1. Define the target release
Record supported WordPress, PHP and WooCommerce versions, the changes, affected data, checkout type and packaging target. Identify who can approve deployment and who can restore the previous state.
2. Sequence the reviews
- Use plugin or theme review for structural and lifecycle changes.
- Use security and REST review for access or data boundaries.
- Use migration and operations review for upgrades, backfills and maintenance.
- Use test strategy, PHPStan and relevant browser journeys for the changed behavior.
- Use release engineering to inspect the final pipeline and the artifact.
3. Ask for the pipeline review
/wp-devkit:release-review .$wp-devkit-ci-cd-and-release-engineering
Review the release pipeline and package without deploying.
Check that the tested archive is the published archive, token permissions and action pinning,
required gates and their skipped-check behavior, version consistency, migration order and rollback readiness.
Report local and hosted checks separately and list unexecuted target checks.4. Evidence to collect before you publish
| Question | Evidence |
|---|---|
| Is the archive what you tested? | Archive digest recorded after the tests and verified again at upload |
| Does it contain only what it should? | File list of the built archive; no secrets, tests, caches or development data |
| Do versions agree? | Plugin header, readme stable tag, changelog and git tag compared in one check |
| Do upgrades work? | Install and upgrade from the previous release on representative disposable data, including an interrupted run |
| Can you go back? | Rollback steps and the data changes that make rollback unsafe |
| Are required checks real? | A deliberately failing change is shown to block the merge; skipped required jobs are understood |
5. Before publication
- Run the configured required checks. A failing check remains a failure; do not regenerate a baseline or widen an ignore to make it pass.
- Test the install and upgrade path with disposable representative data.
- Confirm rollback limits when data changes are irreversible.
- Document versions, commands, artifact identity, evidence and known gaps.