ci: adopt estate CI standard — thin caller + wp-framework PHPUnit + 300-line split

- ci.yml: thin caller → peptide-e2e reusable (tests: wp-framework, has_js: true, line_limit_paths: inc)
- deploy.yml: retire standalone validate; gate deploy on ci.yml via workflow_call
- composer.json: test script → vendor/bin/phpunit (explicit)
- inc/helpers.php: split 311→211 lines; nav walker extracted to nav-walker.php
- inc/nav-walker.php: new — Peptide_Starter_Nav_Walker + menu fallback (123 lines)
- functions.php: require nav-walker.php before helpers.php; version 2.2.2→2.3.0
- style.css: version header 2.2.2→2.3.0
- package.json / package-lock.json: minimal npm manifest for lint-js job

Agent-Session: claude/adopt-ci-20260616

.github/workflows/ci.yml

@@ -1,112 +1,24 @@
-name: CI — Lint & Test
-
-# Runs on every PR and every push to main.
-# Three jobs in parallel:
-#   1. PHP Lint — syntax check across supported PHP versions
-#   2. PHPCS — WordPress coding standards (non-blocking during theme rollout)
-#   3. PHPUnit — runs the theme's test suite against the WordPress test framework
+name: CI
 
+# Thin caller — delegates all jobs to the shared reusable workflow.
+# Must include workflow_call so deploy.yml can gate on this workflow.
 on:
+  pull_request: {}
   push:
     branches: [main]
-  pull_request:
-    branches: [main]
+  workflow_call: {}
 
+# Required by the reusable phpcs job which commits phpcbf auto-fixes back
+# to the PR branch. GitHub enforces that callers declare at least the same
+# permissions as any job-level override in the called workflow.
 permissions:
-  contents: read
+  contents: write
 
 jobs:
-  php-lint:
-    name: PHP Lint (${{ matrix.php }})
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        php: ['8.1', '8.2', '8.3']
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup PHP ${{ matrix.php }}
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php }}
-          coverage: none
-      - name: Syntax check all PHP files
-        run: |
-          set -e
-          find . -name '*.php' \
-            -not -path './vendor/*' \
-            -not -path './node_modules/*' \
-            -not -path './.git/*' \
-            -print0 | xargs -0 -n1 -P4 php -l > /dev/null
-
-  phpcs:
-    name: PHPCS (WordPress standards)
-    runs-on: ubuntu-latest
-    continue-on-error: true
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: '8.1'
-          coverage: none
-          tools: composer:v2
-      - name: Install dependencies
-        run: composer install --no-progress --no-interaction --prefer-dist
-      - name: Run PHPCS
-        run: vendor/bin/phpcs --standard=.phpcs.xml.dist
-
-  phpunit:
-    name: PHPUnit (PHP ${{ matrix.php }}, WP ${{ matrix.wp }})
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        php: ['8.1', '8.2', '8.3']
-        wp: ['latest']
-    services:
-      mysql:
-        image: mysql:8.0
-        env:
-          MYSQL_ROOT_PASSWORD: root
-          MYSQL_DATABASE: wp_tests
-        ports:
-          - 3306:3306
-        options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=5
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install subversion
-        # ubuntu-latest no longer ships svn preinstalled. The WP test suite
-        # bootstrap script checks out develop.svn.wordpress.org via svn.
-        run: sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends subversion
-      - name: Setup PHP ${{ matrix.php }}
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: ${{ matrix.php }}
-          coverage: none
-          tools: composer:v2
-          extensions: mysqli
-      - name: Install composer dependencies
-        run: composer install --no-progress --no-interaction --prefer-dist
-      - name: Wait for MySQL
-        run: |
-          for i in {1..30}; do
-            if mysqladmin ping -h 127.0.0.1 -P 3306 -u root -proot --silent; then
-              echo "MySQL is up"; break
-            fi
-            echo "Waiting for MySQL..."; sleep 2
-          done
-      - name: Install WordPress test suite
-        env:
-          WP_TESTS_DIR: /tmp/wordpress-tests-lib
-          # Trailing slash matters: the bootstrap config substitutes this verbatim into ABSPATH,
-          # then concatenates 'wp-settings.php'. Without the slash you get '/tmp/wordpresswp-settings.php'.
-          WP_CORE_DIR: /tmp/wordpress/
-        run: |
-          chmod +x bin/install-wp-tests.sh
-          # 6th arg = skip-database-creation: the MySQL service already created wp_tests via MYSQL_DATABASE env.
-          bin/install-wp-tests.sh wp_tests root root 127.0.0.1:3306 ${{ matrix.wp }} true
-      - name: Run PHPUnit
-        env:
-          WP_TESTS_DIR: /tmp/wordpress-tests-lib
-        run: vendor/bin/phpunit --colors=always
+  ci:
+    uses: peptiderepo/peptide-e2e/.github/workflows/ci.yml@main
+    with:
+      tests: wp-framework
+      has_js: true
+      line_limit_paths: inc
+    secrets: inherit

.github/workflows/deploy.yml

@@ -9,30 +9,16 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  validate:
-    name: Validate PHP & JS
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      - name: PHP Lint Check
-        run: |
-          find . -name "*.php" -not -path "./vendor/*" -not -path "./node_modules/*" -exec php -l {} \; | (grep -v "No syntax errors" || true) | head -20
-          test ${PIPESTATUS[0]} -eq 0
-      - name: Install PHPCS with WordPress standards
-        run: |
-          composer global config allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
-          composer global require --dev squizlabs/php_codesniffer:"^3.0" wp-coding-standards/wpcs:"^3.0" phpcsstandards/phpcsutils:"^1.0"
-      - name: Run PHPCS (WordPress Core)
-        run: |
-          ~/.composer/vendor/bin/phpcs -s . || true  # non-blocking during theme rollout
-      - name: JS Syntax Check
-        run: |
-          find assets/js -name "*.js" -exec node --check {} \;
+  # Gate deploy on the reusable CI (lint-php, phpcs, phpunit, file-size, lint-js).
+  # ci.yml exposes workflow_call so it can be used here without re-running a
+  # separate workflow — the call result satisfies the branch-protection context
+  # "ci / ci (lint-php (8.1))" etc.
+  ci:
+    uses: ./.github/workflows/ci.yml
 
   deploy:
     name: Deploy (shared pipeline)
-    needs: validate
+    needs: ci
     uses: peptiderepo/peptide-e2e/.github/workflows/deploy-app.yml@main
     with:
       target_path: wp-content/themes/peptide-starter