Merge branch 'web-platform-tests:master' into master

.github/dependabot.yml

@@ -0,0 +1,25 @@
+version: 2
+updates:
+- package-ecosystem: github-actions
+  directory: /
+  schedule:
+    interval: weekly
+  open-pull-requests-limit: 1000
+- package-ecosystem: pip
+  directory: docs/
+  schedule:
+    interval: monthly
+  open-pull-requests-limit: 1000
+  # Upgrade sphinx manually only
+  ignore:
+  - dependency-name: "sphinx"
+- package-ecosystem: pip
+  directory: resources/test/
+  schedule:
+    interval: monthly
+  open-pull-requests-limit: 1000
+- package-ecosystem: pip
+  directory: tools/
+  schedule:
+    interval: daily
+  open-pull-requests-limit: 1000

.github/workflows/check-workflow-run.yml

@@ -0,0 +1,55 @@
+name: Check workflow_run
+
+on:
+  workflow_call:
+    inputs:
+      check-refs:
+        description: "Refs to check whether they've been updated"
+        required: true
+        type: string
+    outputs:
+      updated-refs:
+        description: "Refs which have been updated"
+        value: ${{ jobs.check-workflow-run.outputs.output }}
+
+jobs:
+  check-workflow-run:
+    name: "Check for appropriate epochs"
+    if: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' }}
+    runs-on:
+      - ubuntu-22.04
+    permissions:
+      actions: read
+    outputs:
+      output: ${{ steps.check.outputs.updated-refs }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+          sparse-checkout: |
+            tools
+      - uses: actions/download-artifact@v4
+        with:
+          name: git-push-output
+          path: ${{ runner.temp }}/git-push-output
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - id: check
+        run: |
+          {
+              echo 'updated-refs<<EOF'
+              python3 tools/ci/check_for_updated_refs.py
+              echo EOF
+          } >> "$GITHUB_OUTPUT"
+        env:
+          GIT_PUSH_OUTPUT: ${{ runner.temp }}/git-push-output/git-push-output.txt
+          REFS: ${{ inputs.check-refs }}
+
+  check-workflow-run-noop:
+    name: "Check for appropriate epochs (noop)"
+    if: ${{ github.event_name != 'workflow_run' }}
+    runs-on:
+      - ubuntu-22.04
+    steps:
+      - run: exit 0

.github/workflows/docker.yml

@@ -0,0 +1,48 @@
+name: Publish Docker image
+
+permissions: read-all
+
+on:
+  # For initial testing and we can remove it later.
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag for the container image'
+        required: true
+        type: string
+
+jobs:
+  docker-publish:
+    name: Publish Docker image
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    env:
+      REGISTRY: ghcr.io
+      IMAGE_NAME: ${{ github.repository }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
+      # Based on https://docs.github.com/en/actions/publishing-packages/publishing-docker-images.
+      - name: Log in to the Container registry
+        uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4.6.0
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            latest
+            type=raw,value=${{ inputs.tag }}
+      - name: Build and push the Docker image
+        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
+        with:
+          context: ./tools/docker
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/documentation.yml

@@ -14,18 +14,24 @@ on:
       - 'tools/**'
 jobs:
   build-and-publish:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
+    if: github.repository == 'web-platform-tests/wpt'
     steps:
-    - name: Checkout
-      uses: actions/checkout@v1
-      with:
-        fetch-depth: 50
-    - name: Run website_build.sh
-      # Use a conditional step instead of a conditional job to work around #20700.
-      if: github.repository == 'web-platform-tests/wpt'
-      uses: ./tools/docker/documentation
-      env:
-        DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
-      with:
-        entrypoint: /bin/bash
-        args: tools/ci/website_build.sh
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '14'
+      - name: Set up Virtualenv
+        run: pip install virtualenv
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 50
+      - name: Run website_build.sh
+        run: ./tools/ci/website_build.sh
+        env:
+          DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}

.github/workflows/epochs.yml

@@ -6,13 +6,21 @@ on:
     - cron: 10 */3 * * *
 jobs:
   update:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
+    if: github.repository == 'web-platform-tests/wpt'
     steps:
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
     - name: Run epochs_update.sh
-      # Use a conditional step instead of a conditional job to work around #20700.
-      if: github.repository == 'web-platform-tests/wpt'
       run: ./tools/ci/epochs_update.sh
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    - name: Upload git-push output
+      uses: actions/upload-artifact@v4
+      with:
+        name: git-push-output
+        path: ${{ runner.temp }}/git-push-output.txt
+        if-no-files-found: error
+        compression-level: 1

.github/workflows/interfaces.yml

@@ -0,0 +1,32 @@
+name: interfaces
+on:
+  # Trigger at every UTC noon, or manually.
+  schedule:
+    - cron: 0 12 * * *
+  workflow_dispatch:
+jobs:
+  update:
+    runs-on: ubuntu-20.04
+    if: github.repository == 'web-platform-tests/wpt'
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+    - name: Run interfaces_update.sh
+      run: ./tools/ci/interfaces_update.sh
+    - name: Create pull request
+      uses: peter-evans/create-pull-request@v6
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        author: wpt-pr-bot <[email protected]>
+        # env.webref_idl_version is set by interfaces_update.sh
+        title: "Sync interfaces/ with @webref/idl ${{ env.webref_idl_version }}"
+        commit-message: "Sync interfaces/ with @webref/idl ${{ env.webref_idl_version }}"
+        body: |
+          This automated pull request updates interfaces/*.idl from [@webref/idl ${{ env.webref_idl_version }}](https://www.npmjs.com/package/@webref/idl/v/${{ env.webref_idl_version }}).
+
+          Before merging, please check that any tests that depend on the updated IDL files still work. In particular, check for **gray boxes as the wpt.fyi check status**, which usually means that some tests have regressed.
+
+          If additional changes are needed, please manually create another PR based on this one.
+
+          See the [workflow](https://github.com/web-platform-tests/wpt/blob/master/.github/workflows/interfaces.yml) for how this pull request was created, and the [README](https://github.com/web-platform-tests/wpt/blob/master/interfaces/README.md) for how the IDL files in this directory are used.
+        branch: actions/update-idl

.github/workflows/manifest.yml

@@ -8,23 +8,22 @@ on:
       - 'tools/**'
 jobs:
   build-and-tag:
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
+    if: github.repository == 'web-platform-tests/wpt'
     steps:
     - name: Set up Python
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v5
       with:
-        python-version: '3.x'
+        python-version: '3.12'
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@v4
       with:
         fetch-depth: 50
     - name: Install dependencies
       run: |
         sudo apt-get -qqy install zstd
         pip install -r tools/wpt/requirements.txt
     - name: Run manifest_build.py
-      # Use a conditional step instead of a conditional job to work around #20700.
-      if: github.repository == 'web-platform-tests/wpt'
       run: tools/docker/retry.py --delay 60 python tools/ci/manifest_build.py
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/regen_certs.yml

@@ -1,37 +1,34 @@
-name: Regenerate WPT certificates
+name: certificates
 on:
+  # Our certificates are good for ~1 year, but we regenerate them every
+  # month to be sure. Also support manually triggering the workflow.
   schedule:
-    # Our certificates are good for ~1 year, but we regenerate them every
-    # month to be sure.
-    - cron: '0 0 12 * *'
+    - cron: 0 0 12 * *
+  workflow_dispatch:
 jobs:
   update:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
+    if: github.repository == 'web-platform-tests/wpt'
     steps:
     - name: Set up Python
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v5
       with:
-        python-version: '3.x'
+        python-version: '3.12'
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
     - name: Regenerate certs
-      # Use a conditional step instead of a conditional job to work around #20700.
-      if: github.repository == 'web-platform-tests/wpt'
       run: |
         python wpt make-hosts-file | sudo tee -a /etc/hosts
         python wpt regen-certs --force
     - name: Commit and create pull request
-      # Use a conditional step instead of a conditional job to work around #20700.
-      if: github.repository == 'web-platform-tests/wpt'
-      uses: peter-evans/create-pull-request@v2
+      uses: peter-evans/create-pull-request@v6
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
+        author: wpt-pr-bot <[email protected]>
         commit-message: Automated regeneration of WPT certificates
         title: Regenerate WPT certificates
         body: |
           This automated pull request renews the core WPT certificates.
 
-          Pull request auto-generated by [create-pull-request][1]
-
-          [1]: https://github.com/peter-evans/create-pull-request
+          See the [workflow](https://github.com/web-platform-tests/wpt/blob/master/.github/workflows/regen_certs.yml) for how this pull request was created.
         branch: actions/regen-certs