Skip to content

Update wp-cli framework #1086

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
schlessera wants to merge 2 commits into from
+8 −9
Closed

Update wp-cli framework #1086

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
84c8ed2
Update framework workflow: Use default token
swissspidy Jul 21, 2026
38ecddc
Update wp-cli framework
github-actions[bot] Jul 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions .github/workflows/update-framework.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,6 @@ concurrency:

permissions:
contents: write
issues: read
pull-requests: write

jobs:
Expand All @@ -30,7 +29,7 @@ jobs:
- name: Check out source code
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
token: ${{ secrets.ACTIONS_BOT }}
token: ${{ secrets.GITHUB_TOKEN }}
Comment on lines 29 to +32

@coderabbitai coderabbitai Bot Jul 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '--- file list ---\n'
git ls-files .github/workflows/update-framework.yml

printf '\n--- line count ---\n'
wc -l .github/workflows/update-framework.yml

printf '\n--- relevant excerpt ---\n'
sed -n '1,220p' .github/workflows/update-framework.yml

Repository: wp-cli/wp-cli-bundle

Length of output: 249

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '--- search for checkout usage and credential handling in workflow ---\n'
rg -n "actions/checkout|persist-credentials|GITHUB_TOKEN|GH_TOKEN|git push|composer" .github/workflows/update-framework.yml

Repository: wp-cli/wp-cli-bundle

Length of output: 249

🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,220p' .github/workflows/update-framework.yml

Repository: wp-cli/wp-cli-bundle

Length of output: 3450

Disable persisted checkout credentials. actions/checkout stores the GITHUB_TOKEN in local git config by default. This job runs Composer afterward, so a package script or plugin could read the write-capable token before the push step. Set persist-credentials: false and add explicit auth only for git push.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 29-32: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/update-framework.yml around lines 29 - 32, Update the
actions/checkout step in the update-framework workflow to set
persist-credentials to false, preventing GITHUB_TOKEN from being stored in local
git configuration. Preserve authentication for the later push by configuring
explicit credentials only in the git push step.

Sources: MCP tools, Linters/SAST tools


- name: Set up PHP environment
uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
Expand Down Expand Up @@ -58,7 +57,7 @@ jobs:

- name: Commit and Create Pull Request
env:
GH_TOKEN: ${{ secrets.ACTIONS_BOT }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
PR_BODY: |
**This is an automated pull-request**
Expand All @@ -74,7 +73,7 @@ jobs:

git push -f origin update-framework

PR_NUMBER=$(gh api --method GET "repos/${{ github.repository }}/pulls" -f head="${{ github.repository_owner }}:update-framework" -f base="$DEFAULT_BRANCH" -f state="open" --jq '.[0].number // empty')
PR_NUMBER=$(gh pr list --head "update-framework" --base "$DEFAULT_BRANCH" --state open --json number --jq '.[0].number // empty')
if [ -z "$PR_NUMBER" ]; then
gh pr create \
--title "Update wp-cli framework" \
Expand Down
10 changes: 5 additions & 5 deletions composer.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.