WordPress.org
Get WordPress

Make WordPress Core

Changeset 59679


Ignore:
Timestamp:
01/22/2025 03:13:21 PM (5 months ago)
Author:
johnbillion
Message:

Build/Test Tools: Improve the security and correctness of the GitHub Actions workflows files.

This includes removing use of dangerous inline GitHub Actions expressions, preventing word splitting, further tightening permissions, and generally improving many aspects of the workflows.

This also introduces a new workflow that runs Actionlint to detect incorrect and insecure code and configuration in workflow files.

Props johnbillion, swissspidy, flixos90, desrosj.

See #62221

Location:
trunk
Files:
2 added
30 edited

Legend:

Unmodified
Added
Removed

  • trunk/.github/workflows/coding-standards.yml

    r59673 r59679  
    108108              ref: 'trunk',
    109109              inputs: {
    110                 run_id: '${{ github.run_id }}'
     110                run_id: context.runId,
    111111              }
    112112            });

  • trunk/.github/workflows/end-to-end-tests.yml

    r59673 r59679  
    9494              ref: 'trunk',
    9595              inputs: {
    96                 run_id: '${{ github.run_id }}'
     96                run_id: context.runId,
    9797              }
    9898            });

  • trunk/.github/workflows/failed-workflow.yml

    r57197 r59679  
    3939              owner: context.repo.owner,
    4040              repo: context.repo.repo,
    41               run_id: ${{ inputs.run_id }},
     41              run_id: process.env.RUN_ID,
    4242            });
    4343
    … …  
    5050              owner: context.repo.owner,
    5151              repo: context.repo.repo,
    52               run_id: ${{ inputs.run_id }},
     52              run_id: process.env.RUN_ID,
    5353              enable_debug_logging: true
    5454            });
     55        env:
     56          RUN_ID: ${{ inputs.run_id }}

  • trunk/.github/workflows/install-testing.yml

    r59673 r59679  
    120120          php-version: '${{ matrix.php }}'
    121121          coverage: none
    122           tools: wp-cli${{ contains( fromJSON('["5.4", "5.5"]'), matrix.php ) && ':2.4.0' || '' }}
     122          tools: ${{ contains( fromJSON('["5.4", "5.5"]'), matrix.php ) && 'wp-cli:2.4.0' || 'wp-cli' }}
    123123
    124124      - name: Download WordPress
    125         run: wp core download ${{ inputs.wp-version && format( '--version={0}', inputs.wp-version ) || '--version=nightly' }}
     125        run: wp core download --version="${WP_VERSION}"
     126        env:
     127          WP_VERSION: ${{ inputs.wp-version || 'nightly' }}
    126128
    127129      - name: Create wp-config.php file
    128         run: wp config create --dbname=test_db --dbuser=root --dbpass=root --dbhost=127.0.0.1:${{ job.services.database.ports['3306'] }}
     130        run: wp config create --dbname=test_db --dbuser=root --dbpass=root --dbhost="127.0.0.1:${DB_PORT}"
     131        env:
     132          DB_PORT: ${{ job.services.database.ports['3306'] }}
    129133
    130134      - name: Install WordPress
    131         run: wp core ${{ matrix.multisite && 'multisite-' || '' }}install --url=http://localhost/ --title="Upgrade Test" --admin_user=admin --admin_password=password --admin_email=me@example.org --skip-email
     135        run: wp core ${{ matrix.multisite && 'multisite-install' || 'install' }} --url=http://localhost/ --title="Upgrade Test" --admin_user=admin --admin_password=password --admin_email=me@example.org --skip-email
    132136
    133137  slack-notifications:
    … …  
    176180              ref: 'trunk',
    177181              inputs: {
    178                 run_id: '${{ github.run_id }}'
     182                run_id: context.runId,
    179183              }
    180184            });

  • trunk/.github/workflows/javascript-tests.yml

    r59673 r59679  
    9898              ref: 'trunk',
    9999              inputs: {
    100                 run_id: '${{ github.run_id }}'
     100                run_id: context.runId,
    101101              }
    102102            });

  • trunk/.github/workflows/local-docker-environment.yml

    r59673 r59679  
    105105      db-version: ${{ matrix.db-version }}
    106106      memcached: ${{ matrix.memcached }}
    107       tests-domain: ${{ matrix.tests-domain }}
    108107
    109108  slack-notifications:
    … …  
    152151              ref: 'trunk',
    153152              inputs: {
    154                 run_id: '${{ github.run_id }}'
     153                run_id: context.runId,
    155154              }
    156155            });

  • trunk/.github/workflows/performance.yml

    r59673 r59679  
    9494              ref: 'trunk',
    9595              inputs: {
    96                 run_id: '${{ github.run_id }}'
     96                run_id: context.runId,
    9797              }
    9898            });

  • trunk/.github/workflows/php-compatibility.yml

    r59673 r59679  
    9595              ref: 'trunk',
    9696              inputs: {
    97                 run_id: '${{ github.run_id }}'
     97                run_id: context.runId,
    9898              }
    9999            });

  • trunk/.github/workflows/phpunit-tests.yml

    r59673 r59679  
    145145      memcached: ${{ matrix.memcached }}
    146146      phpunit-config: ${{ matrix.multisite && 'tests/phpunit/multisite.xml' || 'phpunit.xml.dist' }}
    147       report: ${{ matrix.report || false }}
     147      report: ${{ false }}
    148148
    149149  #
    … …  
    194194      memcached: ${{ matrix.memcached }}
    195195      phpunit-config: ${{ matrix.multisite && 'tests/phpunit/multisite.xml' || 'phpunit.xml.dist' }}
    196       report: ${{ matrix.report || false }}
     196      report: ${{ false }}
    197197
    198198  #
    … …  
    264264              ref: 'trunk',
    265265              inputs: {
    266                 run_id: '${{ github.run_id }}'
     266                run_id: context.runId,
    267267              }
    268268            });

  • trunk/.github/workflows/props-bot.yml

    r58903 r59679  
    8686              owner: context.repo.owner,
    8787              repo: context.repo.repo,
    88               issue_number: '${{ github.event.number }}',
     88              issue_number: process.env.ISSUE_NUMBER,
    8989              name: 'props-bot'
    9090            });
     91        env:
     92          ISSUE_NUMBER: ${{ github.event.number }}

  • trunk/.github/workflows/pull-request-comments.yml

    r59441 r59679  
    9797               owner: context.repo.owner,
    9898               repo: context.repo.repo,
    99                run_id: ${{ github.event.workflow_run.id }},
     99               run_id: process.env.RUN_ID,
    100100            } );
    101101
    … …  
    118118            const fs = require( 'fs' );
    119119            fs.writeFileSync( '${{github.workspace}}/pr-number.zip', Buffer.from( download.data ) )
     120        env:
     121          RUN_ID: ${{ github.event.workflow_run.id }}
    120122
    121123      - name: Unzip the artifact containing the PR number

  • trunk/.github/workflows/reusable-cleanup-pull-requests.yml

    r59661 r59679  
    3030      - name: Find fixed ticket numbers
    3131        id: trac-tickets
     32        env:
     33          COMMIT_MSG_RAW: ${{ github.event.head_commit.message }}
    3234        run: |
    33           COMMIT_MESSAGE=$(cat <<'EOF' | sed -n '/^Fixes #/,/\./p'
    34           ${{ github.event.head_commit.message }}
    35           EOF
    36           )
    37           echo "fixed_list=$(echo \"$COMMIT_MESSAGE\" | sed -n 's/.*Fixes #\([0-9]\+\).*/\1/p' | tr '\n' ' ')" >> $GITHUB_OUTPUT
     35          COMMIT_MESSAGE="$(echo "$COMMIT_MSG_RAW" | sed -n '/^Fixes #/,/\./p')"
     36          echo "fixed_list=$(echo "$COMMIT_MESSAGE" | sed -n 's/.*Fixes #\([0-9]\+\).*/\1/p' | tr '\n' ' ')" >> "$GITHUB_OUTPUT"
    3837
    3938      - name: Get the SVN revision
    4039        id: git-svn-id
     40        env:
     41          COMMIT_MSG_RAW: ${{ github.event.head_commit.message }}
    4142        run: |
    42           COMMIT_MESSAGE=$(cat <<'EOF' | sed -n '$p'
    43           ${{ github.event.head_commit.message }}
    44           EOF
    45           )
    46           echo "svn_revision_number=$(echo \"$COMMIT_MESSAGE\" | sed -n 's/.*git-svn-id: https:\/\/develop.svn.wordpress.org\/[^@]*@\([0-9]*\) .*/\1/p')" >> $GITHUB_OUTPUT
     43          COMMIT_MESSAGE="$(echo "$COMMIT_MSG_RAW" | sed -n '$p')"
     44          echo "svn_revision_number=$(echo "$COMMIT_MESSAGE" | sed -n 's/.*git-svn-id: https:\/\/develop.svn.wordpress.org\/[^@]*@\([0-9]*\) .*/\1/p')" >> "$GITHUB_OUTPUT"
    4745
    4846      - name: Find pull requests

  • trunk/.github/workflows/reusable-coding-standards-javascript.yml

    r59354 r59679  
    99env:
    1010  PUPPETEER_SKIP_DOWNLOAD: ${{ true }}
     11
     12# Disable permissions for all available scopes by default.
     13# Any needed permissions should be configured at the job level.
     14permissions: {}
    1115
    1216jobs:
    … …  
    3438        with:
    3539          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
     40          persist-credentials: false
    3641
    3742      - name: Set up Node.js

  • trunk/.github/workflows/reusable-coding-standards-php.yml

    r59354 r59679  
    1717        type: 'boolean'
    1818        default: false
     19
     20# Disable permissions for all available scopes by default.
     21# Any needed permissions should be configured at the job level.
     22permissions: {}
    1923
    2024jobs:
    … …  
    4650        with:
    4751          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
     52          persist-credentials: false
    4853
    4954      - name: Set up PHP
    … …  
    5863      - name: "Get last Monday's date"
    5964        id: get-date
    60         run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> $GITHUB_OUTPUT
     65        run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> "$GITHUB_OUTPUT"
    6166
    6267      - name: Cache PHPCS scan cache
    … …  
    7681
    7782      - name: Make Composer packages available globally
    78         run: echo "${PWD}/vendor/bin" >> $GITHUB_PATH
     83        run: echo "${PWD}/vendor/bin" >> "$GITHUB_PATH"
    7984
    8085      - name: Run PHPCS on all Core files

  • trunk/.github/workflows/reusable-end-to-end-tests.yml

    r59354 r59679  
    3434  LOCAL_PHP: ${{ inputs.php-version }}${{ 'latest' != inputs.php-version && '-fpm' || '' }}
    3535
     36# Disable permissions for all available scopes by default.
     37# Any needed permissions should be configured at the job level.
     38permissions: {}
     39
    3640jobs:
    3741  # Runs the end-to-end test suite.
    … …  
    6468      - name: Configure environment variables
    6569        run: |
    66           echo "PHP_FPM_UID=$(id -u)" >> $GITHUB_ENV
    67           echo "PHP_FPM_GID=$(id -g)" >> $GITHUB_ENV
     70          echo "PHP_FPM_UID=$(id -u)" >> "$GITHUB_ENV"
     71          echo "PHP_FPM_GID=$(id -g)" >> "$GITHUB_ENV"
    6872
    6973      - name: Checkout repository
    … …  
    7175        with:
    7276          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
     77          persist-credentials: false
    7378
    7479      - name: Set up Node.js
    … …  
    118123      - name: Install Gutenberg
    119124        if: ${{ inputs.install-gutenberg }}
    120         run: npm run env:cli -- plugin install gutenberg${{ inputs.gutenberg-version && format( ' --version={0}', inputs.gutenberg-version ) || '' }} --path=/var/www/${{ env.LOCAL_DIR }}
     125        run: |
     126          npm run env:cli -- plugin install gutenberg \
     127          ${{ inputs.gutenberg-version && '--version="${GUTENBERG_VERSION}"' || '' }} \
     128          --path="/var/www/${LOCAL_DIR}"
     129        env:
     130          GUTENBERG_VERSION: ${{ inputs.gutenberg-version }}
    121131
    122132      - name: Install additional languages
    123133        run: |
    124           npm run env:cli -- language core install de_DE --path=/var/www/${{ env.LOCAL_DIR }}
    125           npm run env:cli -- language plugin install de_DE --all --path=/var/www/${{ env.LOCAL_DIR }}
    126           npm run env:cli -- language theme install de_DE --all --path=/var/www/${{ env.LOCAL_DIR }}
     134          npm run env:cli -- language core install de_DE --path="/var/www/${LOCAL_DIR}"
     135          npm run env:cli -- language plugin install de_DE --all --path="/var/www/${LOCAL_DIR}"
     136          npm run env:cli -- language theme install de_DE --all --path="/var/www/${LOCAL_DIR}"
    127137
    128138      - name: Run E2E tests

  • trunk/.github/workflows/reusable-javascript-tests.yml

    r59635 r59679  
    1212        type: 'boolean'
    1313        default: false
     14
     15# Disable permissions for all available scopes by default.
     16# Any needed permissions should be configured at the job level.
     17permissions: {}
    1418
    1519jobs:
    … …  
    3539        with:
    3640          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
     41          persist-credentials: false
    3742
    3843      - name: Set up Node.js

  • trunk/.github/workflows/reusable-performance.yml

    r59669 r59679  
    6464  LOCAL_PHP: ${{ inputs.php-version }}${{ 'latest' != inputs.php-version && '-fpm' || '' }}
    6565  LOCAL_MULTISITE: ${{ inputs.multisite }}
     66
     67# Disable permissions for all available scopes by default.
     68# Any needed permissions should be configured at the job level.
     69permissions: {}
    6670
    6771jobs:
    … …  
    120124      - name: Configure environment variables
    121125        run: |
    122           echo "PHP_FPM_UID=$(id -u)" >> $GITHUB_ENV
    123           echo "PHP_FPM_GID=$(id -g)" >> $GITHUB_ENV
     126          echo "PHP_FPM_UID=$(id -u)" >> "$GITHUB_ENV"
     127          echo "PHP_FPM_GID=$(id -g)" >> "$GITHUB_ENV"
    124128
    125129      - name: Checkout repository
    … …  
    128132          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
    129133          fetch-depth: ${{ github.event_name == 'workflow_dispatch' && '2' || '1' }}
     134          persist-credentials: false
    130135
    131136      # The `workflow_dispatch` event is the only one missing the needed SHA to target.
    132137      - name: Retrieve previous commit SHA (if necessary)
    133138        if: ${{ github.event_name == 'workflow_dispatch' }}
    134         run: echo "TARGET_SHA=$(git rev-parse HEAD^1)" >> $GITHUB_ENV
     139        run: echo "TARGET_SHA=$(git rev-parse HEAD^1)" >> "$GITHUB_ENV"
    135140
    136141      - name: Set up Node.js
    … …  
    182187        if: ${{ inputs.multisite }}
    183188        run: |
    184           npm run env:cli -- theme enable twentytwentyone --network --path=/var/www/${{ env.LOCAL_DIR }}
    185           npm run env:cli -- theme enable twentytwentythree --network --path=/var/www/${{ env.LOCAL_DIR }}
    186           npm run env:cli -- theme enable twentytwentyfour --network --path=/var/www/${{ env.LOCAL_DIR }}
    187           npm run env:cli -- theme enable twentytwentyfive --network --path=/var/www/${{ env.LOCAL_DIR }}
     189          npm run env:cli -- theme enable twentytwentyone --network --path="/var/www/${LOCAL_DIR}"
     190          npm run env:cli -- theme enable twentytwentythree --network --path="/var/www/${LOCAL_DIR}"
     191          npm run env:cli -- theme enable twentytwentyfour --network --path="/var/www/${LOCAL_DIR}"
     192          npm run env:cli -- theme enable twentytwentyfive --network --path="/var/www/${LOCAL_DIR}"
    188193
    189194      - name: Install WordPress Importer plugin
    190         run: npm run env:cli -- plugin install wordpress-importer --activate --path=/var/www/${{ env.LOCAL_DIR }}
     195        run: npm run env:cli -- plugin install wordpress-importer --activate --path="/var/www/${LOCAL_DIR}"
    191196
    192197      - name: Import mock data
    193198        run: |
    194199          curl -O https://raw.githubusercontent.com/WordPress/theme-test-data/b9752e0533a5acbb876951a8cbb5bcc69a56474c/themeunittestdata.wordpress.xml
    195           npm run env:cli -- import themeunittestdata.wordpress.xml --authors=create --path=/var/www/${{ env.LOCAL_DIR }}
     200          npm run env:cli -- import themeunittestdata.wordpress.xml --authors=create --path="/var/www/${LOCAL_DIR}"
    196201          rm themeunittestdata.wordpress.xml
    197202
    198203      - name: Deactivate WordPress Importer plugin
    199         run: npm run env:cli -- plugin deactivate wordpress-importer --path=/var/www/${{ env.LOCAL_DIR }}
     204        run: npm run env:cli -- plugin deactivate wordpress-importer --path="/var/www/${LOCAL_DIR}"
    200205
    201206      - name: Update permalink structure
    202         run: npm run env:cli -- rewrite structure '/%year%/%monthnum%/%postname%/' --path=/var/www/${{ env.LOCAL_DIR }}
     207        run: npm run env:cli -- rewrite structure '/%year%/%monthnum%/%postname%/' --path="/var/www/${LOCAL_DIR}"
    203208
    204209      - name: Install additional languages
    205210        run: |
    206           npm run env:cli -- language core install de_DE --path=/var/www/${{ env.LOCAL_DIR }}
    207           npm run env:cli -- language plugin install de_DE --all --path=/var/www/${{ env.LOCAL_DIR }}
    208           npm run env:cli -- language theme install de_DE --all --path=/var/www/${{ env.LOCAL_DIR }}
     211          npm run env:cli -- language core install de_DE --path="/var/www/${LOCAL_DIR}"
     212          npm run env:cli -- language plugin install de_DE --all --path="/var/www/${LOCAL_DIR}"
     213          npm run env:cli -- language theme install de_DE --all --path="/var/www/${LOCAL_DIR}"
    209214
    210215      # Prevent background update checks from impacting test stability.
    211216      - name: Disable external HTTP requests
    212         run: npm run env:cli -- config set WP_HTTP_BLOCK_EXTERNAL true --raw --type=constant --path=/var/www/${{ env.LOCAL_DIR }}
     217        run: npm run env:cli -- config set WP_HTTP_BLOCK_EXTERNAL true --raw --type=constant --path="/var/www/${LOCAL_DIR}"
    213218
    214219      # Prevent background tasks from impacting test stability.
    215220      - name: Disable cron
    216         run: npm run env:cli -- config set DISABLE_WP_CRON true --raw --type=constant --path=/var/www/${{ env.LOCAL_DIR }}
     221        run: npm run env:cli -- config set DISABLE_WP_CRON true --raw --type=constant --path="/var/www/${LOCAL_DIR}"
    217222
    218223      - name: List defined constants
    219         run: npm run env:cli -- config list --path=/var/www/${{ env.LOCAL_DIR }}
     224        run: npm run env:cli -- config list --path="/var/www/${LOCAL_DIR}"
    220225
    221226      - name: Install MU plugin
    222227        run: |
    223           mkdir ./${{ env.LOCAL_DIR }}/wp-content/mu-plugins
    224           cp ./tests/performance/wp-content/mu-plugins/server-timing.php ./${{ env.LOCAL_DIR }}/wp-content/mu-plugins/server-timing.php
     228          mkdir "./${LOCAL_DIR}/wp-content/mu-plugins"
     229          cp ./tests/performance/wp-content/mu-plugins/server-timing.php "./${LOCAL_DIR}/wp-content/mu-plugins/server-timing.php"
    225230
    226231      - name: Run performance tests (current commit)
    … …  
    253258
    254259            const fs = require( 'fs' );
    255             fs.writeFileSync( '${{ github.workspace }}/before.zip', Buffer.from( download.data ) )
     260            fs.writeFileSync( process.env.GITHUB_WORKSPACE + '/before.zip', Buffer.from( download.data ) )
    256261
    257262            return true;
    … …  
    260265        if: ${{ steps.get-previous-build.outputs.result }}
    261266        run: |
    262           unzip ${{ github.workspace }}/before.zip
    263           unzip -o ${{ github.workspace }}/wordpress.zip
     267          unzip "${GITHUB_WORKSPACE}/before.zip"
     268          unzip -o "${GITHUB_WORKSPACE}/wordpress.zip"
    264269
    265270      - name: Run any database upgrades
    266271        if: ${{ steps.get-previous-build.outputs.result }}
    267         run: npm run env:cli -- core update-db --path=/var/www/${{ env.LOCAL_DIR }}
     272        run: npm run env:cli -- core update-db --path="/var/www/${LOCAL_DIR}"
    268273
    269274      - name: Flush cache
    270275        if: ${{ steps.get-previous-build.outputs.result }}
    271         run: npm run env:cli -- cache flush --path=/var/www/${{ env.LOCAL_DIR }}
     276        run: npm run env:cli -- cache flush --path="/var/www/${LOCAL_DIR}"
    272277
    273278      - name: Delete expired transients
    274279        if: ${{ steps.get-previous-build.outputs.result }}
    275         run: npm run env:cli -- transient delete --expired --path=/var/www/${{ env.LOCAL_DIR }}
     280        run: npm run env:cli -- transient delete --expired --path="/var/www/${LOCAL_DIR}"
    276281
    277282      - name: Run target performance tests (previous/target commit)
    … …  
    284289        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/trunk' }}
    285290        run: |
    286           VERSION="${{ env.BASE_TAG }}"
     291          VERSION="${BASE_TAG}"
    287292          VERSION="${VERSION%.0}"
    288           npm run env:cli -- core update --version=$VERSION --force --path=/var/www/${{ env.LOCAL_DIR }}
    289           npm run env:cli -- core version --path=/var/www/${{ env.LOCAL_DIR }}
     293          npm run env:cli -- core update --version="$VERSION" --force --path="/var/www/${LOCAL_DIR}"
     294          npm run env:cli -- core version --path="/var/www/${LOCAL_DIR}"
    290295
    291296      - name: Run any database upgrades
    292297        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/trunk' }}
    293         run: npm run env:cli -- core update-db --path=/var/www/${{ env.LOCAL_DIR }}
     298        run: npm run env:cli -- core update-db --path="/var/www/${LOCAL_DIR}"
    294299
    295300      - name: Flush cache
    296301        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/trunk' }}
    297         run: npm run env:cli -- cache flush --path=/var/www/${{ env.LOCAL_DIR }}
     302        run: npm run env:cli -- cache flush --path="/var/www/${LOCAL_DIR}"
    298303
    299304      - name: Delete expired transients
    300305        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/trunk' }}
    301         run: npm run env:cli -- transient delete --expired --path=/var/www/${{ env.LOCAL_DIR }}
     306        run: npm run env:cli -- transient delete --expired --path="/var/www/${LOCAL_DIR}"
    302307
    303308      - name: Run baseline performance tests
    … …  
    317322
    318323      - name: Compare results
    319         run: node ./tests/performance/compare-results.js ${{ runner.temp }}/summary.md
     324        run: node ./tests/performance/compare-results.js "${RUNNER_TEMP}/summary.md"
    320325
    321326      - name: Add workflow summary
    322         run: cat ${{ runner.temp }}/summary.md >> $GITHUB_STEP_SUMMARY
     327        run: cat "${RUNNER_TEMP}/summary.md" >> "$GITHUB_STEP_SUMMARY"
    323328
    324329      - name: Set the base sha
    … …  
    330335          github-token: ${{ secrets.GITHUB_TOKEN }}
    331336          script: |
    332             const baseRef = await github.rest.git.getRef({ owner: context.repo.owner, repo: context.repo.repo, ref: 'tags/${{ env.BASE_TAG }}' });
     337            const baseRef = await github.rest.git.getRef({
     338              owner: context.repo.owner,
     339              repo: context.repo.repo,
     340              ref: 'tags/' + process.env.BASE_TAG,
     341            });
    333342            return baseRef.data.object.sha;
    334 
    335       - name: Set commit details
    336         # Only needed when publishing results.
    337         if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/trunk' && ! inputs.memcached && ! inputs.multisite }}
    338         # Write to an environment variable to have the output available in later steps of the job.
    339         run: echo "COMMITTED_AT=$(git show -s $GITHUB_SHA --format='%cI')" >> $GITHUB_ENV
    340343
    341344      - name: Publish performance results
    … …  
    348351        run: |
    349352          if [ -z "$CODEVITALS_PROJECT_TOKEN" ]; then
    350             echo "Performance results could not be published. 'CODEVITALS_PROJECT_TOKEN' is not set" >> $GITHUB_OUTPUT
     353            echo "Performance results could not be published. 'CODEVITALS_PROJECT_TOKEN' is not set"
    351354            exit 1
    352355          fi
    353           node ./tests/performance/log-results.js $CODEVITALS_PROJECT_TOKEN trunk $GITHUB_SHA $BASE_SHA $COMMITTED_AT $HOST_NAME
     356          COMMITTED_AT="$(git show -s "$GITHUB_SHA" --format='%cI')"
     357          node ./tests/performance/log-results.js "$CODEVITALS_PROJECT_TOKEN" trunk "$GITHUB_SHA" "$BASE_SHA" "$COMMITTED_AT" "$HOST_NAME"
    354358
    355359      - name: Ensure version-controlled files are not modified or deleted

  • trunk/.github/workflows/reusable-php-compatibility.yml

    r59354 r59679  
    1212        type: 'string'
    1313        default: 'latest'
     14
     15# Disable permissions for all available scopes by default.
     16# Any needed permissions should be configured at the job level.
     17permissions: {}
    1418
    1519jobs:
    … …  
    4044        with:
    4145          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
     46          persist-credentials: false
    4247
    4348      - name: Set up PHP
    … …  
    5661      - name: "Get last Monday's date"
    5762        id: get-date
    58         run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> $GITHUB_OUTPUT
     63        run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> "$GITHUB_OUTPUT"
    5964
    6065      - name: Cache PHP compatibility scan cache
    … …  
    7277
    7378      - name: Make Composer packages available globally
    74         run: echo "${PWD}/vendor/bin" >> $GITHUB_PATH
     79        run: echo "${PWD}/vendor/bin" >> "$GITHUB_PATH"
    7580
    7681      - name: Run PHP compatibility tests

  • trunk/.github/workflows/reusable-phpunit-tests-v1.yml

    r59534 r59679  
    5151        default: false
    5252env:
     53  COMPOSER_INSTALL: ${{ false }}
    5354  LOCAL_PHP: ${{ inputs.php }}-fpm
    5455  LOCAL_PHPUNIT: ${{ inputs.phpunit && inputs.phpunit || inputs.php }}-fpm
    … …  
    5859  PUPPETEER_SKIP_DOWNLOAD: ${{ true }}
    5960  SLOW_TESTS: 'external-http,media'
     61
     62# Disable permissions for all available scopes by default.
     63# Any needed permissions should be configured at the job level.
     64permissions: {}
    6065
    6166jobs:
    … …  
    8792      - name: Configure environment variables
    8893        run: |
    89           echo "PHP_FPM_UID=$(id -u)" >> $GITHUB_ENV
    90           echo "PHP_FPM_GID=$(id -g)" >> $GITHUB_ENV
     94          echo "PHP_FPM_UID=$(id -u)" >> "$GITHUB_ENV"
     95          echo "PHP_FPM_GID=$(id -g)" >> "$GITHUB_ENV"
    9196
    9297      - name: Checkout repository
    … …  
    9499        with:
    95100          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
     101          persist-credentials: false
    96102
    97103      - name: Set up Node.js
    … …  
    106112      - name: Build WordPress
    107113        run: npm run build
     114
     115      - name: Get composer cache directory
     116        if: ${{ env.COMPOSER_INSTALL == true }}
     117        id: composer-cache
     118        run: echo "composer_dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
    108119
    109120      - name: Cache Composer dependencies
    … …  
    136147        run: |
    137148          cp tests/phpunit/includes/object-cache.php build/wp-content/object-cache.php
    138           docker run --name memcached --net $(basename "$PWD")_wpdevnet -d memcached
     149          BASE=$(basename "$PWD")
     150          docker run --name memcached --net "${BASE}_wpdevnet" -d memcached
    139151
    140152      - name: General debug information
    … …  
    161173      - name: Run slow PHPUnit tests
    162174        if: ${{ inputs.split_slow }}
    163         run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c ${{ env.PHPUNIT_CONFIG }} --group ${{ env.SLOW_TESTS }}
     175        run: npm run "test:${PHPUNIT_SCRIPT}" -- --verbose -c "${PHPUNIT_CONFIG}" --group "${SLOW_TESTS}"
    164176
    165177      - name: Run PHPUnit tests for single site excluding slow tests
    166178        if: ${{ inputs.php < '7.0' && ! inputs.split_slow && ! inputs.multisite }}
    167         run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c ${{ env.PHPUNIT_CONFIG }} --exclude-group ${{ env.SLOW_TESTS }},ajax,ms-files,ms-required
     179        run: npm run "test:${PHPUNIT_SCRIPT}" -- --verbose -c "${PHPUNIT_CONFIG}" --exclude-group "${SLOW_TESTS},ajax,ms-files,ms-required"
    168180
    169181      - name: Run PHPUnit tests for Multisite excluding slow tests
    170182        if: ${{ inputs.php < '7.0' && ! inputs.split_slow && inputs.multisite }}
    171         run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c ${{ env.PHPUNIT_CONFIG }} --exclude-group ${{ env.SLOW_TESTS }},ajax,ms-files,ms-excluded,oembed-headers
     183        run: npm run "test:${PHPUNIT_SCRIPT}" -- --verbose -c "${PHPUNIT_CONFIG}" --exclude-group "${SLOW_TESTS},ajax,ms-files,ms-excluded,oembed-headers"
    172184
    173185      - name: Run PHPUnit tests
    174186        if: ${{ inputs.php >= '7.0' }}
    175         run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c ${{ env.PHPUNIT_CONFIG }}
     187        run: npm run "test:${PHPUNIT_SCRIPT}" -- --verbose -c "${PHPUNIT_CONFIG}"
    176188
    177189      - name: Run AJAX tests
    178190        if: ${{ ! inputs.multisite && ! inputs.split_slow }}
    179         run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c ${{ env.PHPUNIT_CONFIG }} --group ajax
     191        run: npm run "test:${PHPUNIT_SCRIPT}" -- --verbose -c "${PHPUNIT_CONFIG}" --group ajax
    180192
    181193      - name: Run external HTTP tests
    182194        if: ${{ ! inputs.multisite && ! inputs.split_slow }}
    183         run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c phpunit.xml.dist --group external-http
     195        run: npm run "test:${PHPUNIT_SCRIPT}" -- --verbose -c phpunit.xml.dist --group external-http

  • trunk/.github/workflows/reusable-phpunit-tests-v2.yml

    r59354 r59679  
    6363  PHPUNIT_SCRIPT: php
    6464  SLOW_TESTS: 'external-http,media'
     65
     66# Disable permissions for all available scopes by default.
     67# Any needed permissions should be configured at the job level.
     68permissions: {}
    6569
    6670jobs:
    … …  
    9094      - name: Configure environment variables
    9195        run: |
    92           echo "PHP_FPM_UID=$(id -u)" >> $GITHUB_ENV
    93           echo "PHP_FPM_GID=$(id -g)" >> $GITHUB_ENV
     96          echo "PHP_FPM_UID=$(id -u)" >> "$GITHUB_ENV"
     97          echo "PHP_FPM_GID=$(id -g)" >> "$GITHUB_ENV"
    9498
    9599      - name: Checkout repository
    … …  
    97101        with:
    98102          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
     103          persist-credentials: false
    99104
    100105      - name: Install Node.js
    … …  
    109114      - name: Get composer cache directory
    110115        id: composer-cache
    111         run: echo "composer_dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
     116        run: echo "composer_dir=$(composer config cache-files-dir)" >> "$GITHUB_OUTPUT"
    112117
    113118      - name: Cache Composer dependencies
    … …  
    126131          # as PHPUnit 7 is no longer supported. The Composer-installed PHPUnit should be
    127132          # used for PHP 8 testing instead.
    128           if [ ${{ env.LOCAL_PHP }} == '8.0-fpm' ]; then
     133          if [ "${LOCAL_PHP}" == '8.0-fpm' ]; then
    129134            docker compose run --rm php composer install --ignore-platform-reqs
    130             echo "PHPUNIT_SCRIPT=php-composer" >> $GITHUB_ENV
    131           elif [ ${{ env.LOCAL_PHP }} == '7.1-fpm' ]; then
     135            echo "PHPUNIT_SCRIPT=php-composer" >> "$GITHUB_ENV"
     136          elif [ "${LOCAL_PHP}" == '7.1-fpm' ]; then
    132137            docker compose run --rm php composer update
    133138            git checkout -- composer.lock
    134           elif [[ ${{ env.LOCAL_PHP }} == '5.6-fpm' || ${{ env.LOCAL_PHP }} == '7.0-fpm' ]]; then
     139          elif [[ "${LOCAL_PHP}" == '5.6-fpm' || "${LOCAL_PHP}" == '7.0-fpm' ]]; then
    135140            docker compose run --rm php composer require --dev phpunit/phpunit:"^5.7" --update-with-dependencies
    136141            git checkout -- composer.lock composer.json
    … …  
    171176      - name: Run slow PHPUnit tests
    172177        if: ${{ inputs.split_slow }}
    173         run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c ${{ env.PHPUNIT_CONFIG }} --group ${{ env.SLOW_TESTS }}
     178        run: npm run "test:${PHPUNIT_SCRIPT}" -- --verbose -c "${PHPUNIT_CONFIG}" --group "${SLOW_TESTS}"
    174179
    175180      - name: Run PHPUnit tests for single site excluding slow tests
    176181        if: ${{ inputs.php < '7.0' && ! inputs.split_slow && ! inputs.multisite }}
    177         run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c ${{ env.PHPUNIT_CONFIG }} --exclude-group ${{ env.SLOW_TESTS }},ajax,ms-files,ms-required
     182        run: npm run "test:${PHPUNIT_SCRIPT}" -- --verbose -c "${PHPUNIT_CONFIG}" --exclude-group "${SLOW_TESTS},ajax,ms-files,ms-required"
    178183
    179184      - name: Run PHPUnit tests for Multisite excluding slow tests
    180185        if: ${{ inputs.php < '7.0' && ! inputs.split_slow && inputs.multisite }}
    181         run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c ${{ env.PHPUNIT_CONFIG }} --exclude-group ${{ env.SLOW_TESTS }},ajax,ms-files,ms-excluded,oembed-headers
     186        run: npm run "test:${PHPUNIT_SCRIPT}" -- --verbose -c "${PHPUNIT_CONFIG}" --exclude-group "${SLOW_TESTS},ajax,ms-files,ms-excluded,oembed-headers"
    182187
    183188      - name: Run PHPUnit tests
    184189        if: ${{ inputs.php >= '7.0' }}
    185         run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c ${{ env.PHPUNIT_CONFIG }}
     190        run: npm run "test:${PHPUNIT_SCRIPT}" -- --verbose -c "${PHPUNIT_CONFIG}"
    186191
    187192      - name: Run AJAX tests
    188193        if: ${{ ! inputs.split_slow&& inputs.test_ajax }}
    189         run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c ${{ env.PHPUNIT_CONFIG }} --group ajax
     194        run: npm run "test:${PHPUNIT_SCRIPT}" -- --verbose -c "${PHPUNIT_CONFIG}" --group ajax
    190195
    191196      - name: Run ms-files tests as a multisite install
    192197        if: ${{ inputs.multisite && ! inputs.split_slow }}
    193         run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c ${{ env.PHPUNIT_CONFIG }} --group ms-files
     198        run: npm run "test:${PHPUNIT_SCRIPT}" -- --verbose -c "${PHPUNIT_CONFIG}" --group ms-files
    194199
    195200      - name: Run external HTTP tests
    196201        if: ${{ ! inputs.multisite && ! inputs.split_slow }}
    197         run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c phpunit.xml.dist --group external-http
     202        run: npm run "test:${PHPUNIT_SCRIPT}" -- --verbose -c phpunit.xml.dist --group external-http
    198203
    199204      # __fakegroup__ is excluded to force PHPUnit to ignore the <exclude> settings in phpunit.xml.dist.
    200205      - name: Run (xDebug) tests
    201206        if: ${{ ! inputs.split_slow }}
    202         run: LOCAL_PHP_XDEBUG=true npm run test:${{ env.PHPUNIT_SCRIPT }} -- -v --group xdebug --exclude-group __fakegroup__
     207        run: LOCAL_PHP_XDEBUG=true npm run "test:${PHPUNIT_SCRIPT}" -- -v --group xdebug --exclude-group __fakegroup__
    203208
    204209      - name: Ensure version-controlled files are not modified or deleted

  • trunk/.github/workflows/reusable-phpunit-tests-v3.yml

    r59586 r59679  
    7777        description: 'The Codecov token required for uploading reports.'
    7878        required: false
     79      WPT_REPORT_API_KEY:
     80        description: 'The WordPress.org Hosting Tests API key.'
     81        required: false
     82
    7983env:
    8084  LOCAL_PHP: ${{ inputs.php }}-fpm
    … …  
    8791  PHPUNIT_CONFIG: ${{ inputs.phpunit-config }}
    8892  PUPPETEER_SKIP_DOWNLOAD: ${{ true }}
     93
     94# Disable permissions for all available scopes by default.
     95# Any needed permissions should be configured at the job level.
     96permissions: {}
    8997
    9098jobs:
    … …  
    118126      - name: Configure environment variables
    119127        run: |
    120           echo "PHP_FPM_UID=$(id -u)" >> $GITHUB_ENV
    121           echo "PHP_FPM_GID=$(id -g)" >> $GITHUB_ENV
     128          echo "PHP_FPM_UID=$(id -u)" >> "$GITHUB_ENV"
     129          echo "PHP_FPM_GID=$(id -g)" >> "$GITHUB_ENV"
    122130
    123131      - name: Checkout repository
    … …  
    125133        with:
    126134          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
     135          persist-credentials: false
    127136
    128137      - name: Set up Node.js
    … …  
    177186      - name: WordPress Docker container debug information
    178187        run: |
    179           docker compose run --rm mysql ${{ env.LOCAL_DB_TYPE == 'mariadb' && contains( fromJSON('["5.5", "10.0", "10.1", "10.2", "10.3"]'), env.LOCAL_DB_VERSION ) && 'mysql' || env.LOCAL_DB_TYPE }} --version
     188          docker compose run --rm mysql "${LOCAL_DB_CMD}" --version
    180189          docker compose run --rm php php --version
    181190          docker compose run --rm php php -m
    182191          docker compose run --rm php php -i
    183192          docker compose run --rm php locale -a
     193        env:
     194          LOCAL_DB_CMD: ${{ env.LOCAL_DB_TYPE == 'mariadb' && contains( fromJSON('["5.5", "10.0", "10.1", "10.2", "10.3"]'), env.LOCAL_DB_VERSION ) && 'mysql' || env.LOCAL_DB_TYPE }}
    184195
    185196      - name: Install WordPress
    … …  
    188199      - name: Run PHPUnit tests${{ inputs.phpunit-test-groups && format( ' ({0} groups)', inputs.phpunit-test-groups ) || '' }}${{ inputs.coverage-report && ' with coverage report' || '' }}
    189200        continue-on-error: ${{ inputs.allow-errors }}
    190         run: node ./tools/local-env/scripts/docker.js run php ./vendor/bin/phpunit --verbose -c ${{ env.PHPUNIT_CONFIG }}${{ inputs.phpunit-test-groups && format( ' --group {0}', inputs.phpunit-test-groups ) || '' }}${{ inputs.coverage-report && format( ' --coverage-clover wp-code-coverage-{0}-{1}.xml --coverage-html wp-code-coverage-{0}-{1}', ( inputs.multisite && 'multisite' || 'single' ), github.sha ) || '' }}
     201        run: |
     202          node ./tools/local-env/scripts/docker.js run \
     203            php ./vendor/bin/phpunit \
     204            --verbose \
     205            -c "${PHPUNIT_CONFIG}" \
     206            ${{ inputs.phpunit-test-groups && '--group "${TEST_GROUPS}"' || '' }} \
     207            ${{ inputs.coverage-report && '--coverage-clover "wp-code-coverage-${MULTISITE_FLAG}-${GITHUB_SHA}.xml" --coverage-html "wp-code-coverage-${MULTISITE_FLAG}-${GITHUB_SHA}"' || '' }}
     208        env:
     209          TEST_GROUPS: ${{ inputs.phpunit-test-groups }}
     210          MULTISITE_FLAG: ${{ inputs.multisite && 'multisite' || 'single' }}
    191211
    192212      - name: Run AJAX tests
    193213        if: ${{ ! inputs.phpunit-test-groups && ! inputs.coverage-report }}
    194214        continue-on-error: ${{ inputs.allow-errors }}
    195         run: node ./tools/local-env/scripts/docker.js run php ./vendor/bin/phpunit --verbose -c ${{ env.PHPUNIT_CONFIG }} --group ajax
     215        run: node ./tools/local-env/scripts/docker.js run php ./vendor/bin/phpunit --verbose -c "${PHPUNIT_CONFIG}" --group ajax
    196216
    197217      - name: Run ms-files tests as a multisite install
    198218        if: ${{ inputs.multisite && ! inputs.phpunit-test-groups && ! inputs.coverage-report }}
    199219        continue-on-error: ${{ inputs.allow-errors }}
    200         run: node ./tools/local-env/scripts/docker.js run php ./vendor/bin/phpunit --verbose -c ${{ env.PHPUNIT_CONFIG }} --group ms-files
     220        run: node ./tools/local-env/scripts/docker.js run php ./vendor/bin/phpunit --verbose -c "${PHPUNIT_CONFIG}" --group ms-files
    201221
    202222      - name: Run external HTTP tests
    203223        if: ${{ ! inputs.multisite && ! inputs.phpunit-test-groups && ! inputs.coverage-report }}
    204224        continue-on-error: ${{ inputs.allow-errors }}
    205         run: node ./tools/local-env/scripts/docker.js run php ./vendor/bin/phpunit --verbose -c ${{ env.PHPUNIT_CONFIG }} --group external-http
     225        run: node ./tools/local-env/scripts/docker.js run php ./vendor/bin/phpunit --verbose -c "${PHPUNIT_CONFIG}" --group external-http
    206226
    207227      # __fakegroup__ is excluded to force PHPUnit to ignore the <exclude> settings in phpunit.xml.dist.
    … …  
    238258          path: 'test-runner'
    239259          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
     260          persist-credentials: false
    240261
    241262      - name: Submit test results to the WordPress.org host test results

  • trunk/.github/workflows/reusable-support-json-reader-v1.yml

    r59507 r59679  
    2727        value: ${{ jobs.mysql-versions.outputs.versions }}
    2828
     29# Disable permissions for all available scopes by default.
     30# Any needed permissions should be configured at the job level.
     31permissions: {}
     32
    2933jobs:
    3034  # Determines the major version of WordPress being tested.
    … …  
    3741  major-wp-version:
    3842    name: Determine major WordPress version
     43    permissions:
     44      contents: read
    3945    runs-on: ubuntu-latest
    4046    timeout-minutes: 5
    … …  
    4854          repository: ${{ inputs.repository }}
    4955          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
     56          persist-credentials: false
    5057
    5158      - name: Determine the major WordPress version
    5259        id: major-wp-version
    5360        run: |
    54           if [ "${{ inputs.wp-version }}" ] && [ "${{ inputs.wp-version }}" != "nightly" ] && [ "${{ inputs.wp-version }}" != "latest" ] && [ "${{ inputs.wp-version }}" != "trunk" ]; then
    55             echo "version=$(echo "${{ inputs.wp-version }}" | tr '.' '-' | cut -d '-' -f1-2)" >> $GITHUB_OUTPUT
    56           elif [ "${{ inputs.wp-version }}" ] && [ "${{ inputs.wp-version }}" != "trunk" ]; then
    57             echo "version=$(echo "${{ inputs.wp-version }}")" >> $GITHUB_OUTPUT
     61          if [ "${WP_VERSION}" ] && [ "${WP_VERSION}" != "nightly" ] && [ "${WP_VERSION}" != "latest" ] && [ "${WP_VERSION}" != "trunk" ]; then
     62            echo "version=$(echo "${WP_VERSION}" | tr '.' '-' | cut -d '-' -f1-2)" >> "$GITHUB_OUTPUT"
     63          elif [ "${WP_VERSION}" ] && [ "${WP_VERSION}" != "trunk" ]; then
     64            echo "version=${WP_VERSION}" >> "$GITHUB_OUTPUT"
    5865          else
    59             echo "version=nightly" >> $GITHUB_OUTPUT
     66            echo "version=nightly" >> "$GITHUB_OUTPUT"
    6067          fi
     68        env:
     69          WP_VERSION: ${{ inputs.wp-version }}
    6170
    6271  # Determines the versions of PHP supported for a version of WordPress.
    … …  
    6877  php-versions:
    6978    name: Determine PHP versions
     79    permissions:
     80      contents: read
    7081    runs-on: ubuntu-latest
    7182    needs: [ major-wp-version ]
    … …  
    8091          repository: ${{ inputs.repository }}
    8192          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
     93          persist-credentials: false
    8294
    8395      # Look up the major version's specific PHP support policy when a version is provided.
    … …  
    8698        id: php-versions
    8799        run: |
    88           if [ "${{ needs.major-wp-version.outputs.version }}" != "latest" ] && [ "${{ needs.major-wp-version.outputs.version }}" != "nightly" ]; then
    89             echo "versions=$(jq -r '.["${{ needs.major-wp-version.outputs.version }}"] | @json' .version-support-php.json)" >> $GITHUB_OUTPUT
     100          if [ "${WP_VERSION}" != "latest" ] && [ "${WP_VERSION}" != "nightly" ]; then
     101            VERSIONS="$( jq \
     102              -r \
     103              --arg wp_version "${WP_VERSION}" \
     104              '.[$wp_version] | @json' \
     105              .version-support-php.json
     106            )"
     107            echo "versions=$VERSIONS" >> "$GITHUB_OUTPUT"
    90108          else
    91             echo "versions=$(jq -r '.[ (keys[-1]) ] | @json' .version-support-php.json)" >> $GITHUB_OUTPUT
     109            echo "versions=$(jq -r '.[ (keys[-1]) ] | @json' .version-support-php.json)" >> "$GITHUB_OUTPUT"
    92110          fi
     111        env:
     112          WP_VERSION: ${{ needs.major-wp-version.outputs.version }}
    93113
    94114  # Determines the versions of MySQL supported for a version of WordPress.
    … …  
    100120  mysql-versions:
    101121    name: Determine MySQL versions
     122    permissions:
     123      contents: read
    102124    runs-on: ubuntu-latest
    103125    needs: [ major-wp-version ]
    … …  
    112134          repository: ${{ inputs.repository }}
    113135          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
     136          persist-credentials: false
    114137
    115138      # Look up the major version's specific MySQL support policy when a version is provided.
    … …  
    118141        id: mysql-versions
    119142        run: |
    120           if [ "${{ needs.major-wp-version.outputs.version }}" != "latest" ] && [ "${{ needs.major-wp-version.outputs.version }}" != "nightly" ]; then
    121             echo "versions=$(jq -r '.["${{ needs.major-wp-version.outputs.version }}"] | @json' .version-support-mysql.json)" >> $GITHUB_OUTPUT
     143          if [ "${WP_VERSION}" != "latest" ] && [ "${WP_VERSION}" != "nightly" ]; then
     144            VERSIONS="$( jq \
     145              -r \
     146              --arg wp_version "${WP_VERSION}" \
     147              '.[$wp_version] | @json' \
     148              .version-support-mysql.json
     149            )"
     150            echo "versions=$VERSIONS" >> "$GITHUB_OUTPUT"
    122151          else
    123             echo "versions=$(jq -r '.[ (keys[-1]) ] | @json' .version-support-mysql.json)" >> $GITHUB_OUTPUT
     152            echo "versions=$(jq -r '.[ (keys[-1]) ] | @json' .version-support-mysql.json)" >> "$GITHUB_OUTPUT"
    124153          fi
     154        env:
     155          WP_VERSION: ${{ needs.major-wp-version.outputs.version }}

  • trunk/.github/workflows/reusable-test-core-build-process.yml

    r59354 r59679  
    3636  PUPPETEER_SKIP_DOWNLOAD: ${{ true }}
    3737
     38# Disable permissions for all available scopes by default.
     39# Any needed permissions should be configured at the job level.
     40permissions: {}
     41
    3842jobs:
    3943  # Verifies that installing npm dependencies and building WordPress works as expected.
    … …  
    5458  build-process-tests:
    5559    name: Core running from ${{ inputs.directory }} / ${{ contains( inputs.os, 'macos-' ) && 'MacOS' || contains( inputs.os, 'windows-' ) && 'Windows' || 'Linux' }}
     60    permissions:
     61      contents: read
    5662    runs-on: ${{ inputs.os }}
    5763    timeout-minutes: 20
    … …  
    6268        with:
    6369          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
     70          persist-credentials: false
    6471
    6572      - name: Set up Node.js
    … …  
    8693
    8794      - name: Build WordPress to run from ${{ inputs.directory }}
    88         run: npm run build${{ inputs.directory == 'src' && ':dev' || '' }}
     95        run: npm run ${{ inputs.directory == 'src' && 'build:dev' || 'build' }}
    8996
    9097      - name: Ensure version-controlled files are not modified or deleted during building
    … …  
    96103
    97104      - name: Clean after building to run from ${{ inputs.directory }}
    98         run: npm run grunt clean${{ inputs.directory == 'src' && ' -- --dev' || '' }}
     105        run: npm run grunt ${{ inputs.directory == 'src' && 'clean -- --dev' || 'clean' }}
    99106
    100107      - name: Ensure version-controlled files are not modified or deleted during cleaning
    … …  
    113120        run: |
    114121          mkdir -p ./pr-number
    115           echo ${{ github.event.number }} > ./pr-number/NR
     122          echo "${EVENT_NUMBER}" > ./pr-number/NR
     123        env:
     124          EVENT_NUMBER: ${{ github.event.number }}
    116125
    117126      # Uploads the PR number as an artifact for the Pull Request Commenting workflow to download and then

  • trunk/.github/workflows/reusable-test-gutenberg-build-process.yml

    r59354 r59679  
    2323  NODE_OPTIONS: '--max-old-space-size=8192'
    2424
     25# Disable permissions for all available scopes by default.
     26# Any needed permissions should be configured at the job level.
     27permissions: {}
     28
    2529jobs:
    2630  # Verifies that installing npm dependencies and building the Gutenberg plugin works as expected.
    … …  
    3943  build-process-tests:
    4044    name: Gutenberg running from ${{ inputs.directory }} / ${{ contains( inputs.os, 'macos-' ) && 'MacOS' || contains( inputs.os, 'windows-' ) && 'Windows' || 'Linux' }}
     45    permissions:
     46      contents: read
    4147    runs-on: ${{ inputs.os }}
    4248    timeout-minutes: 30
    … …  
    4753        with:
    4854          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
     55          persist-credentials: false
    4956
    5057      - name: Checkout Gutenberg plugin
    … …  
    5461          path: ${{ env.GUTENBERG_DIRECTORY }}
    5562          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
     63          persist-credentials: false
    5664
    5765      - name: Set up Node.js
    … …  
    8391
    8492      - name: Build WordPress to run from ${{ inputs.directory }}
    85         run: npm run build${{ inputs.directory == 'src' && ':dev' || '' }}
     93        run: npm run ${{ inputs.directory == 'src' && 'build:dev' || 'build' }}
    8694
    8795      - name: Run Gutenberg build script after building Core to run from ${{ inputs.directory }}

  • trunk/.github/workflows/reusable-test-local-docker-environment-v1.yml

    r59527 r59679  
    4848  PUPPETEER_SKIP_DOWNLOAD: ${{ true }}
    4949
     50# Disable permissions for all available scopes by default.
     51# Any needed permissions should be configured at the job level.
     52permissions: {}
     53
    5054jobs:
    5155  # Tests the local Docker environment.
    … …  
    7175  local-docker-environment-tests:
    7276    name: PHP ${{ inputs.php }} / ${{ 'mariadb' == inputs.db-type && 'MariaDB' || 'MySQL' }} ${{ inputs.db-version }}${{ inputs.memcached && ' with memcached' || '' }}${{ 'example.org' != inputs.tests-domain && format( ' {0}', inputs.tests-domain ) || '' }}
     77    permissions:
     78      contents: read
    7379    runs-on: ${{ inputs.os }}
    7480    timeout-minutes: 20
    … …  
    7783      - name: Configure environment variables
    7884        run: |
    79           echo "PHP_FPM_UID=$(id -u)" >> $GITHUB_ENV
    80           echo "PHP_FPM_GID=$(id -g)" >> $GITHUB_ENV
     85          echo "PHP_FPM_UID=$(id -u)" >> "$GITHUB_ENV"
     86          echo "PHP_FPM_GID=$(id -g)" >> "$GITHUB_ENV"
    8187
    8288      - name: Checkout repository
    … …  
    8490        with:
    8591          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
     92          persist-credentials: false
    8693
    8794      - name: Set up Node.js
    … …  
    136143      - name: WordPress Docker container debug information
    137144        run: |
    138           docker compose run --rm mysql ${{ env.LOCAL_DB_TYPE }} --version
     145          docker compose run --rm mysql "${LOCAL_DB_TYPE}" --version
    139146          docker compose run --rm php php --version
    140147          docker compose run --rm php php -m

  • trunk/.github/workflows/reusable-upgrade-testing.yml

    r59402 r59679  
    3838        default: '5.7'
    3939
     40# Disable permissions for all available scopes by default.
     41# Any needed permissions should be configured at the job level.
     42permissions: {}
     43
    4044jobs:
    4145  # Runs upgrade tests on a build of WordPress.
    … …  
    5054  upgrade-tests:
    5155    name: ${{ inputs.wp }} to ${{ inputs.new-version }} / PHP ${{ inputs.php }} with ${{ 'mariadb' == inputs.db-type && 'MariaDB' || 'MySQL' }} ${{ inputs.db-version }}${{ inputs.multisite && ' multisite' || '' }}
     56    permissions: {}
    5257    runs-on: ${{ inputs.os }}
    5358    timeout-minutes: 20
    … …  
    7782
    7883      - name: Download WordPress ${{ inputs.wp }}
    79         run: wp core download --version=${{ inputs.wp }}
     84        run: wp core download --version="${WP_VERSION}"
     85        env:
     86          WP_VERSION: ${{ inputs.wp }}
    8087
    8188      - name: Create wp-config.php file
    82         run: wp config create --dbname=test_db --dbuser=root --dbpass=root --dbhost=127.0.0.1:${{ job.services.database.ports['3306'] }}
     89        run: wp config create --dbname=test_db --dbuser=root --dbpass=root --dbhost="127.0.0.1:${DB_PORT}"
     90        env:
     91          DB_PORT: ${{ job.services.database.ports['3306'] }}
    8392
    8493      - name: Install WordPress
    85         run: wp core ${{ inputs.multisite && 'multisite-' || '' }}install --url=http://localhost/ --title="Upgrade Test" --admin_user=admin --admin_password=password --admin_email=me@example.org --skip-email
     94        run: |
     95          wp core ${{ inputs.multisite && 'multisite-install' || 'install' }} \
     96          --url=http://localhost/ --title="Upgrade Test" --admin_user=admin \
     97          --admin_password=password --admin_email=me@example.org --skip-email
    8698
    8799      - name: Update to the latest minor version
    … …  
    90102      - name: Upgrade to WordPress ${{ inputs.new-version }}
    91103        run: |
    92           wp core update${{ 'latest' != inputs.new-version && format( ' --version={0}', inputs.new-version ) || '' }}
     104          wp core update ${{ 'latest' != inputs.new-version && '--version="${WP_VERSION}"' || '' }}
     105        env:
     106          WP_VERSION: ${{ inputs.new-version }}

  • trunk/.github/workflows/slack-notifications.yml

    r59519 r59679  
    5555    if: ${{ github.repository == 'WordPress/wordpress-develop' && github.event.workflow_run.event != 'pull_request' }}
    5656    outputs:
    57       previous_conclusion: ${{ steps.previous-conclusion.outputs.previous_conclusion }}
     57      previous_conclusion: ${{ steps.previous-attempt-result.outputs.result }}
    5858      payload: ${{ steps.create-payload.outputs.payload }}
    5959
    … …  
    6969              owner: context.repo.owner,
    7070              repo: context.repo.repo,
    71               run_id: ${{ github.run_id }},
     71              run_id: context.runId,
    7272            });
    7373
    74             if ( '${{ inputs.calling_status }}' == 'failure' && workflow_run.data.run_attempt == 1 ) {
     74            if ( process.env.CALLING_STATUS == 'failure' && workflow_run.data.run_attempt == 1 ) {
    7575              return 'first-failure';
    7676            }
    … …  
    8383                owner: context.repo.owner,
    8484                repo: context.repo.repo,
    85                 run_id: ${{ github.run_id }},
     85                run_id: context.runId,
    8686                attempt_number: workflow_run.data.run_attempt - 1
    8787              });
    … …  
    9595              repo: context.repo.repo,
    9696              workflow_id: workflow_run.data.workflow_id,
    97               branch: '${{ env.CURRENT_BRANCH }}',
     97              branch: process.env.CURRENT_BRANCH,
    9898              exclude_pull_requests: true,
    9999            });
    … …  
    125125            // Can't determine previous workflow conclusion.
    126126            return 'unknown';
    127 
    128       - name: Store previous conclusion as an output
    129         id: previous-conclusion
    130         run: echo "previous_conclusion=${{ steps.previous-attempt-result.outputs.result }}" >> $GITHUB_OUTPUT
     127        env:
     128          CALLING_STATUS: ${{ inputs.calling_status }}
    131129
    132130      - name: Get the commit message
    … …  
    141139              owner: context.repo.owner,
    142140              repo: context.repo.repo,
    143               ref: '${{ github.sha }}'
     141              ref: context.sha,
    144142            });
    145143            return commit_details.data.commit.message;
    … …  
    148146        id: commit-message
    149147        run: |
    150           COMMIT_MESSAGE=$(cat <<'EOF' | awk 'NR==1' | sed 's/`/\\`/g' | sed 's/\"/\\\\\\"/g' | sed 's/\$/\\$/g'
    151           ${{ ( github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' ) && fromJson( steps.current-commit-message.outputs.result ) || github.event.head_commit.message }}
    152           EOF
    153           )
    154           echo "commit_message_escaped=${COMMIT_MESSAGE}" >> $GITHUB_OUTPUT
     148          # shellcheck disable=SC2016
     149          COMMIT_MESSAGE="$(echo "${COMMIT_MSG_RAW}" | awk 'NR==1' | sed 's/`/\\`/g' | sed 's/\"/\\\\\\"/g' | sed 's/\$/\\$/g')"
     150          echo "commit_message_escaped=${COMMIT_MESSAGE}" >> "$GITHUB_OUTPUT"
     151        env:
     152          COMMIT_MSG_RAW: ${{ ( github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' ) && fromJson( steps.current-commit-message.outputs.result ) || github.event.head_commit.message }}
    155153
    156154      - name: Construct payload and store as an output
    157155        id: create-payload
    158         run: echo "payload={\"workflow_name\":\"${{ github.workflow }}\",\"ref_name\":\"${{ env.CURRENT_BRANCH }}\",\"run_url\":\"https://github.com/WordPress/wordpress-develop/actions/runs/${{ github.run_id }}/attempts/${{ github.run_attempt }}\",\"commit_message\":\"${{ steps.commit-message.outputs.commit_message_escaped }}\"}" >> $GITHUB_OUTPUT
     156        run: |
     157          PAYLOAD="$( jq \
     158            -n \
     159            --arg workflow_name "${GITHUB_WORKFLOW}" \
     160            --arg ref_name "${CURRENT_BRANCH}" \
     161            --arg run_url "https://github.com/WordPress/wordpress-develop/actions/runs/${GITHUB_RUN_ID}/attempts/${GITHUB_RUN_ATTEMPT}" \
     162            --arg commit_message "${COMMIT_MSG}" \
     163            '{workflow_name: $workflow_name, ref_name: $ref_name, run_url: $run_url, commit_message: $commit_message}'
     164          )"
     165          echo "payload=$PAYLOAD" >> "$GITHUB_OUTPUT"
     166        env:
     167          COMMIT_MSG: ${{ steps.commit-message.outputs.commit_message_escaped }}
    159168
    160169  # Posts notifications when a workflow fails.
    161170  failure:
    162171    name: Failure notifications
     172    permissions: {}
    163173    runs-on: ubuntu-latest
    164174    timeout-minutes: 10
    … …  
    177187  fixed:
    178188    name: Fixed notifications
     189    permissions: {}
    179190    runs-on: ubuntu-latest
    180191    timeout-minutes: 10
    … …  
    193204  success:
    194205    name: Success notifications
     206    permissions: {}
    195207    runs-on: ubuntu-latest
    196208    timeout-minutes: 10
    … …  
    209221  cancelled:
    210222    name: Cancelled notifications
     223    permissions: {}
    211224    runs-on: ubuntu-latest
    212225    timeout-minutes: 10

  • trunk/.github/workflows/test-and-zip-default-themes.yml

    r59673 r59679  
    9292          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.branch || github.ref }}
    9393          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
     94          persist-credentials: false
    9495
    9596      - name: Check for zero-byte (empty) files
    9697        run: |
    97           [[ ! $(find src/wp-content/themes/${{ matrix.theme }} -empty) ]]
     98          [[ ! $(find "src/wp-content/themes/${THEME}" -empty) ]]
     99        env:
     100          THEME: ${{ matrix.theme }}
    98101
    99102  # Tests the build script for themes that have one.
    … …  
    131134          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.branch || github.ref }}
    132135          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
     136          persist-credentials: false
    133137
    134138      - name: Set up Node.js
    … …  
    188192          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.branch || github.ref }}
    189193          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
     194          persist-credentials: false
    190195
    191196      - name: Upload theme ZIP as an artifact

  • trunk/.github/workflows/upgrade-testing.yml

    r59673 r59679  
    6060    uses: ./.github/workflows/reusable-upgrade-testing.yml
    6161    if: ${{ github.repository == 'WordPress/wordpress-develop' || github.event_name == 'pull_request' }}
    62     permissions:
    63       contents: read
    6462    strategy:
    6563      fail-fast: false
    … …  
    9795    uses: ./.github/workflows/reusable-upgrade-testing.yml
    9896    if: ${{ github.repository == 'WordPress/wordpress-develop' || github.event_name == 'pull_request' }}
    99     permissions:
    100       contents: read
    10197    strategy:
    10298      fail-fast: false
    … …  
    112108          # The PHP <= 7.3/MySQL 8.4 jobs currently fail due to mysql_native_password being disabled by default. See https://core.trac.wordpress.org/ticket/61218.
    113109          - php: '7.2'
    114             db-version: '8.4'
    115           - php: '7.3'
    116110            db-version: '8.4'
    117111    with:
    … …  
    142136          # The PHP <= 7.3/MySQL 8.4 jobs currently fail due to mysql_native_password being disabled by default. See https://core.trac.wordpress.org/ticket/61218.
    143137          - php: '7.2'
    144             db-version: '8.4'
    145           - php: '7.3'
    146138            db-version: '8.4'
    147139    with:
    … …  
    201193          # The PHP <= 7.3/MySQL 8.4 jobs currently fail due to mysql_native_password being disabled by default. See https://core.trac.wordpress.org/ticket/61218.
    202194          - php: '7.2'
    203             db-version: '8.4'
    204           - php: '7.3'
    205195            db-version: '8.4'
    206196    with:

  • trunk/docker-compose.yml

    r59668 r59679  
    3939
    4040    environment:
    41       - LOCAL_PHP_XDEBUG=${LOCAL_PHP_XDEBUG-false}
    42       - XDEBUG_MODE=${LOCAL_PHP_XDEBUG_MODE-develop,debug}
    43       - LOCAL_PHP_MEMCACHED=${LOCAL_PHP_MEMCACHED-false}
    44       - PHP_FPM_UID=${PHP_FPM_UID-1000}
    45       - PHP_FPM_GID=${PHP_FPM_GID-1000}
    46       - GITHUB_REF=${GITHUB_REF-false}
    47       - GITHUB_EVENT_NAME=${GITHUB_EVENT_NAME-false}
    48       - HOST_PATH=${PWD-}/${LOCAL_DIR-src}
     41      LOCAL_PHP_XDEBUG: ${LOCAL_PHP_XDEBUG-false}
     42      XDEBUG_MODE: ${LOCAL_PHP_XDEBUG_MODE-develop,debug}
     43      LOCAL_PHP_MEMCACHED: ${LOCAL_PHP_MEMCACHED-false}
     44      PHP_FPM_UID: ${PHP_FPM_UID-1000}
     45      PHP_FPM_GID: ${PHP_FPM_GID-1000}
     46      GITHUB_REF: ${GITHUB_REF-false}
     47      GITHUB_EVENT_NAME: ${GITHUB_EVENT_NAME-false}
     48      HOST_PATH: ${PWD-}/${LOCAL_DIR-src}
    4949
    5050    volumes:
    … …  
    8484
    8585    healthcheck:
    86       test: [ "CMD-SHELL", "if [ \"$LOCAL_DB_TYPE\" = \"mariadb\" ]; then case \"$LOCAL_DB_VERSION\" in 5.5|10.0|10.1|10.2|10.3) mysqladmin ping -h localhost || exit $$?;; *) mariadb-admin ping -h localhost || exit $$?;; esac; else mysqladmin ping -h localhost || exit $$?; fi" ]
     86      test: [
     87        'CMD-SHELL',
     88        'if [ "$LOCAL_DB_TYPE" = "mariadb" ]; then case "$LOCAL_DB_VERSION" in 5.5|10.0|10.1|10.2|10.3) mysqladmin ping -h localhost || exit $$?;; *) mariadb-admin ping -h localhost || exit $$?;; esac; else mysqladmin ping -h localhost || exit $$?; fi'
     89      ]
    8790      timeout: 5s
    8891      interval: 5s
    … …  
    99102
    100103    environment:
    101       - LOCAL_PHP_XDEBUG=${LOCAL_PHP_XDEBUG-false}
    102       - LOCAL_PHP_MEMCACHED=${LOCAL_PHP_MEMCACHED-false}
    103       - PHP_FPM_UID=${PHP_FPM_UID-1000}
    104       - PHP_FPM_GID=${PHP_FPM_GID-1000}
    105       - HOST_PATH=${PWD-}/${LOCAL_DIR-src}
     104      LOCAL_PHP_XDEBUG: ${LOCAL_PHP_XDEBUG-false}
     105      LOCAL_PHP_MEMCACHED: ${LOCAL_PHP_MEMCACHED-false}
     106      PHP_FPM_UID: ${PHP_FPM_UID-1000}
     107      PHP_FPM_GID: ${PHP_FPM_GID-1000}
     108      HOST_PATH: ${PWD-}/${LOCAL_DIR-src}
    106109
    107110    volumes:
Note: See TracChangeset for help on using the changeset viewer.