[Ntnelbaba]

Summary

Modernizes CI under .github/workflows and .github/workflows/permissions: Node.js 22.x (current Active LTS), current major versions of official GitHub Actions, refreshed shivammathur/setup-php pin, runner updates, and workflow permission/input hardening appropriate for a public repository.

Node.js

Location	Before	After	Notes
build.yml, lint.yml, theme-check.yml	18.x	22.x
playwright.yml	'20'	'22'
playwright-with-specific-*.yml (3 jobs each)	20.x	22.x

Local verification on Node 22.23.4: npm ci and npm run lint:js succeed. npm run build:prod was not run locally (Composer is not installed in the agent environment); CI jobs already install Composer before production builds.

GitHub Actions and runners (by workflow)

Workflow	Component	Before	After
lint.yml	actions/checkout	v3	v6
lint.yml	actions/setup-node	v3	v7
lint.yml	actions/cache	v3	v6
lint.yml	shivammathur/setup-php	pinned v2 (old SHA)	4424c9a… (# v2.40.0)
build.yml	actions/checkout	v4	v6
build.yml	actions/setup-node	v4	v7
build.yml	actions/cache	v4	v6
build.yml	actions/upload-artifact	v4	v7
deploy.yml	actions/checkout	v4	v6
deploy.yml	actions/download-artifact	v4	v8
phpunit.yml	actions/checkout	v4	v6
phpunit.yml	runs-on (test jobs)	ubuntu-22.04	unchanged (ubuntu-22.04; see adaptations)
playwright.yml	actions/checkout	v4	v6
playwright.yml	actions/setup-node	v4	v7
playwright.yml	actions/upload-artifact	v4	v7
theme-check.yml	actions/checkout	v4	v6
theme-check.yml	actions/setup-node	v4	v7
theme-check.yml	actions/upload-artifact	v4	v7
cherry-pick-validation.yml	actions/checkout	v4	v6
cherry-pick-validation.yml	actions/github-script	v7	v9
cherry-pick-pr.yml	actions/checkout	v4	v6
daily-test-matrix.yml	actions/checkout	v4	v6
daily-test-matrix.yml	actions/github-script	v7	v9
daily-test-matrix.yml	actions/upload-artifact / download-artifact	v4	v7 / v8
daily-test-matrix.yml	runs-on	ubuntu-22.04	ubuntu-latest
playwright-with-specific-elementor-version.yml	checkout / setup-node / artifacts / setup-php	v4 / v4 / v4 / old SHA	v6 / v7 / v7+v8 / v2.40.0
playwright-with-specific-hello-plus-version.yml	same pattern	v4 / v4 / v4 / old SHA	v6 / v7 / v7+v8 / v2.40.0
playground-preview.yml	(already current)	checkout v6, download v8, upload v7, github-script v9	unchanged versions; added persist-credentials: false on checkout

Third-party actions already on latest major: peter-evans/find-comment@v4, peter-evans/create-or-update-comment@v5, technote-space/get-diff-action@v6.

Adaptations

• lint.yml: Replaced deprecated ::set-output with $GITHUB_OUTPUT for the Composer cache directory step.
• Permissions: Added or narrowed top-level permissions: (contents: read by default); elevated per job where comments, artifacts, deployments, or git push are required.
• Checkout: persist-credentials: false wherever git push is not required; left persist-credentials: true on cherry-pick-pr.yml (needs credentials to push cherry-pick branches).
• Shell steps: Moved untrusted/event payload values out of inline run: interpolation into env where practical.
• cherry-pick-pr.yml: Still uses pull_request_target for post-merge/cp_* label handling; continues to check out base.ref only (not the PR head).
• phpunit.yml: Kept matrix jobs on ubuntu-22.04 after a failed trial on ubuntu-latest (svn: command not found in bin/install-wp-tests.sh).

Removed workflows

None. All 12 workflow files under .github/workflows/ are referenced by triggers, workflow_call, deploy/build wiring, or daily matrix dispatch.

Deliberately not changed

Item	Reason
actions/checkout@v7	Standardized on v6 (already used in playground-preview.yml).
peter-evans/*, technote-space/get-diff-action@v6	Already latest major lines.
phpunit.yml runs-on: ubuntu-22.04	Required for preinstalled Subversion used by the PHPUnit bootstrap script.
mysql:5.7 service in phpunit.yml	PHPUnit matrix service image; outside Actions/runner version scope.
Deploy workflow secrets, permitted users, and SVN publish logic	Out of scope.
Theme/application source, package.json, .nvmrc	CI-only change.

  

✨ PR Description

1. Problem & Context

Update Node.js and GitHub Action versions across all workflows to maintain support, improve security, and leverage newer runner capabilities.

2. What Changed (Where)

File	Change
.github/workflows/build.yml	Node 18 $\rightarrow$ 22; Actions checkout@v6, setup-node@v7, cache@v6, upload-artifact@v7.
.github/workflows/cherry-pick-pr.yml	checkout@v6; moved PR context to env vars for shell safety.
.github/workflows/cherry-pick-validation.yml	checkout@v6; github-script@v9; refactored report generation to use env vars.
.github/workflows/daily-test-matrix.yml	checkout@v6, github-script@v9, upload/download-artifact@v7/v8; ubuntu-22.04 $\rightarrow$ ubuntu-latest.
.github/workflows/deploy.yml	checkout@v6; download-artifact@v8; refactored validation to use env vars.
.github/workflows/lint.yml	Node 18 $\rightarrow$ 22; checkout@v6, setup-node@v7, cache@v6; setup-php update.
.github/workflows/permissions/action.yml	Refactored logic to use env vars instead of direct context interpolation.
.github/workflows/phpunit.yml	checkout@v6.
.github/workflows/playground-preview.yml	checkout@v6; download-artifact@v8.
.github/workflows/playwright-*.yml	Node 20 $\rightarrow$ 22; checkout@v6, setup-node@v7, upload/download-artifact@v7/v8.
.github/workflows/theme-check.yml	Node 18 $\rightarrow$ 22; checkout@v6, setup-node@v7, upload-artifact@v7.

3. How It Works

• Upgraded Node.js to v22.x across build and lint pipelines.
• Standardized GitHub Actions to latest major versions (Checkout v6, Setup-Node v7, Artifacts v7/v8).
• Replaced direct ${{ }} interpolation in shell scripts with env mappings to prevent shell injection.

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Description using Guidelines Learn how}

[github-actions]

Hello Elementor Build

Last updated at: 20261103.0858
Version: 3.5.1

✅ Hello Elementor build is ready for download.

You can download the latest build from the link below:

🔗 hello-elementor.3.5.1.zip

The build is available for 7 days.

[github-actions]

WordPress Theme Check

Status: passed (exit code 0)

Ran Theme Check against the packaged hello-elementor zip.

ℹ Starting 'bash hello-elementor-config/theme-check.sh' on the cli container. 

Installing Theme Check (20260901)
Downloading installation package from https://downloads.wordpress.org/plugin/theme-check.20260901.zip...
Unpacking the package...
Installing the plugin...
Removing the old version of the plugin...
Plugin updated successfully.
Activating 'theme-check'...
Plugin 'theme-check' activated.
Success: Installed 1 of 1 plugins.
Unpacking the package...
Installing the theme...
Removing the old version of the theme...
Theme updated successfully.
Activating 'hello-elementor'...
Success: Switched to 'Hello Elementor' theme.
Success: Installed 1 of 1 themes.
type	value
INFO	Themes that use the tag accessibility-ready will need to undergo an accessibility review. See https://make.wordpress.org/themes/handbook/review/accessibility/
INFO	Only one text-domain is being used in this theme. Make sure it matches the theme's slug correctly so that the theme will be compatible with WordPress.org language packs. The domain found is hello-elementor.
RECOMMENDED	No reference to add_theme_support( "custom-header", $args ) was found in the theme. It is recommended that the theme implement this functionality if using an image for the header.
RECOMMENDED	No reference to add_theme_support( "custom-background", $args ) was found in the theme. If the theme uses background images or solid colors for the background, then it is recommended that the theme implement this functionality.
RECOMMENDED	This theme contains no sidebars/widget areas. See Widgets API
✔ Ran `bash hello-elementor-config/theme-check.sh` in 'cli'. (in 3s 236ms)