Commit b13fe2d5b09 for woocommerce
commit b13fe2d5b09fe6df7541f702ed5ef5881c928e0a
Author: Jorge A. Torres <jorge.torres@automattic.com>
Date: Wed Aug 26 14:05:52 2026 +0100
Automate bumping the security-support minimum version (#67745)
diff --git a/.github/workflows/release-new-release-published.yml b/.github/workflows/release-new-release-published.yml
index b7df7f434e0..e85935f3f1d 100644
--- a/.github/workflows/release-new-release-published.yml
+++ b/.github/workflows/release-new-release-published.yml
@@ -147,3 +147,82 @@ jobs:
--reviewer "${{ github.actor }}" \
--label "Release" \
--milestone "$milestone"
+
+ bump-min-security-support-version:
+ name: 'Bump the minimum security-support version after a new major release'
+ runs-on: ubuntu-latest
+ if: ${{ github.event.action == 'published' && endsWith(inputs.release_tag_name, '.0') }}
+ permissions:
+ contents: write
+ pull-requests: write
+ steps:
+ - name: 'Checkout trunk'
+ uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+ with:
+ ref: trunk
+ sparse-checkout: |
+ /docs/contribution/releases/security-support.md
+ sparse-checkout-cone-mode: false
+
+ - name: 'Bump the minimum security-support version and open a PR'
+ env:
+ RELEASE_TAG: ${{ inputs.release_tag_name }}
+ GH_TOKEN: ${{ secrets.WC_BOT_PR_CREATE_TOKEN || secrets.GITHUB_TOKEN }}
+ GH_REPO: ${{ github.repository }}
+ run: |
+ # This job only runs for tag X.Y.0 (see the job-level `if`). The minimum
+ # supported version always sits 2.0 behind it (e.g. 11.0 -> 9.0).
+ main_version="${RELEASE_TAG%.0}"
+ min_version=$(echo "$main_version - 2.0" | bc)
+
+ file="docs/contribution/releases/security-support.md"
+ current_version=$(grep -oP '(?<=current stable WooCommerce version is )[0-9]+\.[0-9]+' "$file")
+
+ if [[ -z "$current_version" ]]; then
+ echo "::error::Could not find the currently documented version in $file. The sentence this automation matches on may have changed - update this workflow."
+ exit 1
+ fi
+
+ # Guard against a delayed or replayed release event moving the version backwards.
+ if [[ "$main_version" == "$current_version" ]] || ! printf '%s\n%s\n' "$current_version" "$main_version" | sort -C -V; then
+ echo "$file already reflects $current_version, which is not older than $main_version. Nothing to do."
+ exit 0
+ fi
+
+ sed -i -E "s/(current stable WooCommerce version is )[0-9]+\.[0-9]+(, that means version \*\*)[0-9]+\.[0-9]+( and newer\*\*)/\1$main_version\2$min_version\3/" "$file"
+
+ if ! grep -q "current stable WooCommerce version is $main_version, that means version \*\*$min_version and newer\*\*" "$file"; then
+ echo "::error::Could not update the minimum supported version in $file. The sentence this automation matches on may have changed - update the sed pattern in this workflow."
+ exit 1
+ fi
+
+ git config --global user.name "woocommercebot"
+ git config --global user.email "woocommercebot@users.noreply.github.com"
+
+ # Branch name hardcoded (per release) to avoid duplicate PRs on reruns.
+ branch_name="bump-min-security-support-version-$RELEASE_TAG"
+ git checkout -b "$branch_name"
+ git commit --all --message "Bump the minimum security-support version to $min_version"
+ git push --force origin "$branch_name"
+
+ pr_title="Bump the minimum security-support version to $min_version"
+ pr_body="WooCommerce $main_version just shipped, so per the [security patch support policy](https://developer.woocommerce.com/docs/contribution/releases/security-support/) (last 21 major versions) the minimum supported version bumps to **$min_version**.
+
+ ---
+ _Auto-generated by the \`release-new-release-published.yml\` workflow after $RELEASE_TAG was published._"
+
+ # Update the PR if one is already open for this branch, otherwise create it.
+ pr_number=$(gh pr list --head "$branch_name" --json number --jq '.[0].number' 2>/dev/null || echo "")
+
+ if [[ -n "$pr_number" ]]; then
+ gh pr edit "$pr_number" --title "$pr_title" --body "$pr_body"
+ else
+ gh pr create \
+ --title "$pr_title" \
+ --body "$pr_body" \
+ --base trunk \
+ --head "$branch_name" \
+ --reviewer "${{ github.actor }}" \
+ --label "Release" \
+ --milestone "$RELEASE_TAG"
+ fi
diff --git a/.linear/release-kickoff-patch.md b/.linear/release-kickoff-patch.md
index 542cf5bf14c..7a9f3678d58 100644
--- a/.linear/release-kickoff-patch.md
+++ b/.linear/release-kickoff-patch.md
@@ -62,7 +62,6 @@ For scheduled releases, the readiness review is the one in the RC sub-issue. Poi
- [ ] Run workflow **[Release: Update stable tag]({repository_url}/actions/workflows/release-update-stable-tag.yml)**: enter `{release_version}` as _Version_ and make sure to check 'I confirm that I want to update the stable tag (this will update the SVN and GitHub stable tags).'
- [ ] Publish the `{release_version}` [release draft]({repository_url}/releases) that was previously created, as well as any other `{release_main_version}` drafts that might exist from previous attempts. **Ensure** that "Set as the latest release" is checked for `{release_version}`.
-- [ ] If this is the stable release of a new major version: move the supported-version floor forward in the [security support policy](https://developer.woocommerce.com/docs/contribution/releases/security-support/) page (last 21 major versions).
### 7. Post-release tasks
diff --git a/docs/contribution/releases/security-support.md b/docs/contribution/releases/security-support.md
index 0a8feb6c68c..96a95237964 100644
--- a/docs/contribution/releases/security-support.md
+++ b/docs/contribution/releases/security-support.md
@@ -26,4 +26,4 @@ Security vulnerabilities must be reported privately through Automattic's HackerO
## Keeping this page current
-The release run-book's publish steps include moving the supported-version floor forward when the stable release of a new major version ships.
+When the stable release of a new major version is published, an automated workflow opens a pull request that bumps the minimum supported version on this page. The release DRI reviews and merges it as part of the post-release tasks.
diff --git a/docs/contribution/releases/workflows.md b/docs/contribution/releases/workflows.md
index d728997f7ba..1bd10895e9a 100644
--- a/docs/contribution/releases/workflows.md
+++ b/docs/contribution/releases/workflows.md
@@ -46,7 +46,7 @@ These workflows are triggered automatically by GitHub events such as pull reques
| Workflow | Trigger | What it does |
| -------- | ------- | ------------ |
-| [Release: Release events proxy](https://github.com/woocommerce/woocommerce/blob/trunk/.github/workflows/release-release-events-proxy.yml) | Release published or prereleased | Delegates to [`release-new-release-published`](https://github.com/woocommerce/woocommerce/blob/trunk/.github/workflows/release-new-release-published.yml) to run post-release actions: sends Slack notifications, updates the global changelog for stable releases, and calls *Generate Number of Commits and Contributors* for beta releases. |
+| [Release: Release events proxy](https://github.com/woocommerce/woocommerce/blob/trunk/.github/workflows/release-release-events-proxy.yml) | Release published or prereleased | Delegates to [`release-new-release-published`](https://github.com/woocommerce/woocommerce/blob/trunk/.github/workflows/release-new-release-published.yml) to run post-release actions: sends Slack notifications, updates the global changelog for stable releases, bumps the minimum [security-support](/docs/contribution/releases/security-support) version when the release is the first of a new major version, and calls *Generate Number of Commits and Contributors* for beta releases. |
| [Release checks run](https://github.com/woocommerce/woocommerce/blob/trunk/.github/workflows/tests-on-release.yml) | Release published or edited | Runs the CI test suite against published releases. Also runs nightly on a schedule. |
## Manual workflows