To-dos

• Core version drift: the image wordpress:7.1.2 ships core 7.1.2 (/usr/src/wordpress/wp-includes/version.php), the data volume of a fresh install ran 7.1.3 when it was first measured, 77 minutes after its creation (wp core version, body class version-7-1-3 in wp-admin). WordPress applies minor core updates in the background inside the volume, so the running version leaves the pin in meta/services.yml. Options: set WP_AUTO_UPDATE_CORE to false in wp-config.php and update through the image, or keep the background updates and stop treating the pin as the running version.

• tasks/02_install.yml passes the administrator password to wp core install as --admin_password=<value> on the command line of container exec, where the process list of the host shows it for the run of the command. Options: wp core install --prompt=admin_password with the value on stdin, or wp user update <login> --prompt=user_pass after an install that sets a throwaway value.

• The Command Palette entry of the admin bar (#wp-admin-bar-command-palette, rendered by core as <a class="ab-item" onclick="wp.data.dispatch( "core/commands" ).open()">) does nothing on click: meta/csp.yml grants unsafe-eval under script-src-attr but no unsafe-inline, and Chromium of the Playwright image v1.64.0-noble logs “Executing inline event handler violates the following Content Security Policy directive ‘script-src-attr ‘self’ ‘unsafe-eval’’” on every wp-admin page and on the site with the admin bar. The unsafe-eval under script-src-attr has no effect there; the media grid’s Underscore templates get unsafe-eval from script-src. Options: grant unsafe-inline under script-src-attr, or remove the onclick in a mu-plugin through the admin_bar_menu hook and bind the click from a script file.