Try/build file checks

.github/dependabot.yml

@@ -29,3 +29,101 @@ updates:
       composer-packages:
         patterns:
           - "composer/ca-bundle"
+
+  # Monitor some npm dependencies for updates in groups.
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 50
+    ignore:
+      - dependency-name: "@wordpress/*"
+    groups:
+      ##
+      # Groups for updating devDependencies.
+      ##
+
+      # Dependencies related to Playwright testing (E2E, performance).
+      tests-playwright:
+        patterns:
+          - "*playwright*"
+      # Dependencies related to JavaScript testing with QUnit.
+      tests-qunit:
+        patterns:
+          - "*qunit*"
+          - "sinon*"
+      # Dependencies related to CSS and SASS building and manilupating.
+      dev-css-sass:
+        patterns:
+          - "autoprefixer"
+          # postcss and css related dependencies.
+          - "*css*"
+          - "*sass"
+      # Dependencies related to the Webpack build process.
+      dev-webpack:
+        patterns:
+          - "*webpack*"
+          - "react-refresh"
+          - "source-map-loader"
+      # Dependencies related to the local Docker development environment.
+      dev-docker:
+        patterns:
+          - "dotenv*"
+          - "wait-on"
+      # Dependencies that do not fall into a specific grouping.
+      dev-miscellaneous:
+        patterns:
+          - "chalk"
+          - "check-node-version"
+          - "ink-docstrap"
+          - "install-changed"
+          - "matchdep"
+          - "uuid"
+      # Dependencies related to JavaScript minification.
+      dev-uglify:
+        patterns:
+          - "*uglify*"
+      # All GruntJS related dependencies that do not relate to another group.
+      dev-grunt:
+        patterns:
+          - "*grunt*"
+
+      ##
+      # Groups for updating production dependencies.
+      ##
+
+      # Dependencies related to jQuery and its ecosystem.
+      external-jquery:
+        patterns:
+          - "jquery*"
+      # Dependencies related to React and its ecosystem.
+      external-react:
+        patterns:
+          - "react*"
+          - "!react-refresh"
+      # Dependencies used for bundling polyfill libraries into WordPress.
+      external-polyfills:
+        patterns:
+          - "core-js-url-browser"
+          - "element-closest"
+          - "formdata-polyfill"
+          - "imagesloaded"
+          - "objectFitPolyfill"
+          - "polyfill-library"
+          - "regenerator-runtime"
+          - "whatwg-fetch"
+          - "wicg-inert"
+      # Dependencies related to the Masonry library.
+      external-masonry:
+        patterns:
+          - "masonry-layout"
+      # Dependencies that do not fall into a specific grouping.
+      external-miscellaneous:
+        patterns:
+          - "backbone"
+          - "clipboard"
+          - "hoverintent"
+          - "json2php"
+          - "lodash"
+          - "moment"
+          - "underscore"

.github/workflows/check-built-files.yml

@@ -32,7 +32,7 @@ concurrency:
   # The concurrency group contains the workflow name and the branch name for pull requests
   # or the commit hash for any other events.
   group: ${{ github.workflow }}-${{ github.event_name == 'pull_request_target' && github.head_ref || github.sha }}
-  cancel-in-progress: true
+
 
 # Disable permissions for all available scopes by default.
 # Any needed permissions should be configured at the job level.
@@ -43,9 +43,8 @@ jobs:
     name: Update built files
     permissions:
       contents: write
-    if: ${{ github.repository == 'WordPress/wordpress-develop' }}
-    # This should always reference a version of the workflow committed through SVN and never a local reference.
-    uses: WordPress/wordpress-develop/.github/workflows/reusable-check-built-files.yml@trunk
+    # This should never be changed to use local reference. Always reference the workflow in trunk.
+    uses: desrosj/wordpress-develop/.github/workflows/reusable-check-built-files.yml@trunk
     secrets:
-      GH_APP_ID: ${{ secrets.GH_PR_MANAGEMENT_APP_ID }}
-      GH_APP_PRIVATE_KEY: ${{ secrets.GH_PR_MANAGEMENT_APP_PRIVATE_KEY }}
+      GH_APP_ID: ${{ secrets.GH_APP_ID }}
+      GH_APP_PRIVATE_KEY: ${{ secrets.GH_APP_PRIVATE_KEY }}

.github/workflows/reusable-check-built-files.yml

@@ -29,21 +29,18 @@ jobs:
   # - Builds Emoji files.
   # - Builds bundled Root Certificate files.
   # - Builds WordPress.
-  # - Checks for changes to versioned files.
-  # - Displays the result of git diff for debugging purposes.
   # - Configures the Git author.
+  # - Checks for changes to versioned files.
   # - Stages changes.
   # - Commits changes.
   # - Pushes changes.
   update-built-files:
     name: Check and update built files
     runs-on: ubuntu-24.04
-    # This prevents an unnecessary second run after changes are committed back because Dependabot always rebases
-    # updates and force pushes.
-    if: ${{ github.actor != 'dependabot[bot]' || github.event.commits < 2 }}
-    timeout-minutes: 10
     permissions:
       contents: write
+    # This prevents a second run after changes are committed back because Dependabot always rebases updates onto trunk.
+    if: ${{ github.actor != 'dependabot[bot]' || github.event.commits < 2 }}
     steps:
       - name: Generate Installation Token
         id: generate_token
@@ -59,7 +56,7 @@ jobs:
           private_key = open("private-key.pem", "r").read()
           payload = {
               "iat": int(time.time()),
-              "exp": int(time.time()) + 600,  # 10-minute expiration
+              "exp": int(time.time()) + 60,  # 1-minute expiration
               "iss": $GH_APP_ID
           }
           print(jwt.encode(payload, private_key, algorithm="RS256"))
@@ -130,6 +127,11 @@ jobs:
       - name: Build WordPress
         run: npm run build:dev
 
+      - name: Configure git user name and email
+        run: |
+          git config user.name "dependabot[bot]"
+          git config user.email 49699333+dependabot[bot]@users.noreply.github.com
+
       - name: Check for changes to versioned files
         id: built-file-check
         run: |
@@ -140,15 +142,8 @@ jobs:
           fi
 
       - name: Display changes to versioned files
-        if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }}
         run: git diff
 
-      - name: Configure git user name and email
-        if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }}
-        run: |
-          git config user.name "dependabot[bot]"
-          git config user.email 49699333+dependabot[bot]@users.noreply.github.com
-
       - name: Stage changes
         if: ${{ steps.built-file-check.outputs.uncommitted_changes == 'true' }}
         run: git add .