chore: make the PHPCS ruleset runnable and gate changed files in CI

[arifulhoque7]

The committed .phpcs.xml.dist was the stock WPCS scaffold, never adapted to this plugin: prefixes and text_domain both left as my-plugin, testVersion 5.3-, WordPress floor 4.6. On WPCS 3.x it does not even start:

ERROR: Referenced sniff "WordPress.VIP" does not exist.

WordPress.VIP was removed in WPCS 2.0. No workflow ran PHPCS either, so the standard has never actually been enforced in this repo.

The ruleset

Renamed to phpcs.xml.dist and rewritten to follow the WPUF rulesets, so the four weDevs plugins look the same: same shape, same severity-0 list, with the weDocs text domain and WeDevs\WeDocs prefix and the real floors from the plugin header (testVersion 7.4-, WP 6.6).

Two deliberate choices:

Space indentation is excluded. A plain WordPress ruleset reports 92.7% of its findings as one sniff, Generic.WhiteSpace.DisallowSpaceIndent. This plugin is indented with four spaces. Enforcing tabs would rewrite every line and throw away the blame history, which is not worth it for a formatting preference. WPUF made the same call.

Escaping stays ON. Both WPUF rulesets set WordPress.Security.EscapeOutput.OutputNotEscaped to severity 0. I kept it as an error here. It is the sniff that found the unescaped output in the Elementor widgets PR (wedocs-plugin#324, 35 hits), and silencing it is how that ships unnoticed.

CI gates changed files only

.github/workflows/phpcs.yml mirrors the WPUF Inspections workflow: on: pull_request, cs2pr --graceful-warnings for inline annotations, and the changed-file list from the PR files API. The rest of the plugin still carries legacy violations, so a full-tree run would fail every build and teach everyone to ignore the job.

Two small upgrades over the WPUF copy: actions/checkout@v7 and actions/cache@v4 instead of @v2 and the third-party pat-s/always-upload-cache@v1.1.4, and ?per_page=100 on the files API so a large PR is not silently truncated at 30.

One divergence, with a reason

The tools are installed into $RUNNER_TEMP, not the plugin's own vendor/.

weDocs lists includes/functions.php in composer's autoload.files, and that file calls WordPress functions at file scope (wedocs_is_plugin_active() at :397, add_action at :583 and :584, add_filter at :613). PHPCS includes vendor/autoload.php when it exists, so installing the tooling in the plugin's own vendor/ makes phpcs fatal before it lints anything:

PHP Fatal error:  Uncaught Error: Call to undefined function add_action()
  in includes/functions.php:590
#2 vendor/squizlabs/php_codesniffer/autoload.php(83): include('vendor/autoload.php')

The fix is a one-line if ( ! defined( 'ABSPATH' ) ) { return; } guard at the top of that file, which I verified locally: with it, composer install runs the dealerdirect installer, installed_paths is set, and phpcs -i lists the WordPress standards.

I deliberately left that guard out of this PR. Adding it makes this PR touch includes/functions.php, which then falls under the new gate, and that file reports 44 non-formatting violations including unslashed $_SERVER reads in wedocs_get_client_ip(), unescaped output, and missing nonce checks. Those need their own review, not a ride-along in a tooling change. Filed as weDevsOfficial/wedocs-pro#420 with the full list and the order to do it in.

WPUF is unaffected by this: neither WPUF repo has an autoload.files entry. weDocs Pro has one but its functions.php has no file-scope calls, so weDevsOfficial/wedocs-pro#419 uses vendor/bin/phpcs normally.

Verified

This PR changes no PHP, so its own inspection run reports nothing to check.

Locally, against the files this release touches:

$ phpcs -q --report=summary includes/Admin.php includes/Assets.php \
    includes/Admin/ChangelogUpsell.php includes/Admin/GlossaryUpsell.php wedocs.php
A TOTAL OF 109 ERRORS AND 10 WARNINGS WERE FOUND IN 4 FILES
PHPCBF CAN FIX 102 OF THESE SNIFF VIOLATIONS AUTOMATICALLY

Related: weDevsOfficial/plugin-internal-tasks#9, weDevsOfficial/wedocs-pro#419, weDevsOfficial/wedocs-pro#420

https://claude.ai/code/session_019wvVjJ8agR8TWAVrrKVESH