GitHub Actions workflows for SymPress packages, WordPress projects, and Composer-first monorepos.

SymPress projects share the same recurring automation needs: Composer installs, PHPCS, PHPStan, PHPUnit, asset builds, WordPress archives, Playwright checks, semantic releases, and optional deployments. This repository keeps those workflows in one place so project repositories only describe when automation should run and which inputs differ.

• External GitHub Actions are pinned to full commit SHAs.
• Repository checks run actionlint, zizmor, contract tests, docs linting, and fixture workflows.
• Workflow defaults use least-privilege permissions and lockfile-first installs.
• Shell-command escape hatches require explicit allow_* inputs.
• Release, archive, and artifact flows include manifest, checksum, secret-scan, and optional attestation controls.
• Community health files, issue templates, pull request checklist, security policy, support guide, and CODEOWNERS are included.

• PHPCS linting, PHPStan static analysis, unit tests, and Composer validation.
• SymPress package QA for root projects and packages/* monorepos.
• JavaScript static analysis and unit tests with npm, yarn, or pnpm detection.
• @wordpress/scripts linting for JS, styles, Markdown, and package.json.
• Text quality checks with Typos, CSpell, and optional grammar review.
• GitHub Actions linting through actionlint.
• Composer-aware asset builds for sympress/asset-compiler projects.
• Build-and-distribute workflow for compiled build branches and downloadable artifacts.
• WordPress plugin/theme archive creation with .distignore support.
• Artifact-level WordPress archive checks before release or QIT.
• Artifact manifests, checksums, and secret-content scans for distributable packages.
• Optional GitHub Artifact Attestations for distributable package manifests.
• Semantic release with a built-in fallback release config.
• Deployer-based deployments.
• Playwright and DDEV Playwright workflows, including optional ngrok support.
• WooCommerce QIT workflow for extension archives.
• Consumer repository diagnostics through npm run doctor -- <repo>.
• CodeQL workflow for PHP security scanning.
• Contract tests, zizmor checks, and a workflow catalog for repository-level governance.

name: QA

on:
  pull_request:
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  qa:
    uses: sympress/workflows/.github/workflows/sympress-qa.yml@177fa0d727b278d2103052ec77c102b4a4c492a0
    with:
      php_version: '8.5'

Workflow calls are made at job level with jobs.<job_id>.uses. See Usage for permissions, secrets, outputs, and common recipes.

• Documentation index for all guides.
• Installation for repository setup, private access, release tags, first consumer workflow, and secrets.
• Usage for day-to-day workflow calls.
• Consumer setup checklist for onboarding a project.
• Enterprise WordPress monorepo QA for root application install checks plus package-level PHPCS/PHPStan.
• Workflow reference for operators.
• Troubleshooting for common GitHub Actions errors.
• Maintainer guide for changing this repository.

• SymPress QA for Composer projects and package monorepos.
• Dependency canary for scheduled dependency checks and failure/recovery notifications.
• Decision guide for choosing the smallest useful workflow.
• Feature map for the complete workflow coverage.
• PHP for focused PHPCS, PHPStan, and PHPUnit jobs.
• JavaScript for static analysis and unit tests.
• WordPress scripts for @wordpress/scripts linting.
• Text quality for spelling and optional grammar checks.
• Assets for sympress/asset-compiler and npm builds.
• Build and distribute for compiled build branches and artifacts.
• Archive creation for WordPress plugin/theme archives.
• Archive check for shipped artifact validation.
• Release for semantic-release automation.
• Playwright and DDEV Playwright for browser tests.
• Deployment for Deployer-based releases.
• Woo QIT for WooCommerce extension checks.
• Security hardening for artifact, shell, SSH, and supply-chain defaults.
• Release strategy for tags and migration policy.

• Security policy for private vulnerability reporting.
• Support guide for adoption and troubleshooting requests.
• Contributing guide for pull request expectations.
• Code of conduct for community standards.

• PHP 8.5, Composer 2, and Node 24.
• working-directory input on package-level workflows.
• COMPOSER_AUTH_JSON, NPM_REGISTRY_TOKEN, and ENV_VARS secrets are optional unless a workflow genuinely needs them.
• Build workflows set COMPOSER_MIRROR_PATH_REPOS=1 so Composer path repositories are copied into distributable builds instead of symlinked.
• Workflows use read-only repository permissions unless they push, release, or deploy.
• Node workflows require a lockfile by default. Set allow_unpinned_node_install: true only for trusted compatibility callers.
• Artifact workflows block secret-like files by default. .env.example and .env.dist are allowed; a real .env must be explicitly allowlisted when it is intentionally non-secret.
• Artifact workflows add artifact-manifest.json and artifact-sha256sums.txt by default.
• Artifact workflows can attest the generated manifest with artifact_attestation: true when callers grant actions: read, attestations: write, and id-token: write.
• Free-form shell inputs are disabled by default and require an explicit allow_* input.
• JSON ENV_VARS names are validated and reserved GitHub/runner variables are blocked.
• Node workflows detect npm, yarn, and pnpm lockfiles for dependency caching.