Repository navigation
feat(logging): add WP Engine Updater client - #862
Draft
josephfusco wants to merge 5 commits into
Draft
josephfusco wants to merge 5 commits into
josephfusco wants to merge 5 commits into
Conversation
Port FaustWP's plugin updater into WPGraphQL Logging as WPGraphQL\Logging\Updates\PluginUpdater and run it on admin_init with the wpgraphql-logging slug. Point the Update URI header at wpe-plugin-updates.wpengine.com so WordPress.org never offers updates for this plugin.
josephfusco
added
[Type] Task
Contributor
📦 Plugin Artifacts Ready!Download from GitHub Actions run Available plugins:
See the "Artifacts" section at the bottom of the Actions run page |
Review against FaustWP and core's wp_update_plugins(): - Stop writing the remote version into $transient->checked. Core compares it with the installed version, so a pending update made every check look like a changed plugin and hit api.wordpress.org on each Plugins screen load. - Report the plugin in no_update when it is current so core can offer auto-updates, and remove it from the other list. - Only cache manifests that decode and validate. A 200 with a bad body was cached for five hours and blocked updates. - Keep the fetched manifest (or failure) for the request. Core saves the transient twice per check, which meant two 10s requests when the API was down. - Look up the installed version lazily instead of calling get_plugins() on every admin_init, including admin-ajax. - Make check_for_updates() idempotent and also run it on the wp_update_plugins and wp_maybe_auto_update cron actions, which never fire admin_init, so cron checks and auto-updates see the plugin. - Sanitize manifest fields (text, key, URL, kses for sections) and guard against non-scalar values.
Running PHPStan at max level on the updater showed manifest fields were still read as mixed after validation. Decode the manifest once into an array of sanitized strings, then have the transient and plugins_api code read from that array instead of from the raw stdClass. Also guard the cached expiry and the installed version against non-scalar values. New wpunit coverage: - the cron hooks - check_for_updates() idempotency and unregister() - one request per page load after a failure - refetching an invalid cached body and skipping the request on a valid cache - rejecting non-HTTP download links and non-scalar fields - sanitized names, sections and optional fields - moving the plugin between response and no_update - the filters running through set_site_transient() and plugins_api()
- Add an Updates section and the src/Updates entry to the plugin docs: where updates come from, the five-hour cache, and how Composer-managed sites should keep updating. - Drop the redundant trailingslashit() calls when building the manifest URL. - Share the option names, manifest URL and plugins_api arguments across the updater tests instead of repeating the literals.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the WP Engine Updater client so sites installed from the release zip get plugin updates in wp-admin. It does nothing until the
wpgraphql-loggingslug and itsinfo.jsonare published to the updater service.Part of #446
Use of AI Tools
AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5.5
Used for: Assisting with porting the WP Engine updater client.