Internal: Clean up unused GitHub Actions and add permissions check [TMZ-1071]

[Ntnelbaba]

Summary

• Remove legacy publish workflows (publish-beta.yml, publish-patch.yml, publish-release.yml) that were superseded by deploy.yml and no longer wired to anything.
• Remove 7 unused composite actions under .github/actions/ and 11 scripts under .github/scripts/ that were only referenced by the deleted workflows (or already had zero references anywhere in the repo).
• Add .github/workflows/permissions/action.yml, mirroring the composite action used in elementor/elementor. Includes a fix for a substring-match bug in the upstream logic — the actor and permitted list are now wrapped in comma delimiters before grep -F, so a short handle can't match a longer permitted username.
• Wire the permissions action into deploy.yml's validate job (inputs: ENVIRONMENT: prod, DEPLOYMENT_PERMITTED: vars.DEPLOYMENT_PERMITTED_USERS, DEPLOYMENT_REPOSITORY_OWNER: elementor) and drop the inline hardcoded actor allow-list that was previously on the build job.

Jira

TMZ-1071

Test plan

• Run Deploy workflow_dispatch as a user in vars.DEPLOYMENT_PERMITTED_USERS — permissions step passes.
• Run Deploy workflow_dispatch as a user not in the list — permissions step fails with a clear ::error:: message and build/deploy jobs are skipped.
• Confirm no other workflow references any deleted script/action (grep already run locally, but re-verify in CI).

Made with Cursor

✨ PR Description

1. Problem & Context

Centralizes deployment authorization logic into a reusable action and removes hardcoded actor checks, improving maintainability and consistency across workflows (TMZ-1071).

2. What Changed (Where)

• .github/workflows/deploy.yml: Added permissions validation step; removed inline actor allowlist from build job condition
• .github/workflows/permissions/action.yml: New composite action checking user/repo eligibility for deployments
• Removed unused build action file (72 lines)

3. How It Works

Permissions action checks: (1) repo owner matches restriction, (2) environment is dev (auto-pass), (3) actor in comma-separated DEPLOYMENT_PERMITTED list. Validation runs before build job, blocking non-permitted actors from proceeding.

4. Risks

Permissions action only blocks build; deploy still has separate if condition. If both aren't kept in sync, unauthorized actors could theoretically reach deploy. Mitigation: consolidate all auth logic into single validation step.

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Description using Guidelines Learn how}

[github-actions]

Hello Elementor Build

Last updated at: 20260819.1255
Version: 3.4.9

✅ Hello Elementor build is ready for download.

You can download the latest build from the link below:

🔗 hello-elementor.3.4.9.zip

The build is available for 7 days.