From 87d0633b002be2333bce15a78317dbba0fcd01d6 Mon Sep 17 00:00:00 2001 From: Joe Fusco Date: Sat, 25 Jul 2026 09:20:32 -0400 Subject: [PATCH 1/8] ci: skip expensive checks on release-please branches --- .github/workflows/multisite.yml | 1 + .github/workflows/phpcs.yml | 1 + .github/workflows/phpstan.yml | 1 + .github/workflows/phpunit.yml | 1 + .github/workflows/plugin-check.yml | 1 + 5 files changed, 5 insertions(+) diff --git a/.github/workflows/multisite.yml b/.github/workflows/multisite.yml index 56200a0f..9342c469 100644 --- a/.github/workflows/multisite.yml +++ b/.github/workflows/multisite.yml @@ -15,6 +15,7 @@ concurrency: jobs: multisite: + if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.ref, 'refs/heads/release-please--') }} runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 diff --git a/.github/workflows/phpcs.yml b/.github/workflows/phpcs.yml index bfd7393c..fb416c08 100644 --- a/.github/workflows/phpcs.yml +++ b/.github/workflows/phpcs.yml @@ -15,6 +15,7 @@ concurrency: jobs: phpcs: + if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.ref, 'refs/heads/release-please--') }} runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 diff --git a/.github/workflows/phpstan.yml b/.github/workflows/phpstan.yml index 32b2e02f..3324a98c 100644 --- a/.github/workflows/phpstan.yml +++ b/.github/workflows/phpstan.yml @@ -15,6 +15,7 @@ concurrency: jobs: phpstan: + if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.ref, 'refs/heads/release-please--') }} runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml index b3947f30..72de6f66 100644 --- a/.github/workflows/phpunit.yml +++ b/.github/workflows/phpunit.yml @@ -15,6 +15,7 @@ concurrency: jobs: phpunit: + if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.ref, 'refs/heads/release-please--') }} name: PHP ${{ matrix.php }} runs-on: ubuntu-latest strategy: diff --git a/.github/workflows/plugin-check.yml b/.github/workflows/plugin-check.yml index e4d555cf..cbfc7063 100644 --- a/.github/workflows/plugin-check.yml +++ b/.github/workflows/plugin-check.yml @@ -21,6 +21,7 @@ permissions: jobs: plugin-check: + if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.ref, 'refs/heads/release-please--') }} runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 From d357f6975b627f2907092e77b2815ea6be9845bb Mon Sep 17 00:00:00 2001 From: Joe Fusco Date: Sat, 25 Jul 2026 09:24:58 -0400 Subject: [PATCH 2/8] ci: consolidate checks into single workflow with release-please gate --- .github/workflows/ci.yml | 175 +++++++++++++++++++++++++++++ .github/workflows/multisite.yml | 38 ------- .github/workflows/phpcs.yml | 31 ----- .github/workflows/phpstan.yml | 33 ------ .github/workflows/phpunit.yml | 54 --------- .github/workflows/plugin-check.yml | 79 ------------- README.md | 2 +- 7 files changed, 176 insertions(+), 236 deletions(-) create mode 100644 .github/workflows/ci.yml delete mode 100644 .github/workflows/multisite.yml delete mode 100644 .github/workflows/phpcs.yml delete mode 100644 .github/workflows/phpstan.yml delete mode 100644 .github/workflows/phpunit.yml delete mode 100644 .github/workflows/plugin-check.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 00000000..c46a29bd --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,175 @@ +name: CI + +on: + push: + branches: [ main ] + pull_request: + branches: [ main ] + +permissions: + contents: read + +concurrency: + group: ci-${{ github.ref }} + cancel-in-progress: true + +jobs: + gate: + runs-on: ubuntu-latest + if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.ref, 'refs/heads/release-please--') }} + steps: + - run: true + + phpcs: + needs: gate + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + - uses: shivammathur/setup-php@v2 + with: + php-version: '8.3' + tools: composer + - uses: actions/cache@v6 + with: + path: ~/.composer/cache + key: composer-${{ hashFiles('composer.json') }} + - run: composer install --no-interaction + - run: ./vendor/bin/phpcs --standard=phpcs.xml.dist + + phpstan: + needs: gate + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + - uses: shivammathur/setup-php@v2 + with: + php-version: '8.3' + tools: composer + - uses: actions/cache@v6 + with: + path: ~/.composer/cache + key: composer-${{ hashFiles('composer.json') }} + - run: composer install --no-interaction + # `--error-format=github` renders findings as inline PR annotations + # on the diff, the same shape PHPCS uses via its own GitHub formatter. + - run: ./vendor/bin/phpstan analyse --no-progress --error-format=github + + phpunit: + needs: gate + name: PHP ${{ matrix.php }} + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + php: [ '7.4', '8.3' ] + include: + - php: '8.3' + coverage: true + steps: + - uses: actions/checkout@v7 + - uses: actions/setup-node@v4 + with: + node-version: 20 + cache: npm + - uses: shivammathur/setup-php@v2 + with: + php-version: '8.3' + tools: composer + - run: npm ci + # Avoids the intermittent 504s on api.github.com during wp-env's + # Docker build (PR #22). Authenticated requests dodge the issue. + - name: Authenticate composer to GitHub + run: composer config --global --auth github-oauth.github.com '${{ secrets.GITHUB_TOKEN }}' + - run: npx wp-env start ${{ matrix.coverage && '--xdebug=coverage' || '' }} + env: + WP_ENV_PHP_VERSION: ${{ matrix.php }} + - run: npx wp-env run tests-cli -- composer require --dev phpunit/phpunit:^9.6 yoast/phpunit-polyfills:^2.0 --working-dir=/var/www/html --update-with-all-dependencies + - run: npx wp-env run tests-cli --env-cwd='wp-content/plugins/presence-api' -- /var/www/html/vendor/bin/phpunit ${{ matrix.coverage && '--coverage-clover coverage.xml' || '' }} + - name: Upload coverage to Codecov + if: ${{ matrix.coverage }} + uses: codecov/codecov-action@v5 + with: + token: ${{ secrets.CODECOV_TOKEN }} + files: coverage.xml + flags: phpunit + + multisite: + needs: gate + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + - uses: actions/setup-node@v4 + with: + node-version: 20 + cache: npm + - uses: shivammathur/setup-php@v2 + with: + php-version: '8.3' + tools: composer + - run: npm ci + # Avoids the intermittent 504s on api.github.com during wp-env's + # Docker build (PR #22). Authenticated requests dodge the issue. + - name: Authenticate composer to GitHub + run: composer config --global --auth github-oauth.github.com '${{ secrets.GITHUB_TOKEN }}' + - run: npx wp-env start + - run: npx wp-env run tests-cli -- composer require --dev phpunit/phpunit:^9.6 yoast/phpunit-polyfills:^2.0 --working-dir=/var/www/html --update-with-all-dependencies + - run: npx wp-env run tests-cli -- wp core multisite-convert --title="Test Network" + - run: npx wp-env run tests-cli --env-cwd='wp-content/plugins/presence-api' -- /var/www/html/vendor/bin/phpunit + + plugin-check: + needs: gate + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + + - uses: shivammathur/setup-php@v2 + with: + php-version: '8.3' + tools: composer + + # Match `release.yml` — no dev deps, optimized autoloader, scripts + # disabled — so what's checked is what would ship. + - run: composer install --no-dev --no-interaction --optimize-autoloader --no-scripts + + - uses: actions/setup-node@v4 + with: + node-version: '22' + + - run: npm install -g @wordpress/env@11.8.1 + + # Avoids the intermittent 504s on api.github.com during wp-env's + # Docker build (PR #22). Authenticated requests dodge the issue. + - name: Authenticate composer to GitHub + run: composer config --global --auth github-oauth.github.com '${{ secrets.GITHUB_TOKEN }}' + + # Build the plugin tree the same way `release.yml` does so + # plugin-check sees only what would actually ship — `.distignore` + # excludes `.wp-env.json`, the `*.dist` configs, tests, and other + # dev files that the live WP.org plugin directory wouldn't see. + - name: Build the plugin + run: | + mkdir -p build/presence-api + rsync -a --exclude-from='.distignore' --exclude='build' ./ build/presence-api/ + + # Point wp-env at the built tree instead of the repo root so the + # `presence-api` slug it loads is the directory plugin-check + # should be analyzing. + - name: Mount the built plugin into wp-env + run: | + cat > .wp-env.override.json <<'JSON' + { "plugins": [ "./build/presence-api" ] } + JSON + + - run: wp-env start --update + + - name: Install Plugin Check inside wp-env + run: | + wp-env run cli wp plugin install plugin-check --activate + wp-env run cli wp plugin activate presence-api + + # `strict-table` is the only built-in format that's human-readable + # in CI logs and exits non-zero when errors are found. (Plain + # `table` always exits 0 even with findings.) + - name: Run Plugin Check + run: | + wp-env run cli wp plugin check presence-api --format=strict-table diff --git a/.github/workflows/multisite.yml b/.github/workflows/multisite.yml deleted file mode 100644 index 9342c469..00000000 --- a/.github/workflows/multisite.yml +++ /dev/null @@ -1,38 +0,0 @@ -name: Multisite - -on: - push: - branches: [ main ] - pull_request: - branches: [ main ] - -permissions: - contents: read - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - multisite: - if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.ref, 'refs/heads/release-please--') }} - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: npm - - uses: shivammathur/setup-php@v2 - with: - php-version: '8.3' - tools: composer - - run: npm ci - # Avoids the intermittent 504s on api.github.com during wp-env's - # Docker build (PR #22). Authenticated requests dodge the issue. - - name: Authenticate composer to GitHub - run: composer config --global --auth github-oauth.github.com '${{ secrets.GITHUB_TOKEN }}' - - run: npx wp-env start - - run: npx wp-env run tests-cli -- composer require --dev phpunit/phpunit:^9.6 yoast/phpunit-polyfills:^2.0 --working-dir=/var/www/html --update-with-all-dependencies - - run: npx wp-env run tests-cli -- wp core multisite-convert --title="Test Network" - - run: npx wp-env run tests-cli --env-cwd='wp-content/plugins/presence-api' -- /var/www/html/vendor/bin/phpunit diff --git a/.github/workflows/phpcs.yml b/.github/workflows/phpcs.yml deleted file mode 100644 index fb416c08..00000000 --- a/.github/workflows/phpcs.yml +++ /dev/null @@ -1,31 +0,0 @@ -name: PHPCS - -on: - push: - branches: [ main ] - pull_request: - branches: [ main ] - -permissions: - contents: read - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - phpcs: - if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.ref, 'refs/heads/release-please--') }} - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7 - - uses: shivammathur/setup-php@v2 - with: - php-version: '8.3' - tools: composer - - uses: actions/cache@v6 - with: - path: ~/.composer/cache - key: composer-${{ hashFiles('composer.json') }} - - run: composer install --no-interaction - - run: ./vendor/bin/phpcs --standard=phpcs.xml.dist diff --git a/.github/workflows/phpstan.yml b/.github/workflows/phpstan.yml deleted file mode 100644 index 3324a98c..00000000 --- a/.github/workflows/phpstan.yml +++ /dev/null @@ -1,33 +0,0 @@ -name: PHPStan - -on: - push: - branches: [ main ] - pull_request: - branches: [ main ] - -permissions: - contents: read - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - phpstan: - if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.ref, 'refs/heads/release-please--') }} - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7 - - uses: shivammathur/setup-php@v2 - with: - php-version: '8.3' - tools: composer - - uses: actions/cache@v6 - with: - path: ~/.composer/cache - key: composer-${{ hashFiles('composer.json') }} - - run: composer install --no-interaction - # `--error-format=github` renders findings as inline PR annotations - # on the diff, the same shape PHPCS uses via its own GitHub formatter. - - run: ./vendor/bin/phpstan analyse --no-progress --error-format=github diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml deleted file mode 100644 index 72de6f66..00000000 --- a/.github/workflows/phpunit.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: PHPUnit - -on: - push: - branches: [ main ] - pull_request: - branches: [ main ] - -permissions: - contents: read - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - phpunit: - if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.ref, 'refs/heads/release-please--') }} - name: PHP ${{ matrix.php }} - runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - php: [ '7.4', '8.3' ] - include: - - php: '8.3' - coverage: true - steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: npm - - uses: shivammathur/setup-php@v2 - with: - php-version: '8.3' - tools: composer - - run: npm ci - # Avoids the intermittent 504s on api.github.com during wp-env's - # Docker build (PR #22). Authenticated requests dodge the issue. - - name: Authenticate composer to GitHub - run: composer config --global --auth github-oauth.github.com '${{ secrets.GITHUB_TOKEN }}' - - run: npx wp-env start ${{ matrix.coverage && '--xdebug=coverage' || '' }} - env: - WP_ENV_PHP_VERSION: ${{ matrix.php }} - - run: npx wp-env run tests-cli -- composer require --dev phpunit/phpunit:^9.6 yoast/phpunit-polyfills:^2.0 --working-dir=/var/www/html --update-with-all-dependencies - - run: npx wp-env run tests-cli --env-cwd='wp-content/plugins/presence-api' -- /var/www/html/vendor/bin/phpunit ${{ matrix.coverage && '--coverage-clover coverage.xml' || '' }} - - name: Upload coverage to Codecov - if: ${{ matrix.coverage }} - uses: codecov/codecov-action@v5 - with: - token: ${{ secrets.CODECOV_TOKEN }} - files: coverage.xml - flags: phpunit diff --git a/.github/workflows/plugin-check.yml b/.github/workflows/plugin-check.yml deleted file mode 100644 index cbfc7063..00000000 --- a/.github/workflows/plugin-check.yml +++ /dev/null @@ -1,79 +0,0 @@ -name: Plugin Check - -# Runs the WordPress.org Plugin Check suite against the staged plugin — -# the same checks the directory's automated review applies on submission. -# Surfaces missing `readme.txt` fields, license-header issues, forbidden -# function calls, and similar guideline violations before they become a -# submission blocker. - -on: - push: - branches: [ main ] - pull_request: - branches: [ main ] - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - contents: read - -jobs: - plugin-check: - if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.ref, 'refs/heads/release-please--') }} - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7 - - - uses: shivammathur/setup-php@v2 - with: - php-version: '8.3' - tools: composer - - # Match `release.yml` — no dev deps, optimized autoloader, scripts - # disabled — so what's checked is what would ship. - - run: composer install --no-dev --no-interaction --optimize-autoloader --no-scripts - - - uses: actions/setup-node@v4 - with: - node-version: '22' - - - run: npm install -g @wordpress/env@11.8.1 - - # Avoids the intermittent 504s on api.github.com during wp-env's - # Docker build (PR #22). Authenticated requests dodge the issue. - - name: Authenticate composer to GitHub - run: composer config --global --auth github-oauth.github.com '${{ secrets.GITHUB_TOKEN }}' - - # Build the plugin tree the same way `release.yml` does so - # plugin-check sees only what would actually ship — `.distignore` - # excludes `.wp-env.json`, the `*.dist` configs, tests, and other - # dev files that the live WP.org plugin directory wouldn't see. - - name: Build the plugin - run: | - mkdir -p build/presence-api - rsync -a --exclude-from='.distignore' --exclude='build' ./ build/presence-api/ - - # Point wp-env at the built tree instead of the repo root so the - # `presence-api` slug it loads is the directory plugin-check - # should be analyzing. - - name: Mount the built plugin into wp-env - run: | - cat > .wp-env.override.json <<'JSON' - { "plugins": [ "./build/presence-api" ] } - JSON - - - run: wp-env start --update - - - name: Install Plugin Check inside wp-env - run: | - wp-env run cli wp plugin install plugin-check --activate - wp-env run cli wp plugin activate presence-api - - # `strict-table` is the only built-in format that's human-readable - # in CI logs and exits non-zero when errors are found. (Plain - # `table` always exits 0 even with findings.) - - name: Run Plugin Check - run: | - wp-env run cli wp plugin check presence-api --format=strict-table diff --git a/README.md b/README.md index 9499e36c..74fdac90 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # Presence API -[![PHPCS](https://github.com/WordPress/presence-api/actions/workflows/phpcs.yml/badge.svg)](https://github.com/WordPress/presence-api/actions/workflows/phpcs.yml) [![PHPUnit](https://github.com/WordPress/presence-api/actions/workflows/phpunit.yml/badge.svg)](https://github.com/WordPress/presence-api/actions/workflows/phpunit.yml) [![Multisite](https://github.com/WordPress/presence-api/actions/workflows/multisite.yml/badge.svg)](https://github.com/WordPress/presence-api/actions/workflows/multisite.yml) +[![CI](https://github.com/WordPress/presence-api/actions/workflows/ci.yml/badge.svg)](https://github.com/WordPress/presence-api/actions/workflows/ci.yml) > **Status:** Experimental feature plugin From 3d5e8b5bcd8e7e0abbb012b34cac99c695c3e8b9 Mon Sep 17 00:00:00 2001 From: Joe Fusco Date: Sat, 25 Jul 2026 09:45:26 -0400 Subject: [PATCH 3/8] ci: refactor into reusable workflows with a lean orchestrator --- .github/workflows/ci.yml | 145 ++--------------------------- .github/workflows/multisite.yml | 30 ++++++ .github/workflows/phpcs.yml | 23 +++++ .github/workflows/phpstan.yml | 25 +++++ .github/workflows/phpunit.yml | 46 +++++++++ .github/workflows/plugin-check.yml | 50 ++++++++++ 6 files changed, 180 insertions(+), 139 deletions(-) create mode 100644 .github/workflows/multisite.yml create mode 100644 .github/workflows/phpcs.yml create mode 100644 .github/workflows/phpstan.yml create mode 100644 .github/workflows/phpunit.yml create mode 100644 .github/workflows/plugin-check.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c46a29bd..73096ff8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,154 +22,21 @@ jobs: phpcs: needs: gate - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7 - - uses: shivammathur/setup-php@v2 - with: - php-version: '8.3' - tools: composer - - uses: actions/cache@v6 - with: - path: ~/.composer/cache - key: composer-${{ hashFiles('composer.json') }} - - run: composer install --no-interaction - - run: ./vendor/bin/phpcs --standard=phpcs.xml.dist + uses: ./.github/workflows/phpcs.yml phpstan: needs: gate - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7 - - uses: shivammathur/setup-php@v2 - with: - php-version: '8.3' - tools: composer - - uses: actions/cache@v6 - with: - path: ~/.composer/cache - key: composer-${{ hashFiles('composer.json') }} - - run: composer install --no-interaction - # `--error-format=github` renders findings as inline PR annotations - # on the diff, the same shape PHPCS uses via its own GitHub formatter. - - run: ./vendor/bin/phpstan analyse --no-progress --error-format=github + uses: ./.github/workflows/phpstan.yml phpunit: needs: gate - name: PHP ${{ matrix.php }} - runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - php: [ '7.4', '8.3' ] - include: - - php: '8.3' - coverage: true - steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: npm - - uses: shivammathur/setup-php@v2 - with: - php-version: '8.3' - tools: composer - - run: npm ci - # Avoids the intermittent 504s on api.github.com during wp-env's - # Docker build (PR #22). Authenticated requests dodge the issue. - - name: Authenticate composer to GitHub - run: composer config --global --auth github-oauth.github.com '${{ secrets.GITHUB_TOKEN }}' - - run: npx wp-env start ${{ matrix.coverage && '--xdebug=coverage' || '' }} - env: - WP_ENV_PHP_VERSION: ${{ matrix.php }} - - run: npx wp-env run tests-cli -- composer require --dev phpunit/phpunit:^9.6 yoast/phpunit-polyfills:^2.0 --working-dir=/var/www/html --update-with-all-dependencies - - run: npx wp-env run tests-cli --env-cwd='wp-content/plugins/presence-api' -- /var/www/html/vendor/bin/phpunit ${{ matrix.coverage && '--coverage-clover coverage.xml' || '' }} - - name: Upload coverage to Codecov - if: ${{ matrix.coverage }} - uses: codecov/codecov-action@v5 - with: - token: ${{ secrets.CODECOV_TOKEN }} - files: coverage.xml - flags: phpunit + uses: ./.github/workflows/phpunit.yml + secrets: inherit multisite: needs: gate - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: npm - - uses: shivammathur/setup-php@v2 - with: - php-version: '8.3' - tools: composer - - run: npm ci - # Avoids the intermittent 504s on api.github.com during wp-env's - # Docker build (PR #22). Authenticated requests dodge the issue. - - name: Authenticate composer to GitHub - run: composer config --global --auth github-oauth.github.com '${{ secrets.GITHUB_TOKEN }}' - - run: npx wp-env start - - run: npx wp-env run tests-cli -- composer require --dev phpunit/phpunit:^9.6 yoast/phpunit-polyfills:^2.0 --working-dir=/var/www/html --update-with-all-dependencies - - run: npx wp-env run tests-cli -- wp core multisite-convert --title="Test Network" - - run: npx wp-env run tests-cli --env-cwd='wp-content/plugins/presence-api' -- /var/www/html/vendor/bin/phpunit + uses: ./.github/workflows/multisite.yml plugin-check: needs: gate - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7 - - - uses: shivammathur/setup-php@v2 - with: - php-version: '8.3' - tools: composer - - # Match `release.yml` — no dev deps, optimized autoloader, scripts - # disabled — so what's checked is what would ship. - - run: composer install --no-dev --no-interaction --optimize-autoloader --no-scripts - - - uses: actions/setup-node@v4 - with: - node-version: '22' - - - run: npm install -g @wordpress/env@11.8.1 - - # Avoids the intermittent 504s on api.github.com during wp-env's - # Docker build (PR #22). Authenticated requests dodge the issue. - - name: Authenticate composer to GitHub - run: composer config --global --auth github-oauth.github.com '${{ secrets.GITHUB_TOKEN }}' - - # Build the plugin tree the same way `release.yml` does so - # plugin-check sees only what would actually ship — `.distignore` - # excludes `.wp-env.json`, the `*.dist` configs, tests, and other - # dev files that the live WP.org plugin directory wouldn't see. - - name: Build the plugin - run: | - mkdir -p build/presence-api - rsync -a --exclude-from='.distignore' --exclude='build' ./ build/presence-api/ - - # Point wp-env at the built tree instead of the repo root so the - # `presence-api` slug it loads is the directory plugin-check - # should be analyzing. - - name: Mount the built plugin into wp-env - run: | - cat > .wp-env.override.json <<'JSON' - { "plugins": [ "./build/presence-api" ] } - JSON - - - run: wp-env start --update - - - name: Install Plugin Check inside wp-env - run: | - wp-env run cli wp plugin install plugin-check --activate - wp-env run cli wp plugin activate presence-api - - # `strict-table` is the only built-in format that's human-readable - # in CI logs and exits non-zero when errors are found. (Plain - # `table` always exits 0 even with findings.) - - name: Run Plugin Check - run: | - wp-env run cli wp plugin check presence-api --format=strict-table + uses: ./.github/workflows/plugin-check.yml diff --git a/.github/workflows/multisite.yml b/.github/workflows/multisite.yml new file mode 100644 index 00000000..553baad3 --- /dev/null +++ b/.github/workflows/multisite.yml @@ -0,0 +1,30 @@ +name: Multisite + +on: + workflow_call: + +permissions: + contents: read + +jobs: + multisite: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + - uses: actions/setup-node@v4 + with: + node-version: 20 + cache: npm + - uses: shivammathur/setup-php@v2 + with: + php-version: '8.3' + tools: composer + - run: npm ci + # Avoids the intermittent 504s on api.github.com during wp-env's + # Docker build (PR #22). Authenticated requests dodge the issue. + - name: Authenticate composer to GitHub + run: composer config --global --auth github-oauth.github.com '${{ secrets.GITHUB_TOKEN }}' + - run: npx wp-env start + - run: npx wp-env run tests-cli -- composer require --dev phpunit/phpunit:^9.6 yoast/phpunit-polyfills:^2.0 --working-dir=/var/www/html --update-with-all-dependencies + - run: npx wp-env run tests-cli -- wp core multisite-convert --title="Test Network" + - run: npx wp-env run tests-cli --env-cwd='wp-content/plugins/presence-api' -- /var/www/html/vendor/bin/phpunit diff --git a/.github/workflows/phpcs.yml b/.github/workflows/phpcs.yml new file mode 100644 index 00000000..13cb2ccb --- /dev/null +++ b/.github/workflows/phpcs.yml @@ -0,0 +1,23 @@ +name: PHPCS + +on: + workflow_call: + +permissions: + contents: read + +jobs: + phpcs: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + - uses: shivammathur/setup-php@v2 + with: + php-version: '8.3' + tools: composer + - uses: actions/cache@v6 + with: + path: ~/.composer/cache + key: composer-${{ hashFiles('composer.json') }} + - run: composer install --no-interaction + - run: ./vendor/bin/phpcs --standard=phpcs.xml.dist diff --git a/.github/workflows/phpstan.yml b/.github/workflows/phpstan.yml new file mode 100644 index 00000000..09b906c0 --- /dev/null +++ b/.github/workflows/phpstan.yml @@ -0,0 +1,25 @@ +name: PHPStan + +on: + workflow_call: + +permissions: + contents: read + +jobs: + phpstan: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + - uses: shivammathur/setup-php@v2 + with: + php-version: '8.3' + tools: composer + - uses: actions/cache@v6 + with: + path: ~/.composer/cache + key: composer-${{ hashFiles('composer.json') }} + - run: composer install --no-interaction + # `--error-format=github` renders findings as inline PR annotations + # on the diff, the same shape PHPCS uses via its own GitHub formatter. + - run: ./vendor/bin/phpstan analyse --no-progress --error-format=github diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml new file mode 100644 index 00000000..ff67f19b --- /dev/null +++ b/.github/workflows/phpunit.yml @@ -0,0 +1,46 @@ +name: PHPUnit + +on: + workflow_call: + +permissions: + contents: read + +jobs: + phpunit: + name: PHP ${{ matrix.php }} + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + php: [ '7.4', '8.3' ] + include: + - php: '8.3' + coverage: true + steps: + - uses: actions/checkout@v7 + - uses: actions/setup-node@v4 + with: + node-version: 20 + cache: npm + - uses: shivammathur/setup-php@v2 + with: + php-version: '8.3' + tools: composer + - run: npm ci + # Avoids the intermittent 504s on api.github.com during wp-env's + # Docker build (PR #22). Authenticated requests dodge the issue. + - name: Authenticate composer to GitHub + run: composer config --global --auth github-oauth.github.com '${{ secrets.GITHUB_TOKEN }}' + - run: npx wp-env start ${{ matrix.coverage && '--xdebug=coverage' || '' }} + env: + WP_ENV_PHP_VERSION: ${{ matrix.php }} + - run: npx wp-env run tests-cli -- composer require --dev phpunit/phpunit:^9.6 yoast/phpunit-polyfills:^2.0 --working-dir=/var/www/html --update-with-all-dependencies + - run: npx wp-env run tests-cli --env-cwd='wp-content/plugins/presence-api' -- /var/www/html/vendor/bin/phpunit ${{ matrix.coverage && '--coverage-clover coverage.xml' || '' }} + - name: Upload coverage to Codecov + if: ${{ matrix.coverage }} + uses: codecov/codecov-action@v5 + with: + token: ${{ secrets.CODECOV_TOKEN }} + files: coverage.xml + flags: phpunit diff --git a/.github/workflows/plugin-check.yml b/.github/workflows/plugin-check.yml new file mode 100644 index 00000000..673f7bd2 --- /dev/null +++ b/.github/workflows/plugin-check.yml @@ -0,0 +1,50 @@ +name: Plugin Check + +on: + workflow_call: + +permissions: + contents: read + +jobs: + plugin-check: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + + - uses: shivammathur/setup-php@v2 + with: + php-version: '8.3' + tools: composer + + - run: composer install --no-dev --no-interaction --optimize-autoloader --no-scripts + + - uses: actions/setup-node@v4 + with: + node-version: '22' + + - run: npm install -g @wordpress/env@11.8.1 + + - name: Authenticate composer to GitHub + run: composer config --global --auth github-oauth.github.com '${{ secrets.GITHUB_TOKEN }}' + + - name: Build plugin + run: | + mkdir -p build/presence-api + rsync -a --exclude-from='.distignore' --exclude='build' ./ build/presence-api/ + + - name: Configure wp-env to mount built plugin + run: | + cat > .wp-env.override.json <<'JSON' + { "plugins": [ "./build/presence-api" ] } + JSON + + - run: wp-env start + + - name: Install Plugin Check + run: | + wp-env run cli wp plugin install plugin-check --activate + wp-env run cli wp plugin activate presence-api + + - name: Run Plugin Check + run: wp-env run cli wp plugin check presence-api --format=strict-table From fd23568cf346ff3a4af76f90a0aa7455d1bd9035 Mon Sep 17 00:00:00 2001 From: Joe Fusco Date: Sat, 25 Jul 2026 09:58:52 -0400 Subject: [PATCH 4/8] ci: pass only CODECOV_TOKEN to phpunit instead of inheriting all secrets --- .github/workflows/ci.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 73096ff8..c9aab8ca 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -31,7 +31,8 @@ jobs: phpunit: needs: gate uses: ./.github/workflows/phpunit.yml - secrets: inherit + secrets: + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} multisite: needs: gate From 42afa2e6ef81abf2163f5f056b30a454c4655049 Mon Sep 17 00:00:00 2001 From: Joe Fusco Date: Sat, 25 Jul 2026 10:18:24 -0400 Subject: [PATCH 5/8] ci: pin action SHAs, scope permissions, and harden workflows --- .github/workflows/deploy-wporg.yml | 3 +- .github/workflows/multisite.yml | 10 +++---- .github/workflows/phpcs.yml | 8 ++++-- .github/workflows/phpstan.yml | 8 ++++-- .github/workflows/phpunit.yml | 12 ++++---- .github/workflows/playground-preview.yml | 16 +++++++---- .github/workflows/plugin-check.yml | 8 ++++-- .github/workflows/release-please.yml | 36 +++++++++++++++++------- .github/workflows/typos.yml | 4 ++- .github/workflows/workflow-scripts.yml | 4 ++- 10 files changed, 70 insertions(+), 39 deletions(-) diff --git a/.github/workflows/deploy-wporg.yml b/.github/workflows/deploy-wporg.yml index a221f6cc..d194deba 100644 --- a/.github/workflows/deploy-wporg.yml +++ b/.github/workflows/deploy-wporg.yml @@ -47,8 +47,9 @@ jobs: fi printf 'ref=refs/tags/%s\n' "$TAG" >> "$GITHUB_OUTPUT" printf 'version=%s\n' "${TAG#v}" >> "$GITHUB_OUTPUT" - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: + persist-credentials: false ref: ${{ steps.inputs.outputs.ref }} - name: Deploy to WordPress.org Plugin Directory uses: 10up/action-wordpress-plugin-deploy@54bd289b8525fd23a5c365ec369185f2966529c2 # stable diff --git a/.github/workflows/multisite.yml b/.github/workflows/multisite.yml index 553baad3..ae182c45 100644 --- a/.github/workflows/multisite.yml +++ b/.github/workflows/multisite.yml @@ -10,18 +10,18 @@ jobs: multisite: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v4 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + with: + persist-credentials: false + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20 cache: npm - - uses: shivammathur/setup-php@v2 + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.3' tools: composer - run: npm ci - # Avoids the intermittent 504s on api.github.com during wp-env's - # Docker build (PR #22). Authenticated requests dodge the issue. - name: Authenticate composer to GitHub run: composer config --global --auth github-oauth.github.com '${{ secrets.GITHUB_TOKEN }}' - run: npx wp-env start diff --git a/.github/workflows/phpcs.yml b/.github/workflows/phpcs.yml index 13cb2ccb..7dec995c 100644 --- a/.github/workflows/phpcs.yml +++ b/.github/workflows/phpcs.yml @@ -10,12 +10,14 @@ jobs: phpcs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: shivammathur/setup-php@v2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + with: + persist-credentials: false + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.3' tools: composer - - uses: actions/cache@v6 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 with: path: ~/.composer/cache key: composer-${{ hashFiles('composer.json') }} diff --git a/.github/workflows/phpstan.yml b/.github/workflows/phpstan.yml index 09b906c0..61174737 100644 --- a/.github/workflows/phpstan.yml +++ b/.github/workflows/phpstan.yml @@ -10,12 +10,14 @@ jobs: phpstan: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 - - uses: shivammathur/setup-php@v2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + with: + persist-credentials: false + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.3' tools: composer - - uses: actions/cache@v6 + - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 with: path: ~/.composer/cache key: composer-${{ hashFiles('composer.json') }} diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml index ff67f19b..4e7bcaf9 100644 --- a/.github/workflows/phpunit.yml +++ b/.github/workflows/phpunit.yml @@ -18,18 +18,18 @@ jobs: - php: '8.3' coverage: true steps: - - uses: actions/checkout@v7 - - uses: actions/setup-node@v4 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + with: + persist-credentials: false + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: 20 cache: npm - - uses: shivammathur/setup-php@v2 + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.3' tools: composer - run: npm ci - # Avoids the intermittent 504s on api.github.com during wp-env's - # Docker build (PR #22). Authenticated requests dodge the issue. - name: Authenticate composer to GitHub run: composer config --global --auth github-oauth.github.com '${{ secrets.GITHUB_TOKEN }}' - run: npx wp-env start ${{ matrix.coverage && '--xdebug=coverage' || '' }} @@ -39,7 +39,7 @@ jobs: - run: npx wp-env run tests-cli --env-cwd='wp-content/plugins/presence-api' -- /var/www/html/vendor/bin/phpunit ${{ matrix.coverage && '--coverage-clover coverage.xml' || '' }} - name: Upload coverage to Codecov if: ${{ matrix.coverage }} - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5 with: token: ${{ secrets.CODECOV_TOKEN }} files: coverage.xml diff --git a/.github/workflows/playground-preview.yml b/.github/workflows/playground-preview.yml index 4598b647..aa788584 100644 --- a/.github/workflows/playground-preview.yml +++ b/.github/workflows/playground-preview.yml @@ -33,11 +33,12 @@ jobs: runs-on: ubuntu-latest if: ${{ !startsWith(github.head_ref, 'release-please--') }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: + persist-credentials: false ref: ${{ github.event.pull_request.head.sha }} - - uses: shivammathur/setup-php@v2 + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.3' tools: composer @@ -93,20 +94,23 @@ jobs: # PR metadata as JSON (no shell-`source` upstream). The publish # workflow validates these fields with regex before using. - name: Save PR metadata + env: + PR_NUMBER: ${{ github.event.pull_request.number }} + HEAD_SHA: ${{ github.event.pull_request.head.sha }} run: | jq -n \ - --argjson pr "${{ github.event.pull_request.number }}" \ - --arg sha "${{ github.event.pull_request.head.sha }}" \ + --argjson pr "$PR_NUMBER" \ + --arg sha "$HEAD_SHA" \ '{pr_number: $pr, head_sha: $sha}' > pr-meta.json - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: release-assets path: release-assets/ retention-days: 14 if-no-files-found: error - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: pr-meta path: pr-meta.json diff --git a/.github/workflows/plugin-check.yml b/.github/workflows/plugin-check.yml index 673f7bd2..1732dad5 100644 --- a/.github/workflows/plugin-check.yml +++ b/.github/workflows/plugin-check.yml @@ -10,16 +10,18 @@ jobs: plugin-check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + with: + persist-credentials: false - - uses: shivammathur/setup-php@v2 + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.3' tools: composer - run: composer install --no-dev --no-interaction --optimize-autoloader --no-scripts - - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 with: node-version: '22' diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 09c2d336..742d60c9 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -8,13 +8,15 @@ on: concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true -permissions: - contents: write - pull-requests: write + +permissions: {} jobs: release-please: runs-on: ubuntu-latest + permissions: + contents: write + pull-requests: write outputs: release_created: ${{ steps.release.outputs.release_created }} tag_name: ${{ steps.release.outputs.tag_name }} @@ -25,7 +27,7 @@ jobs: # disabled (and it's locked at the org level here). Authenticate with a # PAT or GitHub App token stored in the RELEASE_PLEASE_TOKEN secret so # the release PR can be created. - - uses: googleapis/release-please-action@v5 + - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5 id: release with: token: ${{ secrets.RELEASE_PLEASE_TOKEN }} @@ -39,18 +41,24 @@ jobs: needs: release-please if: ${{ needs.release-please.outputs.pr }} runs-on: ubuntu-latest + permissions: + contents: write steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: + persist-credentials: false ref: ${{ fromJSON(needs.release-please.outputs.pr).headBranchName }} - run: bash scripts/sync-versions.sh - name: Commit synced versions back to the release PR + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | if ! git diff --quiet; then git config user.name "github-actions[bot]" git config user.email "41898282+github-actions[bot]@users.noreply.github.com" git add presence-api.php readme.txt git commit -m "chore: sync versions across plugin file and readme" + gh auth setup-git git push fi @@ -64,8 +72,10 @@ jobs: pull-requests: write contents: read steps: - - uses: actions/checkout@v7 - - uses: actions/github-script@v8 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + with: + persist-credentials: false + - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 env: PROPS_SORT_LAST: ${{ vars.PROPS_SORT_LAST }} PR_NUMBER: ${{ fromJSON(needs.release-please.outputs.pr).number }} @@ -80,9 +90,13 @@ jobs: needs: release-please if: ${{ needs.release-please.outputs.release_created }} runs-on: ubuntu-latest + permissions: + contents: write steps: - - uses: actions/checkout@v7 - - uses: shivammathur/setup-php@v2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + with: + persist-credentials: false + - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.3' tools: composer @@ -102,4 +116,6 @@ jobs: uses: ./.github/workflows/deploy-wporg.yml with: tag: ${{ needs.release-please.outputs.tag_name }} - secrets: inherit + secrets: + WPORG_SVN_PASSWORD: ${{ secrets.WPORG_SVN_PASSWORD }} + WPORG_SVN_USERNAME: ${{ secrets.WPORG_SVN_USERNAME }} diff --git a/.github/workflows/typos.yml b/.github/workflows/typos.yml index 9ca38890..e4bc19d3 100644 --- a/.github/workflows/typos.yml +++ b/.github/workflows/typos.yml @@ -16,7 +16,9 @@ jobs: timeout-minutes: 5 steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + with: + persist-credentials: false - name: Search for misspellings uses: crate-ci/typos@bee27e3a4fd1ea2111cf90ab89cd076c870fce14 # v1.48.0 diff --git a/.github/workflows/workflow-scripts.yml b/.github/workflows/workflow-scripts.yml index 144eb1a2..29b65dba 100644 --- a/.github/workflows/workflow-scripts.yml +++ b/.github/workflows/workflow-scripts.yml @@ -22,7 +22,9 @@ jobs: timeout-minutes: 5 steps: - name: Checkout repository - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + with: + persist-credentials: false - name: Run tests run: node --test .github/scripts/*.test.js From a90401d2b555878203c875fc895af38a88ace2c5 Mon Sep 17 00:00:00 2001 From: Joe Fusco Date: Sat, 25 Jul 2026 10:20:50 -0400 Subject: [PATCH 6/8] ci: declare CODECOV_TOKEN secret in phpunit workflow_call interface --- .github/workflows/phpunit.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml index 4e7bcaf9..32314850 100644 --- a/.github/workflows/phpunit.yml +++ b/.github/workflows/phpunit.yml @@ -2,6 +2,9 @@ name: PHPUnit on: workflow_call: + secrets: + CODECOV_TOKEN: + required: true permissions: contents: read From 1c24576674a7a683d3b7cd8cf28ef65926bb8b03 Mon Sep 17 00:00:00 2001 From: Joe Fusco Date: Sat, 25 Jul 2026 10:30:58 -0400 Subject: [PATCH 7/8] ci: suppress intentional zizmor findings with inline annotations --- .github/workflows/add-contributor.yml | 2 +- .github/workflows/props-bot.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/add-contributor.yml b/.github/workflows/add-contributor.yml index dac869c2..fddf0d91 100644 --- a/.github/workflows/add-contributor.yml +++ b/.github/workflows/add-contributor.yml @@ -4,7 +4,7 @@ on: # pull_request_target is required (instead of pull_request) so that # GITHUB_TOKEN has write permissions even when the merged PR came from a fork. # No untrusted code is checked out here, so this is safe. - pull_request_target: + pull_request_target: # zizmor: ignore[dangerous-triggers] types: [closed] branches: [main] diff --git a/.github/workflows/props-bot.yml b/.github/workflows/props-bot.yml index 4d0bc056..489e6f17 100644 --- a/.github/workflows/props-bot.yml +++ b/.github/workflows/props-bot.yml @@ -7,7 +7,7 @@ on: # Note: The pull_request_target event is used instead of pull_request because this workflow needs permission to comment # on the pull request. Because this event grants extra permissions to `GITHUB_TOKEN`, any code changes within the PR # should be considered untrusted. See https://securitylab.github.com/research/github-actions-preventing-pwn-requests/. - pull_request_target: + pull_request_target: # zizmor: ignore[dangerous-triggers] types: - opened - synchronize @@ -73,7 +73,7 @@ jobs: steps: - name: Gather a list of contributors - uses: WordPress/props-bot-action@trunk + uses: WordPress/props-bot-action@trunk # zizmor: ignore[unpinned-uses] with: format: 'svn' From bc0f7ee49a0c5b34e562dc9e141cbd4fb5b4d68b Mon Sep 17 00:00:00 2001 From: Joe Fusco Date: Sat, 25 Jul 2026 11:26:35 -0400 Subject: [PATCH 8/8] ci: fix checkout version comment from v7 to v7.0.0 --- .github/workflows/deploy-wporg.yml | 2 +- .github/workflows/multisite.yml | 2 +- .github/workflows/phpcs.yml | 2 +- .github/workflows/phpstan.yml | 2 +- .github/workflows/phpunit.yml | 2 +- .github/workflows/playground-preview.yml | 2 +- .github/workflows/plugin-check.yml | 2 +- .github/workflows/release-please.yml | 6 +++--- .github/workflows/typos.yml | 2 +- .github/workflows/workflow-scripts.yml | 2 +- 10 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/deploy-wporg.yml b/.github/workflows/deploy-wporg.yml index d194deba..5f9e78b5 100644 --- a/.github/workflows/deploy-wporg.yml +++ b/.github/workflows/deploy-wporg.yml @@ -47,7 +47,7 @@ jobs: fi printf 'ref=refs/tags/%s\n' "$TAG" >> "$GITHUB_OUTPUT" printf 'version=%s\n' "${TAG#v}" >> "$GITHUB_OUTPUT" - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false ref: ${{ steps.inputs.outputs.ref }} diff --git a/.github/workflows/multisite.yml b/.github/workflows/multisite.yml index ae182c45..43b049da 100644 --- a/.github/workflows/multisite.yml +++ b/.github/workflows/multisite.yml @@ -10,7 +10,7 @@ jobs: multisite: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 diff --git a/.github/workflows/phpcs.yml b/.github/workflows/phpcs.yml index 7dec995c..80f9d1d4 100644 --- a/.github/workflows/phpcs.yml +++ b/.github/workflows/phpcs.yml @@ -10,7 +10,7 @@ jobs: phpcs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 diff --git a/.github/workflows/phpstan.yml b/.github/workflows/phpstan.yml index 61174737..64ef1924 100644 --- a/.github/workflows/phpstan.yml +++ b/.github/workflows/phpstan.yml @@ -10,7 +10,7 @@ jobs: phpstan: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml index 32314850..f5afb98a 100644 --- a/.github/workflows/phpunit.yml +++ b/.github/workflows/phpunit.yml @@ -21,7 +21,7 @@ jobs: - php: '8.3' coverage: true steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 diff --git a/.github/workflows/playground-preview.yml b/.github/workflows/playground-preview.yml index aa788584..da0bd0f1 100644 --- a/.github/workflows/playground-preview.yml +++ b/.github/workflows/playground-preview.yml @@ -33,7 +33,7 @@ jobs: runs-on: ubuntu-latest if: ${{ !startsWith(github.head_ref, 'release-please--') }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false ref: ${{ github.event.pull_request.head.sha }} diff --git a/.github/workflows/plugin-check.yml b/.github/workflows/plugin-check.yml index 1732dad5..10c63b24 100644 --- a/.github/workflows/plugin-check.yml +++ b/.github/workflows/plugin-check.yml @@ -10,7 +10,7 @@ jobs: plugin-check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 742d60c9..61d66c43 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -44,7 +44,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false ref: ${{ fromJSON(needs.release-please.outputs.pr).headBranchName }} @@ -72,7 +72,7 @@ jobs: pull-requests: write contents: read steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 @@ -93,7 +93,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 diff --git a/.github/workflows/typos.yml b/.github/workflows/typos.yml index e4bc19d3..accdc1f2 100644 --- a/.github/workflows/typos.yml +++ b/.github/workflows/typos.yml @@ -16,7 +16,7 @@ jobs: timeout-minutes: 5 steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false diff --git a/.github/workflows/workflow-scripts.yml b/.github/workflows/workflow-scripts.yml index 29b65dba..36904331 100644 --- a/.github/workflows/workflow-scripts.yml +++ b/.github/workflows/workflow-scripts.yml @@ -22,7 +22,7 @@ jobs: timeout-minutes: 5 steps: - name: Checkout repository - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false