Add wp-org-svn-deploy reusable workflow (WordPress.org SVN deploy) - #60
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| - name: Checkout release tag | ||
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | ||
| with: | ||
| ref: ${{ inputs.tag }} | ||
|
|
||
| # Deploys trunk/ + tags/<tag>/ and .wordpress-org/ assets via SVN. | ||
| # Refuses to commit when dry_run is true. | ||
| - name: Deploy to WordPress.org |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| - name: Checkout release tag | ||
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | ||
| with: | ||
| ref: ${{ inputs.tag }} |
There was a problem hiding this comment.
🟡 Colliding branch replaces release tag
When a branch and tag share a name, actions/checkout selects the branch. WordPress then receives branch contents under the tag’s version.
| ref: ${{ inputs.tag }} | |
| ref: refs/tags/${{ inputs.tag }} |
Was this helpful? React with 👍 or 👎 to provide feedback.
| SVN_USERNAME: ${{ secrets.svn_username }} | ||
| SVN_PASSWORD: ${{ secrets.svn_password }} | ||
| SLUG: ${{ inputs.slug }} | ||
| VERSION: ${{ inputs.tag }} |
There was a problem hiding this comment.
🟡 Slashed release tags cannot deploy
When tag contains a slash, VERSION names a nested SVN path whose parent does not exist. Every such release fails before commit.
Prompt for agents
The reusable workflow accepts any Git tag string, but 10up/action-wordpress-plugin-deploy uses VERSION directly as the working-copy destination under tags/. A valid Git tag such as release/1.2.3 therefore requires an intermediate SVN directory that the action does not create, and svn cp fails. Decide whether this workflow must support slashed Git tags by mapping them to a valid WordPress version, or reject them explicitly before deployment and document the accepted tag format. Update .github/workflows/wp-org-svn-deploy.yml, its workflow documentation, and its example consistently.
Was this helpful? React with 👍 or 👎 to provide feedback.
|
|
||
| - Deploys `trunk/` + `tags/<tag>/` to `plugins.svn.wordpress.org/<slug>/` | ||
| - Handles `.wordpress-org/` assets (banners, icons, screenshots) when present | ||
| - `dry_run` mode validates the full flow without committing to SVN |
There was a problem hiding this comment.
🔍 Dry-run validation is overstated
dry_run never validates SVN credentials or commit permission. An existing version also bypasses package preparation, despite the promised full-flow validation.
Was this helpful? React with 👍 or 👎 to provide feedback.
There was a problem hiding this comment.
🟡 Changes recommended
Ref qualification and boolean input handling can currently cause incorrect deployment or workflow validation failure.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds a reusable workflow for deploying tagged WordPress plugins to WordPress.org SVN.
Changes:
- Adds SHA-pinned checkout and SVN deployment automation.
- Supports configurable tags, slugs, dry runs, and SVN credentials.
- Adds documentation, example usage, and index entries.
File summaries
| File | Description |
|---|---|
.github/workflows/wp-org-svn-deploy.yml |
Implements the reusable deployment workflow. |
examples/wp-org-svn-deploy.yml |
Provides a manual-dispatch caller example. |
docs/workflows/wp-org-svn-deploy.md |
Documents usage and configuration. |
README.md |
Adds the workflow to the main index. |
docs/README.md |
Adds the workflow documentation entry. |
Review details
- Files reviewed: 5/5 changed files
- Comments generated: 2
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| uses: udx/reusable-workflows/.github/workflows/wp-org-svn-deploy.yml@master | ||
| with: | ||
| tag: ${{ github.event.inputs.tag }} | ||
| dry_run: ${{ github.event.inputs.dry_run }} |
There was a problem hiding this comment.
🟡 Changes recommended
SVN deployments need serialization, and the dry-run credential documentation is inaccurate.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 5/5 changed files
- Comments generated: 2
- Review effort level: Balanced
| jobs: | ||
| deploy: | ||
| name: deploy | ||
| runs-on: ubuntu-latest |
|
|
||
| - Deploys `trunk/` + `tags/<tag>/` to `plugins.svn.wordpress.org/<slug>/` | ||
| - Handles `.wordpress-org/` assets (banners, icons, screenshots) when present | ||
| - `dry_run` mode rehearses checkout and SVN package preparation without committing (credentials and commit permission are only exercised on a real run) |
There was a problem hiding this comment.
🟡 Changes recommended
Tag validation permits @, which can break SVN path handling.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 5/5 changed files
- Comments generated: 1
- Review effort level: Balanced
| if [[ "${TAG}" == *"/"* ]]; then | ||
| echo "::error::Tag '${TAG}' must not contain slashes (SVN tag path would be nested)." | ||
| exit 1 | ||
| fi |
What
New reusable workflow
wp-org-svn-deploy.yml: deploys a tagged plugin release to the WordPress.org Plugin Directory via SVN, wrapping 10up/action-wordpress-plugin-deploy SHA-pinned at 2.3.0 (54bd289b).tag(required; checked out and deployed astags/<tag>/+trunk/),slug(defaults to caller repo name),dry_run(validate without committing)svn_username/svn_password(required) — referenced only viasecrets.*, never stored in any repo; org secrets are scoped to selected repositoriesWhy
wp-stateless 4.4.2 was deployed to wp.org manually over SVN; this makes it a one-dispatch (or fully chained) step for all UDX plugins. Caller wiring for wp-stateless's publish-release.yml follows in a separate PR.
Security notes
permissions: contents: read; no write scopes