Add WordPress agent skills + fix glob CVE-2025 command injection

.github/workflows/copilot-setup-steps.yml

@@ -0,0 +1,45 @@
+name: "Copilot Setup Steps"
+
+# Automatically run the setup steps when they are changed to allow for easy validation, and
+# allow manual testing through the repository's "Actions" tab
+on:
+    workflow_dispatch:
+    push:
+        paths:
+            - .github/workflows/copilot-setup-steps.yml
+    pull_request:
+        paths:
+            - .github/workflows/copilot-setup-steps.yml
+
+jobs:
+    # The job MUST be called `copilot-setup-steps` or it will not be picked up by Copilot.
+    copilot-setup-steps:
+        runs-on: ubuntu-latest
+
+        permissions:
+            contents: read
+
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@v4
+
+            - name: Set up Node.js
+              uses: actions/setup-node@v4
+              with:
+                  node-version: "20"
+                  cache: "npm"
+
+            - name: Install Node.js dependencies
+              run: npm ci
+
+            - name: Set up PHP
+              uses: shivammathur/setup-php@v2
+              with:
+                  php-version: "8.1"
+                  tools: composer
+
+            - name: Install PHP dependencies
+              run: composer install --no-dev --optimize-autoloader
+
+            - name: Fetch and install latest WordPress agent skills
+              run: bash scripts/install-agent-skills.sh "${GITHUB_WORKSPACE}"

.gitignore

@@ -63,6 +63,9 @@ contributors.md
 # WP ENV
 /.wp-env.override.json
 
+# Agent Skills (auto-generated – run `npm run skills:install` to refresh)
+/.github/skills/
+
 # Screenshots
 /screenshots/