Guard release and WordPress.org metadata publication

.github/release-profile.json

@@ -0,0 +1,23 @@
+{
+  "productionBranch": "master",
+  "developmentBranch": "develop",
+  "pluginSlug": "content-control",
+  "pluginName": "Content Control",
+  "mainFile": "content-control.php",
+  "versionTagPrefix": "v",
+  "versionSources": ["package.json", "content-control.php", "readme.txt"],
+  "changelogFiles": ["CHANGELOG.md", "readme.txt"],
+  "artifact": {
+    "root": "content-control",
+    "requiredPaths": ["content-control.php", "vendor/autoload.php", "dist/settings-page.js"],
+    "forbiddenPrefixes": [".git/", ".github/", "bin/", "docs/", "node_modules/", "packages/", "tests/"]
+  },
+  "channels": {
+    "github": true,
+    "wordpressOrg": true,
+    "edd": false,
+    "googleDrive": false,
+    "changelogDraft": false,
+    "slack": false
+  }
+}

.github/workflows/deploy-readme-assets.yml

@@ -1,26 +1,144 @@
-name: Plugin asset/readme update
+name: Sync approved readme/assets PR to WordPress.org
+
 on:
-    push:
-        branches:
-            - master
+    pull_request_target:
+        branches: [master]
+        types: [closed]
+    repository_dispatch:
+        types: [retry_approved_readme_assets_pr]
+
+permissions:
+    contents: read
+    pull-requests: read
 
-env:
-    IGNORE_OTHER_FILES: true
+concurrency:
+    group: content-control-publication
+    cancel-in-progress: false
 
 jobs:
-    master:
-        name: Push to master
+    authorize:
+        name: Authorize approved readme/assets PR
+        if: >-
+            github.event_name == 'repository_dispatch' ||
+            (github.event.pull_request.merged == true &&
+             startsWith(github.event.pull_request.head.ref, 'wordpress-org/'))
         runs-on: ubuntu-latest
+        outputs:
+            should_sync: ${{ steps.authorize.outputs.should_sync }}
+            merge_sha: ${{ steps.authorize.outputs.merge_sha }}
         steps:
-            - name: Checkout master
-              uses: actions/checkout@v4
+            - name: Verify merged PR, approval, branch, and exact file scope
+              id: authorize
+              uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+              env:
+                  RETRY_PULL_REQUEST_NUMBER: ${{ github.event.client_payload.pull_request_number }}
+              with:
+                  script: |
+                      const owner = context.repo.owner;
+                      const repo = context.repo.repo;
+                      const number = context.eventName === 'repository_dispatch'
+                        ? Number(process.env.RETRY_PULL_REQUEST_NUMBER)
+                        : context.payload.pull_request.number;
+                      if (!Number.isSafeInteger(number) || number < 1) {
+                        return core.setFailed('A valid merged readme/assets PR number is required.');
+                      }
+                      const { data: pull } = await github.rest.pulls.get({ owner, repo, pull_number: number });
+                      core.setOutput('should_sync', 'false');
+                      if (!pull.merged || pull.base.ref !== 'master') {
+                        core.info('PR is not merged into master; nothing will be synced.');
+                        return;
+                      }
+                      if (pull.head.repo?.full_name !== `${owner}/${repo}`) {
+                        return core.setFailed('Publication PRs must come from this repository.');
+                      }
+                      if (!/^wordpress-org\/[a-z0-9][a-z0-9._-]*$/.test(pull.head.ref)) {
+                        return core.setFailed('Branch must be wordpress-org/<topic> using lowercase letters, numbers, dots, underscores, or hyphens.');
+                      }
+                      const reviews = await github.paginate(github.rest.pulls.listReviews, {
+                        owner, repo, pull_number: number, per_page: 100,
+                      });
+                      const latestByReviewer = new Map();
+                      for (const review of reviews) {
+                        if (review.user?.login && ['APPROVED', 'CHANGES_REQUESTED', 'DISMISSED'].includes(review.state)) {
+                          latestByReviewer.set(review.user.login, review.state);
+                        }
+                      }
+                      const candidates = [...latestByReviewer.entries()]
+                        .filter(([, state]) => state === 'APPROVED')
+                        .map(([login]) => login);
+                      if (pull.merged_by?.login) candidates.push(pull.merged_by.login);
+                      let authorized = false;
+                      for (const username of [...new Set(candidates)]) {
+                        const { data: permission } = await github.rest.repos.getCollaboratorPermissionLevel({ owner, repo, username });
+                        if (['admin', 'maintain', 'write'].includes(permission.permission)) {
+                          authorized = true;
+                          break;
+                        }
+                      }
+                      if (!authorized) {
+                        return core.setFailed('The PR was not approved or merged by an authorized maintainer.');
+                      }
+                      const files = await github.paginate(github.rest.pulls.listFiles, {
+                        owner, repo, pull_number: number, per_page: 100,
+                      });
+                      const allowedPath = (filename) =>
+                        filename === 'readme.txt' || filename.startsWith('.wordpress-org/');
+                      const removesReadme = files.some((file) =>
+                        (file.filename === 'readme.txt' && file.status === 'removed') ||
+                        (file.status === 'renamed' && file.previous_filename === 'readme.txt')
+                      );
+                      const allowed = files.length > 0 && !removesReadme && files.every((file) =>
+                        allowedPath(file.filename) &&
+                        (file.status !== 'renamed' || allowedPath(file.previous_filename || ''))
+                      );
+                      if (!allowed) {
+                        return core.setFailed('WordPress.org publication PRs may only change readme.txt and .wordpress-org assets.');
+                      }
+                      core.setOutput('merge_sha', pull.merge_commit_sha);
+                      core.setOutput('should_sync', 'true');
+
+    update:
+        name: Update WordPress.org readme and assets
+        needs: authorize
+        if: needs.authorize.outputs.should_sync == 'true'
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout approved merge
+              uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+              with:
+                  ref: ${{ needs.authorize.outputs.merge_sha }}
+                  fetch-depth: 0
+                  persist-credentials: false
+
+            - name: Refuse stale readme or assets
+              run: |
+                  git fetch --no-tags origin master
+                  if ! git diff --quiet HEAD FETCH_HEAD -- readme.txt .wordpress-org; then
+                    echo 'A newer readme or asset change exists on master. Refusing to publish stale files.'
+                    exit 1
+                  fi
 
-            - name: Install SVN
-              run: sudo apt-get install -y subversion
+            - name: Validate publication files
+              run: |
+                  node <<'NODE'
+                  const fs = require('fs');
+                  const version = JSON.parse(fs.readFileSync('package.json', 'utf8')).version;
+                  const stableTag = fs.readFileSync('readme.txt', 'utf8')
+                    .match(/^Stable tag:\s*([^\s]+)\s*$/m)?.[1];
+                  if (stableTag !== version) throw new Error(`Stable tag ${stableTag || '(missing)'} does not match ${version}.`);
+                  NODE
+                  if [ -L readme.txt ] ||
+                    [ -L .wordpress-org ] ||
+                    { [ -d .wordpress-org ] && find .wordpress-org -type l -print -quit | grep -q .; }; then
+                    echo 'Symlinks are not allowed in publication files.'
+                    exit 1
+                  fi
 
-            - name: WordPress.org plugin asset/readme update
-              uses: 10up/action-wordpress-plugin-asset-update@stable
+            - name: Sync readme and assets
+              uses: 10up/action-wordpress-plugin-asset-update@2480306f6f693672726d08b5917ea114cb2825f7 # stable
               env:
                   SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }}
                   SVN_USERNAME: ${{ secrets.SVN_USERNAME }}
-                  SLUG: ${{ secrets.SLUG }}
+                  SLUG: content-control
+                  ASSETS_DIR: .wordpress-org
+                  IGNORE_OTHER_FILES: true