ci: add WordPress.org deploy and PHP format workflows

.distignore

@@ -0,0 +1,26 @@
+# Files and folders excluded from the WordPress.org release (used by 10up/action-wordpress-plugin-deploy).
+/.git
+/.github
+/.wordpress-org
+/node_modules
+/tests
+/vendor
+/assets
+/docs
+
+.distignore
+.editorconfig
+.gitignore
+.gitattributes
+.DS_Store
+.phpunit.result.cache
+composer.json
+composer.lock
+package.json
+package-lock.json
+phpcs.xml
+phpunit.xml
+webpack.config.js
+README.md
+*.map
+*.zip

.github/dependabot.yml

@@ -0,0 +1,36 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "(chore)"
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      npm:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "(chore)"
+    versioning-strategy: lockfile-only
+
+  - package-ecosystem: "composer"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      composer:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "(chore)"
+    versioning-strategy: lockfile-only

.github/workflows/dependabot-automerge.yml

@@ -0,0 +1,9 @@
+name: Dependabot Automerge
+on: pull_request
+
+jobs:
+    dependabot-automerge:
+        # Composer PRs are merged by dependabot-vendor-prefixed.yml after vendor-prefixed/ is rebuilt.
+        if: ${{ !startsWith(github.head_ref, 'dependabot/composer/') }}
+        uses: yardinternet/workflows/.github/workflows/dependabot-automerge.yml@main
+        secrets: inherit

.github/workflows/dependabot-vendor-prefixed.yml

@@ -0,0 +1,71 @@
+name: Dependabot vendor-prefixed
+
+# Dependabot Composer PRs only change composer.lock. This rebuilds vendor-prefixed/ from the
+# updated lock file, pushes it to the PR branch and then merges the PR, so the shipped prefixed
+# code always matches composer.lock (the deploy workflow verifies this).
+on: pull_request
+
+# The reusable automerge workflow uses `${{ github.workflow }}-${{ github.ref }}` as its group,
+# and github.workflow keeps the caller's name there. The suffix keeps the groups apart, otherwise
+# the automerge job would cancel this run.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-rebuild
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  rebuild:
+    name: Rebuild vendor-prefixed
+    if: github.event.pull_request.user.login == 'dependabot[bot]' && startsWith(github.head_ref, 'dependabot/composer/')
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out PR branch
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ github.head_ref }}
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.1'
+          coverage: none
+          tools: composer
+
+      # The post-install scripts run Strauss and then remove vendor/.
+      - name: Rebuild vendor-prefixed
+        run: |
+          rm -rf vendor-prefixed
+          composer install --no-interaction --prefer-dist
+          if [ ! -f vendor-prefixed/autoload.php ]; then
+            echo "::error::vendor-prefixed/autoload.php was not generated."
+            exit 1
+          fi
+
+      # Strauss stamps every file with the build date. Revert files where that is the only change,
+      # so the commit only contains real dependency changes.
+      - name: Drop date-only changes
+        run: |
+          git diff --name-only -- vendor-prefixed | while read -r file; do
+            if git diff -I 'Modified by .* using' --quiet -- "$file"; then
+              git checkout -- "$file"
+            fi
+          done
+
+      # Pushes made with GITHUB_TOKEN do not trigger new workflow runs, so this cannot loop.
+      - name: Commit vendor-prefixed changes
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          commit_message: '(chore): update vendor prefixed directory'
+          file_pattern: 'vendor-prefixed'
+
+  # Composer PRs are skipped by the general automerge workflow, so they are merged here,
+  # only after vendor-prefixed/ has been pushed.
+  automerge:
+    name: Automerge
+    needs: rebuild
+    uses: yardinternet/workflows/.github/workflows/dependabot-automerge.yml@main
+    secrets: inherit

.github/workflows/format-php.yml

@@ -0,0 +1,51 @@
+name: Format PHP
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '**.php'
+      - 'phpcs.xml'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+
+jobs:
+  phpcbf:
+    name: phpcbf
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@v5
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.1'
+          coverage: none
+          tools: composer
+
+      # --no-scripts: the post-install scripts remove vendor/, which holds phpcbf.
+      - name: Install dependencies
+        run: composer install --no-interaction --prefer-dist --no-scripts
+
+      # phpcbf exits 1 when it fixed everything and 2 when unfixable violations remain;
+      # both are fine here, only 3 (processing error) should fail the job.
+      - name: Run phpcbf
+        run: composer run phpcbf || [ $? -le 2 ]
+
+      # Pushes made with GITHUB_TOKEN do not trigger new workflow runs, so this cannot loop.
+      - name: Commit formatting changes
+        uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          commit_message: 'style: apply phpcbf changes'
+          file_pattern: '*.php'
+          # Pass the pattern to git unexpanded so it matches PHP files in subdirectories too.
+          disable_globbing: true

.github/workflows/wordpress-org-deploy.yml

@@ -0,0 +1,117 @@
+name: Deploy to WordPress.org
+
+on:
+  push:
+    tags:
+      - "v*"
+      - "[0-9]*"
+  workflow_dispatch:
+    inputs:
+      dry-run:
+        description: 'Dry run: build and package, but do not commit to WordPress.org SVN'
+        type: boolean
+        default: true
+
+jobs:
+  deploy:
+    name: Deploy new tag
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@v5
+
+      - name: Check the version numbers
+        run: |
+          PLUGIN_VERSION=$(grep -m1 -E '^\s*\*\s*Version:' yard-deepl.php | awk '{print $NF}' | tr -d '\r')
+          STABLE_TAG=$(grep -m1 -E '^Stable tag:' readme.txt | awk '{print $NF}' | tr -d '\r')
+          README_STABLE_TAG=$(grep -m1 -E '^Stable tag:' README.md | awk '{print $NF}' | tr -d '\r')
+          echo "Plugin header: $PLUGIN_VERSION, readme.txt stable tag: $STABLE_TAG, README.md stable tag: $README_STABLE_TAG, ref: $GITHUB_REF_NAME"
+          if [ "$PLUGIN_VERSION" != "$STABLE_TAG" ]; then
+            echo "::error::Plugin header Version and readme.txt Stable tag must be equal."
+            exit 1
+          fi
+          if [ "$PLUGIN_VERSION" != "$README_STABLE_TAG" ]; then
+            echo "::error::Plugin header Version and README.md Stable tag must be equal."
+            exit 1
+          fi
+          if [ "$GITHUB_REF_TYPE" = "tag" ] && [ "${GITHUB_REF_NAME#v}" != "$PLUGIN_VERSION" ]; then
+            echo "::error::Tag must match the plugin header Version."
+            exit 1
+          fi
+          if [ "$GITHUB_REF_TYPE" != "tag" ] && [ "${{ inputs.dry-run }}" != "true" ]; then
+            echo "::error::A real deploy must run from a tag. Pick a tag under 'Use workflow from', or enable dry run."
+            exit 1
+          fi
+          # Used by the deploy action as the SVN tag name.
+          echo "VERSION=$PLUGIN_VERSION" >> "$GITHUB_ENV"
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.1'
+          coverage: none
+          tools: composer
+
+      # vendor-prefixed/ is committed and shipped as-is. Regenerate it from composer.lock and fail
+      # when it differs from the committed copy, so a Composer update (e.g. from Dependabot)
+      # can never ship without the matching prefixed code being committed first.
+      # The post-install scripts run Strauss and then remove vendor/, which the plugin never loads.
+      - name: Verify prefixed dependencies match composer.lock
+        run: |
+          COMMITTED="$RUNNER_TEMP/vendor-prefixed-committed"
+          mv vendor-prefixed "$COMMITTED"
+          composer install --no-interaction --prefer-dist
+          if [ ! -f vendor-prefixed/autoload.php ]; then
+            echo "::error::vendor-prefixed/autoload.php was not generated."
+            exit 1
+          fi
+          # Strauss stamps every file with the build date; ignore those lines.
+          if ! diff -r -I 'Modified by .* using' "$COMMITTED" vendor-prefixed; then
+            echo "::error::vendor-prefixed/ is out of date with composer.lock. Run 'composer install' locally and commit vendor-prefixed/."
+            exit 1
+          fi
+          # Ship exactly the committed files.
+          rm -rf vendor-prefixed
+          mv "$COMMITTED" vendor-prefixed
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Build assets
+        run: |
+          npm ci
+          npm run build
+
+      - name: WordPress plugin deploy
+        id: deploy
+        uses: 10up/action-wordpress-plugin-deploy@stable
+        with:
+          dry-run: ${{ inputs.dry-run == true }}
+        env:
+          SLUG: yard-deepl
+          SVN_USERNAME: ${{ secrets.SVN_USERNAME }}
+          SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }}
+
+      # Build the zip from this checkout instead of the action's generate-zip: when the SVN tag
+      # already exists (rerun), the action zips SVN trunk, which may hold a newer version.
+      - name: Build release zip
+        id: zip
+        run: |
+          BUILD_DIR="$RUNNER_TEMP/build"
+          mkdir -p "$BUILD_DIR/yard-deepl"
+          rsync -rc --exclude-from=.distignore ./ "$BUILD_DIR/yard-deepl/"
+          (cd "$BUILD_DIR" && zip -rq yard-deepl.zip yard-deepl)
+          echo "zip-path=$BUILD_DIR/yard-deepl.zip" >> "$GITHUB_OUTPUT"
+
+      - name: Create GitHub release
+        if: github.ref_type == 'tag' && inputs.dry-run != true
+        uses: softprops/action-gh-release@v2
+        with:
+          files: ${{ steps.zip.outputs.zip-path }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -8,4 +8,3 @@
 node_modules
 tests/coverage
 vendor
-vendor-prefixed

README.md

@@ -73,9 +73,11 @@ If you need to work with development dependencies, follow these steps:
 1. Run `composer install`. This will remove the `vendor` directory and create the `vendor-prefixed` directory.
 2. Run `composer install --no-scripts`. The `--no-scripts` flag prevents the automatic deletion of the `vendor` directory, allowing you to work with the development dependencies. Ensure that the `vendor-prefixed` directory is still present, as the plug-in relies on it.
 
+`vendor-prefixed` is committed to git. After changing Composer packages, commit `vendor-prefixed` together with `composer.lock`; the deploy stops when they don't match.
+
 ### Ready for releasing a new version?
 
-1. Run `composer install --optimize-autoloader`. This will optimize the autoloading rules by converting them into a class map, which improves performance and speeds up autoloading. It is particularly useful for production environments.
+See [docs/RELEASING.md](docs/RELEASING.md) for the release routine and how the GitHub workflows fit together.
 
 ## Usage