FSWP Core Contributor
Foundational (always applied): fswp-developer/references/lean-coding.md (write less, reuse first), fswp-developer/references/coding-standards.md (coding standards, docs, i18n, accessibility), and fswp-security-engineer (input, output, authorization).
Workflow facts here were checked against the Core Contributor Handbook on 2026-09-28. Core processes change; confirm anything time-sensitive in fswp-developer/references/official-docs.md before advising. Nothing here submits anything: the user files tickets and opens pull requests themselves (GitHub automation is reserved, see fswp-developer/references/github-foundation.md).
Route the change first
| The change is in... | Goes to |
|---|---|
| A vulnerability | The private security process linked from the Core handbook. Never a public ticket or PR. Stop and say so. |
| PHP, admin screens, APIs, tests, most Core code | Trac ticket plus patch or pull request against WordPress/wordpress-develop (this skill) |
| The block editor (Gutenberg packages, editor UI, Site Editor) | Issues and pull requests on WordPress/gutenberg; Core receives updates from there. Read that repository's contributing guide. |
| A plugin or theme bug | Not Core; use fswp-maintainer and report to that project |
| Docs | The relevant handbook's docs team process |
Ticket first
- Search Trac (https://core.trac.wordpress.org/) for the symptom. Read the ticket history and any patches.
- If no ticket exists, draft one: precise title, WordPress/PHP versions, steps to reproduce, expected vs actual, and why it is a defect (a bug) versus an enhancement. The user files it under the right component.
- Note workflow keywords on the ticket (for example a request for unit tests) and follow them.
Environment
Use the development checkout, not a normal site:
- Clone
WordPress/wordpress-develop(Git mirror of the canonical repository, which is managed in Subversion). - Docker and Node are needed for the standard workflow. From the checkout root:
npm install,npm run build:dev,npm run env:start,npm run env:install. - Run the PHP tests with
npm run test:php. Pass PHPUnit arguments after a double dash, for example-- --group formatting. Tests tagged@ticketrun by ticket number as a group. Multisite has its own config (-c tests/phpunit/multisite.xml); AJAX tests run with--group ajax. - Non-Docker workflows (Composer, PHPUnit PHAR) exist; see the PHPUnit page in the handbook.
Writing the change
- Branch from trunk; name the branch with the ticket number (for example
12345-short-description). Keep the change focused on one ticket. - Coding standards: WordPress PHP, JS, CSS, and HTML standards, including Yoda conditions, tabs, spacing, and escaping/sanitizing rules. Run PHPCS on changed files.
- Inline documentation: PHPDoc for new or changed functions, hooks, and classes in Core's style, with
@sinceset to the version the ticket's milestone names. - Backward compatibility: Core almost never breaks public behavior. Deprecate (
_deprecated_function()and friends) rather than remove; keep filters and actions stable; preserve function signatures. - Tests: add or update PHPUnit tests that fail before and pass after, tagged with
@ticket. A bug patch without a test is usually asked to add one. - Security and performance: same rules as any WordPress code (
fswp-security-engineer,fswp-performance-engineer), held to a higher bar. - Do not bundle unrelated formatting or refactoring.
Submitting (done by the user)
- Attach a
.difffile to the Trac ticket named after the ticket number, or open a pull request againstWordPress/wordpress-developthat references the ticket. Pull requests are used for review; they are not merged on GitHub, because committers commit through the canonical repository. - Post a ticket comment: what the patch does, how you tested it, steps a tester can follow, and any open questions. Draft it for the user using
references/ticket-comment-template.md. - Expect review, requests for changes, and a slow cycle. Respond on the ticket, update the patch, and keep it rebased on trunk.
Verify before handing over
Run fswp-qa-engineer with the Core checklist: reproduction fails before and passes after, the relevant test group passes, coding standards are clean on changed lines, docs are present, and BC is intact.