Keep the test suite out of everybody's plugin

Composer installs a package from a git archive, and git archive honours
export-ignore. Most of these libraries had no .gitattributes at all, so
tests/, .github/ and the phpcs configuration were being installed into the
vendor directory of every plugin that depends on them.

That is not only untidy. A plugin's vendor tree gets scanned: by
WordPress.org on submission, and by security plugins on the live site. A
test suite is full of what a scanner reports -- stubbed core functions,
fixture credentials, and in two of these libraries a call to PHP's runtime
code interpreter, which is the first thing any of them looks for.

src/, assets/, templates/, data/, composer.json and the README ship.
Nothing else does. Checked with `git archive --worktree-attributes` rather
than assumed.

phpcs now refuses that interpreter outright. The sniff already existed and
was already installed; it is a warning by default, and a warning does not
fail CI, which is how it got in.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Tk8y5eZa3CHVVSM6nVxsJw

Author: arraypress

.gitattributes

@@ -0,0 +1,41 @@
+# What reaches somebody's site.
+#
+# Composer installs a package from a git archive, and git archive honours
+# export-ignore, so everything listed here stops at the repository. That
+# matters more than tidiness: a plugin's vendor directory is scanned, by
+# WordPress.org on submission and by security plugins on the live site, and
+# a test suite full of stubbed core functions is not what anyone wants found
+# in there.
+#
+# src/, assets/, templates/, data/, composer.json and the README ship.
+# Everything that only matters while working on the library does not.
+
+# The suite, and the stubbed core functions it runs against
+/tests export-ignore
+/phpunit.xml export-ignore
+/phpunit.xml.dist export-ignore
+/.phpunit.result.cache export-ignore
+/.phpunit.cache export-ignore
+
+# Continuous integration
+/.github export-ignore
+
+# Coding standards
+/phpcs.xml export-ignore
+/phpcs.xml.dist export-ignore
+/phpcs-format.xml.dist export-ignore
+/phpstan.neon export-ignore
+
+# Repository furniture
+/.gitattributes export-ignore
+/.gitignore export-ignore
+/.editorconfig export-ignore
+/composer.lock export-ignore
+/.DS_Store export-ignore
+
+# Long-form documentation and demonstrations. The README ships.
+/examples export-ignore
+/example export-ignore
+/EXAMPLES.md export-ignore
+/CHANGELOG.md export-ignore
+/SECURITY.md export-ignore

phpcs.xml.dist

@@ -44,4 +44,15 @@
         <exclude-pattern>src/Traits/TabManager.php</exclude-pattern>
     </rule>
 
+    <!--
+        No runtime code interpreter, anywhere that ships. It is a construct
+        WordPress security scanners report on sight, and a plugin's vendor
+        directory does get scanned: by WordPress.org on submission, and by
+        security plugins on the live site. The sniff is only a warning by
+        default, and a warning does not fail CI.
+    -->
+    <rule ref="Squiz.PHP.Eval">
+        <type>error</type>
+    </rule>
+
 </ruleset>