|
| 1 | +name: Lint GitHub Actions workflows |
| 2 | +on: |
| 3 | + workflow_call: |
| 4 | + secrets: |
| 5 | + GH_APP_ID: |
| 6 | + description: 'A GitHub App ID.' |
| 7 | + required: true |
| 8 | + GH_APP_PRIVATE_KEY: |
| 9 | + description: 'A GitHub App private key.' |
| 10 | + required: true |
| 11 | + |
| 12 | +permissions: {} |
| 13 | + |
| 14 | +jobs: |
| 15 | + # Checks a PR for uncommitted changes to built files. |
| 16 | + # |
| 17 | + # This job uses a GitHub App instead of $GITHUB_TOKEN because Dependabot pull requests are only granted |
| 18 | + # read-only access. |
| 19 | + # |
| 20 | + # Performs the following steps: |
| 21 | + # - Generates a token for authenticating with the GitHub App. |
| 22 | + # - Checks out the repository. |
| 23 | + # - Sets up Node.js. |
| 24 | + # - Configures caching for Composer. |
| 25 | + # - Installs Composer dependencies. |
| 26 | + # - Logs general debug information about the runner. |
| 27 | + # - Installs npm dependencies. |
| 28 | + # - Builds CSS file using SASS. |
| 29 | + # - Builds Emoji files. |
| 30 | + # - Builds bundled Root Certificate files. |
| 31 | + # - Builds WordPress. |
| 32 | + # - Checks for changes to versioned files. |
| 33 | + # - Displays the result of git diff for debugging purposes. |
| 34 | + # - Configures the Git author. |
| 35 | + # - Stages changes. |
| 36 | + # - Commits changes. |
| 37 | + # - Pushes changes. |
| 38 | + update-built-files: |
| 39 | + name: Check and update built files |
| 40 | + runs-on: ubuntu-24.04 |
| 41 | + # This prevents an unnecessary second run after changes are committed back because Dependabot always rebases |
| 42 | + # updates and force pushes. |
| 43 | + if: ${{ github.actor != 'dependabot[bot]' || github.event.commits < 2 }} |
| 44 | + timeout-minutes: 10 |
| 45 | + permissions: |
| 46 | + contents: write |
| 47 | + steps: |
| 48 | + - name: Generate Installation Token |
| 49 | + id: generate_token |
| 50 | + env: |
| 51 | + GH_APP_ID: ${{ secrets.GH_APP_ID }} |
| 52 | + GH_APP_PRIVATE_KEY: ${{ secrets.GH_APP_PRIVATE_KEY }} |
| 53 | + run: | |
| 54 | + echo "$GH_APP_PRIVATE_KEY" > private-key.pem |
| 55 | +
|
| 56 | + # Generate JWT |
| 57 | + JWT=$(python3 - <<EOF |
| 58 | + import jwt, time |
| 59 | + private_key = open("private-key.pem", "r").read() |
| 60 | + payload = { |
| 61 | + "iat": int(time.time()), |
| 62 | + "exp": int(time.time()) + 600, # 10-minute expiration |
| 63 | + "iss": $GH_APP_ID |
| 64 | + } |
| 65 | + print(jwt.encode(payload, private_key, algorithm="RS256")) |
| 66 | + EOF |
| 67 | + ) |
| 68 | +
|
| 69 | + # Get Installation ID |
| 70 | + INSTALLATION_ID=$(curl -s -X GET -H "Authorization: Bearer $JWT" \ |
| 71 | + -H "Accept: application/vnd.github.v3+json" \ |
| 72 | + https://api.github.com/app/installations | jq -r '.[0].id') |
| 73 | +
|
| 74 | + # Request Installation Access Token |
| 75 | + ACCESS_TOKEN=$(curl -s -X POST -H "Authorization: Bearer $JWT" \ |
| 76 | + -H "Accept: application/vnd.github.v3+json" \ |
| 77 | + "https://api.github.com/app/installations/$INSTALLATION_ID/access_tokens" | jq -r '.token') |
| 78 | +
|
| 79 | + echo "ACCESS_TOKEN=$ACCESS_TOKEN" >> "$GITHUB_ENV" |
| 80 | +
|
| 81 | + rm -f private-key.pem |
| 82 | +
|
| 83 | + - name: Checkout repository |
| 84 | + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 |
| 85 | + with: |
| 86 | + repository: ${{ github.event.pull_request.head.repo.full_name }} |
| 87 | + ref: ${{ github.event.pull_request.head.ref }} |
| 88 | + show-progress: ${{ runner.debug == '1' && 'true' || 'false' }} |
| 89 | + token: ${{ env.ACCESS_TOKEN }} |
| 90 | + |
| 91 | + - name: Set up Node.js |
| 92 | + uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4.3.0 |
| 93 | + with: |
| 94 | + node-version-file: '.nvmrc' |
| 95 | + cache: npm |
| 96 | + |
| 97 | + # This date is used to ensure that the PHPCS cache is cleared at least once every week. |
| 98 | + # http://man7.org/linux/man-pages/man1/date.1.html |
| 99 | + - name: "Get last Monday's date" |
| 100 | + id: get-date |
| 101 | + run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> "$GITHUB_OUTPUT" |
| 102 | + |
| 103 | + # Since Composer dependencies are installed using `composer update` and no lock file is in version control, |
| 104 | + # passing a custom cache suffix ensures that the cache is flushed at least once per week. |
| 105 | + - name: Install Composer dependencies |
| 106 | + uses: ramsey/composer-install@a2636af0004d1c0499ffca16ac0b4cc94df70565 # v3.1.0 |
| 107 | + with: |
| 108 | + custom-cache-suffix: ${{ steps.get-date.outputs.date }} |
| 109 | + |
| 110 | + - name: Log debug information |
| 111 | + run: | |
| 112 | + npm --version |
| 113 | + node --version |
| 114 | + curl --version |
| 115 | + git --version |
| 116 | +
|
| 117 | + - name: Install npm Dependencies |
| 118 | + run: npm ci |
| 119 | + |
| 120 | + - name: Run SASS precommit tasks |
| 121 | + run: npm run grunt precommit:css |
| 122 | + |
| 123 | + - name: Run Emoji precommit task |
| 124 | + run: npm run grunt precommit:emoji |
| 125 | + env: |
| 126 | + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 127 | + |
| 128 | + - name: Run certificate tasks |
| 129 | + run: npm run grunt copy:certificates |
| 130 | + |
| 131 | + - name: Build WordPress |
| 132 | + run: npm run build:dev |
| 133 | + |
| 134 | + - name: Check for changes to versioned files |
| 135 | + id: built-file-check |
| 136 | + run: | |
| 137 | + if git diff --quiet; then |
| 138 | + echo "uncommitted_changes=false" >> "$GITHUB_OUTPUT" |
| 139 | + else |
| 140 | + echo "uncommitted_changes=true" >> "$GITHUB_OUTPUT" |
| 141 | + fi |
| 142 | +
|
| 143 | + - name: Display changes to versioned files |
| 144 | + if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }} |
| 145 | + run: git diff |
| 146 | + |
| 147 | + - name: Configure git user name and email |
| 148 | + if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }} |
| 149 | + run: | |
| 150 | + git config user.name "wordpress-develop-pr-bot[bot]" |
| 151 | + git config user.email ${{ secrets.GH_APP_ID }}+wordpress-develop-pr-bot[bot]@users.noreply.github.com |
| 152 | +
|
| 153 | + - name: Stage changes |
| 154 | + if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }} |
| 155 | + run: git add . |
| 156 | + |
| 157 | + - name: Commit changes |
| 158 | + if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }} |
| 159 | + run: | |
| 160 | + git commit -m "Automation: Updating built files with changes. [dependabot skip]" |
| 161 | +
|
| 162 | + - name: Push changes |
| 163 | + if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }} |
| 164 | + run: git push |
0 commit comments