[herewithme]

Summary

The plugin had no automated tests: the security fixes of 1.2.1 (stored XSS) and 1.2.2 (allow policy) were only checked by hand. This adds three suites, each at its own level, and runs them on pull requests.

Closes #26

Suite	Location	Covers
PHPUnit (50 tests)	tests/php/	BlockRenderer through do_blocks(): attribute allowlist, escaping, source protocols, allow policy and the blockparty_iframe_allowed_features filter
Jest (53 tests)	tests/js/	Pure helpers of src/blockparty-iframe/utils.js
Playwright (9 tests)	tests/playwright/	The block in the editor (form, "View" / "Replace", server-side preview, lazyload toggle, deprecated static markup) and on the front end

No production file (src/, includes/, blockparty-iframe.php) is modified.

What changed

• Test site: PHPUnit and Playwright run on an isolated wp-env site (.wp-env.test.json, port 8889), separate from the development site.
• Tooling: @wordpress/env 12.1 (needed for --config and testsEnvironment) and @wordpress/scripts 31.8 (same major, accepts wp-env 12) replace the latest ranges. PHPUnit 9.6.38 and yoast/phpunit-polyfills 1.1.5 are added; the WordPress test library comes from wp-env.
• Scripts: env:start / env:stop pointed at a missing ./wp-env.json and are fixed. New test:php, test:unit:js, test:e2e (plus debug and UI variants) and test-site lifecycle scripts. The unusable composer phpunit script is removed.
• CI: tests-php.yml, tests-js.yml and tests-e2e.yml. PHPUnit and Playwright run on WordPress 6.7 (declared minimum) and the latest release, with PHP 8.1.
• Packaging: tests/, .wp-env.test.json and phpunit.xml.dist are excluded from the release archive (.distignore, .gitattributes).
• Docs: README testing section and stale commands fixed; CHANGELOG entry.

Notes for reviewers

• Build output: after the @wordpress/scripts bump, build/blockparty-iframe/index.asset.php lists the same dependencies as before.
• Platform check limited to production: composer check-platform-reqs fails on PHP 8.1 for dev packages, because wp-cli pulls symfony/finder, which needs PHP 8.2 under the simulated config.platform.php 8.3.36. This predates this PR; the workflow checks --no-dev, which passes.
• npm engine warnings: wp-env 12 ships Playground packages that ask for Node >= 24.18, while the project pins 24.15.0. The Docker runtime works regardless; the warnings will show in CI.
• .eslintrc: adds the WordPress Jest and Playwright presets for the test folders.
• New workflows have not run yet: this PR is their first execution.

Test plan

• npm run test:unit:js: 53 tests pass
• npm run test:php: 50 tests pass on WordPress 7.1.4 and 6.7, PHP 8.1
• npm run test:e2e: 9 tests pass on WordPress 7.1.4 and 6.7, PHP 8.1
• Each suite fails when the behaviour is broken (allow filter disabled: 6 PHPUnit and 2 Playwright failures; protocol check disabled: 3 Jest failures)
• Coverage report generated: 98.46% of BlockRenderer lines
• npm run lint:js, composer cs and PHPCS on tests/ pass
• PHP Tests, JavaScript Tests and E2E Tests workflows are green on this PR

🤖 Generated with Claude Code

---

Note

Low Risk
Changes are limited to tests, dev dependencies, CI, and documentation; production plugin behavior is unchanged.

Overview
Adds three automated test suites and runs them in CI, without changing plugin runtime code (src/, includes/, blockparty-iframe.php).

PHPUnit (tests/php/, wp-env on port 8889) exercises BlockRenderer via do_blocks()—URL protocols, attribute allowlists, escaping, allow policy, and blockparty_iframe_allowed_features. Jest (tests/js/) covers utils.js helpers. Playwright (tests/playwright/) covers editor flows (form, server-side preview, lazyload, legacy static markup) and front-end output.

Tooling: Pins @wordpress/scripts 31.8 and @wordpress/env 12.1; adds PHPUnit 9.6 and polyfills; fixes env:start/env:stop; adds test:php, test:unit:js, test:e2e and test-site npm scripts; drops composer phpunit. New .wp-env.test.json isolates the test WordPress site from dev (8888).

CI: Three workflows—tests-php.yml (matrix WP 6.7 + latest, PHP 8.1, coverage artifact), tests-js.yml, tests-e2e.yml (Chromium artifact cache). Packaging excludes tests/, test configs from release via .distignore/.gitattributes. README, CHANGELOG, and ESLint overrides for test folders are updated.

^{Reviewed by Cursor Bugbot for commit ea13e79. Bugbot is set up for automated code reviews on this repo. Configure here.}