Reducing the Plugin Review team’s workload through automation

To help the PluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party Review team make the most of their contribution time and improve the security of all plugins distributed on WordPress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/, MetaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress. team contributors have built a code scanner that detects potential security risks such as unescaped SQL queries in plugin code. This is installed as a plugin on WordPress.org, and displays results in a metaboxMetabox A post metabox is a draggable box shown on the post editing screen. Its purpose is to allow the user to select or enter information in addition to the main post content. This information should be related to the post in some way. on the plugin edit screen accessible to reviewers.

The Plugin Review team has been sharing feedback on the quality of the results, which has let Meta contributors to refine the tool to improve the noise-to-signal ratio that makes any automated checker a challenge.

Looking forward, our teams are discussing how often to run this scan (probably every time a new version of a plugin is detected), and how to semi-automate informing plugin authors about the results of the scans.

We’re excited that the Plugin Review team finds this tool useful, and that we’re making progress toward one of our Big Picture Goals for 2021 by decreasing manual work for contributor teams through better tooling.

If you’re a plugin developer and would like to help test the scanner on your own code, it’s available on GitHub.

Many thanks to the Plugin Review team for making the time to test and share the feedback that made this tooling improvement possible!

#plugins

Robin W 1:15 pm on February 19, 2021

This is really good, and good news for WordPress.

I am a simple developer of 6 published plugins and various private ones. But I know nothing of GIThubGitHub GitHub is a website that offers online implementation of git repositories that can can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged be the repository owner. https://github.com/, cloning or what composer install is – I just do PHPPHP PHP (recursive acronym for PHP: Hypertext Preprocessor) is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. http://php.net/manual/en/intro-whatis.php. and some basic JS 🙂

It would be great if this tool were available to run on wordpress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/ for devs like me – you say it is available for reviewers, so I presume we can’t get access ? It would be great to be able to run it against trunk in my svn repository.

I appreciate that there is probably a ton of work to achieve that !
- Tellyworth 12:06 am on February 22, 2021
  It’s pretty easy to run it against local code on your development box. In a nutshell, assuming you have git and composer command line tools installed and available:
  - git clone https://github.com/WordPress/wporg-code-analysis
  - cd wporg-code-analysis
  - composer install
  - bin/scan-dir.sh /path/to/local/trunk
  We do plan to integrate it in some way on wordpress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/ but it’ll take us a little while to figure out the details.
  - Robin W 6:16 pm on February 22, 2021
    
    hey thanks for the great reply – I’ll have a look at doing this 🙂
derekherman 6:59 pm on February 19, 2021

This looks really interesting and potentially something Tide could run when a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party is updated. We are currently focused on PHPPHP PHP (recursive acronym for PHP: Hypertext Preprocessor) is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. http://php.net/manual/en/intro-whatis.php. Compatibility for v1.0.0 but could add this as a fast follow for the next version. However, ideally the MinimalPluginStandard PHPCSPHP Code Sniffer PHP Code Sniffer, a popular tool for analyzing code quality. The WordPress Coding Standards rely on PHPCS. standard would be decoupled from the other code and moved to a different repository so it could be installed as a standard in a more traditional way.
- Tellyworth 12:10 am on February 22, 2021
  
  It is bundled into a WordPress pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party in the repo, but the codesniffer part is decoupled and runs in isolation (unless I’ve missed something). After composer install, this works as expected, with no WP site or codebase required:
  
  phpcs --standard=./MinimalPluginStandard /path/to/some/code
  
  There’s a simple shell script wrapper in bin that basically does exactly that.
Duy Mai 2:42 am on February 23, 2021

https://make.wordpress.org/support/2021/02/support-ticket-triage-session/#comment-173223

WordPress.org

Welcome to the MetaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress. Team!

Contact

Reducing the Plugin Review team’s workload through automation

WordPress.org

Welcome to the MetaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress. Team!

Contact

Share this: