Merge pull request #1086 from 10up/update/workflows

Cleanup / Modify / Add GitHub Action Workflows

Author: dkotter

.github/dependabot.yml

@@ -0,0 +1,63 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: '/'
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    commit-message:
+      prefix: 'chore(ci)'
+    labels:
+      - dependencies
+    groups:
+      github-actions-updates:
+        patterns: ['*']
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: composer
+    directory: '/'
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    cooldown:
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 7
+    versioning-strategy: increase
+    commit-message:
+      prefix: 'fix'
+      include: 'scope'
+    labels:
+      - dependencies
+    groups:
+      composer-dev-minor-patch:
+        dependency-type: 'development'
+        update-types: [minor, patch]
+      # We don't bundle minor or major production assets, so they're tested individually.
+      composer-patch:
+        dependency-type: 'production'
+        update-types: [patch]
+
+  - package-ecosystem: npm
+    directory: '/'
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    cooldown:
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 7
+    versioning-strategy: increase
+    commit-message:
+      prefix: 'fix'
+      include: 'scope'
+    labels:
+      - dependencies
+    groups:
+      npm-dev-minor-patch:
+        dependency-type: 'development'
+        update-types: [minor, patch]
+      npm-prod-minor-patch:
+        dependency-type: 'production'
+        update-types: [minor, patch]

.github/workflows/build-docs.yml

@@ -5,10 +5,16 @@ on:
     branches:
     - trunk
 
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
 jobs:
-  release:
-    name: Push (merge) to trunk
+  build-docs:
+    name: Build docs
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
 
     steps:
     - name: Checkout

.github/workflows/build-preview-zip.yml

@@ -0,0 +1,64 @@
+name: Build Preview Zip
+
+on:
+  pull_request:
+    types: [ 'opened', 'synchronize', 'reopened', 'edited' ]
+
+# Cancels all previous workflow runs for pull requests that have not completed.
+concurrency:
+  # The concurrency group contains the workflow name and the branch name for pull requests
+  # or the commit hash for any other events.
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }}
+  cancel-in-progress: true
+
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      job_status: ${{ job.status }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
+          persist-credentials: false
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # v2.37.1
+        with:
+          php-version: '7.4'
+          coverage: none
+
+      - name: Use desired version of Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: '.nvmrc'
+          check-latest: true
+
+      - name: Install NPM dependencies
+        run: npm ci
+
+      - name: Install Composer dependencies
+        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # v4.0.0
+        with:
+          composer-options: '--no-dev -o'
+
+      - name: Build plugin
+        run: |
+          npm run build
+          npm run makepot
+          npm run archive
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: classifai-zip-pr${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}
+          path: classifai.zip
+          if-no-files-found: error

.github/workflows/build-release-zip.yml

@@ -4,10 +4,16 @@ on:
   workflow_dispatch:
   workflow_call:
 
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   build_zip:
     name: Build release zip
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
     - name: Checkout code

.github/workflows/close-stale-issues.yml

@@ -8,12 +8,16 @@ on:
     # Schedule for every day at 1:30am UTC
     - cron: '30 1 * * *'
 
-permissions:
-  issues: write
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
 
 jobs:
   stale:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+
     steps:
       - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
         with: