ci(github): add container support for self-hosted runners

.github/workflows/ci.yml

@@ -15,12 +15,15 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }}
   cancel-in-progress: true
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   detect:
     name: Detect Changes
-    runs-on: ubuntu-24.04
+    runs-on: [public-repo]
+    container:
+      image: ubuntu:24.04
     if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
     permissions:
       contents: read
@@ -36,10 +39,16 @@ jobs:
       jest: ${{ steps.filter.outputs.jest }}
 
     steps:
+      - name: Install system dependencies
+        run: |
+          apt-get update
+          apt-get install -y git
+
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
+
+      - name: Configure Git for Safe Directory
+        run: git config --global --add safe.directory "${GITHUB_WORKSPACE}"
 
       - name: Detect file changes
         uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
@@ -138,6 +147,7 @@ jobs:
       contents: read
     strategy:
       fail-fast: false
+      max-parallel: 1
       matrix:
         php: ['8.4', '8.3', '8.2']
         wp: ['latest']
@@ -153,8 +163,8 @@ jobs:
 
   e2e:
     name: E2E Tests
-    needs: detect
-    if: needs.detect.outputs.php == 'true' || needs.detect.outputs.e2e == 'true' || needs.detect.outputs.js == 'true' || needs.detect.outputs.css == 'true'
+    needs: [detect, phpunit]
+    if: needs.detect.result == 'success' && (needs.phpunit.result == 'success' || needs.phpunit.result == 'skipped') && (needs.detect.outputs.php == 'true' || needs.detect.outputs.e2e == 'true' || needs.detect.outputs.js == 'true' || needs.detect.outputs.css == 'true')
     uses: ./.github/workflows/reusable-e2e.yml
     permissions:
       contents: read
@@ -163,6 +173,8 @@ jobs:
 
   build-plugin-zip:
     name: Build Plugin Zip
+    needs: [e2e]
+    if: needs.e2e.result == 'success' || needs.e2e.result == 'skipped'
     permissions:
       contents: read
     uses: ./.github/workflows/reusable-build.yml

.github/workflows/reusable-build.yml

@@ -12,15 +12,42 @@ on:
 
 jobs:
   build:
-    runs-on: ubuntu-24.04
+    runs-on: [public-repo]
+    container:
+      image: ubuntu:24.04
+      options: --user root -v /var/run/docker.sock:/var/run/docker.sock
     permissions:
       contents: read
+
+    env:
+      WP_ENV_PORT: 8889
+      WP_ENV_TESTS_PORT: 8891
+
     steps:
+      - name: Install system dependencies
+        run: |
+          apt-get update
+          apt-get install -y git curl sudo unzip jq
+
+      - name: setup Docker
+        run: |
+          curl -fsSL https://get.docker.com -o get-docker.sh
+          sh get-docker.sh
+
+      - name: Configure Docker group permissions
+        run: |
+          useradd -m wpuser
+          SOCK_GID=$(stat -c '%g' /var/run/docker.sock)
+          groupmod -g $SOCK_GID -o docker
+          usermod -aG docker wpuser
+
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
-          persist-credentials: false
+
+      - name: Configure Git for Safe Directory
+        run: git config --global --add safe.directory "${GITHUB_WORKSPACE}"
 
       - name: Set up PHP
         uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0
@@ -45,15 +72,34 @@ jobs:
       - name: Build plugin for release
         run: npm run build:prod
 
+      - name: Fix wp-env host mapping
+        run: |
+          # Get the host path for the workspace by inspecting the container's own mounts
+          HOST_WORKSPACE_PATH=$(docker inspect $(hostname) --format '{{ range .Mounts }}{{ if eq .Destination "/__w" }}{{ .Source }}{{ end }}{{ end }}')
+
+          # Construct the full host path for the current plugin directory
+          RELATIVE_PATH=$(pwd | sed 's|^/__w||')
+          PLUGIN_HOST_PATH="${HOST_WORKSPACE_PATH}${RELATIVE_PATH}"
+
+          echo "Host Workspace: $HOST_WORKSPACE_PATH"
+          echo "Plugin Host Path: $PLUGIN_HOST_PATH"
+
+          # Update .wp-env.json (default env)
+          jq --arg path "$PLUGIN_HOST_PATH" \
+             'del(.plugins) | .mappings["wp-content/plugins/plugin-skeleton-d"] = $path' \
+             .wp-env.json > .wp-env.json.tmp && mv .wp-env.json.tmp .wp-env.json
+
+          cat .wp-env.json
+
       - name: Start the Docker testing environment
         uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
         with:
           timeout_minutes: 10
           max_attempts: 3
-          command: npm run wp-env start
+          command: sudo -u wpuser env "PATH=$PATH" "WP_ENV_PORT=$WP_ENV_PORT" "WP_ENV_TESTS_PORT=$WP_ENV_TESTS_PORT" npm run wp-env start -- --update
 
       - name: Generate Translation files
-        run: npm run i18n:make-pot
+        run: sudo -u wpuser env "PATH=$PATH" npm run i18n:make-pot
 
       - name: Create plugin zip
         run: npm run plugin-zip
@@ -64,3 +110,7 @@ jobs:
           name: ${{ inputs.artifact-name }}
           path: plugin-skeleton-d.zip
           if-no-files-found: error
+
+      - name: Stop the Docker testing environment
+        if: always()
+        run: sudo -u wpuser env "PATH=$PATH" npm run wp-env destroy -- --force

.github/workflows/reusable-e2e.yml

@@ -8,20 +8,48 @@ on:
         required: true
         type: string
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   e2e:
     name: Playwright E2E Tests
-    runs-on: ubuntu-24.04
+    runs-on: [public-repo]
+    container:
+      image: ubuntu:24.04
+      options: --user root -v /var/run/docker.sock:/var/run/docker.sock
+
     timeout-minutes: 20
 
+    env:
+      WP_ENV_PORT: 8889
+      WP_ENV_TESTS_PORT: 8891
+
     steps:
+      - name: Install system dependencies
+        run: |
+          apt-get update
+          apt-get install -y git curl sudo unzip jq
+
+      - name: setup Docker
+        run: |
+          curl -fsSL https://get.docker.com -o get-docker.sh
+          sh get-docker.sh
+
+      - name: Configure Docker group permissions
+        run: |
+          useradd -m wpuser
+          SOCK_GID=$(stat -c '%g' /var/run/docker.sock)
+          groupmod -g $SOCK_GID -o docker
+          usermod -aG docker wpuser
+
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
-          persist-credentials: false
+
+      - name: Configure Git for Safe Directory
+        run: git config --global --add safe.directory "${GITHUB_WORKSPACE}"
 
       - name: Set up PHP
         uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0
@@ -44,15 +72,38 @@ jobs:
       - name: Build development assets
         run: npm run build:dev
 
+      - name: Fix wp-env host mapping
+        run: |
+          # Get the host path for the workspace by inspecting the container's own mounts
+          HOST_WORKSPACE_PATH=$(docker inspect $(hostname) --format '{{ range .Mounts }}{{ if eq .Destination "/__w" }}{{ .Source }}{{ end }}{{ end }}')
+
+          # Construct the full host path for the current plugin directory
+          RELATIVE_PATH=$(pwd | sed 's|^/__w||')
+          PLUGIN_HOST_PATH="${HOST_WORKSPACE_PATH}${RELATIVE_PATH}"
+
+          echo "Host Workspace: $HOST_WORKSPACE_PATH"
+          echo "Plugin Host Path: $PLUGIN_HOST_PATH"
+
+          # Update .wp-env.test.json
+          jq --arg path "$PLUGIN_HOST_PATH" \
+             'del(.plugins) | .mappings["wp-content/plugins/plugin-skeleton-d"] = $path' \
+             .wp-env.test.json > .wp-env.test.json.tmp && mv .wp-env.test.json.tmp .wp-env.test.json
+
+          cat .wp-env.test.json
+
       - name: Start the Docker testing environment
         uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
         with:
           timeout_minutes: 10
           max_attempts: 3
-          command: WP_ENV_PORT=8889 WP_ENV_TESTS_PORT=8891 npm run wp-env:test start
+          command: sudo -u wpuser env "PATH=$PATH" "WP_ENV_PORT=$WP_ENV_PORT" "WP_ENV_TESTS_PORT=$WP_ENV_TESTS_PORT" npm run wp-env:test start -- --update
+
+      - name: Activate plugin
+        run: |
+          sudo -u wpuser env "PATH=$PATH" npm run wp-env:test run cli -- wp plugin activate plugin-skeleton-d
 
       - name: Run E2E tests
-        run: npm run test:e2e
+        run: sudo -u wpuser env "PATH=$PATH" npm run test:e2e
 
       - name: Upload E2E test results as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
@@ -62,3 +113,7 @@ jobs:
           path: tests/_output
           retention-days: 2
           if-no-files-found: ignore
+
+      - name: Stop the Docker testing environment
+        if: always()
+        run: sudo -u wpuser env "PATH=$PATH" npm run wp-env:test destroy -- --force

.github/workflows/reusable-jest.yml

@@ -9,20 +9,25 @@ on:
         type: boolean
         default: true
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   jest:
     name: Jest Unit Tests${{ inputs.coverage && ' with coverage' || '' }}
-    runs-on: ubuntu-24.04
+    runs-on: [public-repo]
+    container:
+      image: node:22
     timeout-minutes: 10
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
-          persist-credentials: false
+
+      - name: Configure Git for Safe Directory
+        run: git config --global --add safe.directory "${GITHUB_WORKSPACE}"
 
       - name: Setup Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0

.github/workflows/reusable-lint-css-js.yml

@@ -3,20 +3,25 @@ name: Run JS Lint
 on:
   workflow_call:
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   lint-js:
     name: JS Lint & TypeScript
-    runs-on: ubuntu-24.04
+    runs-on: [public-repo]
+    container:
+      image: node:22
     timeout-minutes: 20
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
-          persist-credentials: false
+
+      - name: Configure Git for Safe Directory
+        run: git config --global --add safe.directory "${GITHUB_WORKSPACE}"
 
       - name: Setup Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0

.github/workflows/reusable-phpcs.yml

@@ -8,20 +8,30 @@ on:
         required: true
         type: string
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   phpcs:
     name: PHPCS Coding Standards
-    runs-on: ubuntu-24.04
+    runs-on: [public-repo]
+    container:
+      image: ubuntu:24.04
     timeout-minutes: 20
 
     steps:
+      - name: Install system dependencies
+        run: |
+          apt-get update
+          apt-get install -y git curl sudo unzip
+
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
-          persist-credentials: false
+
+      - name: Configure Git for Safe Directory
+        run: git config --global --add safe.directory "${GITHUB_WORKSPACE}"
 
       - name: Set up PHP
         uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0

.github/workflows/reusable-phpstan.yml

@@ -8,20 +8,30 @@ on:
         required: true
         type: string
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   phpstan:
     name: PHPStan Static Analysis
-    runs-on: ubuntu-24.04
+    runs-on: [public-repo]
+    container:
+      image: ubuntu:24.04
     timeout-minutes: 20
 
     steps:
+      - name: Install system dependencies
+        run: |
+          apt-get update
+          apt-get install -y git curl sudo unzip
+
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
-          persist-credentials: false
+
+      - name: Configure Git for Safe Directory
+        run: git config --global --add safe.directory "${GITHUB_WORKSPACE}"
 
       - name: Set up PHP
         uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0