Add --auto-update-indicated flag to plugin update and theme update commands

[Copilot]

Implementation Plan: Add --auto-update-indicated flag to plugin and theme update

• Explore repository structure and understand update mechanism
• Understand how plugin update information is retrieved and processed
• Add --auto-update-indicated flag to Plugin_Command::update() method
• Extract autoupdate field from WordPress.org API response in get_item_list()
• Filter plugins based on autoupdate flag when --auto-update-indicated is used
• Set default version to server-indicated version when flag is used
• Display auto-update-indicated information in plugin list output
• Run linter and code quality checks (all passing)
• Add Behat tests for the new functionality
• Run unit tests (passing)
• Address code review feedback
• Add validation for --minor/--patch incompatibility
• Add validation for plugin names with --auto-update-indicated
• Add comprehensive test scenarios for plugins
• Add auto-update-indicated support for themes
• Extract autoupdate field for themes
• Add validation for themes with --auto-update-indicated
• Add comprehensive test scenarios for themes
• Run security checks with CodeQL (no issues)

Summary

This PR implements support for WordPress.org's server-indicated automatic updates by adding a --auto-update-indicated flag to both wp plugin update and wp theme update commands.

Changes Made

1. Plugins:

   • New field auto_update_indicated: Extracted from WordPress.org API response and displayed in plugin lists
   • New flag --auto-update-indicated: Filters updates to only plugins with server-indicated automatic updates
   • Comprehensive validation (cannot be combined with --version, --minor, --patch, or plugin names)
   • 7 test scenarios covering all validation cases and behaviors

2. Themes (NEW):

   • New field auto_update_indicated: Extracted from WordPress.org API response and displayed in theme lists
   • New flag --auto-update-indicated: Filters updates to only themes with server-indicated automatic updates
   • Comprehensive validation (cannot be combined with --version, --minor, --patch, or theme names)
   • 7 test scenarios covering all validation cases and behaviors

Usage

# Plugins
wp plugin list --fields=name,version,update,auto_update_indicated
wp plugin update --auto-update-indicated
wp plugin update --auto-update-indicated --dry-run

# Themes
wp theme list --fields=name,version,update,auto_update_indicated
wp theme update --auto-update-indicated
wp theme update --auto-update-indicated --dry-run

Files Changed

• src/Plugin_Command.php: Plugin implementation with validation
• src/Theme_Command.php: Theme implementation with validation
• src/WP_CLI/CommandWithUpgrade.php: Display conversion logic
• src/WP_CLI/ParseThemeNameInput.php: Theme field extraction
• features/plugin-update.feature: 7 test scenarios for plugins
• features/theme-update.feature: 7 test scenarios for themes

Code Quality

✅ Linting (composer lint) - PASSED
✅ Code style (composer phpcs) - PASSED
⚠️ Static analysis (composer phpstan) - Pre-existing errors unrelated to changes

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Feature: "plugin update" should identify plugins where the server response indicates automatic update</issue_title>
<issue_description>## Feature Request

• Yes, I reviewed the contribution guidelines.

Describe your use case and the problem you are facing

Background: when wordpress.org (or a third-party server) is asked about updates for a plugin, the response includes a flag that indicates whether an automatic update of the plugin should be carried out. (This is not to be confused with the WordPress saved settings for automatically updating plugins). wordpress.org use this flag to push automatic updates in the case of large plugins with security vulnerabilities (there is code in WordPress core to recognise it and respond to it). When this flag is set, the response indicates the recommended update (which is not necessarily the latest - sometimes, the plugin may have multiple updates available which update the "minor" version series, so that things aren't broken by an undesired major update; e.g. there are releases of Foo 1.3.2, 1.2.4 and 1.1.5 which contain only the fixes for the security issues in 1.3.1, 1.2.3 and 1.1.4 ).

Use case: I wish to update only plugins which have this flag set, and update to the indicated version. My WordPress install does not update automatically because it is locked down to prevent WordPress self-modifying plugin/theme files when within an "HTTP" context. But those restrictions are not active in a "CLI" context, and there, WordPress can self-modify.

Describe the solution you'd like

1. Add a --auto-update-indicated switch to https://developer.wordpress.org/cli/commands/plugin/update/ to indicate only to update plugins with this flag set (and in this case, the default value of --version should be the version indicated by the server response, not the otherwise default of the latest release available).

2. Also perhaps include the "auto update indicated" information in the output rendered.</issue_description>

Comments on the Issue (you are @copilot in this section)

@danielbachhuber Thanks for the suggestion, @DavidAnderson684.

If this is data that WordPress.org provides, adding a flag in the manner you described seems reasonable.</comment_new>
<comment_new>@danielbachhuber
@jcvignoli I'm open to a pull request! Feel free to submit one, if you'd like. Here is some guidance on our pull request best practices.</comment_new>

• Fixes Feature: "plugin update" should identify plugins where the server response indicates automatic update #367

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.