Procore Connect 2.0.0 — rewrite as a standards-compliant WordPress plugin

.distignore

@@ -0,0 +1,20 @@
+/.git
+/.github
+/.claude
+/.wordpress-org
+/docs
+/tests
+/node_modules
+/vendor/bin
+/build
+.distignore
+.editorconfig
+.gitattributes
+.gitignore
+composer.json
+composer.lock
+phpcs.xml.dist
+phpunit.xml.dist
+CONTRIBUTING.md
+SECURITY.md
+CODE_OF_CONDUCT.md

.editorconfig

@@ -0,0 +1,16 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = tab
+
+[*.{md,yml,yaml,json}]
+indent_style = space
+indent_size = 2
+
+[*.txt]
+indent_style = space
+indent_size = 4

.gitattributes

@@ -0,0 +1,11 @@
+* text=auto eol=lf
+
+/.github        export-ignore
+/docs           export-ignore
+/tests          export-ignore
+/.distignore    export-ignore
+/.editorconfig  export-ignore
+/.gitattributes export-ignore
+/.gitignore     export-ignore
+/phpcs.xml.dist export-ignore
+/phpunit.xml.dist export-ignore

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,75 @@
+name: Bug report
+description: Something is not working as documented
+labels: [ "bug" ]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before filing, please run **Procore → Connection → Test connection**. It reports
+        each stage separately and probes every endpoint, which identifies most problems
+        in one click.
+
+        **Never paste real credentials into a public issue.** For a security problem, use
+        [private reporting](https://github.com/ibuilder/ProcoreWP/security/advisories/new)
+        instead.
+
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened
+      description: What did you expect, and what did you get instead?
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Add [procore_rfis id="123"] to a page
+        2. View the page as a logged-out visitor
+        3. …
+    validations:
+      required: true
+
+  - type: input
+    id: shortcode
+    attributes:
+      label: The shortcode or block involved
+      placeholder: '[procore_rfis id="123" status="open"]'
+
+  - type: textarea
+    id: doctor
+    attributes:
+      label: Output of `wp procore-connect doctor`
+      description: >
+        Reports whether credentials are set without printing them, so it is safe to
+        share. If WP-CLI is unavailable, paste the **Procore → Status** table instead.
+      render: shell
+
+  - type: textarea
+    id: probes
+    attributes:
+      label: Connection test results
+      description: >
+        Which stages and which endpoint probes failed? Redact any account names you would
+        rather not publish.
+      render: shell
+
+  - type: input
+    id: versions
+    attributes:
+      label: Versions
+      placeholder: 'Procore Connect 2.0.0, WordPress 6.9, PHP 8.2'
+    validations:
+      required: true
+
+  - type: checkboxes
+    id: confirmations
+    attributes:
+      label: Before submitting
+      options:
+        - label: I ran the connection test and the failure is not a missing Procore tool permission
+        - label: I checked the page as an administrator, where the real error message is shown
+        - label: This report contains no real credentials
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Documentation
+    url: https://ibuilder.github.io/ProcoreWP/
+    about: Installation, authentication, the shortcode reference and troubleshooting.
+  - name: Report a security vulnerability
+    url: https://github.com/ibuilder/ProcoreWP/security/advisories/new
+    about: Please report privately rather than opening a public issue.
+  - name: Procore API documentation
+    url: https://developers.procore.com/documentation/introduction
+    about: For questions about the Procore API itself rather than this plugin.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,38 @@
+name: Feature request
+description: Suggest a capability or a new Procore endpoint
+labels: [ "enhancement" ]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What are you trying to do?
+      description: Describe the goal, not just the feature. It often points at a simpler answer.
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What would you like Procore Connect to do?
+    validations:
+      required: true
+
+  - type: input
+    id: endpoint
+    attributes:
+      label: Procore endpoint, if this is about new data
+      placeholder: 'GET /rest/v1.0/projects/{project_id}/meetings'
+
+  - type: markdown
+    attributes:
+      value: |
+        If you only need one extra endpoint, you may not need to wait for a release —
+        `procore_connect_endpoints` registers one from a small snippet in your theme or a
+        site plugin. See
+        [the shortcode reference](https://ibuilder.github.io/ProcoreWP/shortcodes/#the-generic-reader).
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: What have you tried?
+      description: Filters, template overrides, `[procore_data]`, or another plugin.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,31 @@
+## What this changes
+
+<!-- What does this do, and why is it needed? -->
+
+## Type of change
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Breaking change
+- [ ] Documentation
+- [ ] Maintenance / tooling
+
+## Checks
+
+- [ ] `composer run syntax` passes
+- [ ] `composer run lint` passes with no errors and no warnings
+- [ ] `composer run test` passes
+- [ ] Added or updated tests for the behaviour this changes
+- [ ] Updated `CHANGELOG.md`
+- [ ] Updated `readme.txt` and `docs/` if user-facing behaviour changed
+
+## If this touches the API layer
+
+- [ ] New endpoints are registered in `src/Api/Endpoints.php` with their required Procore permission
+- [ ] `'public' => true` is only set on endpoints whose payload is safe to publish
+- [ ] Output goes through `Format::cell()` or an explicit `esc_*` call
+- [ ] Procore error messages are not exposed to non-administrators
+
+## Testing done
+
+<!-- What did you verify, and how? Note if you tested against a real Procore account. -->

.github/workflows/pages.yml

@@ -0,0 +1,63 @@
+name: Documentation
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - 'docs/**'
+      - '.github/workflows/pages.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Let an in-progress deployment finish rather than cancelling it mid-publish.
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build the documentation site
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Configure Pages
+        id: pages
+        uses: actions/configure-pages@v5
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.3'
+          bundler-cache: true
+          working-directory: docs
+
+      - name: Build with Jekyll
+        run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}"
+        working-directory: docs
+        env:
+          JEKYLL_ENV: production
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: docs/_site
+
+  deploy:
+    name: Deploy to GitHub Pages
+    needs: build
+    runs-on: ubuntu-latest
+
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+
+    steps:
+      - name: Deploy
+        id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/phpcs.yml

@@ -0,0 +1,58 @@
+name: Coding Standards
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  phpcs:
+    name: PHPCS (WordPress-Extra + WordPress-Docs)
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '7.4'
+          coverage: none
+          tools: composer:v2
+
+      - name: Install dependencies
+        uses: ramsey/composer-install@v3
+
+      - name: Run PHPCS
+        run: ./vendor/bin/phpcs --report=full --report-checkstyle=phpcs-report.xml
+
+      - name: Annotate results
+        if: failure()
+        run: ./vendor/bin/phpcs --report=emacs || true
+
+  syntax:
+    name: PHP syntax (${{ matrix.php }})
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        php: [ '7.4', '8.0', '8.1', '8.2', '8.3', '8.4' ]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: none
+
+      - name: Lint every PHP file
+        run: |
+          find . -path ./vendor -prune -o -name '*.php' -print0 \
+            | xargs -0 -n1 -P4 php -l

.github/workflows/plugin-check.yml

@@ -0,0 +1,49 @@
+name: Plugin Check
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  plugin-check:
+    name: WordPress Plugin Check
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.2'
+          coverage: none
+          tools: composer:v2
+
+      # Build the distributable exactly as the release workflow does, so the
+      # check runs against what users actually install — not the dev tree.
+      - name: Stage the distributable
+        run: |
+          mkdir -p build/procore-connect
+          rsync -a --exclude-from=.distignore \
+            --exclude='.git' --exclude='build' --exclude='vendor' \
+            ./ build/procore-connect/
+          echo "Staged files:"
+          find build/procore-connect -type f | sort
+
+      - name: Run Plugin Check
+        uses: wordpress/plugin-check-action@v1
+        with:
+          build-dir: ./build/procore-connect
+          # Target zero findings. Remove nothing from this list without a
+          # documented reason in the pull request.
+          categories: |
+            general
+            plugin_repo
+            security
+            performance
+            accessibility