ci(github): add container support for self-hosted runners

.github/workflows/README.md

@@ -6,26 +6,28 @@ Workflows are defined to be reusable and modular.
 
 Main CI pipeline used to validate code. Based on file changes it calls the following reusable workflows:
 
-| Reusable Workflow                       | What                                      |
-| --------------------------------------- | ----------------------------------------- |
-| `reusable-phpcs.yml`                    | PHPCS linting                             |
-| `reusable-phpstan.yml`                  | PHPStan static analysis                   |
-| `reusable-phpunit.yml`                  | PHPUnit tests                             |
-| `reusable-lint-css-js.yml`              | ESlint, Stylelint, Prettier, tsc linting  |
-| `reusable-jest.yml`                     | Jest tests                                |
-| `reusable-e2e.yml`                      | Playwright end-to-end tests               |
-| `reusable-build.yml`                    | Creates a build zip (used by playground)  |
-| `reusable-wp-playground-pr-preview.yml` | PR preview environment with wp-playground |
-
-### `copilot-setup-steps.yml`
+| Reusable Workflow                                                                                                                                                                        | What                                      |
+| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- |
+| [`reusable-phpcs.yml`](.reusable-phpcs.yml) <br /> [`reusable-phpcs-public.yml`](.reusable-phpcs-public.yml)                                                                             | PHPCS linting                             |
+| [`reusable-phpstan.yml`](.reusable-phpstan.yml) <br /> [`reusable-phpstan-public.yml`](.reusable-phpstan-public.yml)                                                                     | PHPStan static analysis                   |
+| [`reusable-phpunit.yml`](.reusable-phpunit.yml) <br /> [`reusable-phpunit-public.yml`](.reusable-phpunit-public.yml)                                                                     | PHPUnit tests                             |
+| [`reusable-lint-css-js.yml`](.reusable-lint-css-js.yml) <br /> [`reusable-lint-css-js-public.yml`](.reusable-lint-css-js-public.yml)                                                     | ESlint, Stylelint, Prettier, tsc linting  |
+| [`reusable-jest.yml`](.reusable-jest.yml) <br /> [`reusable-jest-public.yml`](.reusable-jest-public.yml)                                                                                 | Jest tests                                |
+| [`reusable-e2e.yml`](.reusable-e2e.yml) <br /> [`reusable-e2e-public.yml`](.reusable-e2e-public.yml)                                                                                     | Playwright end-to-end tests               |
+| [`reusable-build.yml`](.reusable-build.yml) <br /> [`reusable-build-public.yml`](.reusable-build-public.yml)                                                                             | Creates a build zip (used by playground)  |
+| [`reusable-wp-playground-pr-preview.yml`](.reusable-wp-playground-pr-preview.yml) <br /> [`reusable-wp-playground-pr-preview-public.yml`](.reusable-wp-playground-pr-preview-public.yml) | PR preview environment with wp-playground |
+
+Reusable workflows have a `-public` variant which is used for public GitHub runners. The non-public variants are used for rtCamp's private runners. Ensure that `ci.yml` points to the correct workflows you need, and delete the others.
+
+### [`copilot-setup-steps.yml`](copilot-setup-steps.yml)
 
 Sets up dev environment for GitHub Copilot coding agent.
 
-### `pr-title.yml`
+### [`pr-title.yml`](pr-title.yml)
 
 Triggers on PRs. Validates [Conventional Commit](https://www.conventionalcommits.org/en/v1.0.0/) format, required for release-please automation.
 
-### `release.yml`
+### [`release.yml`](release.yml)
 
 Triggers on push to `main`. Uses [release-please](https://github.com/googleapis/release-please) to automate releases based on conventional commits.
 
@@ -38,9 +40,9 @@ When a release is created, it builds the plugin via `reusable-build.yml` and upl
 
 ### Secrets
 
-| Secret          | Required By                                 | Notes                                                |
-| --------------- | ------------------------------------------- | ---------------------------------------------------- |
-| `CODECOV_TOKEN` | `reusable-phpunit.yml`, `reusable-jest.yml` | Optional — coverage uploads fail silently without it |
+| Secret          | Required By                                                    | Notes                                                |
+| --------------- | -------------------------------------------------------------- | ---------------------------------------------------- |
+| `CODECOV_TOKEN` | `reusable-phpunit-public.yml` <br />`reusable-jest-public.yml` | Optional — coverage uploads fail silently without it |
 
 ### PR Previews
 
@@ -72,7 +74,3 @@ act workflow_dispatch \
 	-s GITHUB_TOKEN=your_github_token_here \
 	-P ubuntu-24.04=catthehacker/ubuntu:act-latest
 ```
-
-## Private Runners
-
-@todo

.github/workflows/ci.yml

@@ -15,12 +15,14 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }}
   cancel-in-progress: true
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   detect:
     name: Detect Changes
-    runs-on: ubuntu-24.04
+    # Use `ubuntu-24.04` on public repositories.
+    runs-on: ubuntu-latest
     if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
     permissions:
       contents: read
@@ -38,8 +40,9 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
+        # Comment this out on private repositories to allow sharing of credentials with subsequent jobs.
+        # with:
+        #  persist-credentials: false
 
       - name: Detect file changes
         uses: dorny/paths-filter@9d7afb8d214ad99e78fbd4247752c4caed2b6e4c # v4.0.0
@@ -50,17 +53,24 @@ jobs:
               - '**.php'
               - 'composer.*'
             phpcs:
-              - '.phpcs.xml.dist'
+              - '.github/workflows/ci.yml'
               - '.github/workflows/reusable-phpcs.yml'
+              - '.phpcs.xml.dist'
             phpstan:
-              - 'phpstan.neon.dist'
+              - '.github/workflows/ci.yml'
               - '.github/workflows/reusable-phpstan.yml'
+              - 'phpstan.neon.dist'
             phpunit:
+              - '.github/workflows/ci.yml'
+              - '.github/workflows/reusable-phpunit.yml'
               - 'tests/**/*.php'
               - 'phpunit.xml.dist'
-              - '.github/workflows/reusable-phpunit.yml'
               - 'package*.json'
+              - '.wp-env.test.json'
             js:
+              - '.github/workflows/ci.yml'
+              - '.github/workflows/reusable-lint-css-js.yml'
+              - '.nvmrc'
               - '**.cjs'
               - '**.js'
               - '**.jsx'
@@ -70,32 +80,38 @@ jobs:
               - '**.ts'
               - '**.tsx'
               - 'package*.json'
-              - '.eslintrc*'
               - 'tsconfig*.json'
             css:
               - '**.css'
               - '**.scss'
+              - '.editorconfig'
+              - '.browserslistrc'
               - '.stylelintignore'
-              - '.stylelintrc*'
+              - '.stylelint.config.js'
             e2e:
-              - 'tests/e2e/**/*'
+              - '.github/workflows/ci.yml'
               - '.github/workflows/reusable-e2e.yml'
+              - 'tests/e2e/**/*'
+              - 'playwright.config.ts'
             jest:
+              - '.github/workflows/ci.yml'
+              - '.github/workflows/reusable-jest.yml'
               - 'tests/js/**/*'
               - 'src/**/__tests__/**/*'
               - 'src/**/*.test.ts'
               - 'src/**/*.test.tsx'
               - 'src/**/*.spec.ts'
               - 'src/**/*.spec.tsx'
               - 'jest.config.js'
-              - '.github/workflows/reusable-jest.yml'
               - 'package*.json'
+              - '.wp-env.test.json'
 
   phpcs:
     name: PHPCS
     needs: detect
     if: needs.detect.outputs.php == 'true' || needs.detect.outputs.phpcs == 'true'
     uses: ./.github/workflows/reusable-phpcs.yml
+    # uses: ./.github/workflows/reusable-phpcs-public.yml
     permissions:
       contents: read
     with:
@@ -106,6 +122,7 @@ jobs:
     needs: detect
     if: needs.detect.outputs.php == 'true' || needs.detect.outputs.phpstan == 'true'
     uses: ./.github/workflows/reusable-phpstan.yml
+    # uses: ./.github/workflows/reusable-phpstan-public.yml
     permissions:
       contents: read
     with:
@@ -116,6 +133,7 @@ jobs:
     needs: detect
     if: needs.detect.outputs.css == 'true' || needs.detect.outputs.js == 'true'
     uses: ./.github/workflows/reusable-lint-css-js.yml
+    # uses: ./.github/workflows/reusable-lint-css-js-public.yml
     permissions:
       contents: read
 
@@ -124,20 +142,24 @@ jobs:
     needs: detect
     if: needs.detect.outputs.js == 'true' || needs.detect.outputs.jest == 'true'
     uses: ./.github/workflows/reusable-jest.yml
+    # uses: ./.github/workflows/reusable-jest-public.yml
     permissions:
       contents: read
     with:
       coverage: true
 
   phpunit:
     name: PHPUnit (PHP ${{ matrix.php }}, WP ${{ matrix.wp }})
-    needs: detect
+    needs: [detect, build-plugin-zip]
     if: needs.detect.outputs.php == 'true' || needs.detect.outputs.phpunit == 'true'
     uses: ./.github/workflows/reusable-phpunit.yml
+    # uses: ./.github/workflows/reusable-phpunit-public.yml
     permissions:
       contents: read
     strategy:
       fail-fast: false
+      # Uncomment this on private runners, which can't run multiple wp-env instances in parallel.
+      max-parallel: 1
       matrix:
         php: ['8.4', '8.3', '8.2']
         wp: ['latest']
@@ -153,9 +175,11 @@ jobs:
 
   e2e:
     name: E2E Tests
-    needs: detect
+    # needs: detect
+    needs: phpunit
     if: needs.detect.outputs.php == 'true' || needs.detect.outputs.e2e == 'true' || needs.detect.outputs.js == 'true' || needs.detect.outputs.css == 'true'
     uses: ./.github/workflows/reusable-e2e.yml
+    # uses: ./.github/workflows/reusable-e2e-public.yml
     permissions:
       contents: read
     with:
@@ -166,6 +190,7 @@ jobs:
     permissions:
       contents: read
     uses: ./.github/workflows/reusable-build.yml
+    # uses: ./.github/workflows/reusable-build-public.yml
     with:
       php-version: '8.2'
       artifact-name: plugin-skeleton-d-pr${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}
@@ -176,6 +201,7 @@ jobs:
     needs: build-plugin-zip
     if: github.event_name == 'pull_request'
     uses: ./.github/workflows/reusable-wp-playground-pr-preview.yml
+    # uses: ./.github/workflows/reusable-wp-playground-pr-preview-public.yml
     permissions:
       actions: read
       contents: write

.github/workflows/reusable-build-public.yml

@@ -0,0 +1,66 @@
+name: Reusable Build
+
+on:
+  workflow_call:
+    inputs:
+      php-version:
+        required: true
+        type: string
+      artifact-name:
+        required: true
+        type: string
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
+          persist-credentials: false
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0
+        with:
+          php-version: ${{ inputs.php-version }}
+          coverage: none
+
+      - name: Install Composer dependencies
+        uses: ramsey/composer-install@a35c6ebd3d08125aaf8852dff361e686a1a67947 # v3.2.0
+        with:
+          composer-options: '--no-dev --optimize-autoloader'
+
+      - name: Setup Node.js
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - name: Build plugin for release
+        run: npm run build:prod
+
+      - name: Start the Docker testing environment
+        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+        with:
+          timeout_minutes: 10
+          max_attempts: 3
+          command: npm run wp-env start
+
+      - name: Generate Translation files
+        run: npm run i18n:make-pot
+
+      - name: Create plugin zip
+        run: npm run plugin-zip
+
+      - name: Upload plugin zip artifact
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: ${{ inputs.artifact-name }}
+          path: plugin-skeleton-d.zip
+          if-no-files-found: error