From 5bc0c3bf649b40c9e19d4c098e815b1c38c2e903 Mon Sep 17 00:00:00 2001 From: Frode Danielsen Date: Mon, 3 Aug 2026 11:39:24 +0200 Subject: [PATCH 1/4] Fix vendor source files being stripped from release package The release rsync excluded 'src/' without a leading slash. rsync treats a pattern with no slash as matching at every depth, so this removed src/ from every vendor package, not just the plugin's own block source. The published 1.0.0 package is missing 107 PHP files: all of Guzzle, guzzle/promises, PSR-7, psr/http-client, psr/http-factory, psr/http-message and getallheaders. Two of the three files listed in Composer's generated autoload_files.php were among them, and those are require'd unconditionally, so the plugin fatals as soon as vendor/autoload.php is included: Fatal error: Uncaught Error: Failed opening required '.../ralouphie/getallheaders/src/getallheaders.php' in vendor/composer/autoload_real.php:41 bin/package-plugin.sh had the correct anchored '/src/' pattern, so local zips were fine and the discrepancy went unnoticed. Extract the staging step into bin/stage-release.sh so the local script and the deploy workflow can no longer disagree about what ships, and anchor the other plugin-root-only patterns (/composer.lock, /package.json, /package-lock.json, /phpcs.xml) that had the same latent problem. Add bin/verify-release.sh, which resolves every $vendorDir/$baseDir reference in Composer's generated autoload files against disk and then loads the autoloader to resolve the classes the plugin actually uses. The previous checks only asserted that release/mailmojo/vendor existed, which was true of the broken package. The new check reports 111 of 177 references missing on the published zip and passes on a correctly staged one. Run staging and verification on pull requests too, so packaging regressions surface before a release is tagged rather than during deploy. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/deploy-wordpress-org.yml | 41 ++---- .github/workflows/verify-package.yml | 78 +++++++++++ bin/package-plugin.sh | 28 ++-- bin/stage-release.sh | 62 +++++++++ bin/verify-release.sh | 151 +++++++++++++++++++++ 5 files changed, 312 insertions(+), 48 deletions(-) create mode 100644 .github/workflows/verify-package.yml create mode 100755 bin/stage-release.sh create mode 100755 bin/verify-release.sh diff --git a/.github/workflows/deploy-wordpress-org.yml b/.github/workflows/deploy-wordpress-org.yml index bf057ca..74a0d35 100644 --- a/.github/workflows/deploy-wordpress-org.yml +++ b/.github/workflows/deploy-wordpress-org.yml @@ -74,33 +74,10 @@ jobs: echo "ZIP_NAME=${ZIP_NAME}" >> "$GITHUB_ENV" rm -rf release - mkdir -p release/mailmojo - - rsync -a \ - --exclude '.*' \ - --exclude 'node_modules/' \ - --exclude 'src/' \ - --exclude 'composer.lock' \ - --exclude 'package.json' \ - --exclude 'package-lock.json' \ - --exclude 'phpcs.xml' \ - --exclude 'test/' \ - --exclude 'tests/' \ - --exclude 'Test/' \ - --exclude 'Tests/' \ - --exclude 'docs/' \ - --exclude '*.md' \ - --exclude '*.sh' \ - --exclude 'Dockerfile' \ - --exclude '*.dist' \ - mailmojo/ release/mailmojo/ - - test -f release/mailmojo/mailmojo.php - test -d release/mailmojo/build - test -d release/mailmojo/includes - test -d release/mailmojo/assets - test -d release/mailmojo/vendor - test -f release/mailmojo/readme.txt + bin/stage-release.sh release/mailmojo + + - name: Verify staged package + run: bin/verify-release.sh release/mailmojo - name: Create release zip run: | @@ -109,7 +86,15 @@ jobs: ZIP_NAME="mailmojo-${GITHUB_REF_NAME#v}.zip" (cd release && zip -qr "../${ZIP_NAME}" mailmojo) - unzip -l "${ZIP_NAME}" | grep -E 'mailmojo/(mailmojo\.php|readme\.txt|build/|includes/|assets/|vendor/)' >/dev/null + - name: Verify release zip + run: | + set -euo pipefail + + rm -rf zip-check + mkdir -p zip-check + unzip -q "${ZIP_NAME}" -d zip-check + bin/verify-release.sh zip-check/mailmojo + rm -rf zip-check - name: Upload release zip uses: actions/upload-artifact@v4 diff --git a/.github/workflows/verify-package.yml b/.github/workflows/verify-package.yml new file mode 100644 index 0000000..486d087 --- /dev/null +++ b/.github/workflows/verify-package.yml @@ -0,0 +1,78 @@ +name: Verify Release Package + +# Dry run of the release packaging on every change, so a packaging regression is +# caught here instead of at tag time. Uses the same bin/stage-release.sh and +# bin/verify-release.sh as .github/workflows/deploy-wordpress-org.yml. + +on: + pull_request: + push: + branches: + - main + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: verify-package-${{ github.ref }} + cancel-in-progress: true + +jobs: + verify: + runs-on: ubuntu-latest + + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: "22" + cache: npm + cache-dependency-path: mailmojo/package-lock.json + + - name: Setup PHP + uses: shivammathur/setup-php@v2 + with: + php-version: "8.2" + coverage: none + + - name: Install Node dependencies + run: npm ci --prefix mailmojo + + - name: Build plugin assets + run: npm run build --prefix mailmojo + + - name: Install Composer dependencies + run: composer install --working-dir=mailmojo --no-dev --prefer-dist --no-interaction --no-progress --optimize-autoloader + + - name: Stage release package + run: bin/stage-release.sh release/mailmojo + + - name: Verify staged package + run: bin/verify-release.sh release/mailmojo + + - name: Create release zip + run: | + set -euo pipefail + + (cd release && zip -qr ../mailmojo-package-check.zip mailmojo) + + - name: Verify release zip + run: | + set -euo pipefail + + rm -rf zip-check + mkdir -p zip-check + unzip -q mailmojo-package-check.zip -d zip-check + bin/verify-release.sh zip-check/mailmojo + + - name: Upload package for inspection + uses: actions/upload-artifact@v4 + with: + name: mailmojo-package-check + path: mailmojo-package-check.zip + if-no-files-found: error + retention-days: 7 diff --git a/bin/package-plugin.sh b/bin/package-plugin.sh index a6ca39d..7cc6ff0 100755 --- a/bin/package-plugin.sh +++ b/bin/package-plugin.sh @@ -1,6 +1,9 @@ #!/usr/bin/env bash set -euo pipefail +REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +cd "${REPO_ROOT}" + VERSION="$(sed -n 's/^[[:space:]]*\* Version:[[:space:]]*//p' mailmojo/mailmojo.php | head -n 1 | xargs)" ZIP_NAME="dist/mailmojo-${VERSION}.zip" @@ -12,26 +15,11 @@ npm run build --prefix mailmojo mkdir -p dist rm -f "${ZIP_NAME}" rm -rf release -mkdir -p release/mailmojo - -rsync -a \ - --exclude '.*' \ - --exclude 'node_modules/' \ - --exclude '/src/' \ - --exclude 'composer.lock' \ - --exclude 'package.json' \ - --exclude 'package-lock.json' \ - --exclude 'phpcs.xml' \ - --exclude 'test/' \ - --exclude 'tests/' \ - --exclude 'Test/' \ - --exclude 'Tests/' \ - --exclude 'docs/' \ - --exclude '*.md' \ - --exclude '*.sh' \ - --exclude 'Dockerfile' \ - --exclude '*.dist' \ - mailmojo/ release/mailmojo/ + +# Staging and verification are shared with the WordPress.org deploy workflow so +# the zip built here matches what actually gets released. +bin/stage-release.sh release/mailmojo +bin/verify-release.sh release/mailmojo (cd release && zip -qr "$(pwd)/../${ZIP_NAME}" mailmojo) diff --git a/bin/stage-release.sh b/bin/stage-release.sh new file mode 100755 index 0000000..4c3dc93 --- /dev/null +++ b/bin/stage-release.sh @@ -0,0 +1,62 @@ +#!/usr/bin/env bash +# +# Stage the distributable plugin directory. +# +# This is the single source of truth for what ships to WordPress.org, shared by +# bin/package-plugin.sh (local zips) and .github/workflows/deploy-wordpress-org.yml +# (the actual release). Keep the exclude list here and nowhere else. +# +# Usage: bin/stage-release.sh [DEST_DIR] +# +set -euo pipefail + +REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +SOURCE_DIR="${REPO_ROOT}/mailmojo" +DEST_DIR="${1:-${REPO_ROOT}/release/mailmojo}" + +if [ ! -f "${SOURCE_DIR}/mailmojo.php" ]; then + echo "Error: ${SOURCE_DIR}/mailmojo.php not found." >&2 + exit 1 +fi + +if [ ! -f "${SOURCE_DIR}/vendor/autoload.php" ]; then + echo "Error: ${SOURCE_DIR}/vendor is missing. Run:" >&2 + echo " composer install --working-dir=mailmojo --no-dev --optimize-autoloader" >&2 + exit 1 +fi + +if [ ! -d "${SOURCE_DIR}/build" ]; then + echo "Error: ${SOURCE_DIR}/build is missing. Run: npm run build --prefix mailmojo" >&2 + exit 1 +fi + +echo "Staging ${SOURCE_DIR} -> ${DEST_DIR}" + +rm -rf "${DEST_DIR}" +mkdir -p "${DEST_DIR}" + +# rsync pattern anchoring matters here. A pattern with a leading slash is +# anchored to the transfer root (the plugin directory); a pattern without one +# matches at *every* depth. Writing 'src/' instead of '/src/' silently deletes +# vendor/*/src -- i.e. every Guzzle and PSR class -- and produces a plugin that +# fatals on load. Anything meant to match only the plugin root is anchored below. +rsync -a \ + --exclude '.*' \ + --exclude 'node_modules/' \ + --exclude '/src/' \ + --exclude '/composer.lock' \ + --exclude '/package.json' \ + --exclude '/package-lock.json' \ + --exclude '/phpcs.xml' \ + --exclude 'test/' \ + --exclude 'tests/' \ + --exclude 'Test/' \ + --exclude 'Tests/' \ + --exclude 'docs/' \ + --exclude '*.md' \ + --exclude '*.sh' \ + --exclude 'Dockerfile' \ + --exclude '*.dist' \ + "${SOURCE_DIR}/" "${DEST_DIR}/" + +echo "Staged $(find "${DEST_DIR}" -type f | wc -l | xargs) files." diff --git a/bin/verify-release.sh b/bin/verify-release.sh new file mode 100755 index 0000000..17a6130 --- /dev/null +++ b/bin/verify-release.sh @@ -0,0 +1,151 @@ +#!/usr/bin/env bash +# +# Verify that a staged (or extracted) plugin directory is complete and loadable. +# +# The important check is autoload integrity: every path Composer's generated +# autoload files point at must exist on disk. A packaging mistake that strips +# vendor source directories leaves those references dangling, and Composer's +# autoload_files entries are `require`d unconditionally -- so the plugin fatals +# on load rather than failing quietly. +# +# Usage: bin/verify-release.sh [PLUGIN_DIR] +# +set -euo pipefail + +REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +PLUGIN_DIR="${1:-${REPO_ROOT}/release/mailmojo}" +PLUGIN_DIR="${PLUGIN_DIR%/}" +VENDOR_DIR="${PLUGIN_DIR}/vendor" + +failed=0 +pass() { echo " ok $*"; } +fail() { + echo " FAIL $*" >&2 + failed=1 +} + +if [ ! -d "${PLUGIN_DIR}" ]; then + echo "Error: ${PLUGIN_DIR} does not exist." >&2 + exit 1 +fi + +echo "Verifying ${PLUGIN_DIR}" + +echo "Required contents:" +for path in \ + mailmojo.php \ + readme.txt \ + uninstall.php \ + build/blocks-manifest.php \ + includes \ + assets \ + languages \ + vendor/autoload.php \ + vendor/composer/autoload_real.php \ + vendor/eliksir/mailmojo-php-sdk/MailMojo/Configuration.php \ + vendor/guzzlehttp/guzzle/src/Client.php; do + if [ -e "${PLUGIN_DIR}/${path}" ]; then + pass "${path}" + else + fail "missing ${path}" + fi +done + +echo "Excluded contents:" +for path in \ + src \ + node_modules \ + composer.lock \ + package.json \ + package-lock.json \ + phpcs.xml; do + if [ -e "${PLUGIN_DIR}/${path}" ]; then + fail "${path} should not be shipped" + else + pass "no ${path}" + fi +done + +echo "Composer autoload integrity:" +if [ ! -d "${VENDOR_DIR}/composer" ]; then + fail "vendor/composer is missing" +else + # Composer's generated autoload_*.php files reference every classmap target, + # PSR-4/PSR-0 root and always-required file as $vendorDir/$baseDir + literal. + refs="$(grep -hoE '\$(vendorDir|baseDir) \. .[^'\'']+' "${VENDOR_DIR}"/composer/autoload_*.php 2>/dev/null | sort -u || true)" + + if [ -z "${refs}" ]; then + fail "found no autoload references to check" + else + checked=0 + missing=0 + while IFS= read -r ref; do + [ -n "${ref}" ] || continue + rel="${ref#*\'}" + case "${ref}" in + '$vendorDir'*) target="${VENDOR_DIR}${rel}" ;; + '$baseDir'*) target="${PLUGIN_DIR}${rel}" ;; + *) continue ;; + esac + checked=$((checked + 1)) + if [ ! -e "${target}" ]; then + missing=$((missing + 1)) + # Report relative to the plugin dir to keep output readable. + fail "dangling autoload reference: ${target#"${PLUGIN_DIR}"/}" + fi + done <&2 + fi + fi +fi + +echo "Runtime load test:" +if command -v php >/dev/null 2>&1; then + if php -r ' + $dir = $argv[1]; + require $dir . "/vendor/autoload.php"; + $classes = array( + "MailMojo\\Configuration", + "MailMojo\\ApiException", + "MailMojo\\Api\\AccountApi", + "MailMojo\\Api\\ListApi", + "MailMojo\\Model\\AccountSdkDetails", + "GuzzleHttp\\Client", + "GuzzleHttp\\Psr7\\Request", + "Psr\\Http\\Message\\RequestInterface", + ); + $bad = array(); + foreach ($classes as $class) { + if (!class_exists($class) && !interface_exists($class)) { + $bad[] = $class; + } + } + if (!function_exists("getallheaders")) { + $bad[] = "getallheaders()"; + } + if ($bad) { + fwrite(STDERR, "unresolvable: " . implode(", ", $bad) . PHP_EOL); + exit(1); + } + exit(0); + ' "${PLUGIN_DIR}"; then + pass "autoloader loads and resolves the classes the plugin uses" + else + fail "autoloader could not load the classes the plugin uses" + fi +else + echo " skip (php not on PATH; the autoload integrity check above still ran)" +fi + +if [ "${failed}" -ne 0 ]; then + echo "Verification FAILED for ${PLUGIN_DIR}" >&2 + exit 1 +fi + +echo "Verification passed for ${PLUGIN_DIR}" From 04392385e69864e126c6e5e86a755af6b12d0fb5 Mon Sep 17 00:00:00 2001 From: Frode Danielsen Date: Mon, 3 Aug 2026 11:46:18 +0200 Subject: [PATCH 2/4] Upload the package artifact even when verification fails Steps without an `if:` only run when all previous steps succeeded, so with the upload placed after the verification steps the artifact was produced only for packages that already passed -- exactly the opposite of when it is useful. Zip and upload before verifying, and mark the upload `!cancelled()` so it also runs on failure. The deploy step has no condition of its own, so it still only runs when every preceding step succeeded and verification continues to gate the release. Downgrade if-no-files-found to a warning: if staging itself fails there is legitimately no zip, and an upload error there would obscure the real failure. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/deploy-wordpress-org.yml | 24 ++++++++++++--------- .github/workflows/verify-package.yml | 25 ++++++++++++---------- 2 files changed, 28 insertions(+), 21 deletions(-) diff --git a/.github/workflows/deploy-wordpress-org.yml b/.github/workflows/deploy-wordpress-org.yml index 74a0d35..737808f 100644 --- a/.github/workflows/deploy-wordpress-org.yml +++ b/.github/workflows/deploy-wordpress-org.yml @@ -76,9 +76,9 @@ jobs: rm -rf release bin/stage-release.sh release/mailmojo - - name: Verify staged package - run: bin/verify-release.sh release/mailmojo - + # Zip and upload before verifying, so a failed release still leaves an + # artifact to download and inspect. The deploy step below only runs when + # every preceding step succeeded, so verification still gates the release. - name: Create release zip run: | set -euo pipefail @@ -86,6 +86,17 @@ jobs: ZIP_NAME="mailmojo-${GITHUB_REF_NAME#v}.zip" (cd release && zip -qr "../${ZIP_NAME}" mailmojo) + - name: Upload release zip + if: ${{ !cancelled() }} + uses: actions/upload-artifact@v4 + with: + name: mailmojo-${{ github.ref_name }} + path: ${{ env.ZIP_NAME }} + if-no-files-found: warn + + - name: Verify staged package + run: bin/verify-release.sh release/mailmojo + - name: Verify release zip run: | set -euo pipefail @@ -96,13 +107,6 @@ jobs: bin/verify-release.sh zip-check/mailmojo rm -rf zip-check - - name: Upload release zip - uses: actions/upload-artifact@v4 - with: - name: mailmojo-${{ github.ref_name }} - path: ${{ env.ZIP_NAME }} - if-no-files-found: error - - name: Deploy to WordPress.org uses: 10up/action-wordpress-plugin-deploy@2.3.0 env: diff --git a/.github/workflows/verify-package.yml b/.github/workflows/verify-package.yml index 486d087..96cedbe 100644 --- a/.github/workflows/verify-package.yml +++ b/.github/workflows/verify-package.yml @@ -51,15 +51,26 @@ jobs: - name: Stage release package run: bin/stage-release.sh release/mailmojo - - name: Verify staged package - run: bin/verify-release.sh release/mailmojo - + # Zip before verifying, so a failing verification still leaves an artifact + # to download and inspect. - name: Create release zip run: | set -euo pipefail (cd release && zip -qr ../mailmojo-package-check.zip mailmojo) + - name: Upload package for inspection + if: ${{ !cancelled() }} + uses: actions/upload-artifact@v4 + with: + name: mailmojo-package-check + path: mailmojo-package-check.zip + if-no-files-found: warn + retention-days: 7 + + - name: Verify staged package + run: bin/verify-release.sh release/mailmojo + - name: Verify release zip run: | set -euo pipefail @@ -68,11 +79,3 @@ jobs: mkdir -p zip-check unzip -q mailmojo-package-check.zip -d zip-check bin/verify-release.sh zip-check/mailmojo - - - name: Upload package for inspection - uses: actions/upload-artifact@v4 - with: - name: mailmojo-package-check - path: mailmojo-package-check.zip - if-no-files-found: error - retention-days: 7 From 7ed3ee58f26bdcdfe6b0c25fd640d9cb8b63d0e9 Mon Sep 17 00:00:00 2001 From: Frode Danielsen Date: Mon, 3 Aug 2026 11:49:52 +0200 Subject: [PATCH 3/4] Bump GitHub actions to Node.js 24 runtimes checkout, setup-node and upload-artifact were on v4, which targets Node.js 20 and is now force-run on Node.js 24 with a deprecation warning. Taking all three to v7 rather than the minimum that clears the warning, since nothing in the intervening majors affects this usage: checkout v6 moved credential persistence to a separate file and v7 blocks fork checkouts for pull_request_target/workflow_run, neither of which applies here; setup-node v5/v6 changed automatic package manager detection, and both workflows set `cache: npm` explicitly; upload-artifact v7 adds an opt-in `archive` parameter that defaults to existing behaviour. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/deploy-wordpress-org.yml | 6 +++--- .github/workflows/verify-package.yml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/deploy-wordpress-org.yml b/.github/workflows/deploy-wordpress-org.yml index 737808f..e634c13 100644 --- a/.github/workflows/deploy-wordpress-org.yml +++ b/.github/workflows/deploy-wordpress-org.yml @@ -15,12 +15,12 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 with: fetch-depth: 0 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v7 with: node-version: "22" cache: npm @@ -88,7 +88,7 @@ jobs: - name: Upload release zip if: ${{ !cancelled() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: mailmojo-${{ github.ref_name }} path: ${{ env.ZIP_NAME }} diff --git a/.github/workflows/verify-package.yml b/.github/workflows/verify-package.yml index 96cedbe..5c23254 100644 --- a/.github/workflows/verify-package.yml +++ b/.github/workflows/verify-package.yml @@ -24,10 +24,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v7 with: node-version: "22" cache: npm @@ -61,7 +61,7 @@ jobs: - name: Upload package for inspection if: ${{ !cancelled() }} - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: mailmojo-package-check path: mailmojo-package-check.zip From a16752142eed62d33a5ed8bda25ca7105fa8418b Mon Sep 17 00:00:00 2001 From: Frode Danielsen Date: Mon, 3 Aug 2026 12:44:55 +0200 Subject: [PATCH 4/4] Pin GitHub actions to commit SHAs Mutable tags mean a third party can change what runs in the release pipeline without any change here, and that pipeline holds the WordPress.org SVN credentials. Pin every action to a commit SHA with the version in a trailing comment. Each SHA is the commit its previous floating tag already resolved to, so this changes nothing about what executes: actions/checkout@v7 -> 3d3c42e5 (v7.0.1) actions/setup-node@v7 -> 82076278 (v7.0.0) actions/upload-artifact@v7 -> 043fb46d (v7.0.1) shivammathur/setup-php@v2 -> f3e473d1 (v2.37.2) 10up/...-deploy@2.3.0 -> 54bd289b (2.3.0) setup-php was on a floating major and the deploy action on a mutable release tag, so both were exposed the same way despite looking pinned. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/deploy-wordpress-org.yml | 10 +++++----- .github/workflows/verify-package.yml | 8 ++++---- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/deploy-wordpress-org.yml b/.github/workflows/deploy-wordpress-org.yml index e634c13..f7fd55a 100644 --- a/.github/workflows/deploy-wordpress-org.yml +++ b/.github/workflows/deploy-wordpress-org.yml @@ -15,19 +15,19 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "22" cache: npm cache-dependency-path: mailmojo/package-lock.json - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2 with: php-version: "8.2" coverage: none @@ -88,7 +88,7 @@ jobs: - name: Upload release zip if: ${{ !cancelled() }} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: mailmojo-${{ github.ref_name }} path: ${{ env.ZIP_NAME }} @@ -108,7 +108,7 @@ jobs: rm -rf zip-check - name: Deploy to WordPress.org - uses: 10up/action-wordpress-plugin-deploy@2.3.0 + uses: 10up/action-wordpress-plugin-deploy@54bd289b8525fd23a5c365ec369185f2966529c2 # 2.3.0 env: SLUG: mailmojo BUILD_DIR: release/mailmojo diff --git a/.github/workflows/verify-package.yml b/.github/workflows/verify-package.yml index 5c23254..a1ace43 100644 --- a/.github/workflows/verify-package.yml +++ b/.github/workflows/verify-package.yml @@ -24,17 +24,17 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Node.js - uses: actions/setup-node@v7 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: "22" cache: npm cache-dependency-path: mailmojo/package-lock.json - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2 with: php-version: "8.2" coverage: none @@ -61,7 +61,7 @@ jobs: - name: Upload package for inspection if: ${{ !cancelled() }} - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: mailmojo-package-check path: mailmojo-package-check.zip