WordPress / WordPress/performance

Optimize workflows; Add Dependabot and CodeQL

Open
#973 13 comments 0 reactions 1 assignee View on GitHub

@thelovekesh is already working on this.

Since Feb 6, 2024.

Infrastructure
Dominant language
PHP
Stars
461
Forks
165
Avg merge
11h 12m
Merged PRs (30d)
28

Description

Currently, there are a few areas where workflows can be optimized to reduce CI times, maintenance, and security in the runners. Also, consider adding tools like @dependabot that can keep the dependency up-to-date unless some dependency requires it, for example: chalk since it's pure ESM now and the plugin CLI is CJS.

Tasks

  • Optimize workflows for lower CI times and reduce files for maintenance(i.e. lint workflows can remain in one file).
  • Remove dependency from third-party workflows for tasks that can be handled natively.
  • Update permissions in the workflows to read-only and manually provide any other permission at the job level.
  • Update wp-env based PHPUnit setup with MySQL + SVN which is easy to set up for any version and has very less or no compatibility maintenance.
  • Add @dependabot config to update composer, npm, and github-actions at least once a month.
  • Add CodeQL for JS code analysis for any security vulnerabilities.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.