Update workflows; Add dependabot and codeql; Optimize workflows

.github/actions/determine-changed-files/action.yml

@@ -0,0 +1,84 @@
+name: Determine count of changed files
+
+description: Determine count of changed files based on the current branch and the base branch
+
+outputs:
+  count:
+    description: The count of changed files
+    value: ${{ steps.determine-file-counts.outputs.count }}
+  php-count:
+    description: The count of changed PHP files
+    value: ${{ steps.determine-file-counts.outputs.php-count }}
+  css-count:
+    description: The count of changed CSS files
+    value: ${{ steps.determine-file-counts.outputs.css-count }}
+  js-count:
+    description: The count of changed JS files
+    value: ${{ steps.determine-file-counts.outputs.js-count }}
+  gha-workflow-count:
+    description: The count of changed GHA workflow files
+    value: ${{ steps.determine-file-counts.outputs.gha-workflow-count }}
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Fetch base branch
+      # Only fetch base ref if it's a PR.
+      if: ${{ github.base_ref != null }}
+      shell: bash
+      run: git fetch --depth=1 --no-tags origin ${{ github.base_ref }}
+
+    - name: Determine modified files for PR
+      if: ${{ github.base_ref != null }}
+      shell: bash
+      run: echo "MODIFIED_FILES=$(git diff --name-only FETCH_HEAD HEAD | base64 -w 0)" >> $GITHUB_ENV
+
+    - name: Determine modified files for commit
+      if: ${{ github.base_ref == null }}
+      shell: bash
+      run: echo "MODIFIED_FILES=$(git diff --name-only HEAD~1 HEAD | base64 -w 0)" >> $GITHUB_ENV
+
+    - name: Determine if modified files should make the workflow run continue
+      id: determine-file-counts
+      shell: bash
+      run: |
+        # Get modified files.
+        MODIFIED_FILES=$(echo "$MODIFIED_FILES" | base64 -d)
+
+        # Determine file counts.
+        FILE_COUNT=$(php -f ./.github/actions/determine-changed-files/determine-modified-files-count.php "$IGNORE_PATH_REGEX" "$MODIFIED_FILES" --invert)
+        PHP_FILE_COUNT=$(php -f ./.github/actions/determine-changed-files/determine-modified-files-count.php ".+\.php|composer\.(json|lock)|phpstan\.neon\.dist" "$MODIFIED_FILES")
+        CSS_FILE_COUNT=$(php -f ./.github/actions/determine-changed-files/determine-modified-files-count.php ".+\.s?css|package\.json|package-lock\.json" "$MODIFIED_FILES")
+        JS_FILE_COUNT=$(php -f ./.github/actions/determine-changed-files/determine-modified-files-count.php ".+\.(js|snap)|package\.json|package-lock\.json" "$MODIFIED_FILES")
+        GHA_WORKFLOW_COUNT=$(php -f ./.github/actions/determine-changed-files/determine-modified-files-count.php "(\.github\/workflows\/.+\.yml)" "$MODIFIED_FILES")
+
+        # Set output variables.
+        echo "count=$FILE_COUNT" >> $GITHUB_OUTPUT
+        echo "php-count=$PHP_FILE_COUNT" >> $GITHUB_OUTPUT
+        echo "css-count=$CSS_FILE_COUNT" >> $GITHUB_OUTPUT
+        echo "js-count=$JS_FILE_COUNT" >> $GITHUB_OUTPUT
+        echo "gha-workflow-count=$GHA_WORKFLOW_COUNT" >> $GITHUB_OUTPUT
+
+        # Add modified files summary.
+        echo "# Modified files summary" >> $GITHUB_STEP_SUMMARY
+        echo "## Modified files" >> $GITHUB_STEP_SUMMARY
+        echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+        echo "$MODIFIED_FILES" >> $GITHUB_STEP_SUMMARY
+        echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+        echo "## Modified files count" >> $GITHUB_STEP_SUMMARY
+        echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+        echo "Total modified files: $FILE_COUNT" >> $GITHUB_STEP_SUMMARY
+        echo "PHP files: $PHP_FILE_COUNT" >> $GITHUB_STEP_SUMMARY
+        echo "CSS files: $CSS_FILE_COUNT" >> $GITHUB_STEP_SUMMARY
+        echo "JS files: $JS_FILE_COUNT" >> $GITHUB_STEP_SUMMARY
+        echo "GHA workflow files: $GHA_WORKFLOW_COUNT" >> $GITHUB_STEP_SUMMARY
+        echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+      env:
+        # Ignore Paths:
+        # - .github/
+        # - !.github/actions
+        # - !.github/workflows
+        # - .github/actions/draft-release/
+        # - .wordpress-org/
+        # - docs/
+        IGNORE_PATH_REGEX: \.github\/(?!actions|workflows)|\.wordpress-org\/|docs\/|\.github\/actions\/draft-release\/

.github/actions/determine-changed-files/determine-modified-files-count.php

@@ -0,0 +1,23 @@
+<?php
+/**
+ * Determine the number of modified files based on the given path pattern.
+ *
+ * Usage:
+ * php -f determine-modified-files-count.php <file path pattern> <file paths delimited by newlines> [--invert]
+ *
+ * For example:
+ * php -f determine-modified-files-count.php "foo\/bar|bar*" "foo/bar/baz\nquux" --invert
+ *
+ * Would output: 1
+ *
+ * @codeCoverageIgnore
+ * @package AMP
+ */
+
+$file_pattern    = sprintf( '/^%s$/m', $argv[1] );
+$modified_files  = explode( "\n", trim( $argv[2] ) );
+$preg_grep_flags = isset( $argv[3] ) && trim( $argv[3] ) === '--invert' ? PREG_GREP_INVERT : 0;
+
+$filtered_files = preg_grep( $file_pattern, $modified_files, $preg_grep_flags );
+
+echo $filtered_files ? count( $filtered_files ) : 0;

.github/actions/setup-node-npm/action.yml

@@ -0,0 +1,25 @@
+name: Setup Node.js and npm
+
+description: Setup Node.js and npm with caching
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Configure Node.js cache
+      uses: actions/cache@v3.3.2
+      id: node-npm-cache
+      env:
+        SEGMENT_DOWNLOAD_TIMEOUT_MINS: '5'
+      with:
+        path: node_modules
+        key: ${{ runner.os }}-node_modules-${{ hashFiles('package*.json') }}-${{ hashFiles('.github/actions/setup-node-npm/action.yml') }}
+
+    - name: Setup Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version-file: '.nvmrc'
+
+    - name: Install NodeJS dependencies
+      if: ${{ steps.node-npm-cache.outputs.cache-hit != 'true' }}
+      shell: bash
+      run: npm ci

.github/actions/setup-php-composer/action.yml

@@ -0,0 +1,46 @@
+name: Setup PHP and Composer
+
+description: Setup PHP and Composer with caching
+
+inputs:
+  tools:
+    description: 'The tools to install'
+    required: false
+    default: 'composer'
+  php-version:
+    description: 'The PHP version to install'
+    required: true
+    default: '7.4'
+  extensions:
+    description: 'The PHP extensions to install'
+    required: false
+    default: 'curl, date, dom, gd, iconv, json, libxml, mysql, spl'
+  coverage:
+    description: 'Whether to install the PHP Xdebug extension'
+    required: false
+    default: 'none'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Setup PHP
+      uses: shivammathur/setup-php@v2
+      with:
+        php-version: ${{ inputs.php-version }}
+        extensions: ${{ inputs.extensions }}
+        coverage: ${{ inputs.coverage }}
+        tools: ${{ inputs.tools }}
+
+    - name: Setup composer cache
+      uses: actions/cache@v3
+      id: php-composer-cache
+      env:
+        SEGMENT_DOWNLOAD_TIMEOUT_MINS: '5'
+      with:
+        path: vendor
+        key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}-${{ hashFiles('.github/actions/setup-php-composer/action.yml') }}
+
+    - name: Install composer dependencies
+      if: ${{ steps.php-composer-cache.outputs.cache-hit != 'true' }}
+      shell: bash
+      run: composer install --ansi --no-interaction --prefer-dist --ignore-platform-reqs

.github/bin/install-wp-tests.sh

@@ -0,0 +1,144 @@
+#!/usr/bin/env bash
+
+set -e
+
+if [ $# -lt 3 ]; then
+	echo "usage: $0 <db-name> <db-user> <db-pass> [db-host] [wp-version] [skip-database-creation]"
+	exit 1
+fi
+
+DB_NAME=$1
+DB_USER=$2
+DB_PASS=$3
+DB_HOST=${4-localhost}
+WP_VERSION=${5-latest}
+SKIP_DB_CREATE=${6-true}
+
+TMPDIR=${TMPDIR-/tmp}
+TMPDIR=$(echo "$TMPDIR" | sed -e "s/\/$//")
+WP_TESTS_DIR=${WP_TESTS_DIR-$TMPDIR/wordpress-tests-lib}
+WP_CORE_DIR=${WP_CORE_DIR-$TMPDIR/wordpress}
+
+download() {
+    if [ $(which curl) ]; then
+        curl -s "$1" > "$2";
+    elif [ $(which wget) ]; then
+        wget -nv -O "$2" "$1"
+    fi
+}
+
+if [[ $WP_VERSION =~ ^[0-9]+\.[0-9]+\-(beta|RC)[0-9]+$ ]]; then
+	WP_BRANCH=${WP_VERSION%\-*}
+	WP_TESTS_TAG="branches/$WP_BRANCH"
+
+elif [[ $WP_VERSION =~ ^[0-9]+\.[0-9]+$ ]]; then
+	WP_TESTS_TAG="branches/$WP_VERSION"
+elif [[ $WP_VERSION =~ [0-9]+\.[0-9]+\.[0-9]+ ]]; then
+	if [[ $WP_VERSION =~ [0-9]+\.[0-9]+\.[0] ]]; then
+		# version x.x.0 means the first release of the major version, so strip off the .0 and download version x.x
+		WP_TESTS_TAG="tags/${WP_VERSION%??}"
+	else
+		WP_TESTS_TAG="tags/$WP_VERSION"
+	fi
+elif [[ $WP_VERSION == 'nightly' || $WP_VERSION == 'trunk' ]]; then
+	WP_TESTS_TAG="trunk"
+else
+	# http serves a single offer, whereas https serves multiple. we only want one
+	download http://api.wordpress.org/core/version-check/1.7/ /tmp/wp-latest.json
+	grep -E '[0-9]+\.[0-9]+(\.[0-9]+)?' /tmp/wp-latest.json
+	LATEST_VERSION=$(grep -o '"version":"[^"]*' /tmp/wp-latest.json | sed 's/"version":"//')
+	if [[ -z "$LATEST_VERSION" ]]; then
+		echo "Latest WordPress version could not be found"
+		exit 1
+	fi
+	WP_TESTS_TAG="tags/$LATEST_VERSION"
+fi
+
+install_wp() {
+
+	if [ -d "$WP_CORE_DIR" ]; then
+		return;
+	fi
+
+	if grep -isqE 'trunk|alpha|beta|rc' <<< "$WP_VERSION"; then
+		local SVN_URL=https://develop.svn.wordpress.org/trunk/
+	elif [ "$WP_VERSION" == 'latest' ]; then
+		local TAG=$( svn ls https://develop.svn.wordpress.org/tags | tail -n 1 | sed 's:/$::' )
+		local SVN_URL="https://develop.svn.wordpress.org/tags/$TAG/"
+	elif [[ "$WP_VERSION" =~ ^[0-9]+\.[0-9]+$ ]]; then
+		# Use the release branch if no patch version supplied. This is useful to keep testing the latest minor version.
+		local SVN_URL="https://develop.svn.wordpress.org/branches/$WP_VERSION/"
+	else
+		local SVN_URL="https://develop.svn.wordpress.org/tags/$WP_VERSION/"
+	fi
+
+	echo "Installing WP from $SVN_URL to $WP_CORE_DIR"
+
+	svn export -q "$SVN_URL" "$WP_CORE_DIR"
+
+	# Download `wp-includes` folder from the WordPress Core SVN repo to include built internal dependencies.
+	local SVN_CORE_URL=${SVN_URL/develop/core}
+	svn export -q --force "${SVN_CORE_URL}wp-includes" "$WP_CORE_DIR/src/wp-includes"
+
+	download https://raw.github.com/markoheijnen/wp-mysqli/master/db.php "$WP_CORE_DIR"/src/wp-content/db.php
+}
+
+install_test_suite() {
+	# portable in-place argument for both GNU sed and Mac OSX sed
+	if [[ $(uname -s) == 'Darwin' ]]; then
+		local ioption='-i.bak'
+	else
+		local ioption='-i'
+	fi
+
+	# set up testing suite if it doesn't yet exist
+	if [ ! -d "$WP_TESTS_DIR" ]; then
+		# set up testing suite
+		mkdir -p "$WP_TESTS_DIR"
+		svn co --quiet --ignore-externals https://develop.svn.wordpress.org/"${WP_TESTS_TAG}"/tests/phpunit/includes/ "$WP_TESTS_DIR/includes"
+		svn co --quiet --ignore-externals https://develop.svn.wordpress.org/"${WP_TESTS_TAG}"/tests/phpunit/data/ "$WP_TESTS_DIR/data"
+	fi
+
+	if [ ! -f wp-tests-config.php ]; then
+		download https://develop.svn.wordpress.org/${WP_TESTS_TAG}/wp-tests-config-sample.php "$WP_TESTS_DIR"/wp-tests-config.php
+		# remove all forward slashes in the end
+		WP_CORE_DIR="$(echo $WP_CORE_DIR | sed "s:/\+$::")"
+		sed $ioption "s:dirname( __FILE__ ) . '/src/':'$WP_CORE_DIR/src/':" "$WP_TESTS_DIR/wp-tests-config.php"
+		sed $ioption "s/youremptytestdbnamehere/$DB_NAME/" "$WP_TESTS_DIR/wp-tests-config.php"
+		sed $ioption "s/yourusernamehere/$DB_USER/" "$WP_TESTS_DIR/wp-tests-config.php"
+		sed $ioption "s/yourpasswordhere/$DB_PASS/" "$WP_TESTS_DIR/wp-tests-config.php"
+		sed $ioption "s|localhost|${DB_HOST}|" "$WP_TESTS_DIR/wp-tests-config.php"
+	fi
+
+}
+
+install_db() {
+
+	if [ "${SKIP_DB_CREATE}" = "true" ]; then
+		return 0
+	fi
+
+	# parse DB_HOST for port or socket references
+	local PARTS=("${DB_HOST//\:/ }")
+	local DB_HOSTNAME=${PARTS[0]};
+	local DB_SOCK_OR_PORT=${PARTS[1]};
+	local EXTRA=""
+
+	if [ -n "$DB_HOSTNAME" ] ; then
+		if [ "$(echo "$DB_SOCK_OR_PORT" | grep -e '^[0-9]\{1,\}$')" ]; then
+			EXTRA=" --host=$DB_HOSTNAME --port=$DB_SOCK_OR_PORT --protocol=tcp"
+		elif [ -n "$DB_SOCK_OR_PORT" ] ; then
+			EXTRA=" --socket=$DB_SOCK_OR_PORT"
+		elif [ -n "$DB_HOSTNAME" ] ; then
+			EXTRA=" --host=$DB_HOSTNAME --protocol=tcp"
+		fi
+	fi
+
+	# create database
+	mariadb-admin create $DB_NAME --user="$DB_USER" --password="$DB_PASS"$EXTRA || \
+		mysqladmin create "$DB_NAME" --user="$DB_USER" --password="$DB_PASS"$EXTRA
+}
+
+install_wp
+install_test_suite
+install_db

.github/dependabot.yml

@@ -0,0 +1,62 @@
+version: 2
+updates:
+
+# Config for AMP plugin.
+- package-ecosystem: composer
+  directory: "/"
+  schedule:
+    interval: monthly
+    time: "17:00"
+    timezone: America/Los_Angeles
+  open-pull-requests-limit: 10
+  groups:
+    code-quality:
+      patterns:
+        - "phpstan/*"
+        - "szepeviktor/phpstan-wordpress"
+        - "phpcompatibility/php-compatibility"
+        - "slevomat/coding-standard"
+        - "dealerdirect/phpcodesniffer-composer-installer"
+        - "squizlabs/php_codesniffer"
+        - "wp-coding-standards/wpcs"
+        - "wp-phpunit/wp-phpunit"
+        - "yoast/phpunit-polyfills"
+
+- package-ecosystem: npm
+  directory: "/"
+  schedule:
+    interval: monthly
+    time: "17:00"
+    timezone: America/Los_Angeles
+  open-pull-requests-limit: 10
+  groups:
+    wordpress-packages:
+      patterns:
+        - "@wordpress/*"
+    plugin-cli:
+      patterns:
+        - "@octokit/rest"
+        - "commander"
+        - "fs-extra"
+        - "fast-glob"
+        - "lodash"
+    code-quality:
+      patterns:
+        - "husky"
+        - "lint-staged"
+  ignore:
+  # Latest version of chalk is pure ESM.
+  - dependency-name: chalk
+
+# Config for GitHub Actions.
+- package-ecosystem: github-actions
+  directory: "/"
+  schedule:
+    interval: monthly
+    time: "17:00"
+    timezone: America/Los_Angeles
+  open-pull-requests-limit: 10
+  groups:
+    github-actions:
+      patterns:
+        - "actions/*"

.github/release.yml

@@ -0,0 +1,5 @@
+changelog:
+  exclude:
+    authors:
+      - dependabot
+      - dependabot-preview