CI: harden and consolidate test workflows

[remyperona]

🤖 This PR was created with the assistance of AI. Review carefully before merging.

Description

Fixes #8692

Implements all five follow-up items from #8692 — reducing duplication, hardening supply-chain security, and cutting CI runtime across the four PHP test workflows and deploy_plugin.yml.

Cross-repo dependency: Item 1 relies on two composite actions in wp-media/workflows (setup-php-composer, setup-wp-tests), referenced at @main. Those must be merged there before this PR is merged. CI on this branch is green against the current @main.

• Item 1 — Extract shared setup (HIGH VALUE, CROSS-REPO): The four test workflows are now thin callers. All common setup (PHP + Composer, WP test-suite install, caching, MySQL auth, problem matchers) moved into two shared composite actions consumed via uses: wp-media/workflows/.github/actions/…@main:
  • setup-php-composer — inputs: php-version, optional coverage (e.g. xdebug), optional extra-require (used for wpackagist-plugin/woocommerce "^7" on Old PHP and phpunit/phpcov on the coverage run).
  • setup-wp-tests — input: wp-version.
    Each workflow now differs only in its matrix and its composer test command(s). This drops ~180 lines of duplication.
• Item 2 — Pin actions to SHAs + Dependabot (SECURITY): actions/checkout (all four workflows + deploy_plugin.yml) and codacy/codacy-coverage-reporter-action (coverage workflow) are pinned to full commit SHAs with version comments; deploy_plugin.yml also pins shivammathur/setup-php and ramsey/composer-install. The remaining third-party actions are now SHA-pinned inside the shared composite actions. Added .github/dependabot.yml with a grouped weekly github-actions update entry targeting develop.
• Item 3 — Cache the WP test suite (PERFORMANCE): Handled in setup-wp-tests — caches the WordPress core + test library keyed on wp-version, and skips the SVN install/download on a cache hit.
• Item 4 — MySQL services: container: Each job now uses a mysql:8.0 service container on 127.0.0.1:3306 (with a health check) instead of the runner's built-in MySQL. The mysql_native_password requirement (for PHP 7.4 mysqli against MySQL 8) is applied inside setup-wp-tests as a post-startup ALTER USER step, so the old init.d start + socket workaround is gone.
• Item 5 — Cleanups: The unused globally-installed phpunit tool is dropped from PHP setup, and apt-get update now precedes the subversion install — both folded into the shared actions.

Type of change

• New feature (non-breaking change which adds functionality).
• Bug fix (non-breaking change which fixes an issue).
• Enhancement (non-breaking change which improves an existing functionality).
• Breaking change (fix or feature that would cause existing functionality to not work as before).
• Sub-task of Follow-up: CI workflow test/deploy enhancements #8692
• Chore
• Release

Detailed scenario

What was tested

This PR's own GitHub Actions runs. All four PHP test workflows are green on the latest commit: WP 5.9/PHP 7.4 (Old PHP), and WP latest across PHP 8.0–8.4 including the xdebug coverage run. Verified that: the shared composite actions resolve and run; the MySQL mysql:8.0 service container is used and the native-password auth succeeds (specifically exercised on PHP 7.4); and the WP test-suite cache produces a hit on re-runs, skipping the SVN install/download.

How to test

Open this PR's Actions tab and confirm the four PHP test workflow runs are green. In a job log, verify the "Setup PHP + Composer" and "Setup WordPress test suite" steps invoke the wp-media/workflows composite actions, the MySQL service container starts under "Initialize containers", and on a second run the test-suite cache reports a hit (SVN install skipped).

Affected Features & Quality Assurance Scope

CI/tooling only. No plugin runtime behavior changes.

Technical description

services.<id>.options maps to docker create flags, so the MySQL server arg --default-authentication-plugin cannot live there; root is instead switched to mysql_native_password via ALTER USER 'root'@'%' over TCP after the container is healthy (with --get-server-public-key for the cold-cache handshake), preserving PHP 7.4 mysqli compatibility. The setup duplication across the four workflows is removed by delegating to composite actions in wp-media/workflows, leaving each workflow with only its matrix and test command(s).

Documentation

n/a

New dependencies

No runtime dependencies. CI now depends on two wp-media/workflows composite actions (setup-php-composer, setup-wp-tests) and SHA-pins all third-party actions; .github/dependabot.yml automates future action bumps.

Risks

• CI/tooling-only; worst case is a workflow misconfiguration that surfaces in this PR's own runs, not in the shipped plugin.
• Cross-repo coupling: the composite actions are referenced at @main; a breaking change there could affect these workflows. Merge order matters — the wp-media/workflows changes must land first.
• Item 4 (MySQL container) was the higher-risk item per Follow-up: CI workflow test/deploy enhancements #8692; it is confirmed green in CI here.
• Cache staleness for latest: the wp-versions: 'latest' workflows key their WP cache on the literal latest, so a newly-released WP core is not re-fetched until the cache key changes. The 5.9 (Old PHP) job is unaffected.

Mandatory Checklist

Code validation

• I validated all the Acceptance Criteria. If possible, provide screenshots or videos.
• I triggered all changed lines of code at least once without new errors/warnings/notices.
• I implemented built-in tests to cover the new/changed code.

Code style

• I wrote a self-explanatory code about what it does.
• I protected entry points against unexpected inputs.
• I did not introduce unnecessary complexity.
• Output messages (errors, notices, logs) are explicit enough for users to understand the issue and are actionnable.

Unticked items justification

Built-in tests are not applicable: the change is GitHub Actions workflow configuration only. The workflows are exercised directly by this PR's own CI runs.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Coverage ∅ diff coverage

Metric	Results
Coverage variation	Report missing for e061b221
Diff coverage	✅ ∅ diff coverage (50.00%)

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (e061b22)	Report Missing	Report Missing	Report Missing
Head commit (02a3b1e)	46713	22380	47.91%

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#8695)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

¹ Codacy didn't receive coverage data for the commit, or there was an error processing the received data. Check your integration for errors and validate that your coverage setup is correct.

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}