You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
-**Forms:**`wp_nonce_field()` + `wp_verify_nonce()` for CSRF protection
26
+
-**Permissions:**`current_user_can()` before any sensitive operation
27
+
-**Database:**`$wpdb->prepare()` for all direct queries; prefer WooCommerce/WordPress APIs over raw SQL
28
+
-**Vulnerabilities to prevent:** SQL injection, XSS, CSRF, LFI, path traversal
29
+
- Auto-identify and fix security issues when found
27
30
28
-
1.**Security First:** Always sanitize input (`sanitize_*()`) and escape output (`esc_*()`)
29
-
2.**WordPress APIs:** Use WP functions instead of raw PHP/SQL
30
-
3.**Hook System:** Proper use of `add_action()` and `add_filter()`
31
-
4.**Internationalization:** Use `__()`, `_e()`, `esc_html__()` for all strings
32
-
5.**Performance:** Avoid N+1 queries, use WP caching, optimize database calls
31
+
## Code Quality
33
32
34
-
## 🔒 Security Requirements (Critical)
33
+
- Use WordPress APIs instead of raw PHP equivalents (e.g., `wc_get_products()` over `get_posts()` for products)
34
+
- Use WooCommerce HPOS-compatible APIs (no direct `wp_posts`/`wp_postmeta` queries for orders or products)
35
+
- Use `add_action()` / `add_filter()` with named methods (not anonymous closures) so hooks can be unhooked
36
+
- No inline styles in PHP or JS — use dedicated CSS files with proper classes
37
+
- Define magic numbers as named constants
38
+
- Use `WP_Error` for error handling; log errors via `wc_get_logger()` without exposing sensitive data
39
+
- PHPDoc all functions: `@param`, `@return`, `@since` tags
40
+
- Remove unused code; don't leave dead code behind
35
41
36
-
**Input Handling:**
37
-
- Use `sanitize_text_field()`, `sanitize_email()`, `wp_kses()` for user input
38
-
- Validate with `is_email()`, `absint()`, `wp_verify_nonce()` for security
39
-
- Use prepared statements for database queries (`$wpdb->prepare()`)
42
+
## Internationalization (i18n)
40
43
41
-
**Output Security:**
42
-
-Escape all output: `esc_html()`, `esc_attr()`, `esc_url()`, `esc_js()`
43
-
-Use `wp_nonce_field()` and `wp_verify_nonce()` for forms
44
-
-Check permissions with `current_user_can()`before sensitive operations
44
+
- Text domain: `free-gift-coupons-bulk-coupons-generator`
45
+
-All user-facing strings must use `__()`, `_e()`, `esc_html__()`, `esc_attr__()`, etc.
46
+
-Update `.pot` language files when adding or modifying translatable strings
47
+
-JS strings must be passed via `wp_localize_script()`or `wp_add_inline_script()`, never hardcoded
45
48
46
-
**Vulnerability Prevention:**
47
-
- Prevent SQL injection, XSS, CSRF, Local File Inclusion (LFI), and path traversal
48
-
- Follow principle of least privilege
49
-
- Auto-identify and fix security issues when found
49
+
## Performance
50
50
51
-
## 📝 Documentation & Versioning
51
+
- Use WordPress caching (`wp_cache_*()`, transients) with targeted invalidation hooks
52
+
- Avoid N+1 queries — use batch-fetching APIs
53
+
- Enqueue assets with `wp_enqueue_script()` / `wp_enqueue_style()` — load only on relevant admin pages
54
+
- Prefer `wc_get_products()` over `get_posts()` + `wc_get_product()` loops
52
55
53
-
**Changelog Management:**
54
-
- Always update CHANGELOG.md and readme.txt when making code changes
55
-
-**Sync both changelogs:** CHANGELOG.md and readme.txt changelog section
56
-
- Use "Unreleased" section for ongoing changes
56
+
## Documentation & Versioning
57
57
58
-
**Version Release Process (only when instructed):**
59
-
- Follow semantic versioning (MAJOR.MINOR.PATCH)
60
-
- Update version in: plugin header, README.md, readme.txt, CHANGELOG.md, GEMINI.md, and `.pot` language files, constants section, package.json, and composer.json
61
-
- Move "Unreleased" changes to new version section in both changelogs
62
-
-**Never auto-update versions** - wait for explicit instruction
58
+
- Always update both CHANGELOG.md and readme.txt changelog section — keep them in sync
59
+
- Use an "Unreleased" section for ongoing changes
60
+
-**Version releases (only when explicitly instructed):**
61
+
- Follow semantic versioning (MAJOR.MINOR.PATCH)
62
+
- Update version in: plugin header, README.md, readme.txt, CHANGELOG.md, GEMINI.md, `.pot` files, constants, and composer.json
63
+
- Move "Unreleased" entries to new version section in both changelogs
64
+
- Never auto-update versions
63
65
64
-
**Code Documentation:**
65
-
- Use PHPDoc with `@param`, `@return`, `@since` tags
66
-
- Write clear function/class descriptions
67
-
- Document security considerations and hooks used
66
+
## Workflow
68
67
69
-
**Internationalization (i18n):**
70
-
- Update `.pot` language files when adding or modifying translatable strings
71
-
- Always use the correct text domain when dealing with translation functions
72
-
- Mark all user-facing strings with `__()`, `_e()`, `esc_html__()`, `esc_attr__()`, etc.
73
-
74
-
## ⚡ Performance & Quality
75
-
76
-
**Performance Optimization:**
77
-
- Use WordPress caching (`wp_cache_*()`, transients)
78
-
- Optimize database queries, avoid N+1 problems
79
-
- Proper asset enqueueing with `wp_enqueue_*()` functions
80
-
- Focus on correctness first, then optimize
81
-
82
-
**Code Architecture:**
83
-
- Group by feature, not by type
84
-
- Use descriptive function/variable names
85
-
- Remove unused code automatically
86
-
- Follow feature-sliced design when applicable
87
-
88
-
**Error Handling:**
89
-
- Use `WP_Error` for WordPress-specific errors
90
-
- Log errors without exposing sensitive data
91
-
- Handle edge cases gracefully
92
-
- Validate all function parameters
93
-
94
-
## 🚀 Workflow & Automation
95
-
96
-
**Task Execution:**
97
-
- Make changes directly to existing files (don't create duplicates)
98
-
- Proceed automatically unless action is destructive
99
-
- Auto-identify and fix bugs when possible
100
-
- Only ask confirmation for data loss/deletion scenarios
101
-
102
-
**File Management:**
103
-
- Edit files in place (e.g., modify `admin.php` directly)
104
-
- Create new files only when truly necessary
105
-
- Avoid file duplication and unnecessary rewrites
106
-
- Maintain clean project structure
107
-
108
-
**Communication:**
109
-
- Provide concise, actionable responses
110
-
- Use clear formatting for readability
111
-
- Never create change summaries as separate .md files
112
-
- Focus on specific changes made, not verbose explanations
68
+
- Read complete files before modifying them — understand context first
69
+
- Edit files in place; create new files only when necessary
70
+
- Proceed automatically unless the action is destructive (data loss, deletion)
71
+
- Provide concise, actionable responses — no separate summary files
This PR updates the translation template (`.pot` file) based on recent code changes.
75
+
76
+
### What Changed
77
+
The following PHP and JavaScript source files had translatable strings added or modified:
78
+
79
+
```
80
+
${{ github.event.head_commit.message }}
81
+
```
82
+
83
+
### Next Steps
84
+
1. Review the changes in the `.pot` file
85
+
2. Approve and merge this PR
86
+
3. Translators can then use the updated `.pot` file with their translation tools
87
+
88
+
---
89
+
*This PR was automatically generated by the [Update Translation File](https://github.com/${{ github.repository }}/blob/main/.github/workflows/update-pot-file.yml) workflow.*
0 commit comments