Introduce the GitHub Actions Workflow Standards page

[johnbillion]

Work has been ongoing recently to improve the quality and security of GitHub Actions workflow files in the wordpress-develop and gutenberg repos. Examples:

• GitHub Actions workflow hardening gutenberg#69126
• #62221 GitHub Actions workflow hardening wordpress-develop#8007
• Add more workflow file linting with Zizmor wordpress-develop#9767

While the Actionlint and Zizmor tools that we now use are great for surfacing problems in workflow files, we also need good user-facing documentation that provides guidance on addressing common issues and what automation is in place.

Members of the security team have been working on this page and it's already live at https://developer.wordpress.org/coding-standards/wordpress-coding-standards/github-actions/. It now needs to be moved into the docs repo alongside the other pages.

[dingo-d]

I had just one comment, otherwise looks good 👍🏼

[jrfnl]

@johnbillion You seem to be mixing two different tasks in this single PR:

• Adding a new page
• Improving the security of the GH Actions workflow(s) for this repo.

As those are different decision points, with different justifications, could you please move the workflow changes to their own PR ?

[johnbillion]

could you please move the workflow changes to their own PR ?

Done: #161

[desrosj]

@johnbillion some small suggestions. Some may be a bit deeper than you're looking to go in this high-level guide, and some are stylistic preferences.

[rodrigoprimo]

Looks good to me overall. I left a couple of inline comments with questions about small things that caught my attention.

[GaryJones]

Also, the PR body still says "This PR also fixes some issues in the qa.yml workflow file in this repo so it adheres to these standards.", even though that was moved out.

[GaryJones]

The scope is undefined. The doc says “WordPress uses…” then only names wordpress-develop as an enforcement point. Does this apply to Gutenberg? Plugin/theme contributors? The wpcs-docs repo itself? The PR body hints at all of them, but the page should state its scope explicitly — otherwise it’s a guideline dressed as a standard.

[desrosj]

The end goal is to add enforcement of these practices org-wide to ensure all repositories remain secure. But that will take time.

That said, we could maybe add a section linking to the repositories enforcing this to date. Gutenberg runs a workflow, but I don't believe it is configured as a check that is required to pass currently. I could be wrong on that and would need to check.

[GaryJones]

There's a title vs content imbalance here. It's called “GitHub Actions Workflow Standards”, but the substance is almost entirely Zizmor audit findings rephrased. Actionlint gets one paragraph and zero concrete examples. Either rename it to something like “Workflow Security Standards”, or beef up the Actionlint side (common findings, shellcheck guidance, expression typing pitfalls).

For a document presented as the standard, I’d expect at least a mention of:

• timeout-minutes (DoS / runaway jobs)
• Concurrency controls (concurrency: block)
• GITHUB_TOKEN scoping vs PATs
• etc.

[johnbillion]

Yep all fair points.

This document currently focuses on the security aspect of workflows, but in the future I fully expect it to be extended to include timeout-minutes, concurrency, use of reusable workflows, and maybe even use of npx and other software installation and dependency management concerns, but they're all out of scope for this first version.

The current objective is to provide a point of reference for workflow security hardening that repo maintainers can be pointed to.

.