npm run packageand confirm only the 7 top-level entries above appear.assets/js/{desktop,iframe-bridge,recycle-bin}{,.min}.js) and the hand-written ones (admin-bar.js,media-library-enhanced.js) are inside the zip.git add foo.txt && git commit), re-runnpm run package, confirmfoo.txtis NOT in the zip.includearray and confirm the script errors out instead of silently producing an incomplete zip.bin/release.shonce merged, confirm the published zip matches expectations.Relationship to #90
#90 removes the existing stray
typescriptfile and gitignores thescript(1)default name. This PR is the structural follow-up: even if a future stray file slips past.gitignoreand gets committed, it can no longer end up in a release zip without someone explicitly allow-listing it.