Merge branch 'main' into fix/remove-github-ssh-key

Author: strangerkir

.github/workflows/wordpress-org-release.yml

@@ -79,7 +79,6 @@ jobs:
             exit 1
           fi
 
-          echo "VALIDATED_PLUGIN_VERSION=$PLUGIN_VERSION" >> $GITHUB_ENV
           echo "✅ Valid WordPress.org version: $PLUGIN_VERSION"
 
           if ! git check-ref-format --allow-onelevel "$GIT_REF"; then
@@ -96,6 +95,8 @@ jobs:
 
       - name: Verify plugin file matches plugin version
         id: plugin_file_version
+        env:
+          PLUGIN_VERSION: ${{ inputs.PLUGIN_VERSION }}
         run: |
           set -euo pipefail
 
@@ -128,29 +129,30 @@ jobs:
 
           echo "README_VERSION=$README_VERSION" >> "$GITHUB_OUTPUT"
 
-          if [ "$VALIDATED_PLUGIN_VERSION" != "$PLUGIN_FILE_VERSION" ]; then
-            echo "❌ Input version ($VALIDATED_PLUGIN_VERSION) does not match $PLUGIN_FILE ($PLUGIN_FILE_VERSION)"
+          if [ "$PLUGIN_VERSION" != "$PLUGIN_FILE_VERSION" ]; then
+            echo "❌ Input version ($PLUGIN_VERSION) does not match $PLUGIN_FILE ($PLUGIN_FILE_VERSION)"
             exit 1
           fi
 
-          echo "✅ Version $VALIDATED_PLUGIN_VERSION is consistent with $PLUGIN_FILE"
+          echo "✅ Version $PLUGIN_VERSION is consistent with $PLUGIN_FILE"
 
       # During a trunk-only sync, Stable tag is expected to still point to an already-published
       # version, not PLUGIN_VERSION - that's checked against SVN's existing tags instead, once
       # the SVN repository is checked out (see "Verify readme points to an existing tag" below).
       - name: Verify readme matches plugin version
         if: inputs.UPDATE_TRUNK_ONLY == false
         env:
+          PLUGIN_VERSION: ${{ inputs.PLUGIN_VERSION }}
           README_VERSION: ${{ steps.plugin_file_version.outputs.README_VERSION }}
         run: |
           set -euo pipefail
 
-          if [ "$VALIDATED_PLUGIN_VERSION" != "$README_VERSION" ]; then
-            echo "❌ Input version ($VALIDATED_PLUGIN_VERSION) does not match readme.txt Stable tag ($README_VERSION)"
+          if [ "$PLUGIN_VERSION" != "$README_VERSION" ]; then
+            echo "❌ Input version ($PLUGIN_VERSION) does not match readme.txt Stable tag ($README_VERSION)"
             exit 1
           fi
 
-          echo "✅ readme.txt Stable tag ($README_VERSION) matches version $VALIDATED_PLUGIN_VERSION"
+          echo "✅ readme.txt Stable tag ($README_VERSION) matches version $PLUGIN_VERSION"
 
       - name: Checkout SVN repository
         env:
@@ -254,9 +256,23 @@ jobs:
           cd "${SVN_REPO_ROOT}/trunk"
           svn status
 
+      - name: Copy trunk to new tag
+        if: inputs.UPDATE_TRUNK_ONLY == false
+        env:
+          PLUGIN_VERSION: ${{ inputs.PLUGIN_VERSION }}
+        run: |
+          set -euo pipefail
+
+          cd "$SVN_REPO_ROOT"
+
+          # Copied locally so it commits together with trunk in a single transaction below.
+          # WordPress.org's plugin SVN maintainer has explicitly discouraged splitting release commits
+          svn copy trunk "tags/${PLUGIN_VERSION}"
+
       - name: Commit changes to SVN repository
         if: inputs.DRY_RUN == false
         env:
+          PLUGIN_VERSION: ${{ inputs.PLUGIN_VERSION }}
           SVN_USERNAME: ${{ secrets.SVN_USERNAME }}
           SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }}
         run: |
@@ -265,42 +281,35 @@ jobs:
           [ -d "$SVN_REPO_ROOT" ] || { echo "❌ SVN_REPO_ROOT not found"; exit 1; }
           cd "$SVN_REPO_ROOT"
 
+          # Commit trunk and the new tag together (when tagging) so WordPress.org never sees
+          # trunk pointing at a Stable tag that doesn't exist yet as a published tag.
+          COMMIT_PATHS=(trunk)
+          COMMIT_MESSAGE="Update trunk to version ${PLUGIN_VERSION}"
+
+          if [ "${{ inputs.UPDATE_TRUNK_ONLY }}" == "false" ]; then
+            COMMIT_PATHS+=("tags/${PLUGIN_VERSION}")
+            COMMIT_MESSAGE="Release version ${PLUGIN_VERSION}"
+          fi
+
           # Do not add -q to grep: it exits on the first match, SIGPIPE-ing svn status mid-write;
           # under pipefail that non-zero exit wins over grep's, which would wrongly report
-          # "No changes in trunk" and abort even when there are real changes to commit.
-          svn status trunk | grep '^[ADMR!~]' >/dev/null || { echo "❌ No changes in trunk"; exit 1; }
+          # "No changes to commit" and abort even when there are real changes to commit.
+          svn status "${COMMIT_PATHS[@]}" | grep '^[ADMR!~]' >/dev/null || { echo "❌ No changes to commit"; exit 1; }
 
           # WordPress.org SVN doesn't support SSH keys or tokens.
           # Keeping credentials as step-level env vars with --no-auth-cache is the best available option.
           echo '🚀 Committing...'
 
-          svn commit trunk \
-            --username "$SVN_USERNAME" \
-            --password "$SVN_PASSWORD" \
-            --no-auth-cache \
-            --non-interactive \
-            -m "Update trunk to version ${VALIDATED_PLUGIN_VERSION}"
-
-      - name: Create a new tag
-        if: inputs.UPDATE_TRUNK_ONLY == false && inputs.DRY_RUN == false
-        env:
-          SVN_USERNAME: ${{ secrets.SVN_USERNAME }}
-          SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }}
-        run: |
-          set -euo pipefail
-          
-          echo "🚀 Publishing version ${VALIDATED_PLUGIN_VERSION}"
-          
-          svn copy \
-            "https://plugins.svn.wordpress.org/${{ inputs.SVN_PLUGIN_SLUG }}/trunk" \
-            "https://plugins.svn.wordpress.org/${{ inputs.SVN_PLUGIN_SLUG }}/tags/${VALIDATED_PLUGIN_VERSION}" \
+          svn commit "${COMMIT_PATHS[@]}" \
             --username "$SVN_USERNAME" \
             --password "$SVN_PASSWORD" \
             --no-auth-cache \
             --non-interactive \
-            -m "Tagging version ${VALIDATED_PLUGIN_VERSION}"
+            -m "$COMMIT_MESSAGE"
 
-          echo "✅ Version ${VALIDATED_PLUGIN_VERSION} was published to WordPress.org"
+          if [ "${{ inputs.UPDATE_TRUNK_ONLY }}" == "false" ]; then
+            echo "✅ Version ${PLUGIN_VERSION} was published to WordPress.org"
+          fi
 
       - name: Compress and upload trunk contents as an artifact
         if: inputs.DRY_RUN == true