Update branch for replacing import in T19

.github/workflows/reusable-phpstan-static-analysis-v1.yml

@@ -21,7 +21,8 @@ permissions: {}
 jobs:
   # Runs PHP static analysis tests.
   #
-  # Violations are reported inline with annotations.
+  # Violations are reported inline with annotations. For pull requests, the results are also uploaded
+  # as an artifact, which the PHPStan Pull Request Comments workflow summarizes in a comment.
   #
   # Performs the following steps:
   # - Checks out the repository.
@@ -31,8 +32,10 @@ jobs:
   # - Make Composer packages available globally.
   # - Builds WordPress.
   # - Configures caching for PHPStan static analysis scans.
-  # - Runs PHPStan static analysis (with Pull Request annotations).
-  # - Checks whether the baselines need regenerating.
+  # - Runs PHPStan static analysis.
+  # - Reports the results as annotations.
+  # - Uploads the results as an artifact (pull requests only).
+  # - Checks for errors that cannot be reported as warnings, such as out-of-date baselines.
   # - Saves the PHPStan result cache.
   # - Ensures version-controlled files are not modified or deleted.
   phpstan:
@@ -43,18 +46,20 @@ jobs:
     timeout-minutes: 20
 
     steps:
+      # For a pull request, the parents of the merge commit are fetched too, to find the files that the base branch
+      # has changed since the pull request branched from it.
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
           persist-credentials: false
+          fetch-depth: ${{ github.event_name == 'pull_request' && 2 || 1 }}
 
       - name: Set up PHP
         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: ${{ inputs.php-version }}
           coverage: none
-          tools: cs2pr
 
       - name: General debug information
         run: |
@@ -98,35 +103,125 @@ jobs:
       - name: Run PHP static analysis tests
         id: phpstan
         run: |
-          # The report is written to a file as well as piped to cs2pr, so that the step below
-          # can look at it.
+          # The report is written to a file for the steps below, which turn it into annotations,
+          # the pull request comment, and a check for errors that cannot be reported as warnings.
+          # Only the report goes to standard output; the debug output goes to standard error, so
+          # it stays in the log without corrupting the JSON.
           #
-          # cs2pr exits successfully so that reported errors annotate the pull request without
-          # failing the run. A pipeline reports only the status of its last command, so that
-          # also discards the status of the analysis itself. Recover it from PIPESTATUS.
-          composer run phpstan -- -vvv --error-format=checkstyle | tee "${RUNNER_TEMP}/phpstan-report.xml" | cs2pr --errors-as-warnings --graceful-warnings
-          status="${PIPESTATUS[0]}"
+          # The step shell exits on the first failing command, which would also end the step on
+          # the status of 1 that PHPStan uses for reporting errors. Capture the status instead.
+          status=0
+          composer run phpstan -- -vvv --error-format=json > "${RUNNER_TEMP}/phpstan-report.json" || status=$?
 
           # PHPStan exits 1 when it has errors to report, which is the expected case here and
-          # is what the annotations are for. Anything higher means it did not finish at all,
-          # which would otherwise pass silently, since the discarded status was the only sign.
+          # is what the annotations are for. Anything higher means it did not finish at all.
           if [ "${status}" -gt 1 ]; then
             echo "::error title=PHPStan did not complete::The analysis exited with status ${status}, so the code was not fully checked. This is a failure of the run itself rather than a problem found in the code."
             exit "${status}"
           fi
 
-      # An ignored error that no longer occurs, or occurs a different number of times, is
-      # reported under an `ignore.*` identifier. That is not something to fix in the code: the
-      # usual cause is that the error *was* fixed, leaving a baseline describing a state that
-      # no longer exists. PHPStan does not allow those reports to be ignored or baselined.
+      # Errors are annotated as warnings, so that they are visible on the pull request without
+      # failing the run. The exception is an error that PHPStan does not allow to be ignored,
+      # such as an out-of-date baseline entry, or one that is not specific to a file. These are
+      # annotated as errors instead, and the run fails on them in the check further below.
       #
-      # The analysis above is reported as warnings, so this would otherwise surface as a
-      # passing run carrying an annotation that reads like a complaint about a fix. Call it
-      # out on its own, and say what to do about it.
+      # The results are also written out for the PHPStan Pull Request Comments workflow, which
+      # runs with the permissions needed to comment on the pull request. Only the facts are
+      # passed along: the comment is composed there, since a pull request can change anything
+      # that runs here.
+      - name: Report the analysis results
+        id: report
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const fs = require( 'fs' );
+
+            const report = JSON.parse( fs.readFileSync( `${ process.env.RUNNER_TEMP }/phpstan-report.json`, 'utf8' ) );
+            const workspace = `${ process.env.GITHUB_WORKSPACE }/`;
+
+            const errors = [];
+            for ( const [ absolutePath, file ] of Object.entries( report.files ) ) {
+              const relativePath = absolutePath.startsWith( workspace ) ? absolutePath.slice( workspace.length ) : absolutePath;
+              for ( const message of file.messages ) {
+                errors.push( {
+                  file: relativePath,
+                  line: message.line ?? null,
+                  message: message.message,
+                  identifier: message.identifier ?? null,
+                  tip: message.tip ?? null,
+                  ignorable: message.ignorable,
+                } );
+              }
+            }
+
+            // Errors that are not specific to a file, such as an `ignoreErrors` entry without a
+            // path that no longer matches. These cannot be ignored either.
+            for ( const message of report.errors ) {
+              errors.push( { file: null, line: null, message, identifier: null, tip: null, ignorable: false } );
+            }
+
+            for ( const error of errors ) {
+              const properties = { title: error.identifier ? `PHPStan: ${ error.identifier }` : 'PHPStan' };
+              if ( error.file ) {
+                properties.file = error.file;
+              }
+              if ( error.line ) {
+                properties.startLine = error.line;
+              }
+              const message = error.tip ? `${ error.message }\n${ error.tip }` : error.message;
+              if ( error.ignorable ) {
+                core.warning( message, properties );
+              } else {
+                core.error( message, properties );
+              }
+            }
+
+            // Tips are left out of the results, since they are only shown in the annotations, next to the code.
+            //
+            // The commit analyzed is the pull request merged into its base branch, whose second parent is the head
+            // commit. The files with errors that differ between the two are those the base branch has changed, in
+            // which the line numbers reported can be off in the head commit.
+            if ( context.eventName === 'pull_request' ) {
+              let changedInBase = [];
+              try {
+                const filesWithErrors = new Set( errors.map( ( error ) => error.file ) );
+                changedInBase = require( 'child_process' )
+                  .execFileSync( 'git', [ 'diff', '--name-only', '--no-renames', 'HEAD^2', 'HEAD' ], { encoding: 'utf8' } )
+                  .split( '\n' )
+                  .filter( ( file ) => filesWithErrors.has( file ) );
+              } catch ( error ) {
+                core.warning( `The files changed in the base branch could not be found: ${ error.message }` );
+              }
+              fs.mkdirSync( `${ process.env.RUNNER_TEMP }/phpstan-results`, { recursive: true } );
+              fs.writeFileSync( `${ process.env.RUNNER_TEMP }/phpstan-results/results.json`, JSON.stringify( {
+                pull_request: context.payload.pull_request.number,
+                changed_in_base: changedInBase,
+                errors: errors.map( ( { tip, ...error } ) => error ),
+              } ) );
+            }
+
+      # Uploads the results for the PHPStan Pull Request Comments workflow, which keeps a comment on the
+      # pull request up to date with them.
+      - name: Upload the analysis results as an artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: ${{ github.event_name == 'pull_request' && steps.report.outcome == 'success' }}
+        with:
+          name: phpstan-results
+          path: ${{ runner.temp }}/phpstan-results/
+
+      # Some errors cannot be ignored, so they cannot be reported as warnings either. Most often
+      # this is an ignored error that no longer occurs, or occurs a different number of times,
+      # which is reported under an `ignore.*` identifier. That is not something to fix in the
+      # code: the usual cause is that the error *was* fixed, leaving a baseline describing a state
+      # that no longer exists.
+      #
+      # Such an error is reported without a line number, so its annotation is not shown alongside
+      # the changes in the pull request, and one that is not specific to a file has nowhere to be
+      # shown at all. A passing run would let it go unnoticed, so fail the run on it instead, and
+      # say what to do about it.
       #
-      # Detection is on the identifier rather than the message, which is prose and may be
-      # reworded in any release. The checkstyle format carries it in the `source` attribute.
-      - name: Check whether the baselines need regenerating
+      # Detection is on PHPStan's own `ignorable` flag rather than on the identifier or message.
+      - name: Check for errors that cannot be reported as warnings
         if: ${{ !cancelled() }}
         env:
           BASELINES_URL: ${{ github.server_url }}/${{ github.repository }}/tree/${{ github.sha }}/tests/phpstan/baselines
@@ -135,28 +230,36 @@ jobs:
           # This step runs even when the analysis above it failed, in which case the report may
           # never have been written. That failure is reported there, so there is nothing to add
           # here beyond staying quiet about a file that was never going to exist.
-          if [ ! -f "${RUNNER_TEMP}/phpstan-report.xml" ]; then
+          report="${RUNNER_TEMP}/phpstan-report.json"
+          if [ ! -f "${report}" ]; then
             exit 0
           fi
 
-          # Leave the run alone unless PHPStan reported an ignore error, because everything
-          # below concerns an ignore configuration that no longer describes the code, and
-          # nothing else. Those errors are `ignore.unmatched`, where a pattern matched nothing
-          # at all, and `ignore.count`, where it matched a different number of times than the
-          # entry records. The `ignore.` prefix is matched rather than those two names so that
-          # any later addition to the group is caught as well.
-          if ! grep -q 'source="ignore\.' "${RUNNER_TEMP}/phpstan-report.xml"; then
+          # Errors that are not specific to a file are listed separately from the rest, and are
+          # never ignorable.
+          unignorable=$( jq '[ .files[].messages[] | select( .ignorable | not ) ] + .errors | length' "${report}" )
+          if [ "${unignorable}" -eq 0 ]; then
             exit 0
           fi
 
+          # Whether the errors include ignore errors decides what to say about them, but not whether to
+          # fail: every error that reaches this point fails the run. Ignore errors concern an ignore
+          # configuration that no longer describes the code. They are `ignore.unmatched`, where a
+          # pattern matched nothing at all, and `ignore.count`, where it matched a different number of
+          # times than the entry records. The `ignore.` prefix is matched rather than those two names
+          # so that any later addition to the group is caught as well. Any other error that cannot be
+          # ignored is something regenerating the baselines would not help with, so it is reported
+          # plainly instead.
+          ignore_errors=$( jq '[ .files[].messages[] | select( .identifier // "" | startswith( "ignore." ) ) ] | length' "${report}" )
+
           # The summary is Markdown, and its code spans and fences are written literally, so the
           # heredoc is quoted to keep the backticks out of the shell's hands. The links are
           # written in reference style for the same reason: the URLs are the only part needing
           # a variable, so defining them afterwards keeps the whole of the prose in here.
           #
           # A newline renders as a line break rather than a space, so each paragraph is one
           # line however long that makes it, and the rendered summary wraps to its own width.
-          cat >> "${GITHUB_STEP_SUMMARY}" <<'SUMMARY'
+          baselines_summary=$( cat <<'SUMMARY'
           ## PHPStan baselines are out of date
 
           An ignored error no longer occurs, or occurs a different number of times, so PHPStan reported it under an `ignore.unmatched` or `ignore.count` identifier.
@@ -182,13 +285,20 @@ jobs:
           See [`tests/phpstan/README.md`][readme] for details.
 
           SUMMARY
+          )
+
+          if [ "${ignore_errors}" -gt 0 ]; then
+            {
+              printf '%s\n\n' "${baselines_summary}"
+              echo "[baselines]: ${BASELINES_URL}"
+              echo "[readme]: ${README_URL}"
+            } >> "${GITHUB_STEP_SUMMARY}"
 
-          {
-            echo "[baselines]: ${BASELINES_URL}"
-            echo "[readme]: ${README_URL}"
-          } >> "${GITHUB_STEP_SUMMARY}"
+            echo "::error title=PHPStan baselines are out of date::An ignored error no longer occurs, or occurs a different number of times. If you fixed it, that is expected: run \`npm run typecheck:php:baselines\` or \`composer phpstan:baselines\` and commit the updated baselines. See ${README_URL}"
+          else
+            echo "::error title=PHPStan reported errors that cannot be ignored::PHPStan reported ${unignorable} error(s) that cannot be ignored or reported as warnings. See the error annotations for details, and ${README_URL} for how to run the analysis locally."
+          fi
 
-          echo "::error title=PHPStan baselines are out of date::An ignored error no longer occurs, or occurs a different number of times. If you fixed it, that is expected: run \`npm run typecheck:php:baselines\` or \`composer phpstan:baselines\` and commit the updated baselines. See ${README_URL}"
           exit 1
 
       - name: "Save result cache"

Gruntfile.js

@@ -531,6 +531,9 @@ module.exports = function(grunt) {
 					[ WORKING_DIR + 'wp-admin/js/language-chooser.js' ]: [ './src/js/_enqueues/lib/language-chooser.js' ],
 					[ WORKING_DIR + 'wp-admin/js/link.js' ]: [ './src/js/_enqueues/admin/link.js' ],
 					[ WORKING_DIR + 'wp-admin/js/media-gallery.js' ]: [ './src/js/_enqueues/deprecated/media-gallery.js' ],
+					[ WORKING_DIR + 'wp-admin/js/media-frame-upload.js' ]: [ './src/js/_enqueues/admin/media-frame-upload.js' ],
+					[ WORKING_DIR + 'wp-admin/js/media-new-upload.js' ]: [ './src/js/_enqueues/admin/media-new-upload.js' ],
+					[ WORKING_DIR + 'wp-admin/js/media-upload-pipeline.js' ]: [ './src/js/_enqueues/admin/media-upload-pipeline.js' ],
 					[ WORKING_DIR + 'wp-admin/js/media-upload.js' ]: [ './src/js/_enqueues/admin/media-upload.js' ],
 					[ WORKING_DIR + 'wp-admin/js/media.js' ]: [ './src/js/_enqueues/admin/media.js' ],
 					[ WORKING_DIR + 'wp-admin/js/nav-menu.js' ]: [ './src/js/_enqueues/lib/nav-menu.js' ],
@@ -697,7 +700,7 @@ module.exports = function(grunt) {
 				src: 'vendor/composer/ca-bundle/res/cacert.pem',
 				dest: SOURCE_DIR + 'wp-includes/certificates/ca-bundle.crt'
 			},
-			// Gutenberg PHP infrastructure files (routes.php, pages.php, constants.php, pages/).
+			// Gutenberg PHP infrastructure files (routes.php, pages.php, constants.php, pages/, core actions, core fields).
 			'gutenberg-php': {
 				options: {
 					process: function( content ) {
@@ -716,6 +719,10 @@ module.exports = function(grunt) {
 						'pages.php',
 						'constants.php',
 						'pages/**/*.php',
+						// The actions Core registers through the entity actions API.
+						'scripts/core-actions/**/*.php',
+						// The fields Core registers through the entity fields API.
+						'scripts/core-fields/**/*.php',
 					],
 					dest: SOURCE_DIR + 'wp-includes/build/',
 				} ],
@@ -1321,6 +1328,9 @@ module.exports = function(grunt) {
 					'src/wp-admin/js/language-chooser.js': 'src/js/_enqueues/lib/language-chooser.js',
 					'src/wp-admin/js/link.js': 'src/js/_enqueues/admin/link.js',
 					'src/wp-admin/js/media-gallery.js': 'src/js/_enqueues/deprecated/media-gallery.js',
+					'src/wp-admin/js/media-frame-upload.js': 'src/js/_enqueues/admin/media-frame-upload.js',
+					'src/wp-admin/js/media-new-upload.js': 'src/js/_enqueues/admin/media-new-upload.js',
+					'src/wp-admin/js/media-upload-pipeline.js': 'src/js/_enqueues/admin/media-upload-pipeline.js',
 					'src/wp-admin/js/media-upload.js': 'src/js/_enqueues/admin/media-upload.js',
 					'src/wp-admin/js/media.js': 'src/js/_enqueues/admin/media.js',
 					'src/wp-admin/js/nav-menu.js': 'src/js/_enqueues/lib/nav-menu.js',

composer.json

@@ -48,7 +48,7 @@
 		"ext-zlib": "*"
 	},
 	"require-dev": {
-		"composer/ca-bundle": "1.5.13",
+		"composer/ca-bundle": "1.6.0",
 		"squizlabs/php_codesniffer": "3.13.5",
 		"wp-coding-standards/wpcs": "~3.4.1",
 		"phpcompatibility/phpcompatibility-wp": "~2.1.3",

package.json

@@ -7,7 +7,7 @@
 		"url": "https://develop.svn.wordpress.org/trunk"
 	},
 	"gutenberg": {
-		"sha": "954fe7f9e04631c41aec4552acd627a7203a2aad",
+		"sha": "be6a50be6834e922b9db12c75c9a2cd817b2db59",
 		"ghcrRepo": "WordPress/gutenberg/gutenberg-wp-develop-build"
 	},
 	"engines": {
@@ -44,6 +44,7 @@
 		"@napi-rs/image": "1.14.0",
 		"@playwright/test": "1.61.1",
 		"@pmmmwh/react-refresh-webpack-plugin": "0.6.2",
+		"@types/backbone": "1.4.23",
 		"@types/codemirror": "5.60.17",
 		"@types/espree": "10.1.0",
 		"@types/htmlhint": "1.1.5",

src/js/_enqueues/admin/link.js

@@ -30,7 +30,7 @@ jQuery( function($) {
 			$(this).attr( 'aria-selected', 'true' ).removeAttr( 'tabindex' );
 			$(this).parent().addClass('tabs').siblings('li').removeClass('tabs');
 			$('.tabs-panel').hide();
-			$(t).show();
+			$( document ).find( t ).show();
 			if ( '#categories-all' == t ) {
 				deleteUserSetting('cats');
 			} else {