chore: Update deps and cleanup scaffold (first pass)

.gitattributes

@@ -1,23 +1,27 @@
-#
-# Exclude these files from release archives.
-# This will also make them unavailable when using Composer with `--prefer-dist`.
-# If you develop for this repo using Composer, use `--prefer-source`.
-#
-# @see https://git-scm.com/docs/gitattributes
-# @see https://blog.madewithlove.be/post/gitattributes/
-#
-/.editorconfig           export-ignore
-/.gitattributes          export-ignore
-/.github/                export-ignore
-/.gitignore              export-ignore
-/.nvmrc                  export-ignore
-/.prettierignore         export-ignore
-/.prettierrc.js          export-ignore
-/.wp-env.json            export-ignore
-/CONTRIBUTING.md         export-ignore
-/docs/                   export-ignore
-/phpcs.xml.dist          export-ignore
-/phpstan.neon.dist       export-ignore
-/phpunit.xml.dist        export-ignore
-/README-INITIAL.md       export-ignore
-/tests/                  export-ignore
+# Automatically normalize line endings.
+* text=auto
+
+# Directories to exclude from `composer require`.
+/.github        export-ignore
+/.wordpress-org export-ignore
+/tests          export-ignore
+
+# Don't include the dotfiles for distribution.
+/.* export-ignore
+
+# Root files that are not needed for distribution.
+/CHANGELOG.md      export-ignore
+/composer.lock     export-ignore
+/package-lock.json export-ignore
+/package.json      export-ignore
+/phpstan.neon.dist export-ignore
+/phpunit.xml.dist  export-ignore
+
+# Mark docs as documentation for GitHub Linguist.
+/docs/           linguist-documentation export-ignore
+/CONTRIBUTING.md linguist-documentation export-ignore
+/SECURITY.md     linguist-documentation export-ignore
+
+# Keep license and readme files.
+/LICENSE.md linguist-documentation
+/README.md linguist-documentation

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,49 @@
+<!-- Thanks for contributing to the AI plugin! Please follow the AI Plugin Contributing Guidelines:
+https://github.com/WordPress/mcp-adapter/blob/trunk/CONTRIBUTING.md -->
+
+## What?
+<!-- Link this PR to its associated issue with an appropriate keyword: Closes, See, Follow up to, etc. -->
+Closes <!-- #ISSUE-NUMBER or URL -->
+
+<!-- In a few words, what is the PR actually doing? -->
+
+## Why?
+<!-- Why is this PR necessary? What problem is it solving? Reference any existing previous issue(s) or PR(s), but please add a short summary here, too -->
+
+## How?
+<!-- How is your PR addressing the issue at hand? What are the implementation details? -->
+
+### Use of AI Tools
+<!--
+You are free to use artificial intelligence (AI) tooling to contribute, but you must disclose what tooling you are using and to what extent a pull request has been authored by AI. It is your responsibility to review and take responsibility for what AI generates. See the WordPress AI Guidelines: <https://make.wordpress.org/ai/handbook/ai-guidelines/>.
+
+Example disclosure:
+
+AI assistance: Yes
+Tool(s): GitHub Copilot, ChatGPT
+Model(s): GPT-5.1
+Used for: Initial code skeleton and test suggestions; final implementation and tests were reviewed and edited by me.
+-->
+
+## Testing Instructions
+<!-- Please provide steps on how to test or validate that the change in this PR works as described. -->
+
+## Screenshots or screencast
+<!-- If this PR includes UI changes, please provide screenshots or a screen recording for clarity. -->
+<!-- This section can be removed if not applicable. -->
+
+| Before | After |
+| ------ | ----- |
+|        |       |
+
+## Changelog Entry
+<!--
+Please include a summary for this PR, noting whether this is something being Added / Changed / Deprecated / Removed / Fixed / or Security related.  You can replace the sample entries after this comment block with the single changelog entry line for this PR. -->
+
+> Added - New feature.
+> Changed - Existing functionality.
+> Deprecated - Soon-to-be removed feature.
+> Removed - Feature.
+> Fixed - Bug fix.
+> Security - Vulnerability.
+> Developer - Development related updates.

.github/dependabot.yml

@@ -0,0 +1,63 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: '/'
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: 'chore(ci)'
+    labels:
+      - dependencies
+    groups:
+      github-actions-updates:
+        patterns: ['*']
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: composer
+    directory: '/'
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    cooldown:
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 7
+    versioning-strategy: increase
+    commit-message:
+      prefix: 'fix'
+      include: 'scope'
+    labels:
+      - dependencies
+    groups:
+      composer-dev-minor-patch:
+        dependency-type: 'development'
+        update-types: [minor, patch]
+      # We don't bundle minor or major production assets, so they're tested individually.
+      composer-patch:
+        dependency-type: 'production'
+        update-types: [patch]
+
+  - package-ecosystem: npm
+    directory: '/'
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    cooldown:
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 7
+    versioning-strategy: increase
+    commit-message:
+      prefix: 'fix'
+      include: 'scope'
+    labels:
+      - dependencies
+    groups:
+      npm-dev-minor-patch:
+        dependency-type: 'development'
+        update-types: [minor, patch]
+      npm-prod-minor-patch:
+        dependency-type: 'production'
+        update-types: [minor, patch]

.github/workflows/copilot-setup-steps.yml

@@ -26,22 +26,22 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
           persist-credentials: false
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@9e72090525849c5e82e596468b86eb55e9cc5401 # v2.32.0
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2.37.1
         with:
           php-version: '8.3'
           coverage: none
 
       - name: Install Composer dependencies
-        uses: ramsey/composer-install@a2636af0004d1c0499ffca16ac0b4cc94df70565 # v3.1.0
+        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # v4.0.0
 
-      - name: Setup Node
-        uses: actions/setup-node@v4
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           cache: 'npm'
           node-version-file: '.nvmrc'

.github/workflows/props-bot.yml

@@ -50,8 +50,9 @@ jobs:
     name: Generate a list of props
     runs-on: ubuntu-24.04
     permissions:
-      pull-requests: write # Required by props-bot-action to comment on the PR.
-      contents: read       # Required by props-bot-action to read repository contents.
+      # The action needs permission `write` permission for PRs in order to add a comment.
+      pull-requests: write
+      contents: read
     timeout-minutes: 20
     # The job will run when pull requests are open, ready for review and:
     #
@@ -75,7 +76,7 @@ jobs:
           format: 'git'
 
       - name: Remove the props-bot label
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         if: ${{ github.event.action == 'labeled' && 'props-bot' == github.event.label.name }}
         with:
           retries: 2

.github/workflows/release.yml

@@ -25,13 +25,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
           persist-credentials: false
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@9e72090525849c5e82e596468b86eb55e9cc5401 # v2.32.0
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2.37.1
         with:
           php-version: '8.3'
           coverage: none
@@ -58,7 +58,7 @@ jobs:
           npm run plugin-zip
 
       - name: Upload artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: mcp-adapter
           path: mcp-adapter.zip