feat(ci): install wp-tooling from npm by Adi-ty · Pull Request #48 · rtCamp/wp-shared-workflows

Adi-ty · 2026-10-06T11:46:58Z

What this PR does

Switches the wp-tooling install from a pinned git SHA to the published @rtcamp/wp-tooling npm package, and adopts the CLI's new --strict flag.

Closes

N/A

Changes

wp-tooling-ref now takes an npm version or range instead of a git SHA; the input name is unchanged, so v1 callers keep working.
Install runs from npm with the same job-local prefix: npm install --prefix "$RUNNER_TEMP/wp-tooling" "@rtcamp/wp-tooling@$VERSION".
Empty input resolves to ^2, so 2.x fixes reach consumers without a bump PR here.
Prefix stays outside the checkout so a consumer's .npmrc cannot redirect @rtCamp; npx would read it and 404. Do not simplify this step to npx.
detect-changes now passes --strict: a failed git diff exits 1 instead of reporting zero changes; the old stderr grep is removed.
AGENTS.md updated: duplicated-SHA note replaced with "both default to ^2".

How I verified

bin/check-workflows.sh, actionlint and yamllint all pass.

- @rtcamp/wp-tooling is on the registry, so the CLI installs from npm instead of github:rtCamp/wp-tooling#<sha>. wp-tooling-ref keeps its name but takes an npm version or range; empty falls back to ^2 in the install step, so 2.x fixes reach consumers without a bump PR here. A caller that pinned the old SHA gets a clear npm error. - The --prefix install stays on purpose: it moves npm's project root out of the checkout, so a consumer's .npmrc cannot redirect @rtCamp (npx would read it and 404). - detect-changes gains --strict: a failed git diff exits 1 (wp-tooling 2.0.0) instead of reporting zero changes and skipping every job, replacing the stderr grep in this step.

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

Review effort: Lite
Findings: 2

Open (2)

Same concern as in version-monitor.yml: dropping --ignore-scripts changes the trust boundary by… · New
Previously installation used --ignore-scripts, but the npm-based install no longer does. This is… · New

What changed in this PR

Updates CI workflows to install wp-tooling from the published @rtcamp/wp-tooling npm package (instead of a pinned Git SHA) and makes change detection fail-fast by using the CLI’s --strict flag.

Changes:

wp-tooling-ref input now represents an npm version/range (defaulting to ^2 when empty) across workflows.
Install step now runs npm install --prefix "$RUNNER_TEMP/wp-tooling" "@rtcamp/wp-tooling@$VERSION" and adds that prefix’s bin to PATH.
detect-changes now uses --strict and removes stderr-grep-based failure detection; docs updated accordingly.

File	Description
AGENTS.md	Updates guidance to reflect the new `^2` default behavior across workflows.
.github/workflows/wp-ci.yml	Rewords `wp-tooling-ref` input semantics and changes default to empty (implying `^2`).
.github/workflows/version-monitor.yml	Switches wp-tooling installation to npm and changes defaulting logic to `^2`.
.github/workflows/ci-detect-changes.yml	Switches wp-tooling installation to npm, adds `--strict`, and removes stderr parsing workaround.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

-          npm install --ignore-scripts --no-audit --no-fund --prefix "$prefix" \
-            "github:rtCamp/wp-tooling#${WP_TOOLING_REF}"
-          echo "$prefix/node_modules/.bin" >> "$GITHUB_PATH"
+          npm install --no-audit --no-fund --prefix "$RUNNER_TEMP/wp-tooling" "@rtcamp/wp-tooling@$WP_TOOLING_VERSION"


-          npm install --ignore-scripts --no-audit --no-fund --prefix "$prefix" \
-            "github:rtCamp/wp-tooling#${WP_TOOLING_REF}"
-          echo "$prefix/node_modules/.bin" >> "$GITHUB_PATH"
+          npm install --no-audit --no-fund --prefix "$RUNNER_TEMP/wp-tooling" "@rtcamp/wp-tooling@$WP_TOOLING_VERSION"


Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

6 open findings

This change makes wp-tooling-ref an npm version/range, but it also removes the ability to pass a… · New
Passing --strict unconditionally will fail the workflow if a caller sets wp-tooling-ref to a… · New
Passing --strict unconditionally will fail the workflow if a caller sets wp-tooling-ref to a… · New
Installing from a semver range (default ^2) makes runs non-reproducible over time, which can… · New
Previously installation used --ignore-scripts, but the npm-based install no longer does. This is…
Same concern as in version-monitor.yml: dropping --ignore-scripts changes the trust boundary by…

🧠 Review effort: Lite

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

-          npm install --ignore-scripts --no-audit --no-fund --prefix "$prefix" \
-            "github:rtCamp/wp-tooling#${WP_TOOLING_REF}"
-          echo "$prefix/node_modules/.bin" >> "$GITHUB_PATH"
+          npm install --ignore-scripts --no-audit --no-fund --prefix "$RUNNER_TEMP/wp-tooling" "@rtcamp/wp-tooling@$WP_TOOLING_VERSION"


        run: |
          set -euo pipefail
-          args=(--output github --include-files)
+          args=(--strict --output github --include-files)


-            exit 1
-          fi
-          exit "$status"
+          wp-tooling detect-changes "${args[@]}"


-          npm install --ignore-scripts --no-audit --no-fund --prefix "$prefix" \
-            "github:rtCamp/wp-tooling#${WP_TOOLING_REF}"
-          echo "$prefix/node_modules/.bin" >> "$GITHUB_PATH"
+          npm install --ignore-scripts --no-audit --no-fund --prefix "$RUNNER_TEMP/wp-tooling" "@rtcamp/wp-tooling@$WP_TOOLING_VERSION"


Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

10 open findings

Changing wp-tooling-ref from a git SHA/ref to a semver version/range is a breaking behavior… · New
With --strict, failures now correctly exit non-zero, but the previous implementation emitted a… · New
With --strict, failures now correctly exit non-zero, but the previous implementation emitted a… · New
npm ls can exit non-zero for conditions that may not indicate a broken install (commonly peer… · New
Installing from a semver range (default ^2) makes runs non-reproducible over time, which can…
Passing --strict unconditionally will fail the workflow if a caller sets wp-tooling-ref to a…
Passing --strict unconditionally will fail the workflow if a caller sets wp-tooling-ref to a…
This change makes wp-tooling-ref an npm version/range, but it also removes the ability to pass a…
Previously installation used --ignore-scripts, but the npm-based install no longer does. This is…
Same concern as in version-monitor.yml: dropping --ignore-scripts changes the trust boundary by…

🧠 Review effort: Lite

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

+          WP_TOOLING_VERSION: ${{ inputs.wp-tooling-ref || '^2' }}
        run: |
          set -euo pipefail
-          prefix="$RUNNER_TEMP/wp-tooling"
-          npm install --ignore-scripts --no-audit --no-fund --prefix "$prefix" \
-            "github:rtCamp/wp-tooling#${WP_TOOLING_REF}"
-          echo "$prefix/node_modules/.bin" >> "$GITHUB_PATH"
+          npm install --ignore-scripts --no-audit --no-fund --prefix "$RUNNER_TEMP/wp-tooling" "@rtcamp/wp-tooling@$WP_TOOLING_VERSION"


        run: |
          set -euo pipefail
-          args=(--output github --include-files)
+          args=(--strict --output github --include-files)


-            exit 1
-          fi
-          exit "$status"
+          wp-tooling detect-changes "${args[@]}"


-            "github:rtCamp/wp-tooling#${WP_TOOLING_REF}"
-          echo "$prefix/node_modules/.bin" >> "$GITHUB_PATH"
+          npm install --ignore-scripts --no-audit --no-fund --prefix "$RUNNER_TEMP/wp-tooling" "@rtcamp/wp-tooling@$WP_TOOLING_VERSION"
+          npm ls --prefix "$RUNNER_TEMP/wp-tooling" @rtcamp/wp-tooling


Adi-ty marked this pull request as ready for review October 6, 2026 11:49

Adi-ty requested review from AnuragVasanwala and a balanced review from Copilot October 6, 2026 11:49

Copilot AI reviewed Oct 6, 2026

View reviewed changes

fix(ci): install wp-tooling with --ignore-scripts

515bb1f

Copilot AI balanced review requested due to automatic review settings October 8, 2026 05:23

Copilot AI reviewed Oct 8, 2026

View reviewed changes

fix(ci): log the installed wp-tooling version

ebc4e39

Copilot AI balanced review requested due to automatic review settings October 8, 2026 06:07

Copilot AI reviewed Oct 8, 2026

View reviewed changes

Navigation Menu

Repository navigation

feat(ci): install wp-tooling from npm - #48

feat(ci): install wp-tooling from npm#48
Adi-ty wants to merge 3 commits into
mainfrom
fix/wp-tooling-from-npm

Adi-ty commented Oct 6, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Adi-ty commented Oct 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Closes

Changes

How I verified

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Adi-ty commented Oct 6, 2026 •

edited

Loading