A Grav 2 theme: when "it works" isn't enough
The theme was running on the site and looked finished. Then it turned out that "it works" and "it's right" are two different things.
In the previous part I stopped at a deployed theme. But it was still just a folder inside the site's repository. No versions, no build, no checks. Every change meant copying files by hand and hoping nothing broke.
From a pile of files to a package
The theme got its own repository, versions and an automated build. The finished package installs with a single command, and deploying no longer risks overwriting something my wife uploaded in the Admin. That part was quick and boring. What came next was the interesting bit.
A review that slowed us down and made it better
I had marked the report as finished without anyone going through it. Only a separate review found things my own tests never caught: a page that could be crashed with a single bad URL, personal data left in the default settings, and Czech links hardcoded in the code. Nothing dramatic, but exactly what would pop up first on someone else's site.
While at it, we removed my wife's branding from the package so it never reaches strangers. That included rewriting the Git history and deleting the old releases. We deliberately left these irreversible steps to a human rather than trying to automate them.
Checks that have to be able to fail
Today the theme is guarded by automation: templates, code, secrets across the whole history, and dependencies. I verified every check by deliberately introducing an error and watching whether CI failed. One test, it turned out, was passing without testing what I thought it did. And the nicest surprise: even a tool pinned to a specific version, which looks safe, had known vulnerabilities.
An Admin that speaks your language
Forms in the administration now switch to the language of the logged-in user, and colours are set in configuration, not in code. Small things, but they turn it into something you could hand over to someone else.
What follows from it
- A review can't be replaced by tests I wrote myself. Someone who asks different questions helps.
- A test that never failed tells you nothing. A good check has to be able to fail.
- Verify where a human will see it. Only the real Admin gave me certainty that the translations work.
It wasn't straightforward and we got stuck several times. But the result is a theme you can rely on more than on a folder of files, and above all a way of working that moves us towards a better output.
