@@ -40,6 +40,10 @@ concurrency:
4040 group : ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }}
4141 cancel-in-progress : true
4242
43+ # Disable permissions for all available scopes by default.
44+ # Any needed permissions should be configured at the job level.
45+ permissions : {}
46+
4347jobs :
4448 # Runs PHP coding standards checks.
4549 #
@@ -59,17 +63,21 @@ jobs:
5963 phpcs :
6064 name : PHP coding standards
6165 runs-on : ubuntu-latest
66+ permissions :
67+ contents : read
6268 timeout-minutes : 20
6369 if : ${{ github.repository == 'WordPress/wordpress-develop' || github.event_name == 'pull_request' }}
6470
6571 steps :
6672 - name : Checkout repository
67- uses : actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
73+ uses : actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
74+ with :
75+ show-progress : ${{ runner.debug == '1' && 'true' || 'false' }}
6876
6977 - name : Set up PHP
70- uses : shivammathur/setup-php@8e2ac35f639d3e794c1da1f28999385ab6fdf0fc # v2.23 .0
78+ uses : shivammathur/setup-php@6d7209f44a25a59e904b1ee9f3b0c33ab2cd888d # v2.29 .0
7179 with :
72- php-version : ' 7.4 '
80+ php-version : ' latest '
7381 coverage : none
7482 tools : cs2pr
7583
8088 run : echo "date=$(/bin/date -u --date='last Mon' "+%F")" >> $GITHUB_OUTPUT
8189
8290 - name : Cache PHPCS scan cache
83- uses : actions/cache@58c146cc91c5b9e778e71775dfe9bf1442ad9a12 # v3.2.3
91+ uses : actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
8492 with :
8593 path : |
8694 .cache/phpcs-src.json
@@ -130,17 +138,21 @@ jobs:
130138 jshint :
131139 name : JavaScript coding standards
132140 runs-on : ubuntu-latest
141+ permissions :
142+ contents : read
133143 timeout-minutes : 20
134144 if : ${{ github.repository == 'WordPress/wordpress-develop' || github.event_name == 'pull_request' }}
135145 env :
136- PUPPETEER_SKIP_CHROMIUM_DOWNLOAD : ${{ true }}
146+ PUPPETEER_SKIP_DOWNLOAD : ${{ true }}
137147
138148 steps :
139149 - name : Checkout repository
140- uses : actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
150+ uses : actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
151+ with :
152+ show-progress : ${{ runner.debug == '1' && 'true' || 'false' }}
141153
142154 - name : Set up Node.js
143- uses : actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
155+ uses : actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
144156 with :
145157 node-version-file : ' .nvmrc'
146158 cache : npm
@@ -150,7 +162,6 @@ jobs:
150162 npm --version
151163 node --version
152164 git --version
153- svn --version
154165
155166 - name : Install npm Dependencies
156167 run : npm ci
@@ -164,10 +175,13 @@ jobs:
164175 slack-notifications :
165176 name : Slack Notifications
166177 uses : WordPress/wordpress-develop/.github/workflows/slack-notifications.yml@trunk
178+ permissions :
179+ actions : read
180+ contents : read
167181 needs : [ phpcs, jshint ]
168182 if : ${{ github.repository == 'WordPress/wordpress-develop' && github.event_name != 'pull_request' && always() }}
169183 with :
170- calling_status : ${{ needs.phpcs.result == 'success' && needs.jshint .result == 'success' && 'success ' || ( needs.phpcs .result == 'cancelled' || needs.jshint.result == 'cancelled' ) && 'cancelled ' || 'failure ' }}
184+ calling_status : ${{ contains( needs.* .result, 'cancelled' ) && 'cancelled ' || contains ( needs.* .result, 'failure' ) && 'failure ' || 'success ' }}
171185 secrets :
172186 SLACK_GHA_SUCCESS_WEBHOOK : ${{ secrets.SLACK_GHA_SUCCESS_WEBHOOK }}
173187 SLACK_GHA_CANCELLED_WEBHOOK : ${{ secrets.SLACK_GHA_CANCELLED_WEBHOOK }}
@@ -177,20 +191,22 @@ jobs:
177191 failed-workflow :
178192 name : Failed workflow tasks
179193 runs-on : ubuntu-latest
194+ permissions :
195+ actions : write
180196 needs : [ phpcs, jshint, slack-notifications ]
181197 if : |
182198 always() &&
183199 github.repository == 'WordPress/wordpress-develop' &&
184200 github.event_name != 'pull_request' &&
185201 github.run_attempt < 2 &&
186202 (
187- needs.phpcs .result == 'cancelled' || needs.phpcs.result == 'failure' ||
188- needs.jshint.result == 'cancelled' || needs.jshint .result == 'failure'
203+ contains( needs.* .result, 'cancelled' ) ||
204+ contains( needs.* .result, 'failure' )
189205 )
190206
191207 steps :
192208 - name : Dispatch workflow run
193- uses : actions/github-script@98814c53be79b1d30f795b907e553d8679345975 # v6.4.0
209+ uses : actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
194210 with :
195211 retries : 2
196212 retry-exempt-status-codes : 418
0 commit comments