chore: sync template to v1.9.5

.claude/template-version

@@ -1 +1 @@
-1.9.3
+1.9.5

.github/workflows/accessibility.yml

@@ -107,7 +107,7 @@ jobs:
     name: Pa11y and axe at WCAG 2.2 AAA
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Check the CI archetype
         # Reads .github/ci-archetype, trimmed of surrounding whitespace and
@@ -141,8 +141,8 @@ jobs:
             echo "is_wordpress_theme=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
-        if: steps.archetype.outputs.is_browser_extension != 'true' && steps.archetype.outputs.is_python_tool != 'true' && steps.archetype.outputs.is_wordpress_theme != 'true'
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        if: steps.archetype.outputs.is_browser_extension != 'true' && steps.archetype.outputs.is_python_tool != 'true' && steps.archetype.outputs.is_wordpress_theme != 'true' && steps.archetype.outputs.is_wordpress_theme != 'true'
         with:
           node-version: lts/*
           cache: npm

.github/workflows/ci.yml

@@ -58,12 +58,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       # --- Static front-end: HTML, CSS, JavaScript ---
       - name: Set up Node.js
         if: hashFiles('package.json') != ''
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: lts/*
           cache: npm
@@ -114,7 +114,7 @@ jobs:
       # docs/stacks/wordpress.md.
       - name: Set up PHP
         if: hashFiles('composer.json') != ''
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240  # v2.37.2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc  # v2.37.1
         with:
           php-version: '8.3'
 
@@ -182,7 +182,7 @@ jobs:
       # --- Python command-line tool or automation script ---
       - name: Set up Python
         if: steps.archetype.outputs.is_python_tool == 'true'
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c  # v6.0.0
         with:
           python-version: '3.x'
 

.github/workflows/codeql.yml

@@ -44,7 +44,7 @@ jobs:
   analyze:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: Check the CI archetype
         id: archetype
         run: |
@@ -59,8 +59,8 @@ jobs:
             echo "codeql_language=javascript" >> "$GITHUB_OUTPUT"
           fi
       - name: Initialise CodeQL
-        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a  # v4.37.1
+        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa  # v4.36.0
         with:
           languages: ${{ steps.archetype.outputs.codeql_language }}
       - name: Analyse
-        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a  # v4.37.1
+        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa  # v4.36.0

.github/workflows/deploy.yml

@@ -67,7 +67,7 @@ jobs:
       is_browser_extension: ${{ steps.archetype.outputs.is_browser_extension }}
     steps:
       - name: Check out the code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       - name: Check the CI archetype
         # Reads .github/ci-archetype, trimmed of surrounding whitespace and
@@ -98,7 +98,7 @@ jobs:
 
       - name: Set up Node.js
         if: steps.archetype.outputs.is_browser_extension != 'true'
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: lts/*
           cache: npm
@@ -200,7 +200,7 @@ jobs:
   #   runs-on: ubuntu-latest
   #   steps:
   #     - name: Check out the code
-  #       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+  #       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
   #
   #     - name: Assemble site
   #       # Fail-safe ALLOW-list: only paths matching an explicit --include

.github/workflows/lint.yml

@@ -29,6 +29,17 @@
 # jacob-ci-archetypes.md and docs/decisions/001-python-tool-ci-archetype.md
 # in Lire RSS Hermes, where this archetype was first introduced.
 #
+# A project whose .github/ci-archetype declares wordpress-theme may or may
+# not have a root package.json. If it does (a theme with its own JS/CSS
+# tooling, for example Tim Dixon WordPress Theme), the ordinary npm path
+# above already lints it correctly and nothing further is needed. If it
+# does not (a theme that is PHP-only at the root, for example LLBS Website),
+# the npm steps and the static-content HTML/CSS validation path are both
+# skipped, and a PHP syntax check runs instead. This is a syntax-only check
+# (php -l), not the fuller PHP_CodeSniffer/WordPress-coding-standards check
+# described in docs/stacks/wordpress.md — that is a known follow-up, not yet
+# wired into this template. See docs/decisions/ for the archetype record.
+#
 # Action versions are pinned to commit SHAs verified on 2026-05-21. The
 # version tag is shown in the trailing comment. Update the SHA and the
 # comment together when upgrading an action.
@@ -50,14 +61,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
-      - name: Check for a python-tool archetype declaration
+      - name: Check for a python-tool or wordpress-theme archetype declaration
         # Reads .github/ci-archetype, trimmed of surrounding whitespace and
         # newlines, mirroring the equivalent step in ci.yml and
         # accessibility.yml. A python-tool project has no HTML, CSS, or
         # JavaScript package manifest at all, so the Node.js setup and every
-        # validation step below are skipped for it.
+        # validation step below are skipped for it. A wordpress-theme
+        # project is handled further below: the npm and static-content
+        # paths already cover it correctly when it has a root package.json,
+        # so is_wordpress_theme only changes behaviour when there is none.
         id: archetype
         run: |
           if [ -f .github/ci-archetype ]; then
@@ -70,10 +84,23 @@ jobs:
           else
             echo "is_python_tool=false" >> "$GITHUB_OUTPUT"
           fi
+          if [ "$value" = "wordpress-theme" ]; then
+            echo "is_wordpress_theme=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "is_wordpress_theme=false" >> "$GITHUB_OUTPUT"
+          fi
 
       - name: Set up Node.js
-        if: steps.archetype.outputs.is_python_tool != 'true'
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        # Skipped for a wordpress-theme project with no root package.json
+        # (for example LLBS Website): that combination has neither an npm
+        # project nor a .github/lint-tools manifest, so setup-node's cache
+        # resolution against cache-dependency-path below fails hard with
+        # "Some specified paths were not resolved" rather than skipping
+        # gracefully. Every other case (non-wordpress-theme, or
+        # wordpress-theme with a package.json) still runs Node setup as
+        # before.
+        if: steps.archetype.outputs.is_python_tool != 'true' && (steps.archetype.outputs.is_wordpress_theme != 'true' || hashFiles('package.json') != '')
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
         with:
           node-version: lts/*
           cache: npm
@@ -86,33 +113,50 @@ jobs:
       - name: Lint
         # Replace with your project's lint command(s). Common examples:
         # npm run lint:html, npm run lint:css, npm run lint:js.
+        # Not conditioned on is_wordpress_theme: hashFiles('package.json')
+        # already correctly includes a wordpress-theme project that has its
+        # own npm project (for example Tim Dixon WordPress Theme) and
+        # excludes one that doesn't (for example LLBS Website).
         if: steps.archetype.outputs.is_python_tool != 'true' && hashFiles('package.json') != ''
         run: npm run lint
 
       # --- static-content archetype: no package.json, so validate markup
       # and styles directly, using the pinned tool manifest below instead
       # of an application manifest that does not otherwise exist. ---
       - name: Install HTML/CSS validation tools (static-content)
-        if: steps.archetype.outputs.is_python_tool != 'true' && hashFiles('package.json') == ''
+        if: steps.archetype.outputs.is_python_tool != 'true' && steps.archetype.outputs.is_wordpress_theme != 'true' && hashFiles('package.json') == ''
         run: npm ci
         working-directory: .github/lint-tools
 
       - name: Add validation tools to PATH
-        if: steps.archetype.outputs.is_python_tool != 'true' && hashFiles('package.json') == ''
+        if: steps.archetype.outputs.is_python_tool != 'true' && steps.archetype.outputs.is_wordpress_theme != 'true' && hashFiles('package.json') == ''
         run: echo "$GITHUB_WORKSPACE/.github/lint-tools/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Validate HTML (static-content)
-        if: steps.archetype.outputs.is_python_tool != 'true' && hashFiles('package.json') == ''
+        if: steps.archetype.outputs.is_python_tool != 'true' && steps.archetype.outputs.is_wordpress_theme != 'true' && hashFiles('package.json') == ''
         run: |
           find . -name '*.html' -not -path './.git/*' -not -path './.github/*' -not -path './node_modules/*' -print0 \
             | xargs -0 --no-run-if-empty html-validate --config .github/lint-tools/.htmlvalidate.json
 
       - name: Validate CSS (static-content)
-        if: steps.archetype.outputs.is_python_tool != 'true' && hashFiles('package.json') == ''
+        if: steps.archetype.outputs.is_python_tool != 'true' && steps.archetype.outputs.is_wordpress_theme != 'true' && hashFiles('package.json') == ''
         run: |
           find . -name '*.css' -not -path './.git/*' -not -path './.github/*' -not -path './node_modules/*' -print0 \
             | xargs -0 --no-run-if-empty stylelint --config .github/lint-tools/.stylelintrc.json
 
+      # --- wordpress-theme archetype, no root package.json: a PHP-only
+      # theme (for example LLBS Website) has neither an npm project nor a
+      # .github/lint-tools manifest, so the paths above do not apply. Run a
+      # syntax-only PHP check instead. A wordpress-theme project that DOES
+      # have a root package.json (for example Tim Dixon WordPress Theme)
+      # never reaches this step: the npm path above already lints it. ---
+      - name: Check PHP syntax (wordpress-theme, no package.json)
+        if: steps.archetype.outputs.is_wordpress_theme == 'true' && hashFiles('package.json') == ''
+        run: |
+          find . -name '*.php' -not -path './.git/*' -not -path './.github/*' -not -path './node_modules/*' -not -path './vendor/*' \
+            -exec php -l {} \; | grep -v "No syntax errors" | tee /tmp/php-errors.txt
+          [ ! -s /tmp/php-errors.txt ]
+
       - name: Note that no Python lint standard exists yet (python-tool)
         # Non-blocking, log-only. This is an honest, visible gap, not a
         # silently weakened gate: unlike the browser-extension archetype's

.github/workflows/playwright.yml

@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out the code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
       # --- Uncomment and adapt when the project has Playwright tests ---
 

.github/workflows/security.yml

@@ -20,9 +20,9 @@ jobs:
   semgrep:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: Cache pip packages for Semgrep
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
         with:
           path: ~/.cache/pip
           key: ${{ runner.os }}-semgrep-1.166.0
@@ -37,7 +37,7 @@ jobs:
   trivy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - name: Trivy filesystem scan
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # v0.36.0
         with:
@@ -57,7 +57,7 @@ jobs:
     continue-on-error: true
     if: github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294  # v5.0.0
         # There is nothing to diff without a manifest and lockfile; skip
         # rather than fail or no-op unpredictably on a static-content