GitHub Actions workflow updates

[johnbillion]

This updates the GitHub Actions workflow files to:

• Grant minimally-scoped permissions to each job to adhere to the principle of least privilege
• Specify a timeout on each job to prevent runaway processes consuming too many minutes (the default is 360)

Once this PR is merged, the Settings -> Actions -> Workflow permissions setting can be changed by a repo admin to "Read repository contents and packages permissions".

References

• https://docs.github.com/en/actions/reference/security/secure-use
• https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idtimeout-minutes

Use of AI

Claude Code was used to create the initial changes. All permissions and timeouts changes were reviewed and adjusted by me where necessary.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: johnbillion <[email protected]>
Co-authored-by: desrosj <[email protected]>
Co-authored-by: thelovekesh <[email protected]>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[Copilot]

Pull request overview

This PR updates GitHub Actions workflows to use explicit, reduced permissions and add job timeouts to prevent runaway workflow execution.

Changes:

• Adds top-level permissions: {} defaults to several workflows.
• Adds or documents job-level permissions for checkout, artifacts, deployments, CodeQL, and cancellation actions.
• Adds timeout-minutes values to jobs that did not previously define them.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
.github/workflows/spell-check.yml	Adds default-deny permissions, checkout read permission, and timeout.
.github/workflows/props-bot.yml	Clarifies existing job permission comments.
.github/workflows/pr-validation.yml	Adds default-deny permissions and job timeouts.
.github/workflows/plugin-check.yml	Adds timeouts and documents job-level permissions.
.github/workflows/php-test-plugins.yml	Adds default-deny permissions and explicit job scopes.
.github/workflows/php-lint.yml	Adds default-deny permissions and explicit job scopes.
.github/workflows/js-lint.yml	Adds default-deny permissions and explicit job scopes.
.github/workflows/e2e-test.yml	Adds default-deny permissions and checkout read scope.
.github/workflows/deploy-plugins.yml	Adds timeouts and adjusts deployment/release permission scopes.
.github/workflows/codeql-analysis.yml	Adds CodeQL job timeout and documents security-events permission.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.33%. Comparing base (c1a7da2) to head (3d9b512).

Additional details and impacted files

@@           Coverage Diff           @@
##            trunk    #2471   +/-   ##
=======================================
  Coverage   69.33%   69.33%           
=======================================
  Files          90       90           
  Lines        7749     7749           
=======================================
  Hits         5373     5373           
  Misses       2376     2376           

Flag	Coverage Δ
multisite	69.33% <ø> (ø)
single	35.73% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[thelovekesh]

safe to keep but not required for public repos.

[desrosj]

With permissions: {} being set at the workflow level, I think the idea here is to be explicit instead of relying on an implicit fallback.

It's also good to have just in case the workflow's overall permissions change for some reason, or someone creates a private fork or mirror (which does happen for some of the important repositories in the WordPress org).

[johnbillion]

Yeah it also facilitates contributors running the workflows on a private fork. See:

• WordPress/wordpress-develop@f9e61f6236
• WordPress/wordpress-develop@9a621273a6

[thelovekesh]

unrelated to this, but need to audit third-party actions here.

styfle/cancel-workflow-action should be replaced with concurrency.

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true  # or expression which evaluates to true/false 

[thelovekesh]

cc @westonruter

[desrosj]

@thelovekesh Good call out. I will resolve my review comment stating the same.

[westonruter]

I've opened #2472 to address this.

[thelovekesh]

maybe redundant given permission are already disabled on workflow level?

[desrosj]

In my opinion, it's good to leave this and be explicit just in case the workflow-level permissions are changed unintentionally/unknowingly. @johnbillion what do you think?

[johnbillion]

Yeah the idea here is to be as explicit as possible. Defence in depth, etc.

[thelovekesh]

sounds good

[thelovekesh]

same as above

[desrosj]

This looks good. The only thing I want to follow up on is confirming the props-bot.yml permissions. There was some Copilot feedback in another repository that I want to validate. Looks like that comment was confirmed incorrect since I looked last. This is good to go.

[westonruter]

Once this PR is merged, the Settings -> Actions -> Workflow permissions setting can be changed by a repo admin to "Read repository contents and packages permissions".

Updated: