diff --git a/.github/workflows/.gitignore b/.github/workflows/.gitignore new file mode 100644 index 0000000000..603ec14871 --- /dev/null +++ b/.github/workflows/.gitignore @@ -0,0 +1,3 @@ +# Workflow artifacts and logs +validation-errors.log +*.log diff --git a/.github/workflows/frontmatter-validation.yml b/.github/workflows/frontmatter-validation.yml new file mode 100644 index 0000000000..cbe2a97233 --- /dev/null +++ b/.github/workflows/frontmatter-validation.yml @@ -0,0 +1,130 @@ +--- +name: Frontmatter Validation + +on: + push: + branches: + - main + - develop + - 'claude/**' + paths: + - '**.md' + - 'schemas/frontmatter/**' + - '.github/workflows/frontmatter-validation.yml' + pull_request: + paths: + - '**.md' + - 'schemas/frontmatter/**' + - '.github/workflows/frontmatter-validation.yml' + workflow_dispatch: + +jobs: + validate-schema: + name: Validate Frontmatter Schema + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: '20' + cache: 'npm' + cache-dependency-path: schemas/frontmatter/package-lock.json + + - name: Install dependencies + working-directory: schemas/frontmatter + run: npm ci + + - name: Validate schema structure + working-directory: schemas/frontmatter + run: npm run validate:schema + + - name: Run schema tests + working-directory: schemas/frontmatter + run: npm test + + validate-frontmatter: + name: Validate All Frontmatter + runs-on: ubuntu-latest + needs: validate-schema + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: '20' + cache: 'npm' + cache-dependency-path: schemas/frontmatter/package-lock.json + + - name: Install dependencies + working-directory: schemas/frontmatter + run: npm ci + + - name: Validate all frontmatter files + working-directory: schemas/frontmatter + run: npm run validate + + - name: Upload validation report + if: failure() + uses: actions/upload-artifact@v4 + with: + name: validation-errors + path: schemas/frontmatter/validation-errors.log + retention-days: 7 + + frontmatter-changed-files: + name: Validate Changed Files Only + runs-on: ubuntu-latest + if: github.event_name == 'pull_request' + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: '20' + cache: 'npm' + cache-dependency-path: schemas/frontmatter/package-lock.json + + - name: Install dependencies + working-directory: schemas/frontmatter + run: npm ci + + - name: Get changed markdown files + id: changed-files + uses: tj-actions/changed-files@v44 + with: + files: | + **.md + + - name: Validate changed files + if: steps.changed-files.outputs.any_changed == 'true' + working-directory: schemas/frontmatter + run: | + echo "Validating changed files:" + for file in ${{ steps.changed-files.outputs.all_changed_files }}; do + echo " - $file" + node validate.js "../../$file" || exit 1 + done + + - name: Comment on PR + if: failure() && github.event_name == 'pull_request' + uses: actions/github-script@v7 + with: + script: | + github.rest.issues.createComment({ + issue_number: context.issue.number, + owner: context.repo.owner, + repo: context.repo.repo, + body: '⚠️ **Frontmatter validation failed**\n\nPlease check the workflow logs for details and ensure all frontmatter follows the schema at `schemas/frontmatter/frontmatter.schema.json`.\n\nSee [Frontmatter Documentation](https://github.com/lightspeedwp/.github/blob/develop/schemas/frontmatter/README.md) for guidance.' + }) diff --git a/schemas/frontmatter/MIGRATION.md b/schemas/frontmatter/MIGRATION.md new file mode 100644 index 0000000000..a13e36af6c --- /dev/null +++ b/schemas/frontmatter/MIGRATION.md @@ -0,0 +1,375 @@ +--- +title: 'Frontmatter Schema Migration Plan' +description: 'Step-by-step plan for moving frontmatter.schema.json to its own subfolder with validation' +version: 'v1.0' +last_updated: '2025-11-12' +file_type: 'documentation' +tags: ['migration', 'schema', 'refactoring'] +references: + - path: './README.md' + description: 'Frontmatter schema documentation' + - path: '../../docs/DOCUMENTATION_AUDIT.md' + description: 'Documentation audit that recommended this change' +--- + +# Frontmatter Schema Migration Plan + +This document outlines the complete migration plan for moving `schemas/frontmatter.schema.json` to `schemas/frontmatter/frontmatter.schema.json`. + +## Overview + +**Old Location**: `/schemas/frontmatter.schema.json` +**New Location**: `/schemas/frontmatter/frontmatter.schema.json` + +**Why?** +- Better organization for related files (docs, examples, tests) +- More scalable structure for future schema versions +- Dedicated space for validation tools and utilities +- Aligns with best practices for schema management + +## Impact Analysis + +### Files Affected: 45+ + +#### Critical (Code Files) - Must Update First +- `metrics/frontmatter-metrics.js` (line 63) +- `scripts/validation/validate-frontmatter.js` (line 24) +- `scripts/validation/__tests__/validate-frontmatter.test.js` (lines 311, 358) + +#### High Priority ($schema References in Frontmatter) +- `.github/agents/wp-security-review.agent.md` +- `.github/agents/wp-performance-audit.agent.md` +- `.github/agents/wp-accessibility-review.agent.md` +- `schemas/frontmatter/frontmatter.schema.json` (self-references) + +#### Medium Priority (Documentation Links) +- All test README files (5 files) +- `schemas/README.md` +- `scripts/README.md` and `scripts/validation/README.md` +- Instruction files in `.github/instructions/` (7 files) +- Chatmode files (2 files) +- Documentation files in `docs/` (multiple) + +#### Broken Links to Fix +- `.github/instructions/issue-creation.instructions.md` +- `.github/instructions/issues.instructions.md` +- `.github/instructions/pr-creation.instructions.md` +- `docs/README_DOCS_ARCHITECTURE.md` + +These use incorrect path `schema/` instead of `schemas/` - must be fixed! + +## Migration Steps + +### Phase 1: Preparation ✅ COMPLETE + +- [x] Audit all references to frontmatter.schema.json +- [x] Create new folder structure +- [x] Create validation script +- [x] Create tests +- [x] Create documentation +- [x] Create examples +- [x] Create GitHub Actions workflow + +### Phase 2: Schema Setup (Current) + +1. **Move the schema file** + ```bash + # Create backup + cp schemas/frontmatter.schema.json schemas/frontmatter.schema.json.backup + + # Move to new location + mv schemas/frontmatter.schema.json schemas/frontmatter/frontmatter.schema.json + ``` + +2. **Install validation dependencies** + ```bash + cd schemas/frontmatter + npm install + ``` + +3. **Test the validation** + ```bash + # Validate schema itself + npm run validate:schema + + # Run tests + npm test + ``` + +### Phase 3: Update Code Files (Critical) + +**These MUST be updated before deployment to avoid runtime errors.** + +1. **Update `metrics/frontmatter-metrics.js`** + ```diff + - const schemaPath = path.join(process.cwd(), "schemas/frontmatter.schema.json"); + + const schemaPath = path.join(process.cwd(), "schemas/frontmatter/frontmatter.schema.json"); + ``` + +2. **Update `scripts/validation/validate-frontmatter.js`** + ```diff + - schemaPath: path.join(__dirname, '../../schemas/frontmatter.schema.json') + + schemaPath: path.join(__dirname, '../../schemas/frontmatter/frontmatter.schema.json') + ``` + +3. **Update `scripts/validation/__tests__/validate-frontmatter.test.js`** + ```diff + - const schemaPath = path.resolve(__dirname, '../../../schemas/frontmatter.schema.json'); + + const schemaPath = path.resolve(__dirname, '../../../schemas/frontmatter/frontmatter.schema.json'); + ``` + +### Phase 4: Update Frontmatter $schema References + +Update all files that reference the schema in their frontmatter: + +**Pattern to find:** +```bash +grep -r '$schema.*frontmatter.schema.json' .github/ +``` + +**Agent files:** +```diff +- $schema: "../frontmatter.schema.json" ++ $schema: "../schemas/frontmatter/frontmatter.schema.json" +``` + +**Schema self-references:** +```diff +- "path": "schemas/frontmatter.schema.json" ++ "path": "schemas/frontmatter/frontmatter.schema.json" +``` + +### Phase 5: Update Documentation Links + +Update all markdown links: + +**Pattern to find:** +```bash +grep -r 'frontmatter\.schema\.json' --include="*.md" +``` + +**Replace pattern:** +```diff +- [schema](../../schemas/frontmatter.schema.json) ++ [schema](../../schemas/frontmatter/frontmatter.schema.json) +``` + +**Files to update:** +- `schemas/README.md` +- `scripts/README.md` +- `scripts/validation/README.md` +- All test README files +- `docs/CHATMODE-FRONTMATTER.md` +- `.github/instructions/*.instructions.md` + +### Phase 6: Fix Broken Links + +These files incorrectly use `schema/` instead of `schemas/`: + +1. `.github/instructions/issue-creation.instructions.md` +2. `.github/instructions/issues.instructions.md` +3. `.github/instructions/pr-creation.instructions.md` +4. `docs/README_DOCS_ARCHITECTURE.md` + +**Fix:** +```diff +- [frontmatter schema](../../schema/frontmatter.schema.json) ++ [frontmatter schema](../../schemas/frontmatter/frontmatter.schema.json) +``` + +### Phase 7: Update Workflow Files + +Update `.github/workflows/frontmatter-metrics.yml` and any other workflows that reference the schema: + +```diff +- schemas/frontmatter.schema.json ++ schemas/frontmatter/frontmatter.schema.json +``` + +### Phase 8: Testing & Validation + +1. **Run validation script** + ```bash + cd schemas/frontmatter + npm run validate + ``` + +2. **Check for broken references** + ```bash + # Search for old references + grep -r "schemas/frontmatter\.schema\.json" . --exclude-dir=node_modules + + # Should only find in this migration doc and backup file + ``` + +3. **Test code functionality** + ```bash + # Run any dependent scripts + node scripts/validation/validate-frontmatter.js + node metrics/frontmatter-metrics.js + ``` + +4. **Test GitHub Actions** + - Create a test PR with a markdown file + - Verify the frontmatter-validation workflow runs + - Ensure it uses the new path + +### Phase 9: Cleanup & Documentation + +1. **Remove backup** + ```bash + rm schemas/frontmatter.schema.json.backup + ``` + +2. **Update VSCode settings** + + In `.vscode/settings.json`: + ```diff + { + "yaml.schemas": { + - "./schemas/frontmatter.schema.json": [ + + "./schemas/frontmatter/frontmatter.schema.json": [ + ".github/agents/*.md", + ".github/instructions/*.md", + ".github/prompts/*.md", + ".github/chatmodes/*.md", + "docs/*.md" + ] + } + } + ``` + +3. **Update CHANGELOG** + ```markdown + ## [Unreleased] + + ### Changed + - Moved frontmatter schema to dedicated subfolder for better organization + - Schema now at `schemas/frontmatter/frontmatter.schema.json` + - Added validation tools, tests, and examples in schema folder + + ### Added + - Frontmatter validation script with CLI tool + - Automated schema validation via GitHub Actions + - Example frontmatter files for each file type + - Comprehensive schema documentation + ``` + +4. **Announce the change** + - Update relevant documentation index files + - Post in GitHub Discussions if necessary + - Note in next team meeting + +## Automated Migration Script + +For bulk updates, you can use this script: + +```bash +#!/bin/bash +# migrate-schema-references.sh + +OLD_PATH="schemas/frontmatter.schema.json" +NEW_PATH="schemas/frontmatter/frontmatter.schema.json" + +# Update code files (JavaScript) +find . -name "*.js" -type f -not -path "*/node_modules/*" -exec sed -i "s|$OLD_PATH|$NEW_PATH|g" {} + + +# Update markdown files +find . -name "*.md" -type f -not -path "*/node_modules/*" -exec sed -i "s|$OLD_PATH|$NEW_PATH|g" {} + + +# Update YAML files +find . -name "*.yml" -type f -not -path "*/node_modules/*" -exec sed -i "s|$OLD_PATH|$NEW_PATH|g" {} + +find . -name "*.yaml" -type f -not -path "*/node_modules/*" -exec sed -i "s|$OLD_PATH|$NEW_PATH|g" {} + + +# Fix broken links (schema/ -> schemas/frontmatter/) +find . -name "*.md" -type f -not -path "*/node_modules/*" -exec sed -i "s|schema/frontmatter\.schema\.json|schemas/frontmatter/frontmatter.schema.json|g" {} + + +echo "Migration complete! Review changes with: git diff" +``` + +**Usage:** +```bash +chmod +x migrate-schema-references.sh +./migrate-schema-references.sh +git diff # Review changes +``` + +## Rollback Plan + +If issues arise: + +1. **Quick rollback** + ```bash + # Restore from backup + cp schemas/frontmatter.schema.json.backup schemas/frontmatter.schema.json + + # Revert git changes + git checkout HEAD -- . + ``` + +2. **Partial rollback** + - Keep the new structure + - Create symlink for backward compatibility: + ```bash + ln -s frontmatter/frontmatter.schema.json schemas/frontmatter.schema.json + ``` + +## Verification Checklist + +After migration, verify: + +- [ ] Schema file exists at new location +- [ ] Old location removed (or symlinked) +- [ ] All code files updated and working +- [ ] All frontmatter $schema references updated +- [ ] All documentation links updated +- [ ] Broken links fixed +- [ ] VSCode settings updated +- [ ] GitHub Actions workflow passing +- [ ] Validation script works: `npm run validate` +- [ ] Tests pass: `npm test` +- [ ] No grep results for old path (except backups/docs) +- [ ] CHANGELOG updated +- [ ] No broken references in production + +## Success Criteria + +Migration is considered successful when: + +1. ✅ All frontmatter validates without errors +2. ✅ CI/CD pipeline passes +3. ✅ No broken links in documentation +4. ✅ All code files use new path +5. ✅ VSCode intellisense works with new path +6. ✅ Examples and tests run successfully +7. ✅ No complaints from team members about broken tools + +## Timeline + +**Estimated Duration**: 2-3 hours + +- Phase 1 (Preparation): ✅ Complete +- Phase 2 (Setup): 15 minutes +- Phase 3 (Code): 15 minutes +- Phase 4 (Frontmatter): 30 minutes +- Phase 5 (Documentation): 45 minutes +- Phase 6 (Broken Links): 15 minutes +- Phase 7 (Workflows): 10 minutes +- Phase 8 (Testing): 30 minutes +- Phase 9 (Cleanup): 15 minutes + +## Support + +Questions or issues? + +1. Check [README.md](./README.md) for schema documentation +2. Review [validation examples](./examples/) +3. Test with `npm run validate` +4. Open an issue in GitHub + +--- + +**Status**: Ready for execution +**Approved by**: Pending +**Executed by**: Pending +**Completion date**: Pending diff --git a/schemas/frontmatter/README.md b/schemas/frontmatter/README.md new file mode 100644 index 0000000000..c6f2634215 --- /dev/null +++ b/schemas/frontmatter/README.md @@ -0,0 +1,243 @@ +--- +title: 'Frontmatter Schema Documentation' +description: 'Unified frontmatter schema for LightSpeed .github files, validation tools, and usage guidelines' +version: 'v1.0' +last_updated: '2025-11-12' +file_type: 'documentation' +tags: ['schema', 'frontmatter', 'validation', 'yaml'] +references: + - path: '../../docs/CHATMODE-FRONTMATTER.md' + description: 'Frontmatter conventions guide' + - path: '../../.github/instructions/frontmatter.instructions.md' + description: 'Frontmatter instructions for AI agents' + - path: '../../.github/instructions/tagging-and-frontmatter-conventions.instructions.md' + description: 'Tagging conventions' +--- + +# Frontmatter Schema + +This folder contains the unified frontmatter schema used across all LightSpeed `.github` configuration files, along with validation tools, examples, and documentation. + +## Overview + +The `frontmatter.schema.json` file is a JSON Schema (Draft 07) that validates YAML frontmatter in: + +- Agent specifications (`.github/agents/*.agent.md`) +- Instructions (`.github/instructions/*.instructions.md`) +- Prompts (`.github/prompts/*.prompt.md`) +- Chatmodes (`.github/chatmodes/*.chatmode.md`) +- Documentation (`docs/*.md`) +- GitHub templates (issue, PR, discussion templates) +- Root configuration files (`CLAUDE.md`, `GEMINI.md`, `AGENTS.md`) + +## Files + +``` +frontmatter/ +├── frontmatter.schema.json # The main JSON Schema +├── validate.js # Validation CLI tool +├── package.json # Dependencies for validation +├── README.md # This file +├── examples/ # Example frontmatter +│ ├── agent.example.md +│ ├── instruction.example.md +│ └── prompt.example.md +└── tests/ # Validation tests + └── schema.test.js +``` + +## Quick Start + +### Installation + +```bash +cd schemas/frontmatter +npm install +``` + +### Validate All Files + +```bash +npm run validate +``` + +### Validate Specific File + +```bash +node validate.js path/to/file.md +``` + +### Validate Schema Only + +```bash +npm run validate:schema +``` + +## Schema Structure + +The schema uses JSON Schema's `oneOf` discriminator pattern with `file_type` as the discriminator property. Each file type has specific requirements: + +### Common Fields + +Available across all file types (via `$ref: "#/definitions/commonFields"`): + +| Field | Type | Description | +|-------|------|-------------| +| `title` | string | Human-readable title | +| `description` | string | Brief description of purpose (required for most types) | +| `version` | string | Version string (e.g., v1.1) | +| `created_date` | date | ISO date when file was created | +| `last_updated` | date | ISO date of last update | +| `author` | string | Main author or responsible party | +| `maintainer` | string | Current maintainer or team | +| `owners` | array | List of owners/maintainers | +| `tags` | array | Keywords for discovery (max 8) | +| `status` | enum | `active`, `deprecated`, `draft`, `experimental` | +| `stability` | enum | `stable`, `experimental`, `incubating` | +| `deprecated` | boolean | Whether this file is deprecated | +| `replacement` | string | Path to replacement file if deprecated | +| `domain` | enum | Primary classification domain | +| `references` | array | AI-focused references to related files | + +### File Types + +Each `file_type` has specific required and optional fields: + +- **`agent`**: Agent specifications (`.github/agents/*.agent.md`) +- **`instructions`**: Instructions files (`.github/instructions/*.instructions.md`) +- **`prompt`**: Prompt specifications (`.github/prompts/*.prompt.md`) +- **`chatmode`**: Chatmode configurations (`.github/chatmodes/*.chatmode.md`) +- **`documentation`**: General docs (`docs/*.md`) +- **`issue-template`**: GitHub issue templates +- **`pr-template`**: GitHub PR templates +- And more... + +See the schema file for complete definitions. + +## Usage in Files + +### Reference the Schema + +Add a `$schema` property in your YAML frontmatter: + +```yaml +--- +$schema: "schemas/frontmatter/frontmatter.schema.json" +file_type: "agent" +name: "example-agent" +description: "An example agent specification" +--- +``` + +### VSCode Integration + +VSCode will automatically validate YAML frontmatter if you have the YAML extension installed and the schema properly referenced. + +Add to `.vscode/settings.json`: + +```json +{ + "yaml.schemas": { + "./schemas/frontmatter/frontmatter.schema.json": [ + ".github/agents/*.md", + ".github/instructions/*.md", + ".github/prompts/*.md", + ".github/chatmodes/*.md", + "docs/*.md" + ] + } +} +``` + +## Validation + +### Manual Validation + +```bash +# Validate all files +npm run validate + +# Validate specific file +node validate.js .github/agents/example.agent.md + +# Only check if schema is valid +npm run validate:schema +``` + +### CI/CD Validation + +The validation script is integrated into GitHub Actions. See `.github/workflows/frontmatter-validation.yml`. + +### Pre-commit Hook + +To validate frontmatter before committing: + +```bash +# .git/hooks/pre-commit +#!/bin/bash +cd schemas/frontmatter +npm run validate +``` + +## Examples + +See the `examples/` directory for complete examples of each file type: + +- `agent.example.md` - Agent specification +- `instruction.example.md` - Instructions file +- `prompt.example.md` - Prompt specification + +## Testing + +Run the test suite: + +```bash +npm test +``` + +## Updating the Schema + +When updating `frontmatter.schema.json`: + +1. **Edit the schema** - Make your changes following JSON Schema Draft 07 spec +2. **Validate the schema** - Run `npm run validate:schema` +3. **Update examples** - Ensure examples in `examples/` reflect changes +4. **Update documentation** - Update this README and related docs +5. **Run full validation** - Run `npm run validate` to check all files +6. **Update version** - Increment version in schema's `title` or add a `version` field +7. **Commit changes** - Include rationale in commit message +8. **Update references** - If path changed, update all referencing files + +## Migration + +This schema was moved from `schemas/frontmatter.schema.json` to `schemas/frontmatter/frontmatter.schema.json` in November 2025 for better organization. + +If you encounter broken references, update them to the new path: + +```diff +- $schema: "schemas/frontmatter.schema.json" ++ $schema: "schemas/frontmatter/frontmatter.schema.json" +``` + +## Resources + +- [JSON Schema Specification](https://json-schema.org/specification.html) +- [AJV Documentation](https://ajv.js.org/) +- [YAML Specification](https://yaml.org/spec/) +- [LightSpeed Frontmatter Conventions](../../docs/CHATMODE-FRONTMATTER.md) +- [Frontmatter Instructions](../../.github/instructions/frontmatter.instructions.md) + +## Support + +For questions or issues: + +1. Check [GitHub Discussions](https://github.com/orgs/lightspeedwp/discussions) +2. Review [CHATMODE-FRONTMATTER.md](../../docs/CHATMODE-FRONTMATTER.md) +3. Reference [frontmatter.instructions.md](../../.github/instructions/frontmatter.instructions.md) +4. Open an issue following the [issue template](../../.github/ISSUE_TEMPLATE/) + +--- + +**Maintainer**: LightSpeed Team +**Last Updated**: 2025-11-12 +**Version**: 1.0 diff --git a/schemas/frontmatter/examples/agent.example.md b/schemas/frontmatter/examples/agent.example.md new file mode 100644 index 0000000000..242a6e99a6 --- /dev/null +++ b/schemas/frontmatter/examples/agent.example.md @@ -0,0 +1,70 @@ +--- +$schema: "../frontmatter.schema.json" +file_type: "agent" +name: "example-security-agent" +description: "Example agent that performs WordPress security audits and recommends fixes" +version: "v1.0.0" +last_updated: "2025-11-12" +owners: ["lightspeedwp/security-team"] +status: "active" +category: "security" +domain: "security" +stability: "stable" +tags: ["security", "audit", "wordpress", "owasp"] +labels: ["security", "wordpress", "automated"] +references: + - path: "../../docs/SECURITY.md" + description: "Security guidelines and policies" + - path: "../../.github/instructions/coding-standards.instructions.md" + description: "Coding standards including security requirements" + - path: "../frontmatter.schema.json" + description: "Frontmatter schema definition" +--- + +# Example Security Agent + +This is an example agent specification showing proper frontmatter structure. + +## Purpose + +This agent performs comprehensive security audits on WordPress codebases, checking for: + +- SQL injection vulnerabilities +- XSS vulnerabilities +- CSRF protection +- Input validation and sanitization +- Output escaping +- Authentication and authorization +- Nonce verification +- Capability checks + +## Usage + +```bash +# Trigger via GitHub Copilot +@agent example-security-agent audit this file for security issues +``` + +## Expected Behavior + +1. Scans the specified files or codebase +2. Identifies potential security vulnerabilities +3. Provides specific recommendations for fixes +4. References WordPress Coding Standards and OWASP guidelines +5. Generates a security report + +## Output Format + +The agent produces a markdown report with: + +- Executive summary +- Detailed findings by severity (Critical, High, Medium, Low) +- Code snippets showing vulnerabilities +- Recommended fixes with code examples +- References to security best practices + +## Related + +- [WordPress Security Guidelines](https://developer.wordpress.org/apis/security/) +- [OWASP Top 10](https://owasp.org/www-project-top-ten/) +- [Security Instructions](../../.github/instructions/security.instructions.md) diff --git a/schemas/frontmatter/examples/instruction.example.md b/schemas/frontmatter/examples/instruction.example.md new file mode 100644 index 0000000000..40c5d4d7b3 --- /dev/null +++ b/schemas/frontmatter/examples/instruction.example.md @@ -0,0 +1,98 @@ +--- +$schema: "../frontmatter.schema.json" +file_type: "instructions" +title: "WordPress REST API Security Instructions" +description: "Security guidelines for WordPress REST API development including authentication, authorization, input validation, and output sanitization" +version: "v1.0.0" +last_updated: "2025-11-12" +author: "LightSpeed Security Team" +maintainer: "Ash Shaw" +applyTo: + - "includes/api/**/*.php" + - "includes/rest/**/*.php" +mode: "agent" +domain: "security" +stability: "stable" +tags: ["security", "rest-api", "validation", "wordpress"] +references: + - path: "../../docs/SECURITY.md" + description: "Main security documentation" + - path: "./coding-standards.instructions.md" + description: "WordPress coding standards" + - path: "../frontmatter.schema.json" + description: "Frontmatter schema definition" +--- + +# WordPress REST API Security Instructions + +This is an example instructions file showing proper frontmatter structure for applying security guidelines to specific file patterns. + +## Purpose + +Ensure all WordPress REST API endpoints follow security best practices. + +## Required Security Measures + +### 1. Authentication + +All custom REST API endpoints MUST implement proper authentication: + +```php +register_rest_route('myplugin/v1', '/secure-endpoint', [ + 'methods' => 'POST', + 'callback' => 'my_secure_callback', + 'permission_callback' => 'my_permission_check', // Required! +]); +``` + +### 2. Authorization + +Check user capabilities before processing: + +```php +function my_permission_check() { + return current_user_can('edit_posts'); +} +``` + +### 3. Input Validation + +Validate all input parameters: + +```php +'args' => [ + 'id' => [ + 'required' => true, + 'validate_callback' => function($param) { + return is_numeric($param); + }, + 'sanitize_callback' => 'absint', + ], +], +``` + +### 4. Nonce Verification + +For sensitive operations, verify nonces: + +```php +if (!wp_verify_nonce($_REQUEST['_wpnonce'], 'my_action')) { + return new WP_Error('invalid_nonce', 'Security check failed', ['status' => 403]); +} +``` + +## Checklist + +- [ ] Permission callback defined (not `__return_true`) +- [ ] User capabilities checked +- [ ] Input validated and sanitized +- [ ] Output escaped if returning HTML +- [ ] Nonces verified for state-changing operations +- [ ] Rate limiting considered for public endpoints +- [ ] Error messages don't leak sensitive information + +## References + +- [REST API Handbook](https://developer.wordpress.org/rest-api/) +- [WordPress Security](https://developer.wordpress.org/apis/security/) +- [OWASP API Security](https://owasp.org/www-project-api-security/) diff --git a/schemas/frontmatter/examples/prompt.example.md b/schemas/frontmatter/examples/prompt.example.md new file mode 100644 index 0000000000..ebb6c258db --- /dev/null +++ b/schemas/frontmatter/examples/prompt.example.md @@ -0,0 +1,140 @@ +--- +$schema: "../frontmatter.schema.json" +file_type: "prompt" +title: "Generate WordPress Block Pattern" +description: "Prompt for generating WordPress block patterns from design specifications or descriptions" +version: "v1.0.0" +last_updated: "2025-11-12" +author: "LightSpeed Team" +mode: "edit" +model: "claude-sonnet-4.0" +domain: "wp-core" +stability: "stable" +tags: ["blocks", "patterns", "wordpress", "generation"] +tools: ["edit", "write", "read"] +references: + - path: "../../docs/BLOCK-PATTERNS.md" + description: "Block patterns documentation" + - path: "../../.github/instructions/pattern-development.instructions.md" + description: "Pattern development guidelines" + - path: "../frontmatter.schema.json" + description: "Frontmatter schema definition" +--- + +# Generate WordPress Block Pattern + +This is an example prompt specification showing proper frontmatter structure. + +## Prompt + +You are a WordPress block pattern generator. Given a design specification or description, create a WordPress block pattern following WordPress coding standards and best practices. + +## Requirements + +1. **Pattern Structure**: Follow WordPress block pattern registration format +2. **Accessibility**: Include proper ARIA labels and semantic HTML +3. **Responsiveness**: Use WordPress responsive utilities +4. **Internationalization**: Wrap user-facing strings in `__()` or `_e()` +5. **Naming**: Use kebab-case for pattern slugs +6. **Categories**: Assign to appropriate pattern categories + +## Expected Input + +User provides one of: + +- Design mockup or screenshot +- Text description of desired layout +- Example website or pattern to recreate +- Specific blocks and arrangement + +## Expected Output + +Generate: + +1. Pattern registration code (PHP) +2. Pattern metadata (title, description, categories, keywords) +3. Block markup with proper structure +4. Inline documentation + +## Example + +**User Input:** +> Create a hero section with a heading, paragraph, and button in two columns + +**Assistant Output:** + +```php + + +