[github-actions]

Summary

Upgrade the optional starter baseline together to WordPress 7.1.2, WooCommerce 11.1.2 and Jetpack 16.2. Both plugin releases require WordPress 7.0 or newer; applying them independently to the former 6.9.9 baseline was invalid. Fresh official archives were ingested with core checksum verification, and their sanitized trees match the runtime payloads proposed in #97, #99 and #100. Local Akismet and themes retain their ownership.

Add a seeded-store upgrade and paired database/runtime rollback regression from the immutable v1.5.0 baseline. It validates actual WooCommerce migration callbacks, both order-storage modes, existing products/orders/customer data, stock/tax/coupon/cart invariants, REST permissions, email cleanup/customization preservation, and new checkout-order persistence. CI runs both repository profiles on PHP 8.1, 8.4 and 8.5, including the minimum supported PHP version.

Fix explicit archive subdirectories inside wrapper folders being rejected when an earlier candidate path does not exist, while preserving symlink rejection. Add nine archive regressions, eight migration-input safety assertions and five diagnostic rejection/control assertions. Both fresh-install and upgrade smoke fail on recorded WordPress database errors even when processes exit successfully. Document runtime upgrade/rollback requirements and distinguish them from tooling-only framework adoption.

Validation

• Native PHP 8.5.5: all 25 framework suites passed with 1,843 assertions, including all 22 runner/upgrade safety assertions.
• Corrected disposable local migration and rollback passed for content-only/legacy orders, including 52 tables, maximum-length identifiers, actual download permissions, all queued migration callbacks and fresh-process persistence of a new checkout order. Earlier exploratory runs were superseded after diagnostic review caught excessive table-prefix length. Hosted CI establishes the final complete matrix.
• PHPStan framework level 5 and strict boundary checks, actionlint, shellcheck, workflow parity/permissions, and documentation checks passed.
• Independent reviews covered migration reliability, security/upstream compatibility, and architecture/documentation/release operations.
• Final hosted CI run 36119332873 passed all 13 jobs on 9baa215: 25 suites and 1,832 assertions per PHP job, six fresh-install cases and 12 upgrade/rollback cases, plus quality, signed artifact and downstream checks. CodeQL run 36119328988 completed successfully; the exact final inventory retains only documented alerts 230, 231 and 242. All 15 required checks passed.
• Main protection now enforces the previously omitted PHP 8.5 validation and all six runtime smoke jobs, while preserving strict checks, pull-request requirements and no bypass actors.

Security review

Reviewed all 54 open alerts on the proposed runtime: 51 exact-location false positives were independently assessed and individually dismissed, with no global rule exclusions. Confirmed upstream alerts #230, #231 and #242 remain open. A separate inherited editor-content concern remains under private follow-up; neither migration CI nor this tooling release provides runtime security clearance. Detailed public dispositions and limits are recorded in docs/security-reviews/2026-09-25-baseline.md. Official runtime files remain unpatched.

Downstream impact

The framework ZIP remains tooling-only. Existing downstream runtime versions are not automatically replaced by adopting framework 1.6.0. Runtime upgrades require coordinated core/plugin deployment and database updates; the repository's synthetic fixture does not certify a merchant's extensions, live payment integration or production data.

Release

Prepared through the normal prepare-wp-core-base-release workflow. After successful protected-branch checks and merge, normal finalization creates the immutable v1.6.0 tag, signs and verifies the artifact, then publishes the release. No protection bypass or ad hoc tag is required.