From 5080aff24348992cf35876eb8d598f21b8d68ee3 Mon Sep 17 00:00:00 2001 From: Tom J Nowell Date: Wed, 6 Aug 2025 16:15:25 +0100 Subject: [PATCH 1/8] Add basic linter action Adds a basic linting action for PHPCS --- .github/workflows/linting.yml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 .github/workflows/linting.yml diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml new file mode 100644 index 0000000..d61a3c0 --- /dev/null +++ b/.github/workflows/linting.yml @@ -0,0 +1,30 @@ +name: Linting + +on: workflow_call + +permissions: + contents: read + +jobs: + php: + name: PHP + runs-on: ubuntu-24.04 + permissions: + checks: write + contents: read + pull-requests: read + steps: + - name: Setup PHP + uses: shivammathur/setup-php@v2 + with: + php-version: '7.2' + - name: Checkout + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2 + - name: Install dependencies + run: composer install --no-progress --no-interaction --no-ansi + - name: Lint code + uses: wearerequired/lint-action@548d8a7c4b04d3553d32ed5b6e91eb171e10e7bb #v2.3.0 + with: + continue_on_error: false + github_token: ${{ secrets.GITHUB_TOKEN }} + php_codesniffer: true From d13604b8b4608189c5cab6fd6ddda818dfe7dd21 Mon Sep 17 00:00:00 2001 From: Tom J Nowell Date: Wed, 6 Aug 2025 16:16:25 +0100 Subject: [PATCH 2/8] Validate composer.json when linting --- .github/workflows/linting.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml index d61a3c0..0dee04a 100644 --- a/.github/workflows/linting.yml +++ b/.github/workflows/linting.yml @@ -20,6 +20,8 @@ jobs: php-version: '7.2' - name: Checkout uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2 + - name: Validate Composer config + run: composer validate --no-check-all --no-check-publish - name: Install dependencies run: composer install --no-progress --no-interaction --no-ansi - name: Lint code From 749c29b38d9bfe443223112df1ee4f8a1a3603a2 Mon Sep 17 00:00:00 2001 From: Tom J Nowell Date: Wed, 6 Aug 2025 16:19:06 +0100 Subject: [PATCH 3/8] Add composer package change diff CI action --- .github/workflows/composer-diff.yml | 45 +++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 .github/workflows/composer-diff.yml diff --git a/.github/workflows/composer-diff.yml b/.github/workflows/composer-diff.yml new file mode 100644 index 0000000..d73b10e --- /dev/null +++ b/.github/workflows/composer-diff.yml @@ -0,0 +1,45 @@ +name: Composer Diff + +permissions: + contents: read + +on: + pull_request: + paths: + - 'composer.lock' +jobs: + composer-diff: + name: Composer Diff + runs-on: ubuntu-24.04 + + permissions: + pull-requests: write + contents: read + + steps: + - name: Checkout + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2 + with: + fetch-depth: 0 # Required to make it possible to compare with PR base branch + + - name: Generate composer diff + id: composer_diff # To reference the output in comment + uses: IonBazan/composer-diff-action@3140157575f6a67799cc80248ae35f5fb303ab15 #v1.2.0 + with: + format: mdlist + with-links: true + with-platform: true + + + - uses: marocchino/sticky-pull-request-comment@d2ad0de260ae8b0235ce059e63f2949ba9e05943 #v2.9.3 + # An empty diff result will break this action. + if: ${{ steps.composer_diff.outputs.composer_diff_exit_code != 0 }} + with: + header: composer-diff # Creates a collapsed comment with the report + message: | +
+ Composer package changes + + ${{ steps.composer_diff.outputs.composer_diff }} + +
From fb649e95cb42ab4344c1f57b93e5d5e5ebe844b8 Mon Sep 17 00:00:00 2001 From: Sander van Dragt Date: Fri, 16 Oct 2026 10:50:41 +0100 Subject: [PATCH 4/8] Run linting on pull requests and update action pins The linting workflow only had a workflow_call trigger and nothing called it, so it never ran. Run it on pull requests and on pushes to master. Pin setup-php to a SHA and move every action to its latest release. Co-Authored-By: Claude --- .github/workflows/composer-diff.yml | 6 +++--- .github/workflows/linting.yml | 13 +++++++++---- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/.github/workflows/composer-diff.yml b/.github/workflows/composer-diff.yml index d73b10e..c6cde9d 100644 --- a/.github/workflows/composer-diff.yml +++ b/.github/workflows/composer-diff.yml @@ -18,20 +18,20 @@ jobs: steps: - name: Checkout - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1 with: fetch-depth: 0 # Required to make it possible to compare with PR base branch - name: Generate composer diff id: composer_diff # To reference the output in comment - uses: IonBazan/composer-diff-action@3140157575f6a67799cc80248ae35f5fb303ab15 #v1.2.0 + uses: IonBazan/composer-diff-action@e2022e8718d05cc6e4e5990a06fc928c75837f76 #v2.0.0 with: format: mdlist with-links: true with-platform: true - - uses: marocchino/sticky-pull-request-comment@d2ad0de260ae8b0235ce059e63f2949ba9e05943 #v2.9.3 + - uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 #v3.0.5 # An empty diff result will break this action. if: ${{ steps.composer_diff.outputs.composer_diff_exit_code != 0 }} with: diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml index 0dee04a..403babd 100644 --- a/.github/workflows/linting.yml +++ b/.github/workflows/linting.yml @@ -1,6 +1,11 @@ name: Linting -on: workflow_call +on: + pull_request: + push: + branches: + - master + workflow_call: permissions: contents: read @@ -15,17 +20,17 @@ jobs: pull-requests: read steps: - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 #2.40.0 with: php-version: '7.2' - name: Checkout - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1 - name: Validate Composer config run: composer validate --no-check-all --no-check-publish - name: Install dependencies run: composer install --no-progress --no-interaction --no-ansi - name: Lint code - uses: wearerequired/lint-action@548d8a7c4b04d3553d32ed5b6e91eb171e10e7bb #v2.3.0 + uses: wearerequired/lint-action@124229c6e2974984ba137c67a499ba28bfc33e33 #v3.0.2 with: continue_on_error: false github_token: ${{ secrets.GITHUB_TOKEN }} From dedb155c9ea10981ff1f541d86ee9feb2e052d68 Mon Sep 17 00:00:00 2001 From: Sander van Dragt Date: Fri, 16 Oct 2026 10:52:02 +0100 Subject: [PATCH 5/8] Put phpcs on PATH and point it at the project ruleset Co-Authored-By: Claude --- .github/workflows/linting.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml index 403babd..ed6ad30 100644 --- a/.github/workflows/linting.yml +++ b/.github/workflows/linting.yml @@ -29,9 +29,13 @@ jobs: run: composer validate --no-check-all --no-check-publish - name: Install dependencies run: composer install --no-progress --no-interaction --no-ansi + # lint-action runs a bare `phpcs`, so it must be on PATH. + - name: Add Composer binaries to PATH + run: echo "$GITHUB_WORKSPACE/vendor/bin" >> "$GITHUB_PATH" - name: Lint code uses: wearerequired/lint-action@124229c6e2974984ba137c67a499ba28bfc33e33 #v3.0.2 with: continue_on_error: false github_token: ${{ secrets.GITHUB_TOKEN }} php_codesniffer: true + php_codesniffer_args: --standard=phpcs.ruleset.xml From 7716e31886f7b69b5c2aed2bdf9ecedf26eaed07 Mon Sep 17 00:00:00 2001 From: Sander van Dragt Date: Fri, 16 Oct 2026 10:59:05 +0100 Subject: [PATCH 6/8] Lint on PHP 8.2 humanmade/coding-standards 2.x, which the WPCS advisory fix needs, requires PHP 8.2 to run. The ruleset still checks compatibility with PHP 7.2. Co-Authored-By: Claude --- .github/workflows/linting.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml index ed6ad30..72f06e8 100644 --- a/.github/workflows/linting.yml +++ b/.github/workflows/linting.yml @@ -22,7 +22,7 @@ jobs: - name: Setup PHP uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 #2.40.0 with: - php-version: '7.2' + php-version: '8.2' - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1 - name: Validate Composer config From ce820fcf650b8154186ad6147ef8c0f99c443dfc Mon Sep 17 00:00:00 2001 From: Sander van Dragt Date: Fri, 16 Oct 2026 11:50:15 +0100 Subject: [PATCH 7/8] Skip token-writing steps on fork PRs and clear stale package reports Fork PRs get a read-only GITHUB_TOKEN, so lint-action can't create its check run and the sticky comment can't post. Run plain composer lint on forks instead, and skip the comment there. Delete the package-change comment when a later push leaves composer.lock with no changes. Co-Authored-By: Claude --- .github/workflows/composer-diff.yml | 10 +++++++++- .github/workflows/linting.yml | 5 +++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/.github/workflows/composer-diff.yml b/.github/workflows/composer-diff.yml index c6cde9d..d1b3ec9 100644 --- a/.github/workflows/composer-diff.yml +++ b/.github/workflows/composer-diff.yml @@ -31,9 +31,10 @@ jobs: with-platform: true + # Fork PRs get a read-only token, so the comment steps would fail there. - uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 #v3.0.5 # An empty diff result will break this action. - if: ${{ steps.composer_diff.outputs.composer_diff_exit_code != 0 }} + if: ${{ github.event.pull_request.head.repo.full_name == github.repository && steps.composer_diff.outputs.composer_diff_exit_code != 0 }} with: header: composer-diff # Creates a collapsed comment with the report message: | @@ -43,3 +44,10 @@ jobs: ${{ steps.composer_diff.outputs.composer_diff }} + + # Remove the report once a later push leaves no package changes. + - uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 #v3.0.5 + if: ${{ github.event.pull_request.head.repo.full_name == github.repository && steps.composer_diff.outputs.composer_diff_exit_code == 0 }} + with: + header: composer-diff + delete: true diff --git a/.github/workflows/linting.yml b/.github/workflows/linting.yml index 72f06e8..04361a7 100644 --- a/.github/workflows/linting.yml +++ b/.github/workflows/linting.yml @@ -33,9 +33,14 @@ jobs: - name: Add Composer binaries to PATH run: echo "$GITHUB_WORKSPACE/vendor/bin" >> "$GITHUB_PATH" - name: Lint code + # Fork PRs get a read-only token, so lint-action can't create its check run there. + if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }} uses: wearerequired/lint-action@124229c6e2974984ba137c67a499ba28bfc33e33 #v3.0.2 with: continue_on_error: false github_token: ${{ secrets.GITHUB_TOKEN }} php_codesniffer: true php_codesniffer_args: --standard=phpcs.ruleset.xml + - name: Lint code (fork) + if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }} + run: composer lint From 3559a40efc0f20dabf5c37f891a88912ea3cff46 Mon Sep 17 00:00:00 2001 From: Sander van Dragt Date: Fri, 16 Oct 2026 11:52:42 +0100 Subject: [PATCH 8/8] Turn off hm-linter for this repository The Linting workflow now runs phpcs on every PR, and per-repository Actions are preferred over hm-linter. Disable all three hm-linter checks so contributors get one lint report. Co-Authored-By: Claude --- .github/hmlinter.yml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 .github/hmlinter.yml diff --git a/.github/hmlinter.yml b/.github/hmlinter.yml new file mode 100644 index 0000000..51b3c6e --- /dev/null +++ b/.github/hmlinter.yml @@ -0,0 +1,9 @@ +# The Linting workflow runs phpcs instead of hm-linter. +phpcs: + enabled: false + +eslint: + enabled: false + +stylelint: + enabled: false