Problem
`homeboy lint` on `main` reports 527 findings, 175 errors — and this was already true at the v0.38.0 release commit (`1012091`), so the debt predates the recent event-chat-tools work in #289/#290/#291/#292. Every release since at least v0.38.0 must have been cut with `--skip-checks` or under an older lint config.
This bit us cutting the v0.39.0 release for the new `delete_event`/`move_event` chat tools: every new file is clean (`homeboy lint --file inc/Abilities/DeleteEventAbilities.php` passes), but the cumulative pre-existing debt fails `homeboy release` preflight and forces `--skip-checks`.
What the findings look like
Two main flavors:
Real errors (need fixing):
- `inc/Abilities/UpcomingCountAbilities.php:128,132` — `WordPress.DB.PreparedSQL.InterpolatedNotPrepared`, interpolated `{$ed_table}` / `{$parent_clause}` instead of `$wpdb->prepare()` placeholders
- (sweep needed for other DB-layer files)
Style warnings (mostly auto-fixable):
- `WordPress.Arrays.MultipleStatementAlignment.DoubleArrowNotAligned` across many ability files (e.g. `inc/Abilities/EventScraperTest.php:251`)
- Various phpcs cosmetic findings — most are `fixable: true`
Why this matters
- Lint baseline drift defeats the purpose of preflight gates. We end up reflexively using `--skip-checks`, which masks any *new* lint regression that a future PR introduces.
- Genuine `WordPress.DB.PreparedSQL.InterpolatedNotPrepared` errors in `UpcomingCountAbilities` are real security/correctness smells. Even if the interpolated values are internally trusted (table names, taxonomy clauses), `$wpdb->prepare()` with placeholders is the canonical pattern and the linter is right to flag it.
Proposed remediation
- First pass — auto-fixable style warnings. Run `phpcbf` (or whatever homeboy wraps) across `inc/`. Most array-alignment warnings will resolve in one sweep with no behavior change. Land that as a single `style:` commit.
- Second pass — DB prepared-statement errors. Audit every `WordPress.DB.PreparedSQL.*` error file by file. For interpolated table names, use `esc_sql()` + `$wpdb->prepare()` patterns or extract into pre-validated constants. Land as one or more `fix:` commits.
- Third pass — establish a baseline. Once the residual count is justified (e.g. unavoidable false positives), run `homeboy lint --baseline` to lock it in so future PRs only have to be clean against the baseline, not against zero.
- Update CI / release gate. Once baseline is set, `homeboy release` preflight should pass cleanly without `--skip-checks`.
Out of scope
- Refactoring the underlying logic in any of the flagged files — this is strictly lint debt remediation.
- Removing `EventScraperTest.php` or similar dev/test scaffolding files if they're still in active use.
Why filed now
Cutting v0.39.0 for #289/#290/#291/#292 required `homeboy release data-machine-events --skip-checks`. Filing this so the next agent picking up the repo doesn't repeat the workaround silently.
Problem
`homeboy lint` on `main` reports 527 findings, 175 errors — and this was already true at the v0.38.0 release commit (`1012091`), so the debt predates the recent event-chat-tools work in #289/#290/#291/#292. Every release since at least v0.38.0 must have been cut with `--skip-checks` or under an older lint config.
This bit us cutting the v0.39.0 release for the new `delete_event`/`move_event` chat tools: every new file is clean (`homeboy lint --file inc/Abilities/DeleteEventAbilities.php` passes), but the cumulative pre-existing debt fails `homeboy release` preflight and forces `--skip-checks`.
What the findings look like
Two main flavors:
Real errors (need fixing):
Style warnings (mostly auto-fixable):
Why this matters
Proposed remediation
Out of scope
Why filed now
Cutting v0.39.0 for #289/#290/#291/#292 required `homeboy release data-machine-events --skip-checks`. Filing this so the next agent picking up the repo doesn't repeat the workaround silently.