Chore/consistency remediation

.github/workflows/audit.yml

@@ -16,6 +16,6 @@ jobs:
   audit:
     name: Audit
     # npm gate audits production deps only — the dev-tooling graph (wp-scripts/playwright trees) is advisory via dependabot alerts.
-    uses: ahegyes/wordpress-configs/.github/workflows/reusable-supply-chain-audit.yml@714fc2a66d6ae5011999beb18a4b01fb1992f4bd
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-supply-chain-audit.yml@4214abd176545fe11f90ce6a449f8fc3fd7a9315
     with:
       npm-audit-flags: '--omit=dev --audit-level=high'

.github/workflows/codeql.yml

@@ -16,8 +16,9 @@ permissions: {}
 
 jobs:
   analyze:
+    name: CodeQL
     permissions:
       actions: read
       contents: read
       security-events: write
-    uses: ahegyes/wordpress-configs/.github/workflows/reusable-codeql.yml@714fc2a66d6ae5011999beb18a4b01fb1992f4bd
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-codeql.yml@4214abd176545fe11f90ce6a449f8fc3fd7a9315

.github/workflows/php-syntax.yml

@@ -1,9 +1,8 @@
 name: PHP Syntax
 
 # Parse-lints the pre-autoload bootstrap package across its full PHP floor so a
-# modern-syntax token can't slip in and parse-fatal on a legacy runtime — the
-# one place that would defeat the package's graceful-degradation job. index.php
-# guards are excluded on purpose: they may fatal on a stray direct hit.
+# modern-syntax token can't slip in and parse-fatal on a legacy runtime (index.php
+# guards excluded — their strict_types declare doesn't parse below PHP 7).
 
 on:
   push:

.github/workflows/quality.yml

@@ -10,6 +10,7 @@ permissions:
 
 jobs:
   lint-php:
-    uses: ahegyes/wordpress-configs/.github/workflows/reusable-php-lint.yml@714fc2a66d6ae5011999beb18a4b01fb1992f4bd
+    name: Lint PHP
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-php-lint.yml@4214abd176545fe11f90ce6a449f8fc3fd7a9315
     with:
       scripts: '["lint:php:phpcs", "lint:php:phpstan", "lint:php:deptrac", "lint:php:composer-require-checker", "changelog:validate"]'

.github/workflows/split-packages.yml

@@ -27,16 +27,12 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
-          # Don't install the credential helper that auths as github-actions[bot].
-          # We push to the split repos via PAT embedded in the URL — the helper
-          # would otherwise hijack the auth and fail with 403.
+          # The default credential helper would hijack the PAT-in-URL push auth and fail with 403.
           persist-credentials: false
 
       - name: Install splitsh-lite
         run: |
-          # v1.0.1 (2017) is the latest splitsh-lite release with a published
-          # linux/amd64 binary; v2.0.0 was tagged in 2023 with no assets attached.
-          # The tool's `--prefix` behavior hasn't materially changed since v1.
+          # v1.0.1 is the latest splitsh-lite release with a published linux/amd64 binary (v2.0.0 was tagged with no assets).
           curl -fsSL -o splitsh.tar.gz https://github.com/splitsh/lite/releases/download/v1.0.1/lite_linux_amd64.tar.gz
           # sha256 computed from the v1.0.1 release asset (upstream publishes no checksums — trust-on-first-use pin).
           echo "2539301ce5e21d0ca44b689d0dd2c1b20d9f9e996c1fe6c462afb8af4e7141cc  splitsh.tar.gz" | sha256sum -c -

.github/workflows/tests-mutation.yml

@@ -42,7 +42,7 @@ jobs:
 
   infection-integration:
     name: Run Infection (Integration)
-    uses: ahegyes/wordpress-configs/.github/workflows/reusable-phpunit.yml@7c1ef45c6be4cffdea69b05e855ec0c03e51166c
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-phpunit.yml@4214abd176545fe11f90ce6a449f8fc3fd7a9315
     with:
       php-version: '8.5'
       composer-script: 'test:integration:mutation'

.github/workflows/tests.yml

@@ -12,7 +12,7 @@ permissions:
 jobs:
   unit:
     name: Unit
-    uses: ahegyes/wordpress-configs/.github/workflows/reusable-phpunit.yml@714fc2a66d6ae5011999beb18a4b01fb1992f4bd
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-phpunit.yml@4214abd176545fe11f90ce6a449f8fc3fd7a9315
     with:
       php-version: '8.5'
       composer-script: 'test:unit'
@@ -28,14 +28,12 @@ jobs:
           - label: 'WP 7.0 (floor)'
             php-version: '8.5'
             wp-env-core: 'WordPress/WordPress#tags/7.0'
-          # Graceful-failure path: WP 6.9.4 is below the framework's 7.0 floor.
-          # Exercises check_requirements returning WP_Error with
-          # plugin_wp_incompatible. Validates that the framework correctly
-          # blocks plugin init on an incompatible WP runtime.
+          # Graceful-failure path: WP 6.9.4 is below the framework's 7.0 floor,
+          # so check_requirements must block init with plugin_wp_incompatible.
           - label: 'WP 6.9.4 (below floor)'
             php-version: '8.5'
             wp-env-core: 'WordPress/WordPress#tags/6.9.4'
-    uses: ahegyes/wordpress-configs/.github/workflows/reusable-phpunit.yml@714fc2a66d6ae5011999beb18a4b01fb1992f4bd
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-phpunit.yml@4214abd176545fe11f90ce6a449f8fc3fd7a9315
     with:
       php-version: ${{ matrix.php-version }}
       wp-env-core: ${{ matrix.wp-env-core }}

.github/workflows/workflow-checks.yml

@@ -20,8 +20,9 @@ permissions: {}
 
 jobs:
   checks:
+    name: Workflow Checks
     permissions:
       contents: read
       security-events: write
       actions: read
-    uses: ahegyes/wordpress-configs/.github/workflows/reusable-workflow-checks.yml@714fc2a66d6ae5011999beb18a4b01fb1992f4bd
+    uses: ahegyes/wordpress-configs/.github/workflows/reusable-workflow-checks.yml@4214abd176545fe11f90ce6a449f8fc3fd7a9315