Build/test tools: run test-old-branches on the security mirror (checks only, no Slack)

[lancewillett]

Trac ticket: https://core.trac.wordpress.org/ticket/64893

Summary

test-old-branches.yml restricts its dispatch job to github.repository == 'WordPress/wordpress-develop', so it only runs on the canonical public repository. This extends that one guard to also allow the private security mirror (WordPress/wordpress-develop-security), so backport branches there get the same cross-branch test coverage. The Slack notification job is deliberately left public-only, so the mirror runs the tests without posting to the public channel. The public repository's behavior is unchanged.

Why

Security backport branches are prepared on the private mirror, which shares this workflow file but is excluded by the repo-name guard. As a result the suite never runs across old branches there, and a missed backport can ship without a red test. Enabling the dispatch job closes that gap; the per-branch results are visible as checks without a Slack alert.

Guard expression

Two options enable a private mirror: the explicit repository name (used here) or github.event.repository.private. test-old-branches.yml runs on pushes to trunk that change its workflow files, twice-monthly schedules, and manual workflow_dispatch events. Because github.event.repository is not reliably populated on schedule events, the explicit-name form is used for reliability. Happy to switch to the private-flag form if preferred.

Testing

• actionlint passes on the changed workflow.
• git diff --check passes.
• The change is limited to the dispatch job's if: guard; the Slack notification job's guard is untouched.
• The public repository's guard clause is unchanged, so canonical CI is unaffected.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props lancewillett.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[Copilot]

Pull request overview

Updates the test-old-branches.yml GitHub Actions workflow guard conditions so it runs not only on the public WordPress/wordpress-develop repository, but also on the private security mirror WordPress/wordpress-develop-security, enabling the same cross-branch coverage for security backport branches.

Changes:

• Expand the repository-name if: guard on dispatch-workflows-for-old-branches to allow the security mirror.
• Expand the repository-name if: guard on slack-notifications to allow the security mirror (while preserving the existing pull_request exclusion and always() behavior).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[adimoldovan]

test-old-branches.yml dispatches other workflows and each has their own guard:

• coding-standards.yml#L58
• javascript-tests.yml#L61
• phpunit-tests.yml#L70
• test-build-processes.yml#L57
• php-compatibility.yml#L50
• end-to-end-tests.yml#L65
• performance.yml#L59

All still github.repository == 'WordPress/wordpress-develop'

Those guards need updating too, but in a separate PR — test-old-branches.yml only exists on trunk, while the dispatched workflows live on every branch:

1. This PR — trunk only, nothing to backport.
2. Follow-up — the seven workflows above, on trunk + backported to 7.0…4.7.

[adimoldovan]

We probably don't want it to run on push and schedule in the mirror repo.

Suggested change

	if: ${{ github.repository == 'WordPress/wordpress-develop' || github.repository == 'WordPress/wordpress-develop-security' }}
	if: ${{ github.repository == 'WordPress/wordpress-develop' || ( github.repository == 'WordPress/wordpress-develop-security' && github.event_name == 'workflow_dispatch' )