Cherry-pick PRs for WP 7.1.1

.github/actionlint.yml

@@ -7,6 +7,10 @@ paths:
         ignore:
             # [SC2129](https://www.shellcheck.net/wiki/SC2129) is ignored because it is a stylistic issue.
             - 'shellcheck reported issue in this script: SC2129:.+'
+            # `queue` is a real concurrency key, but actionlint does not know it
+            # yet, and its last release predates the feature. Tracked upstream in
+            # https://github.com/rhysd/actionlint/issues/654.
+            - 'unexpected key "queue" for "concurrency" section.+'
     .github/workflows/end2end-test.yml:
         ignore:
             # This file gets created in the step prior.

.github/workflows/bundle-size.yml

@@ -46,7 +46,10 @@ jobs:
         runs-on: 'ubuntu-24.04'
         permissions:
             contents: read
+            # Only used on a fork, where the action falls back to commenting and
+            # its own failure handling takes over. See `use-check` below.
             pull-requests: write
+            checks: write
 
         steps:
             - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -63,8 +66,72 @@ jobs:
                   cache: npm
 
             - uses: preactjs/compressed-size-action@f322c295dde06a1cb7ccaef105732dd8a726d1d9 # v2.10.0
+              id: size
               with:
                   omit-unchanged: true
                   repo-token: '${{ secrets.GITHUB_TOKEN }}'
                   pattern: '{build/scripts/**/*.min.js,build/styles/**/*.css,build/modules/**/*.min.js}'
                   clean-script: 'distclean'
+                  # Report a check rather than a comment, leaving the size report
+                  # to the unified comment. Not on a fork: its token cannot create
+                  # a check, and the check path, unlike the comment path, does not
+                  # catch that failure.
+                  use-check: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
+
+            - name: Save the size report
+              if: ${{ !cancelled() && steps.size.outputs.comment-body }}
+              env:
+                  # Through the environment, never interpolated into the script.
+                  BODY: ${{ steps.size.outputs.comment-body }}
+              run: |
+                  mkdir -p "${RUNNER_TEMP}/pr-meta"
+                  # Drop the action's own footer, which the unified comment replaces.
+                  printf '%s' "$BODY" | sed '/compressed-size-action<\/sub>/d' > "${RUNNER_TEMP}/pr-meta/body.md"
+
+            - name: Upload the size report
+              if: ${{ !cancelled() && steps.size.outputs.comment-body }}
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+              with:
+                  name: pr-meta--bundle-size
+                  path: ${{ runner.temp }}/pr-meta
+                  if-no-files-found: ignore
+
+    pr-meta:
+        name: Update PR meta comment
+        needs: build
+        # Runs even when the build failed, so a stale size report is cleared.
+        # Skipped on a fork, whose token cannot write a comment.
+        if: ${{ !cancelled() && github.event.pull_request.head.repo.full_name == github.repository }}
+        runs-on: 'ubuntu-24.04'
+        permissions:
+            contents: read
+            pull-requests: write
+        timeout-minutes: 5
+        # Every writer of this comment shares one lock, across workflows. The
+        # default `queue: single` would cancel a pending writer once a third
+        # arrived, silently dropping its section.
+        concurrency:
+            group: pr-meta-${{ github.event.number }}
+            cancel-in-progress: false
+            queue: max
+
+        steps:
+            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+              with:
+                  sparse-checkout: tools/pr-meta
+                  show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
+                  persist-credentials: false
+
+            - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+              continue-on-error: true
+              with:
+                  name: pr-meta--bundle-size
+                  path: pr-meta
+
+            - uses: ./tools/pr-meta
+              with:
+                  repo-token: ${{ secrets.GITHUB_TOKEN }}
+                  section: bundle-size
+                  body-path: pr-meta/body.md
+                  commit-sha: ${{ github.event.pull_request.head.sha }}
+                  run-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

.github/workflows/end2end-test.yml

@@ -139,8 +139,6 @@ jobs:
         runs-on: 'ubuntu-24.04'
         permissions:
             contents: read
-        outputs:
-            has-flaky-test-report: ${{ !!steps.merge-flaky-tests-reports.outputs.artifact-id }}
         steps:
             - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
               with:
@@ -186,40 +184,69 @@ jobs:
                   path: playwright-report
                   if-no-files-found: ignore
 
-    report-to-issues:
-        name: Report to GitHub
-        needs: [merge-artifacts]
-        if: ${{ needs.merge-artifacts.outputs.has-flaky-test-report == 'true' }}
+            # Flaky tests are only reported as a comment on the pull request. The
+            # merge step above only sets `artifact-id` when a report was produced,
+            # so both steps are skipped on runs without any flaky test.
+            - name: Download merged flaky tests report
+              id: download-flaky-tests-report
+              if: ${{ github.event_name == 'pull_request' && steps.merge-flaky-tests-reports.outputs.artifact-id }}
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+              with:
+                  name: flaky-tests-report
+                  path: flaky-tests
+
+            - name: Render the flaky tests report
+              if: ${{ steps.download-flaky-tests-report.outcome == 'success' }}
+              uses: ./packages/report-flaky-tests
+              with:
+                  artifact-path: flaky-tests
+                  output-path: pr-meta/body.md
+
+            - name: Upload the flaky tests report
+              if: ${{ steps.download-flaky-tests-report.outcome == 'success' }}
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+              with:
+                  name: pr-meta--flaky-tests
+                  path: pr-meta
+                  if-no-files-found: ignore
+
+    pr-meta:
+        name: Update PR meta comment
+        needs: merge-artifacts
+        # Runs on every pull request, including the clean ones: a run with no
+        # flaky test uploads no report, and the empty section clears a stale one.
+        # Only when the job above succeeded, though, since a missing report then
+        # means the run was clean rather than that rendering it failed.
+        # Skipped on a fork, whose token cannot write a comment.
+        if: ${{ needs.merge-artifacts.result == 'success' && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
         runs-on: 'ubuntu-24.04'
         permissions:
             contents: read
-            issues: write
             pull-requests: write
+        timeout-minutes: 5
+        # Shared with every other writer of this comment. See bundle-size.yml.
+        concurrency:
+            group: pr-meta-${{ github.event.number }}
+            cancel-in-progress: false
+            queue: max
+
         steps:
-            # Checkout defaults to using the branch which triggered the event, which
-            # isn't necessarily `trunk` (e.g. in the case of a merge).
             - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
               with:
-                  ref: trunk
+                  sparse-checkout: tools/pr-meta
                   show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
                   persist-credentials: false
 
             - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-              # Don't fail the job if there isn't any flaky tests report.
               continue-on-error: true
               with:
-                  name: flaky-tests-report
-                  path: flaky-tests
-
-            - name: Setup Node.js and install dependencies
-              uses: ./.github/setup-node
-
-            - name: Npm build
-              run: npm run build -- --skip-types
+                  name: pr-meta--flaky-tests
+                  path: pr-meta
 
-            - name: Report flaky tests
-              uses: ./packages/report-flaky-tests
+            - uses: ./tools/pr-meta
               with:
-                  repo-token: '${{ secrets.GITHUB_TOKEN }}'
-                  label: '[Type] Flaky Test'
-                  artifact-path: flaky-tests
+                  repo-token: ${{ secrets.GITHUB_TOKEN }}
+                  section: flaky-tests
+                  body-path: pr-meta/body.md
+                  commit-sha: ${{ github.event.pull_request.head.sha }}
+                  run-url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

.github/workflows/enforce-pr-labels.yml

@@ -1,25 +1,89 @@
 name: Enforce labels on Pull Request
 on:
     pull_request_target:
-        types: [labeled, unlabeled, ready_for_review, review_requested]
+        types:
+            [
+                opened,
+                reopened,
+                labeled,
+                unlabeled,
+                ready_for_review,
+                review_requested,
+            ]
 
 # Disable permissions for all available scopes by default.
 # Any needed permissions should be configured at the job level.
 permissions: {}
 
 jobs:
     type-related-labels:
+        name: Check the type label
         runs-on: 'ubuntu-24.04'
         if: ${{ github.event.pull_request.state == 'open' }}
         permissions:
+            contents: read
             pull-requests: write
+        timeout-minutes: 5
+        # Shared with every other writer of this comment. See bundle-size.yml.
+        concurrency:
+            group: pr-meta-${{ github.event.number }}
+            cancel-in-progress: false
+            queue: max
+
         steps:
-            - uses: mheap/github-action-required-labels@0ac283b4e65c1fb28ce6079dea5546ceca98ccbe # v5.5.2
+            # A `pull_request_target` job has a writable token, so it checks out
+            # the base branch it was triggered on, never the pull request's head.
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
-                  mode: exactly
-                  count: 1
-                  labels: '^\[Type\]'
-                  use_regex: true
-                  add_comment: true
-                  message: "**Warning: Type of PR label mismatch**\n\n To merge this PR, it requires {{ errorString }} {{ count }} label indicating the type of PR. Other labels are optional and not being checked here. \n- **Required label**: Any label starting with `[Type]`.\n- **Labels found**: {{ applied }}.\n\nRead more about [Type labels in Gutenberg](https://github.com/WordPress/gutenberg/labels?q=type). Don't worry if you don't have the required permissions to add labels; the PR reviewer should be able to help with the task."
-                  exit_type: failure
+                  sparse-checkout: tools/pr-meta
+                  show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
+                  persist-credentials: false
+
+            - name: Check for a type label
+              id: check
+              env:
+                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                  PR_NUMBER: ${{ github.event.number }}
+                  REPO: ${{ github.repository }}
+              run: |
+                  mkdir -p pr-meta
+
+                  # Read the labels now rather than from the event payload. Runs
+                  # queue behind each other on the shared lock, so an older one
+                  # can arrive after a newer one already fixed the labels.
+                  type_labels="$(gh api "repos/${REPO}/issues/${PR_NUMBER}/labels" \
+                    --jq '[ .[].name | select( startswith( "[Type]" ) ) ]')"
+                  count="$(printf '%s' "$type_labels" | jq 'length')"
+
+                  if [ "$count" -eq 1 ]; then
+                    echo "ok=true" >> "$GITHUB_OUTPUT"
+                    exit 0
+                  fi
+
+                  echo "ok=false" >> "$GITHUB_OUTPUT"
+                  applied="$(printf '%s' "$type_labels" | jq -r 'if length == 0 then "none" else join( ", " ) end')"
+
+                  cat > pr-meta/body.md <<EOF
+                  This pull request needs exactly one label indicating its type, and has ${count}.
+
+                  - Required: any label starting with \`[Type]\`.
+                  - Found: ${applied}.
+
+                  Read more about [Type labels in Gutenberg](https://github.com/WordPress/gutenberg/labels?q=type). If you cannot add labels yourself, a reviewer can do it for you.
+                  EOF
+
+            # Runs whatever the check found, since an empty section is what
+            # clears the warning once the labels are right. Not when the check
+            # itself failed: no body file then means "labels are fine", and a
+            # failed API call would erase a warning nothing had disproved.
+            - name: Report the result
+              if: ${{ !cancelled() && steps.check.outcome == 'success' }}
+              uses: ./tools/pr-meta
+              with:
+                  repo-token: ${{ secrets.GITHUB_TOKEN }}
+                  section: labels
+                  body-path: pr-meta/body.md
+
+            - name: Require exactly one type label
+              if: ${{ steps.check.outputs.ok != 'true' }}
+              run: exit 1

.github/workflows/pull-request-automation.yml

@@ -16,6 +16,10 @@ jobs:
             issues: write
             pull-requests: write
         if: ${{ github.repository == 'WordPress/gutenberg' }}
+        outputs:
+            welcome-prompt: ${{ steps.automation.outputs.welcome-prompt }}
+            account-link-prompt: ${{ steps.automation.outputs.first-time-contributor-prompt }}
+            account-link-pr-number: ${{ steps.automation.outputs.first-time-contributor-pr-number }}
 
         steps:
             # Checkout defaults to using the branch which triggered the event, which
@@ -30,5 +34,71 @@ jobs:
               uses: ./.github/setup-node
 
             - uses: ./packages/project-management-automation
+              id: automation
               with:
                   github_token: ${{ secrets.GITHUB_TOKEN }}
+
+    welcome:
+        name: Welcome a first-time contributor
+        needs: pull-request-automation
+        # Only a pull request opened by a first-time contributor gets a welcome.
+        if: ${{ !cancelled() && needs.pull-request-automation.outputs.welcome-prompt }}
+        runs-on: 'ubuntu-24.04'
+        permissions:
+            contents: read
+            pull-requests: write
+        timeout-minutes: 5
+        # Shared with every other writer of this comment. See bundle-size.yml.
+        concurrency:
+            group: pr-meta-${{ github.event.pull_request.number }}
+            cancel-in-progress: false
+            queue: max
+
+        steps:
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+              with:
+                  ref: trunk
+                  sparse-checkout: tools/pr-meta
+                  show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
+                  persist-credentials: false
+
+            - uses: ./tools/pr-meta
+              with:
+                  repo-token: ${{ secrets.GITHUB_TOKEN }}
+                  section: welcome
+                  body: ${{ needs.pull-request-automation.outputs.welcome-prompt }}
+                  pr-number: ${{ github.event.pull_request.number }}
+
+    account-link:
+        name: Prompt for a WordPress.org profile
+        needs: pull-request-automation
+        # Only a push that merged a first pull request produces a prompt.
+        if: ${{ !cancelled() && needs.pull-request-automation.outputs.account-link-pr-number }}
+        runs-on: 'ubuntu-24.04'
+        permissions:
+            contents: read
+            pull-requests: write
+        timeout-minutes: 5
+        # Shared with every other writer of this comment. See bundle-size.yml.
+        # A push payload has no `github.event.number`, so the pull request comes
+        # from the job above: keying on an empty value would share one lock with
+        # every unrelated push.
+        concurrency:
+            group: pr-meta-${{ needs.pull-request-automation.outputs.account-link-pr-number }}
+            cancel-in-progress: false
+            queue: max
+
+        steps:
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+              with:
+                  ref: trunk
+                  sparse-checkout: tools/pr-meta
+                  show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
+                  persist-credentials: false
+
+            - uses: ./tools/pr-meta
+              with:
+                  repo-token: ${{ secrets.GITHUB_TOKEN }}
+                  section: account-link
+                  body: ${{ needs.pull-request-automation.outputs.account-link-prompt }}
+                  pr-number: ${{ needs.pull-request-automation.outputs.account-link-pr-number }}

.github/workflows/workflow-lint.yml

@@ -9,6 +9,7 @@ on:
             - '.github/workflows/**'
             - '.github/setup-node/action.yml'
             - 'packages/**/action.yml'
+            - 'tools/**/action.yml'
     pull_request:
         branches:
             - trunk
@@ -17,6 +18,7 @@ on:
             - '.github/workflows/**'
             - '.github/setup-node/action.yml'
             - 'packages/**/action.yml'
+            - 'tools/**/action.yml'
     workflow_dispatch:
 
 # Cancels all previous workflow runs for pull requests that have not completed.

backport-changelog/7.1/13398.md

@@ -0,0 +1,3 @@
+https://github.com/WordPress/wordpress-develop/pull/13398
+
+* https://github.com/WordPress/gutenberg/pull/82335