Skip to content

Repair wp/6.6 branch Actions: Update GitHub Actions to their latest versions #82915

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
desrosj wants to merge 14 commits into from
Open

Repair wp/6.6 branch Actions: Update GitHub Actions to their latest versions #82915

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
ec6d67c
CI: Update `actions/checkout` to `v7.0.1`
desrosj Sep 15, 2026
1408334
CI: Update `actions/setup-node` to `v7.0.0`
desrosj Sep 15, 2026
656af3c
CI: Update `actions/upload-artifact` to `v7.0.1`
desrosj Sep 15, 2026
f1baf24
CI: Update `actions/cache` to `v6.1.0`
desrosj Sep 15, 2026
a515c41
CI: Update `ramsey/composer-install` to `v4.0.0`
desrosj Sep 15, 2026
0e58cad
CI: Update `shivammathur/setup-php` to `v2.37.2`
desrosj Sep 15, 2026
ee08e08
CI: Update `preactjs/compressed-size-action` to `v2.10.0`
desrosj Sep 15, 2026
6111ca2
Update `actions/download-artifact` to `v8.0.1`.
desrosj Sep 15, 2026
b878904
Update `actions/github-script` to `v9.0.0`.
desrosj Sep 15, 2026
b363a48
CI: Update `actions/checkout` to `v7.0.1` in `publish-npm-packages.yml`.
desrosj Sep 15, 2026
292f394
CI: Update `actions/setup-node` to `v7.0.0` in `publish-npm-packages.…
desrosj Sep 15, 2026
d7f9d02
Bump `actions/upload-artifact/merge` to `v7.0.1`.
desrosj Sep 15, 2026
085e0c5
Fix mismatched version comments flagged by zizmor.
desrosj Sep 15, 2026
8b23a48
Fix shivammathur/setup-php version comment to use the stable tag.
desrosj Sep 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/setup-node/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ runs:
using: 'composite'
steps:
- name: Use desired version of Node.js
uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version-file: '.nvmrc'
node-version: ${{ inputs.node-version }}
Expand All @@ -25,7 +25,7 @@ runs:

- name: Cache node_modules
id: cache-node_modules
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: '**/node_modules'
key: node_modules-${{ runner.os }}-${{ runner.arch }}-${{ steps.node-version.outputs.NODE_VERSION }}-${{ hashFiles('package-lock.json') }}
Expand All @@ -36,7 +36,7 @@ runs:
npm ci
shell: bash
- name: Upload npm logs as an artifact on failure
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: failure()
with:
name: npm-logs
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/bundle-size.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,19 +38,19 @@ jobs:
timeout-minutes: 30

steps:
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 1
show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}

- name: Use desired version of Node.js
uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version-file: '.nvmrc'
check-latest: true
cache: npm

- uses: preactjs/compressed-size-action@f780fd104362cfce9e118f9198df2ee37d12946c # v2.6.0
- uses: preactjs/compressed-size-action@f322c295dde06a1cb7ccaef105732dd8a726d1d9 # 2.10.0
with:
repo-token: '${{ secrets.GITHUB_TOKEN }}'
pattern: '{build/**/*.min.js,build/**/*.css}'
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/create-block.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ jobs:
os: ['macos-latest', 'ubuntu-latest', 'windows-latest']

steps:
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}

Expand Down
14 changes: 7 additions & 7 deletions .github/workflows/end2end-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ jobs:
totalParts: [8]

steps:
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}

Expand All @@ -53,15 +53,15 @@ jobs:
xvfb-run --auto-servernum --server-args="-screen 0 1280x960x24" -- npm run test:e2e -- --shard=${{ matrix.part }}/${{ matrix.totalParts }}

- name: Archive debug artifacts (screenshots, traces)
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: ${{ !cancelled() }}
with:
name: failures-artifacts--${{ matrix.part }}
path: artifacts/test-results
if-no-files-found: ignore

- name: Archive flaky tests report
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: ${{ !cancelled() }}
with:
name: flaky-tests-report--${{ matrix.part }}
Expand All @@ -78,7 +78,7 @@ jobs:
has-flaky-test-report: ${{ !!steps.merge-flaky-tests-reports.outputs.artifact-id }}
steps:
- name: Merge failures artifacts
uses: actions/upload-artifact/merge@v4
uses: actions/upload-artifact/merge@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
# Don't fail the job if there aren't any artifacts to merge.
continue-on-error: true
with:
Expand All @@ -89,7 +89,7 @@ jobs:

- name: Merge flaky tests reports
id: merge-flaky-tests-reports
uses: actions/upload-artifact/merge@v4
uses: actions/upload-artifact/merge@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
continue-on-error: true
with:
name: flaky-tests-report
Expand All @@ -104,12 +104,12 @@ jobs:
steps:
# Checkout defaults to using the branch which triggered the event, which
# isn't necessarily `trunk` (e.g. in the case of a merge).
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: trunk
show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}

- uses: actions/download-artifact@v4.1.7
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
# Don't fail the job if there isn't any flaky tests report.
continue-on-error: true
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/props-bot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ jobs:
uses: WordPress/props-bot-action@trunk

- name: Remove the props-bot label
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
if: ${{ github.event.action == 'labeled' && 'props-bot' == github.event.label.name }}
with:
retries: 2
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/publish-npm-packages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,15 +31,15 @@ jobs:
steps:
- name: Checkout (for CLI)
if: ${{ github.event.inputs.release_type != 'wp' }}
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
path: cli
ref: trunk
show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}

- name: Checkout (for publishing)
if: ${{ github.event.inputs.release_type != 'wp' }}
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
path: publish
# Later, we switch this branch in the script that publishes packages.
Expand All @@ -49,7 +49,7 @@ jobs:

- name: Checkout (for publishing WP major version)
if: ${{ github.event.inputs.release_type == 'wp' && github.event.inputs.wp_version }}
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
path: publish
ref: wp/${{ github.event.inputs.wp_version }}
Expand All @@ -67,7 +67,7 @@ jobs:

- name: Setup Node.js
if: ${{ github.event.inputs.release_type != 'wp' }}
uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version-file: 'cli/.nvmrc'
registry-url: 'https://registry.npmjs.org'
Expand All @@ -76,7 +76,7 @@ jobs:

- name: Setup Node.js (for WP major version)
if: ${{ github.event.inputs.release_type == 'wp' && github.event.inputs.wp_version }}
uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version-file: 'publish/.nvmrc'
registry-url: 'https://registry.npmjs.org'
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/static-checks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,12 +23,12 @@ jobs:
if: ${{ github.repository == 'WordPress/gutenberg' || github.event_name == 'pull_request' }}

steps:
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}

- name: Use desired version of Node.js
uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version-file: '.nvmrc'
check-latest: true
Expand Down
26 changes: 13 additions & 13 deletions .github/workflows/unit-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}

Expand Down Expand Up @@ -70,7 +70,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}

Expand Down Expand Up @@ -121,7 +121,7 @@ jobs:
name: Build JavaScript assets for PHP unit tests
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}

Expand All @@ -132,7 +132,7 @@ jobs:
run: npm run build

- name: Upload built JavaScript assets
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: build-assets
path: ./build/
Expand Down Expand Up @@ -170,7 +170,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}

Expand All @@ -185,7 +185,7 @@ jobs:
# dependency versions are installed and cached.
##
- name: Set up PHP
uses: shivammathur/setup-php@c665c7a15b5295c2488ac8a87af9cb806cd72198 # v2.30.4
uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
with:
php-version: '${{ matrix.php }}'
ini-file: development
Expand All @@ -204,12 +204,12 @@ jobs:
# Since Composer dependencies are installed using `composer update` and no lock file is in version control,
# passing a custom cache suffix ensures that the cache is flushed at least once per week.
- name: Install Composer dependencies
uses: ramsey/composer-install@57532f8be5bda426838819c5ee9afb8af389d51a # v3.0.0
uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
with:
custom-cache-suffix: $(/bin/date -u --date='last Mon' "+%F")

- name: Download built JavaScript assets
uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: build-assets
path: ./build
Expand Down Expand Up @@ -281,12 +281,12 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}

- name: Set up PHP
uses: shivammathur/setup-php@c665c7a15b5295c2488ac8a87af9cb806cd72198 # v2.30.4
uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
with:
php-version: '7.4'
coverage: none
Expand All @@ -299,15 +299,15 @@ jobs:
run: echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> $GITHUB_OUTPUT

- name: Cache PHPCS scan cache
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .cache/phpcs.json
key: ${{ runner.os }}-date-${{ steps.get-date.outputs.date }}-phpcs-cache-${{ hashFiles('**/composer.json', 'phpcs.xml.dist') }}

# Since Composer dependencies are installed using `composer update` and no lock file is in version control,
# passing a custom cache suffix ensures that the cache is flushed at least once per week.
- name: Install Composer dependencies
uses: ramsey/composer-install@57532f8be5bda426838819c5ee9afb8af389d51a # v3.0.0
uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
with:
custom-cache-suffix: ${{ steps.get-date.outputs.date }}

Expand Down Expand Up @@ -351,7 +351,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}

Expand Down
Loading