WordPress / WordPress/performance
Optimize workflows; Add Dependabot and CodeQL
Open
@thelovekesh is already working on this.
Since Feb 6, 2024.
Infrastructure
- Dominant language
- PHP
- Stars
- 461
- Forks
- 165
- Avg merge
- 11h 12m
- Merged PRs (30d)
- 28
Description
Currently, there are a few areas where workflows can be optimized to reduce CI times, maintenance, and security in the runners. Also, consider adding tools like @dependabot that can keep the dependency up-to-date unless some dependency requires it, for example: chalk since it's pure ESM now and the plugin CLI is CJS.
Tasks
- Optimize workflows for lower CI times and reduce files for maintenance(i.e. lint workflows can remain in one file).
- Remove dependency from third-party workflows for tasks that can be handled natively.
- Update permissions in the workflows to read-only and manually provide any other permission at the job level.
- Update wp-env based PHPUnit setup with MySQL + SVN which is easy to set up for any version and has very less or no compatibility maintenance.
- Add @dependabot config to update
composer,npm, andgithub-actionsat least once a month. - Add CodeQL for JS code analysis for any security vulnerabilities.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.