Update framework workflow: Use default token

[swissspidy]

Summary by CodeRabbit

• Chores
  • Updated automated framework update workflows to use standard authentication.
  • Improved pull request detection and streamlined workflow permissions.

[coderabbitai]

📝 Walkthrough

Walkthrough

The framework update workflow removes unnecessary issue permissions, switches checkout and GitHub CLI authentication to GITHUB_TOKEN, and replaces REST API pull request detection with filtered gh pr list output.

Changes

Framework update workflow

Layer / File(s)	Summary
Workflow permissions and authentication .github/workflows/update-framework.yml	Removes issues: read and uses secrets.GITHUB_TOKEN for checkout and GitHub CLI authentication.
Existing pull request detection .github/workflows/update-framework.yml	Uses gh pr list filters and jq to extract the first open matching pull request number instead of querying the pulls REST endpoint.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• wp-cli/wp-cli-bundle#1082: Updates the same workflow’s existing pull request lookup.
• wp-cli/wp-cli-bundle#1083: Changes the same workflow’s permissions and pull request detection.
• wp-cli/wp-cli-bundle#1084: Modifies the same workflow’s pull request lookup logic.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main workflow change: switching the framework workflow to use the default token.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/update-framework-workflow

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/update-framework.yml:
- Line 32: Update the actions/checkout configuration to set persist-credentials
to false, then authenticate Git immediately before the git push step using the
existing checkout token. Ensure later Composer steps cannot access persisted
checkout credentials while preserving push authentication.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 75b77aff-d3ea-4a6a-9ddb-96c97df47426

📥 Commits

Reviewing files that changed from the base of the PR and between 727e898 and 84c8ed2.

📒 Files selected for processing (1)

• .github/workflows/update-framework.yml

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Map the workflow file and inspect the relevant range with line numbers.
wc -l .github/workflows/update-framework.yml
sed -n '1,220p' .github/workflows/update-framework.yml | cat -n

# Also search for any later git/auth/push steps in this workflow.
rg -n "actions/checkout|persist-credentials|composer|gh auth|git push|GITHUB_TOKEN|GH_TOKEN" .github/workflows/update-framework.yml

Repository: wp-cli/wp-cli-bundle

Length of output: 4895

---

Do not persist the checkout token.
actions/checkout writes the token into .git/config by default, and the later Composer steps can access it through scripts/plugins. Set persist-credentials: false here and authenticate Git only right before git push.

🧰 Tools

🪛 zizmor (1.26.1)

[warning] 29-32: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/update-framework.yml at line 32, Update the
actions/checkout configuration to set persist-credentials to false, then
authenticate Git immediately before the git push step using the existing
checkout token. Ensure later Composer steps cannot access persisted checkout
credentials while preserving push authentication.

Source: Linters/SAST tools

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!