ci: consolidate checks into single workflow with release-please gate

.github/workflows/add-contributor.yml

@@ -4,7 +4,7 @@ on:
   # pull_request_target is required (instead of pull_request) so that
   # GITHUB_TOKEN has write permissions even when the merged PR came from a fork.
   # No untrusted code is checked out here, so this is safe.
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types: [closed]
     branches: [main]
 

.github/workflows/ci.yml

@@ -0,0 +1,43 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gate:
+    runs-on: ubuntu-latest
+    if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.ref, 'refs/heads/release-please--') }}
+    steps:
+      - run: true
+
+  phpcs:
+    needs: gate
+    uses: ./.github/workflows/phpcs.yml
+
+  phpstan:
+    needs: gate
+    uses: ./.github/workflows/phpstan.yml
+
+  phpunit:
+    needs: gate
+    uses: ./.github/workflows/phpunit.yml
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
+  multisite:
+    needs: gate
+    uses: ./.github/workflows/multisite.yml
+
+  plugin-check:
+    needs: gate
+    uses: ./.github/workflows/plugin-check.yml

.github/workflows/deploy-wporg.yml

@@ -47,8 +47,9 @@ jobs:
           fi
           printf 'ref=refs/tags/%s\n' "$TAG" >> "$GITHUB_OUTPUT"
           printf 'version=%s\n' "${TAG#v}" >> "$GITHUB_OUTPUT"
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
+          persist-credentials: false
           ref: ${{ steps.inputs.outputs.ref }}
       - name: Deploy to WordPress.org Plugin Directory
         uses: 10up/action-wordpress-plugin-deploy@54bd289b8525fd23a5c365ec369185f2966529c2 # stable

.github/workflows/multisite.yml

@@ -1,34 +1,27 @@
 name: Multisite
 
 on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
+  workflow_call:
 
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
   multisite:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20
           cache: npm
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.3'
           tools: composer
       - run: npm ci
-      # Avoids the intermittent 504s on api.github.com during wp-env's
-      # Docker build (PR #22). Authenticated requests dodge the issue.
       - name: Authenticate composer to GitHub
         run: composer config --global --auth github-oauth.github.com '${{ secrets.GITHUB_TOKEN }}'
       - run: npx wp-env start

.github/workflows/phpcs.yml

@@ -1,28 +1,23 @@
 name: PHPCS
 
 on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
+  workflow_call:
 
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
   phpcs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: shivammathur/setup-php@v2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.3'
           tools: composer
-      - uses: actions/cache@v6
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: ~/.composer/cache
           key: composer-${{ hashFiles('composer.json') }}

.github/workflows/phpstan.yml

@@ -1,28 +1,23 @@
 name: PHPStan
 
 on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
+  workflow_call:
 
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
   phpstan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: shivammathur/setup-php@v2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.3'
           tools: composer
-      - uses: actions/cache@v6
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: ~/.composer/cache
           key: composer-${{ hashFiles('composer.json') }}

.github/workflows/phpunit.yml

@@ -1,18 +1,14 @@
 name: PHPUnit
 
 on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
+  workflow_call:
+    secrets:
+      CODECOV_TOKEN:
+        required: true
 
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
   phpunit:
     name: PHP ${{ matrix.php }}
@@ -25,18 +21,18 @@ jobs:
           - php: '8.3'
             coverage: true
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20
           cache: npm
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.3'
           tools: composer
       - run: npm ci
-      # Avoids the intermittent 504s on api.github.com during wp-env's
-      # Docker build (PR #22). Authenticated requests dodge the issue.
       - name: Authenticate composer to GitHub
         run: composer config --global --auth github-oauth.github.com '${{ secrets.GITHUB_TOKEN }}'
       - run: npx wp-env start ${{ matrix.coverage && '--xdebug=coverage' || '' }}
@@ -46,7 +42,7 @@ jobs:
       - run: npx wp-env run tests-cli --env-cwd='wp-content/plugins/presence-api' -- /var/www/html/vendor/bin/phpunit ${{ matrix.coverage && '--coverage-clover coverage.xml' || '' }}
       - name: Upload coverage to Codecov
         if: ${{ matrix.coverage }}
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage.xml

.github/workflows/playground-preview.yml

@@ -33,11 +33,12 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ !startsWith(github.head_ref, 'release-please--') }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
+          persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha }}
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.3'
           tools: composer
@@ -93,20 +94,23 @@ jobs:
       # PR metadata as JSON (no shell-`source` upstream). The publish
       # workflow validates these fields with regex before using.
       - name: Save PR metadata
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
           jq -n \
-            --argjson pr "${{ github.event.pull_request.number }}" \
-            --arg sha "${{ github.event.pull_request.head.sha }}" \
+            --argjson pr "$PR_NUMBER" \
+            --arg sha "$HEAD_SHA" \
             '{pr_number: $pr, head_sha: $sha}' > pr-meta.json
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: release-assets
           path: release-assets/
           retention-days: 14
           if-no-files-found: error
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: pr-meta
           path: pr-meta.json

.github/workflows/plugin-check.yml

@@ -1,20 +1,7 @@
 name: Plugin Check
 
-# Runs the WordPress.org Plugin Check suite against the staged plugin —
-# the same checks the directory's automated review applies on submission.
-# Surfaces missing `readme.txt` fields, license-header issues, forbidden
-# function calls, and similar guideline violations before they become a
-# submission blocker.
-
 on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  workflow_call:
 
 permissions:
   contents: read
@@ -23,56 +10,43 @@ jobs:
   plugin-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.3'
           tools: composer
 
-      # Match `release.yml` — no dev deps, optimized autoloader, scripts
-      # disabled — so what's checked is what would ship.
       - run: composer install --no-dev --no-interaction --optimize-autoloader --no-scripts
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '22'
 
       - run: npm install -g @wordpress/env@11.8.1
 
-      # Avoids the intermittent 504s on api.github.com during wp-env's
-      # Docker build (PR #22). Authenticated requests dodge the issue.
       - name: Authenticate composer to GitHub
         run: composer config --global --auth github-oauth.github.com '${{ secrets.GITHUB_TOKEN }}'
 
-      # Build the plugin tree the same way `release.yml` does so
-      # plugin-check sees only what would actually ship — `.distignore`
-      # excludes `.wp-env.json`, the `*.dist` configs, tests, and other
-      # dev files that the live WP.org plugin directory wouldn't see.
-      - name: Build the plugin
+      - name: Build plugin
         run: |
           mkdir -p build/presence-api
           rsync -a --exclude-from='.distignore' --exclude='build' ./ build/presence-api/
 
-      # Point wp-env at the built tree instead of the repo root so the
-      # `presence-api` slug it loads is the directory plugin-check
-      # should be analyzing.
-      - name: Mount the built plugin into wp-env
+      - name: Configure wp-env to mount built plugin
         run: |
           cat > .wp-env.override.json <<'JSON'
           { "plugins": [ "./build/presence-api" ] }
           JSON
 
-      - run: wp-env start --update
+      - run: wp-env start
 
-      - name: Install Plugin Check inside wp-env
+      - name: Install Plugin Check
         run: |
           wp-env run cli wp plugin install plugin-check --activate
           wp-env run cli wp plugin activate presence-api
 
-      # `strict-table` is the only built-in format that's human-readable
-      # in CI logs and exits non-zero when errors are found. (Plain
-      # `table` always exits 0 even with findings.)
       - name: Run Plugin Check
-        run: |
-          wp-env run cli wp plugin check presence-api --format=strict-table
+        run: wp-env run cli wp plugin check presence-api --format=strict-table

.github/workflows/props-bot.yml

@@ -7,7 +7,7 @@ on:
   # Note: The pull_request_target event is used instead of pull_request because this workflow needs permission to comment
   # on the pull request. Because this event grants extra permissions to `GITHUB_TOKEN`, any code changes within the PR
   # should be considered untrusted. See https://securitylab.github.com/research/github-actions-preventing-pwn-requests/.
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types:
       - opened
       - synchronize
@@ -73,7 +73,7 @@ jobs:
 
     steps:
       - name: Gather a list of contributors
-        uses: WordPress/props-bot-action@trunk
+        uses: WordPress/props-bot-action@trunk # zizmor: ignore[unpinned-uses]
         with:
           format: 'svn'