Skip to content

GitHub Actions workflow updates #3628

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
johnbillion wants to merge 5 commits into
base: trunk
Choose a base branch
from
Open

GitHub Actions workflow updates #3628

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
51146ce
Grant minimally-scoped permissions.
johnbillion May 13, 2026
cda15b8
Set timeouts on all jobs.
johnbillion May 13, 2026
a3ad7a0
Merge branch 'trunk' into workflow-updates
desrosj May 13, 2026
211cf44
Typo
johnbillion May 13, 2026
74474bb
Merge branch 'trunk' into workflow-updates
desrosj May 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 10 additions & 3 deletions .github/workflows/auto-label-prs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,14 +30,18 @@ on:
pull_request_target:
types: [opened, synchronize, reopened, ready_for_review]

permissions:
contents: read
pull-requests: write
# Disable permissions for all available scopes by default.
# Any needed permissions should be configured at the job level.
permissions: {}

jobs:
paths:
if: github.repository == 'WordPress/wordpress-playground'
runs-on: ubuntu-latest
timeout-minutes: 10
permissions:
contents: read # Required for actions/labeler to read the configuration file.
pull-requests: write # Required to apply labels to pull requests.
steps:
# Pinned to a commit SHA, not a tag: this job runs with
# pull-requests:write, so a moved tag would be a supply-chain
Expand All @@ -50,6 +54,9 @@ jobs:
package-and-type:
if: github.repository == 'WordPress/wordpress-playground'
runs-on: ubuntu-latest
timeout-minutes: 10
permissions:
pull-requests: write # Required to apply labels to pull requests.
steps:
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
with:
Expand Down
78 changes: 76 additions & 2 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,10 @@ on:
- trunk
pull_request:

# Disable permissions for all available scopes by default.
# Any needed permissions should be configured at the job level.
permissions: {}

jobs:
# This step:
# * Warms up the node_modules cache
Expand All @@ -18,6 +22,9 @@ jobs:
name: 'Lint and typecheck'
if: github.repository == 'WordPress/wordpress-playground' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
steps:
- uses: actions/checkout@v4
with:
Expand All @@ -30,6 +37,9 @@ jobs:
test-unit-asyncify:
if: github.repository == 'WordPress/wordpress-playground' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -79,6 +89,9 @@ jobs:
test-unit-jspi:
if: github.repository == 'WordPress/wordpress-playground' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -130,6 +143,9 @@ jobs:
os: [ubuntu-latest, windows-latest, macos-latest]
continue-on-error: true
runs-on: ${{ matrix.os }}
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
name: 'test-playground-cli (${{ matrix.os }})'
steps:
- uses: actions/checkout@v4
Expand All @@ -148,6 +164,9 @@ jobs:
async-strategy: [asyncify, jspi]
continue-on-error: true
runs-on: ${{ matrix.os }}
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
name: 'test-file-locking-${{ matrix.async-strategy }} (${{ matrix.os }})'
steps:
- uses: actions/checkout@v4
Expand All @@ -161,6 +180,9 @@ jobs:
test-e2e-php-wasm-web-jspi:
if: github.repository == 'WordPress/wordpress-playground' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
steps:
- uses: actions/checkout@v4
with:
Expand All @@ -171,6 +193,9 @@ jobs:
test-e2e-php-wasm-web-asyncify:
if: github.repository == 'WordPress/wordpress-playground' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
steps:
- uses: actions/checkout@v4
with:
Expand All @@ -181,6 +206,9 @@ jobs:
test-e2e:
if: github.repository == 'WordPress/wordpress-playground' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
# Run as root to allow node to bind to port 80
steps:
- uses: actions/checkout@v4
Expand All @@ -201,6 +229,9 @@ jobs:
test-e2e-playwright:
if: github.repository == 'WordPress/wordpress-playground' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -282,6 +313,9 @@ jobs:

test-e2e-personal-wp:
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
steps:
- uses: actions/checkout@v4
with:
Expand All @@ -301,6 +335,9 @@ jobs:
test-e2e-components:
if: github.repository == 'WordPress/wordpress-playground' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
steps:
- uses: actions/checkout@v4
with:
Expand All @@ -320,6 +357,9 @@ jobs:
# Run MCP e2e tests independently from other tests because running a local version of the MCP server from TypeScript files requires Node 22+
test-e2e-mcp:
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
steps:
- uses: actions/checkout@v4
with:
Expand All @@ -341,6 +381,9 @@ jobs:
test-docs-api-reference:
if: github.repository == 'WordPress/wordpress-playground' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
steps:
- uses: actions/checkout@v4
with:
Expand All @@ -360,6 +403,9 @@ jobs:
test-built-npm-packages:
if: github.repository == 'WordPress/wordpress-playground' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
steps:
- uses: actions/checkout@v4
with:
Expand All @@ -373,6 +419,9 @@ jobs:
test-playground-client-types-rollup:
if: github.repository == 'WordPress/wordpress-playground' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
steps:
- uses: actions/checkout@v4
with:
Expand All @@ -388,6 +437,9 @@ jobs:
test-running-unbuilt-playground-cli:
if: github.repository == 'WordPress/wordpress-playground' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
steps:
- uses: actions/checkout@v4
with:
Expand All @@ -400,6 +452,9 @@ jobs:
test-php-wasm-cli-smoke:
if: github.repository == 'WordPress/wordpress-playground' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
steps:
- uses: actions/checkout@v4
with:
Expand All @@ -412,6 +467,9 @@ jobs:
detect-compile-extension-helper-changes:
if: github.repository == 'WordPress/wordpress-playground' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo and fetch commit history.
outputs:
changed: ${{ steps.changed.outputs.changed }}
steps:
Expand Down Expand Up @@ -447,6 +505,9 @@ jobs:
needs: detect-compile-extension-helper-changes
if: (github.repository == 'WordPress/wordpress-playground' || github.event_name == 'pull_request') && needs.detect-compile-extension-helper-changes.outputs.changed == 'true'
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
steps:
- name: Free up runner disk space
shell: bash
Expand Down Expand Up @@ -481,6 +542,8 @@ jobs:
if: github.repository == 'WordPress/wordpress-playground' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
steps:
- uses: actions/checkout@v4
with:
Expand Down Expand Up @@ -511,6 +574,9 @@ jobs:
test-redis-extension:
if: github.repository == 'WordPress/wordpress-playground' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
services:
redis:
image: redis:7-alpine
Expand Down Expand Up @@ -539,6 +605,9 @@ jobs:
test-memcached-extension:
if: github.repository == 'WordPress/wordpress-playground' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
services:
memcached:
image: memcached:1.6-alpine
Expand All @@ -562,6 +631,9 @@ jobs:
build:
if: github.repository == 'WordPress/wordpress-playground' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read # Required to clone the repo.
steps:
- uses: actions/checkout@v4
with:
Expand Down Expand Up @@ -592,8 +664,9 @@ jobs:

# Grant GITHUB_TOKEN the permissions required to make a Pages deployment
permissions:
pages: write # to deploy to Pages
id-token: write # to verify the deployment originates from an appropriate source
contents: read # Required to clone the repo.
pages: write # Required to deploy to GitHub Pages.
id-token: write # Required to verify the deployment originates from an appropriate source.

# Deploy to the github-pages environment
environment:
Expand All @@ -602,6 +675,7 @@ jobs:

# Specify runner + deployment step
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- uses: actions/checkout@v4
with:
Expand Down
9 changes: 6 additions & 3 deletions .github/workflows/dependabot-lockfile.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,17 @@ on:
pull_request:
types: [opened, synchronize]

permissions:
contents: write
pull-requests: write
# Disable permissions for all available scopes by default.
# Any needed permissions should be configured at the job level.
permissions: {}

jobs:
fix-lock:
if: github.actor == 'dependabot[bot]'
runs-on: ubuntu-latest
timeout-minutes: 10
permissions:
contents: write # Required to push the updated lockfile commit back to the branch.
steps:
- uses: actions/checkout@v4
with:
Expand Down
9 changes: 9 additions & 0 deletions .github/workflows/deploy-cors-proxy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@ on:
concurrency:
group: cors-proxy-deployment

# Disable permissions for all available scopes by default.
# Any needed permissions should be configured at the job level.
permissions: {}

jobs:
# Check preconditions in a separate job because secrets aren't
# available in job-level `if` conditions.
Expand All @@ -27,6 +31,8 @@ jobs:
github.actor == 'ashfame'
)
runs-on: ubuntu-latest
timeout-minutes: 20
permissions: {}
Comment thread
johnbillion marked this conversation as resolved.
environment:
name: cors-proxy-wp-cloud
outputs:
Expand Down Expand Up @@ -56,6 +62,9 @@ jobs:

# Specify runner + deployment step
runs-on: ubuntu-latest
timeout-minutes: 20
permissions:
contents: read # Required to clone the repo.
environment:
name: cors-proxy-wp-cloud
steps:
Expand Down
9 changes: 9 additions & 0 deletions .github/workflows/deploy-my-wordpress-net.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,10 @@ on:
concurrency:
group: my-wordpress-net-deployment

# Disable permissions for all available scopes by default.
# Any needed permissions should be configured at the job level.
permissions: {}

jobs:
# Check preconditions in a separate job because secrets aren't
# available in job-level `if` conditions.
Expand All @@ -29,6 +33,8 @@ jobs:
github.actor == 'ashfame'
)
runs-on: ubuntu-latest
timeout-minutes: 20
permissions: {}
Comment thread
johnbillion marked this conversation as resolved.
environment:
name: my-wordpress-net-wp-cloud
outputs:
Expand Down Expand Up @@ -57,6 +63,9 @@ jobs:
if: needs.check_preconditions.outputs.meets_deploy_preconditions == 'true'

runs-on: ubuntu-latest
timeout-minutes: 20
permissions:
contents: read # Required to clone the repo.
environment:
name: my-wordpress-net-wp-cloud
steps:
Expand Down
Loading
Loading