feat: responsive image + theme signing + migrate CLI + CI refine + WP migration verification - #487
Merged
Merged
Conversation
Renders a `<picture>` with one `<source>` per format (AVIF first, then
WebP, then JPEG/PNG fallbacks) and a fallback `<img>` so capable
browsers pick the modern format while older clients fall through.
Pairs with packages/go/media/imageproc/srcset.go on the server side —
accepts the same wire shape (PictureSource = { srcset, type }) that
the media API emits alongside the canonical src.
Two ergonomic call sites:
- sources={variants} - full payload from the API
- widths={[256,1024]} - convenience for migrators (synthesises a
`?w=N` srcset)
Defaults to loading=lazy + decoding=async; priority flips both for
above-the-fold paints. Includes width/height passthrough so the
browser can reserve the layout space and avoid CLS.
Closes #47
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: Tayeb Mokni <tayeb.mokni@gmail.com>
New .github/workflows/theme-publish.yml mirrors the plugin signing flow from #130. On a tag push of `theme/<slug>/vX.Y.Z` the workflow builds a zipped theme bundle, signs it with cosign keyless (Fulcio OIDC binds the signature to the workflow's identity), and attaches the bundle + signature + cert chain to the GitHub release. Themes are simpler than plugins — no WASM, no capability surface to diff — so the pipeline is leaner, but the chain of trust is identical: operators verify with `cosign verify-blob` against the workflow OIDC issuer before installing. Closes #139 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: Tayeb Mokni <tayeb.mokni@gmail.com>
The remaining migrate CLI subcommand from #231. `up`, `down`, `status`, `wp`, `verify`, and `replacements` were already in place; this adds a `to <version>` command that migrates up or down to reach a specific schema version (matching the migration filename prefix). Implementation: - packages/go/migrate.To(ctx, cfg, logger, target) wraps migrate.Migrate(target) under the same advisory lock used by Run/Down/Status so concurrent boots from multiple replicas serialise correctly. - target=0 is rejected — to roll back ALL migrations, use `migrate down 0` where the destructive intent is explicit. - CLI parses the positional arg as a non-zero positive integer (matches the NNNNNN_*.{up,down}.sql filename convention). Tests cover the validation surface (zero target, missing arg, extra args, non-numeric input) at both the package and CLI layers. Closes #231 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: Tayeb Mokni <tayeb.mokni@gmail.com>
Refine the CI workflow per #254. Path-filter granularity was already in place (the changes job at the top scopes go/web/docs/dashboards/ openapi to relevant subtrees); this builds on that with: - **Test sharding**: split go test into 2 shards by partitioning the workspace's first-party modules deterministically across two runners. Sharding by module (not by test) keeps the per-shard setup cost amortised — each shard syncs the workspace once. - **Coverage gate**: each shard writes per-module atomic-mode coverage profiles; a follow-up `test-go-coverage` job downloads them, merges into a single profile, and fails the build if the project-wide total drops below 80%. The coverage gate is `continue-on-error: true` so it doesn't block PRs while the codebase catches up to the threshold — same pattern as `bundle-budget`. A follow-up issue will flip it to required on the branch protection rule once we're consistently green. Closes #254 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: Tayeb Mokni <tayeb.mokni@gmail.com>
14 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #47, #139, #174, #192, #199, #231, #254.
Summary
apps/web/src/components/responsive-image/with<ResponsiveImage src alt sizes [sources|widths]>using<picture>+srcset. Pairs with the wire shape emitted bypackages/go/media/imageproc/srcset.go(PictureSource = { srcset, type })..github/workflows/theme-publish.yml; mirrors the plugin signing flow from Plugin signing pipeline (cosign / Sigstore) #130. On atheme/<slug>/vX.Y.Ztag push, zips the theme, cosign-keyless-signs (Fulcio OIDC), attaches bundle + signature + cert chain to the GitHub release.packages/go/migrate/shortcode/provides the parser, map/preserve/strip modes viaprocess.go, and 6 built-in translators registered viaRegisterDefaults().packages/go/migrate/urlrewrite/provides the WP media URL rewriter for post content.packages/go/migrate/importer/roles.goprovidesRoleMapperwith WP built-in slugs → GoNext Role values plus--role-mapoverrides.status,down N,verify, andwp <wxr-file>already shipped. Added the remaininggonext migrate to <version>subcommand backed bypackages/go/migrate.To(under the same advisory lock used by Run/Down/Status). Rejects target=0 — destructive intent must go throughmigrate down 0.test-go-coveragejob that merges profiles and enforces an 80% project-wide gate (advisory until the codebase catches up, same pattern asbundle-budget).Test plan
apps/webtypecheck passesvitest run responsive-image— 12 / 12 passgo test ./migrate/— pkgmigrate tests pass (To zero-target validation included)go test ./cli/gonext/cmd/migrate/— CLI tests pass (to-subcommand validation included)python3 -c 'import yaml; yaml.safe_load(...)'on both workflow files