Skip VCS-controlled plugins/themes during updates by default

[Copilot]

Running wp plugin update or wp theme update on a git-cloned plugin/theme would wipe the directory contents, destroying local work. The update commands should gracefully detect and skip VCS checkouts rather than corrupting them.

Changes

• CommandWithUpgrade::update_many() — after existing item filtering, uses WordPress core's WP_Automatic_Updater::is_vcs_checkout() to detect .git/.svn/.hg/.bzr in the plugin or theme directory. Matching items are removed from the update queue with a warning. Loads class-wp-automatic-updater.php (WP 5.3+) or falls back to class-wp-upgrader.php for older versions.
• --include-vcs flag — added to both wp plugin update and wp theme update to override the default skip behavior.
• Behat tests — added scenarios for both plugins and themes covering the skip-by-default and --include-vcs override paths.

Example

# Before: silently destroys the VCS checkout
$ wp plugin update gutenberg
Removing the old version of the plugin...
# directory is now empty

# After: warns and skips
$ wp plugin update gutenberg
Warning: gutenberg: Skipped update because a VCS checkout was detected. Use --include-vcs to override.
Error: No plugins updated.

# Override when intentional
$ wp plugin update gutenberg --include-vcs
Success: Updated 1 of 1 plugins.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Ignore VSC folders by default with update subcommand</issue_title>
<issue_description>### Problem

Running the update subcommand deletes the contents of cloned plugin/theme folders.

A similar report was closed 4 years ago, but I think that should be reconsidered. I routinely run into this, and end up having to restore local changes from backups.

I have lots of sites in my dev environment, and most of those have lots of plugins. I can't memorize which ones are VCS and which aren't, so I have to manually check each one, and then update non-VCS plugins individually.

1. git clone git@github.com:WordPress/gutenberg.git (or any other plugin that's in the repository) and cd to it's folder
2. git checkout v8.0.0
3. wp plugin update --all

Downloading update from https://downloads.wordpress.org/plugin/gutenberg.9.0.0.zip...
The authenticity of gutenberg.9.0.0.zip could not be verified as no signature was found.
Unpacking the update...
Installing the latest version...
Removing the old version of the plugin...
Warning: Could not remove the old plugin.
Plugin update failed.
+-----------+-------------+-------------+--------+
| name      | old_version | new_version | status |
+-----------+-------------+-------------+--------+
| gutenberg | 8.0.0       | 9.0.0       | Error  |
+-----------+-------------+-------------+--------+
Error: No plugins updated.

The folder is now empty, and any work that was done locally is lost.

> ls
.  ..  node_modules

Proposed Solution

The update subcommands aren't intended to work with VCS repos, so I think they should gracefully ignore them, rather than breaking them. An --include-vcs flag could override that for the rare time when someone does want to blow away a VCS checkout with the version from the w.org repo.

Environment

> wp cli info
OS:	Darwin 19.6.0 Darwin Kernel Version 19.6.0: Thu Jun 18 20:49:00 PDT 2020; root:xnu-6153.141.1~1/RELEASE_X86_64 x86_64
Shell:	/bin/bash
PHP binary:	/usr/local/Cellar/php/7.4.10/bin/php
PHP version:	7.4.10
php.ini used:	/usr/local/etc/php/7.4/php-cli.ini
WP-CLI root dir:	phar://wp-cli.phar/vendor/wp-cli/wp-cli
WP-CLI vendor dir:	phar://wp-cli.phar/vendor
WP_CLI phar path:	/Users/ian-work/vhosts/localhost/wp.test/public_html/content/plugins/gutenberg
WP-CLI packages dir:	/Users/ian-work/.wp-cli/packages/
WP-CLI global config:
WP-CLI project config:	/Users/ian-work/vhosts/localhost/wp.test/wp-cli.yml
WP-CLI version:	2.4.0

</issue_description>

<agent_instructions>Use WP_Automatic_Updater::is_vcs_checkout helper to warn for VCS controlled plugins/themes and skip them. Add a flag to still allow include them.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

@danielbachhuber I'm open to either changing the default behavior, or introducing a `--skip-vcs` flag to maintain backwards compatibility.

It would be good to parallel whatever core does in this regard (I don't recall exactly off the top of my head).</comment_new>

• Fixes Ignore VSC folders by default with update subcommand #257

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.

[codecov]

Codecov Report

❌ Patch coverage is 92.85714% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/WP_CLI/CommandWithUpgrade.php	92.85%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

This PR prevents wp plugin update / wp theme update from destructively updating VCS checkouts (e.g., git clones) by default, aligning update behavior with WordPress core’s VCS detection and adding an override flag when the destructive behavior is intentional.

Changes:

• Add VCS-checkout detection in CommandWithUpgrade::update_many() and skip affected plugins/themes by default with a warning.
• Introduce --include-vcs option to allow updating VCS-controlled plugins/themes when explicitly requested.
• Add Behat coverage for skip-by-default and override behavior for both plugins and themes.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/WP_CLI/CommandWithUpgrade.php	Filters plugin/theme update queue to skip items detected as VCS checkouts unless --include-vcs is provided.
src/Plugin_Command.php	Documents new --include-vcs option for wp plugin update.
src/Theme_Command.php	Documents new --include-vcs option for wp theme update.
features/plugin-update.feature	Adds scenarios for skipping VCS plugins and overriding with --include-vcs.
features/theme-update.feature	Adds scenarios for skipping VCS themes and overriding with --include-vcs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.