Request: Do not update plugin-check silently without a new version of this action

[marekdedic]

Hi,
I am using this action to run plugin-check on my WP plugin repos. However, if I understand it correctly, this action upgrades (i.e. uses the latest) plugin-check without a new version release to this action.

Why this is a problem:

• On December 27, plugin-check released version 1.8.0, which brings in a lot of new checks
• However, the direct_file_access check has some significant omissions - in my case Improve direct_file_access check to ignore class-only files plugin-check#1146
• Because the action just uses the latest version of plugin-check, all my PRs have been failing CI since Dec 27.

I don't really see any good way out of this - I can:

1. Just live with broken CI for 2 months and going
2. Disable this action until plugin-check fixes the issues and hope I remember to re-enable it afterwards

...neither of which is a good option. I have dependabot set up, so all my dependency updates fail CI and I have to review them manually.

If this action pinned the plugin-check version it uses (and bump versions with new plugin-check versions), the problem would be solved - I could just postpone the update of plugin-check, make the upgrade when I have the bandwidth to deal with it and when it works the way I need. The current state is a much worse DX.

Just to make sure - I'm not complaining about plugin-check not implementing WordPress/plugin-check#1146 right away. Issues happen, sometimes they take longer to sort out, that's okay. But I'd like to not be forced to deal with the issue (or just the update itself, even if it's completely fine, it can still take time to update) the second a new version is available.

[swissspidy]

I'll think about pinning the version.

I don't really see any good way out of this - I can:

1. Just live with broken CI for 2 months and going
2. Disable this action until plugin-check fixes the issues and hope I remember to re-enable it afterwards

...neither of which is a good option. I have dependabot set up, so all my dependency updates fail CI and I have to review them manually.

You're missing the most obvious third option3:

Configure the action to disable the checks for your plugin as per the documentation

You can use ignore-codes, exclude-files, exlude-directories, and exclude-checks, whatever works best for your plugin.

[marekdedic]

You are right, disabling the "offending" checks is a much gentler alternative to disabling the whole plugin-check. I'll look into it, thanks!

I still think breaking users' CI silently is not a great UX and having the upgrade be an actual upgrade (which I believe in the age of dependabot is reasonable) would be much nicer than one day waking up and having to turn off all new checks until you have the time to solve the new issues properly (which you should, but sometimes it can be a non-trivial amount of work and you want to schedule it)