Run the coding standards, and fix what they found

These four ran php -l and the test suite in CI and nothing else, so the
WordPress sniffs had never been applied. Adding phpcs surfaced real defects,
not just formatting:

clear_cache() deleted the _transient_<prefix>_* option rows with a raw DELETE.
The matching _transient_timeout_<prefix>_* rows do not carry that prefix, so
the LIKE never saw them and every cached lookup orphaned one options row,
permanently. It now selects the names and calls delete_transient(), which
removes both halves, fires the delete_transient_* hooks, and clears the entry
from an external object cache. The same copy-pasted bug was in wp-ipinfo,
wp-ipqualityscore and wp-proxycheck.

wp-ipqualityscore also forwarded $_SERVER['HTTP_USER_AGENT'] and
HTTP_ACCEPT_LANGUAGE straight into the outbound query. WordPress slashes the
superglobals, so a header containing a quote was reported to IPQualityScore
with a backslash the visitor never sent; it is now unslashed and sanitised.
Its date range used date() rather than gmdate(), so a site running ahead of
UTC asked for a range ending tomorrow.

in_array() calls now pass $strict. A __() call built its message by
interpolating a variable into the msgid, which cannot be translated at all;
that value moved into a placeholder. Translator comments added throughout,
and placeholders ordered where there is more than one.

Parameters named after reserved keywords are renamed the way core renamed
them ($default -> $default_value).

The abstract private method in email-blocklist's CustomLists trait is
suppressed rather than changed: private abstract is illegal on a class but
legal in a trait, and the sniff does not distinguish the two. Verified it
runs on 8.5 before suppressing.

CI now runs composer lint and composer format:check alongside the tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Tk8y5eZa3CHVVSM6nVxsJw

Author: arraypress

.github/workflows/ci.yml

@@ -36,6 +36,14 @@ jobs:
       - name: Lint
         run: find src tests -name '*.php' -print0 | xargs -0 -n1 -P4 php -l > /dev/null
 
+      - name: Coding standards
+        run: composer lint
+
+      - name: Formatting
+        # Separate from the lint: a clean lint does not mean a clean format
+        # check, and a green build has to mean both.
+        run: composer format:check
+
       - name: Tests
         # Checked for output, not just exit status. Anything that exits during
         # autoload takes phpunit with it before it runs, and the step passes

composer.json

@@ -21,7 +21,10 @@
   "config": {
     "optimize-autoloader": true,
     "sort-packages": true,
-    "preferred-install": "dist"
+    "preferred-install": "dist",
+    "allow-plugins": {
+      "dealerdirect/phpcodesniffer-composer-installer": true
+    }
   },
   "minimum-stability": "dev",
   "prefer-stable": true,
@@ -50,14 +53,20 @@
     "transaction-scoring"
   ],
   "require-dev": {
-    "phpunit/phpunit": "^12.0"
+    "phpunit/phpunit": "^12.0",
+    "phpcompatibility/phpcompatibility-wp": "^2.1",
+    "squizlabs/php_codesniffer": "^3.13.5",
+    "wp-coding-standards/wpcs": "^3.4"
   },
   "autoload-dev": {
     "psr-4": {
       "ArrayPress\\IPQualityScore\\Tests\\": "tests/"
     }
   },
   "scripts": {
-    "test": "phpunit"
+    "test": "phpunit",
+    "lint": "phpcs",
+    "format": "phpcbf --standard=phpcs-format.xml.dist",
+    "format:check": "phpcs --standard=phpcs-format.xml.dist"
   }
 }