ENG-5451: Ship a Pressable DDEV provider add-on (ddev pull/push for local WordPress dev)

Client-side DDEV provider that syncs a Pressable WordPress site's database and
uploads to/from a local DDEV project over the site's existing SSH + WP-CLI +
rsync access (no Pressable API, no platform changes).

- providers/pressable.yaml — auth + pull (db export | gzip; rsync uploads) and
  push (capture remote URL, wp db import, wp search-replace back for siteurl+home,
  wp cache flush, rsync uploads; additive files).
- config.pressable.yaml — post-import-db hook rewrites prod URL -> local DDEV URL.
- install.yaml — add-on manifest (provider + config overlay, no service).
- tests/ + .github/workflows/tests.yml — install/structure bats smoke test (stable + HEAD).
- .github/workflows/release{,-on-merge}.yml + .github/scripts/release.rb — tag-driven
  and merge-driven release automation (Ruby version helper).
- README.md, .coderabbit.yaml, Apache 2.0 LICENSE.

Verified live end-to-end (pull + push, common + split-config) against a real
Pressable test site; CodeRabbit + Codex review addressed.

Author: paulhtrott

.coderabbit.yaml

@@ -0,0 +1,57 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+language: en-US
+early_access: false
+reviews:
+  profile: chill
+  request_changes_workflow: false
+  high_level_summary: true
+  review_status: true
+  poem: false
+  auto_review:
+    enabled: true
+    drafts: false
+  path_instructions:
+    - path: "providers/pressable.yaml"
+      instructions: |
+        This is a DDEV provider definition. Each *_command block is Bash that
+        runs inside DDEV's web container during `ddev pull` / `ddev push`.
+        Review for: correct SSH + WP-CLI + rsync usage; serialized-data-safe URL
+        rewriting via `wp search-replace` (never sed); and push safety (files
+        push is additive with no --delete, the DB push overwrites the remote and
+        is staging-only, and the post-import `wp cache flush` is required because
+        a raw `wp db import` bypasses the hosting platform's object cache). `${SSH}` and
+        `${EXPORT_ARGS}` are intentionally unquoted so they word-split into a
+        command plus its arguments — do not flag that as SC2086.
+    - path: "config.pressable.yaml"
+      instructions: |
+        DDEV config overlay merged into the project config. The post-import-db
+        hook rewrites the production URL to the local DDEV URL after a pull, via
+        `wp search-replace`. Review the hook's correctness and idempotency.
+    - path: ".github/scripts/release.rb"
+      instructions: |
+        A plain Ruby release helper. There is no Rails and no RuboCop config in
+        this repo, so review for correctness of the git-tag / semver logic and
+        shell-out safety, not Rails or RuboCop-style conventions.
+  tools:
+    shellcheck:
+      enabled: true
+    yamllint:
+      enabled: true
+    actionlint:
+      enabled: true
+    markdownlint:
+      enabled: true
+    languagetool:
+      enabled: true
+    gitleaks:
+      enabled: true
+    rubocop:
+      enabled: false
+    semgrep:
+      enabled: false
+    hadolint:
+      enabled: false
+    checkov:
+      enabled: false
+chat:
+  auto_reply: true

.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 4
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{bats,sh,yml,yaml}]
+indent_size = 2

.gitattributes

@@ -0,0 +1,5 @@
+# Exclude files from releases/tarballs
+tests/ export-ignore
+.github/ export-ignore
+.gitattributes export-ignore
+.editorconfig export-ignore

.github/scripts/release.rb

@@ -0,0 +1,88 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Cut a release for the ddev-pressable add-on.
+#
+# DDEV add-ons are versioned by git tags: `ddev add-on get pressable/ddev-pressable`
+# installs the latest GitHub release, which .github/workflows/release.yml publishes
+# automatically when a `vX.Y.Z` tag is pushed. This helper computes the next
+# version from the latest tag, then creates and pushes the annotated tag.
+#
+# Usage (run from the repo root):
+#   .github/scripts/release.rb            # patch bump (default): 1.2.3 -> 1.2.4
+#   .github/scripts/release.rb patch      # 1.2.3 -> 1.2.4
+#   .github/scripts/release.rb minor      # 1.2.3 -> 1.3.0
+#   .github/scripts/release.rb major      # 1.2.3 -> 2.0.0
+#   .github/scripts/release.rb 1.5.0      # explicit version
+#   .github/scripts/release.rb --dry-run minor
+
+require "open3"
+
+DEFAULT_BUMP = "patch"
+REMOTE = "origin"
+MAIN_BRANCH = "main"
+
+# Run a command, aborting with its output on failure.
+def run(*cmd)
+  out, status = Open3.capture2e(*cmd)
+  abort "command failed: #{cmd.join(' ')}\n#{out}" unless status.success?
+  out.strip
+end
+
+# Run a command, returning its (stripped) output and ignoring a non-zero exit.
+def capture(*cmd)
+  out, = Open3.capture2e(*cmd)
+  out.strip
+end
+
+dry_run = !ARGV.delete("--dry-run").nil?
+arg = ARGV.shift || DEFAULT_BUMP
+
+branch = run("git", "rev-parse", "--abbrev-ref", "HEAD")
+abort "Refusing to release from '#{branch}'; switch to '#{MAIN_BRANCH}' first." unless branch == MAIN_BRANCH
+
+abort "Working tree is dirty; commit or stash changes first." unless capture("git", "status", "--porcelain").empty?
+
+run("git", "fetch", "--tags", REMOTE)
+local = run("git", "rev-parse", "@")
+# `--verify --quiet` prints nothing and exits non-zero when there is no upstream
+# (e.g. CI's `git checkout -B main`), so the sync check is skipped rather than
+# tripping on the error text. Without it the check aborts whenever no upstream
+# tracking is configured.
+upstream = capture("git", "rev-parse", "--verify", "--quiet", "@{u}")
+abort "Local #{MAIN_BRANCH} is out of sync with #{REMOTE}; pull/push first." unless upstream.empty? || local == upstream
+
+# Pick the highest STRICT semver tag, ignoring any malformed `v*` tags
+# (e.g. `v1`, `vfoo`) that would otherwise crash the major.minor.patch split.
+latest = capture("git", "tag", "--list", "v*", "--sort=-v:refname")
+         .lines.map(&:strip)
+         .find { |t| t.match?(/\Av\d+\.\d+\.\d+\z/) }
+current = latest ? latest.sub(/\Av/, "") : "0.0.0"
+major, minor, patch = current.split(".").map(&:to_i)
+
+next_version =
+  case arg
+  when "major" then "#{major + 1}.0.0"
+  when "minor" then "#{major}.#{minor + 1}.0"
+  when "patch" then "#{major}.#{minor}.#{patch + 1}"
+  when /\Av?\d+\.\d+\.\d+\z/ then arg.sub(/\Av/, "")
+  else abort "Unknown argument '#{arg}'. Use major | minor | patch, or an explicit X.Y.Z."
+  end
+
+tag = "v#{next_version}"
+abort "Tag #{tag} already exists." unless capture("git", "tag", "--list", tag).empty?
+
+puts "Current version: v#{current}"
+puts "Next version:    #{tag}"
+
+if dry_run
+  puts "[dry-run] Would create and push annotated tag #{tag} to #{REMOTE}."
+  exit 0
+end
+
+run("git", "tag", "-a", tag, "-m", "Release #{tag}")
+run("git", "push", REMOTE, tag)
+
+puts "Pushed #{tag}. The release workflow will publish the GitHub release."
+slug = capture("git", "remote", "get-url", REMOTE)[%r{github\.com[:/](.+?)(?:\.git)?\z}, 1]
+puts "Watch: https://github.com/#{slug}/actions" if slug

.github/workflows/release-on-merge.yml

@@ -0,0 +1,81 @@
+name: release-on-merge
+
+# Auto-cuts a release after every successful merge to `main`:
+#   merge -> the `tests` workflow runs on main -> on success this fires ->
+#   compute the next version -> tag it -> publish the GitHub release.
+#
+# Bump level (default: patch):
+#   - add a `release:minor` or `release:major` label to the merged PR, OR
+#   - put `#minor` / `#major` in the merge/squash commit message.
+# Skip a release for a merge:
+#   - add a `release:skip` label, OR put `[skip release]` in the commit message.
+#
+# It is gated on `tests` passing (via workflow_run) so a merge never ships a
+# broken release. The version logic lives in .github/scripts/release.rb (the same
+# helper used for manual releases); this workflow just selects the bump and runs it.
+on:
+  workflow_run:
+    workflows: ["tests"]
+    types: [completed]
+    branches: [main]
+
+permissions:
+  contents: write
+  pull-requests: read
+
+jobs:
+  release:
+    # Only when tests passed AND they ran for a push to main (not a PR test run).
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          fetch-depth: 0
+
+      - name: Determine bump level and skip
+        id: decide
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+        run: |
+          set -euo pipefail
+          msg="$(git log -1 --format=%B "${HEAD_SHA}")"
+          labels="$(gh api "repos/${REPO}/commits/${HEAD_SHA}/pulls" --jq '.[].labels[].name' 2>/dev/null || true)"
+          bump="patch"
+          skip="false"
+          if printf '%s' "${msg}" | grep -qiE '\[skip release\]' || printf '%s\n' "${labels}" | grep -qx 'release:skip'; then
+            skip="true"
+          elif printf '%s' "${msg}" | grep -qE '(^|[^[:alnum:]])#major([^[:alnum:]]|$)' || printf '%s\n' "${labels}" | grep -qx 'release:major'; then
+            bump="major"
+          elif printf '%s' "${msg}" | grep -qE '(^|[^[:alnum:]])#minor([^[:alnum:]]|$)' || printf '%s\n' "${labels}" | grep -qx 'release:minor'; then
+            bump="minor"
+          fi
+          # Idempotency guard: if this commit is already released (a semver tag
+          # points at it), skip — e.g. a re-run of the `tests` workflow on the
+          # same HEAD_SHA must not cut a second release.
+          if git tag --points-at "${HEAD_SHA}" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "Commit ${HEAD_SHA} is already released; skipping."
+            skip="true"
+          fi
+          {
+            echo "bump=${bump}"
+            echo "skip=${skip}"
+          } >> "${GITHUB_OUTPUT}"
+          echo "Selected bump=${bump} skip=${skip}"
+
+      - name: Tag and publish release
+        if: ${{ steps.decide.outputs.skip != 'true' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          # Put the tested commit on a local `main` so release.rb's branch guard passes.
+          git checkout -B main
+          ruby .github/scripts/release.rb "${{ steps.decide.outputs.bump }}"
+          tag="$(git describe --tags --abbrev=0)"
+          gh release create "${tag}" --title "${tag}" --generate-notes --verify-tag

.github/workflows/release.yml

@@ -0,0 +1,30 @@
+name: release
+
+# Publishes a GitHub release whenever a semver tag is pushed. The release's
+# auto-generated source tarball is what `ddev add-on get pressable/ddev-pressable`
+# downloads, so the git tag is the add-on's version. Cut a tag with
+# `.github/scripts/release.rb`.
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${GITHUB_REF_NAME}" \
+            --title "${GITHUB_REF_NAME}" \
+            --generate-notes \
+            --verify-tag

.github/workflows/tests.yml

@@ -0,0 +1,45 @@
+name: tests
+on:
+  pull_request:
+    paths-ignore:
+      - "**.md"
+  push:
+    branches: [ main ]
+    paths-ignore:
+      - "**.md"
+
+  schedule:
+    - cron: '25 08 * * *'
+
+  workflow_dispatch:
+    inputs:
+      debug_enabled:
+        type: boolean
+        description: Debug with tmate
+        required: false
+        default: false
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  tests:
+    strategy:
+      matrix:
+        ddev_version: [stable, HEAD]
+      fail-fast: false
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: ddev/github-action-add-on-test@v2
+        with:
+          ddev_version: ${{ matrix.ddev_version }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          debug_enabled: ${{ github.event.inputs.debug_enabled }}
+          addon_repository: ${{ env.GITHUB_REPOSITORY }}
+          addon_ref: ${{ env.GITHUB_REF }}

.gitignore

@@ -0,0 +1,10 @@
+# macOS
+.DS_Store
+
+# Editors
+.idea/
+.vscode/
+*.swp
+
+# Local bats test scratch (the test harness writes under $HOME/tmp)
+tests/tmp/