Changeset 59679 for trunk/.github/workflows/upgrade-testing.yml

Timestamp:

01/22/2025 03:13:21 PM (17 months ago)

Author:

johnbillion

Message:

Build/Test Tools: Improve the security and correctness of the GitHub Actions workflows files.

This includes removing use of dangerous inline GitHub Actions expressions, preventing word splitting, further tightening permissions, and generally improving many aspects of the workflows.

This also introduces a new workflow that runs Actionlint to detect incorrect and insecure code and configuration in workflow files.

Props johnbillion, swissspidy, flixos90, desrosj.

See #62221

File:

• trunk/.github/workflows/upgrade-testing.yml (modified) (5 diffs)

trunk/.github/workflows/upgrade-testing.yml

@@ -60 +60 @@
     uses: ./.github/workflows/reusable-upgrade-testing.yml
     if: ${{ github.repository == 'WordPress/wordpress-develop' || github.event_name == 'pull_request' }}
-    permissions:
-      contents: read
     strategy:
       fail-fast: false
@@ -97 +95 @@
     uses: ./.github/workflows/reusable-upgrade-testing.yml
     if: ${{ github.repository == 'WordPress/wordpress-develop' || github.event_name == 'pull_request' }}
-    permissions:
-      contents: read
     strategy:
       fail-fast: false
@@ -112 +108 @@
           # The PHP <= 7.3/MySQL 8.4 jobs currently fail due to mysql_native_password being disabled by default. See https://core.trac.wordpress.org/ticket/61218.
           - php: '7.2'
-            db-version: '8.4'
-          - php: '7.3'
             db-version: '8.4'
     with:
@@ -142 +136 @@
           # The PHP <= 7.3/MySQL 8.4 jobs currently fail due to mysql_native_password being disabled by default. See https://core.trac.wordpress.org/ticket/61218.
           - php: '7.2'
-            db-version: '8.4'
-          - php: '7.3'
             db-version: '8.4'
     with:
@@ -201 +193 @@
           # The PHP <= 7.3/MySQL 8.4 jobs currently fail due to mysql_native_password being disabled by default. See https://core.trac.wordpress.org/ticket/61218.
           - php: '7.2'
-            db-version: '8.4'
-          - php: '7.3'
             db-version: '8.4'
     with: