From 33f100cbfbddd059fd3ee2f06e0fc0e6d9710d9f Mon Sep 17 00:00:00 2001
From: Lance Willett <lance.willett@automattic.com>
Date: Mon, 27 Jul 2026 15:43:03 -0700
Subject: [PATCH] Build/Test Tools: Add the missing
 reusable-prepare-gutenberg.yml workflow.

[62859] added the callers of this reusable workflow (phpunit-tests.yml, reusable-phpunit-tests-v3.yml, and test-coverage.yml) but did not add the reusable-prepare-gutenberg.yml file they depend on, so those workflows reference a reusable workflow that does not exist and fail to load. This reddens actionlint and blocks the PHPUnit workflow from starting on trunk.

Add the file: it resolves the Gutenberg build once per run, verifies it (SHA-256 and size), and uploads it as a run artifact the PHPUnit callers consume via the gutenberg-build artifact and the gutenberg-sha output.

Follow-up to [62859].
Props lance.willett@automattic.com.
See #65721.
---
 .../workflows/reusable-prepare-gutenberg.yml  | 60 +++++++++++++++++++
 1 file changed, 60 insertions(+)
 create mode 100644 .github/workflows/reusable-prepare-gutenberg.yml

diff --git a/.github/workflows/reusable-prepare-gutenberg.yml b/.github/workflows/reusable-prepare-gutenberg.yml
new file mode 100644
index 0000000000000..c5e1f904a9680
--- /dev/null
+++ b/.github/workflows/reusable-prepare-gutenberg.yml
@@ -0,0 +1,60 @@
+##
+# A reusable workflow that downloads and verifies the Gutenberg build once per
+# calling workflow run.
+##
+name: Prepare Gutenberg build
+
+on:
+  workflow_call:
+    outputs:
+      gutenberg-sha:
+        description: 'The immutable Gutenberg source SHA verified by this workflow.'
+        value: ${{ jobs.prepare-gutenberg.outputs.gutenberg-sha }}
+
+# Disable permissions for all available scopes by default.
+# Any needed permissions should be configured at the job level.
+permissions: {}
+
+jobs:
+  prepare-gutenberg:
+    name: Gutenberg
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    outputs:
+      gutenberg-sha: ${{ steps.download.outputs.gutenberg-sha }}
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          # Resolve the Gutenberg ref from the exact commit that started this workflow run.
+          ref: ${{ github.sha }}
+          show-progress: ${{ runner.debug == '1' && 'true' || 'false' }}
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: '.nvmrc'
+
+      - name: Download and verify Gutenberg build
+        id: download
+        run: |
+          node tools/gutenberg/download.js
+          gutenberg_sha="$(tr -d '\n' < gutenberg/.gutenberg-hash)"
+          if [[ ! "$gutenberg_sha" =~ ^[a-fA-F0-9]{40}$ ]]; then
+            echo "Expected a 40-character Gutenberg SHA, received: $gutenberg_sha" >&2
+            exit 1
+          fi
+          echo "gutenberg-sha=$gutenberg_sha" >> "$GITHUB_OUTPUT"
+
+      - name: Upload Gutenberg build
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: gutenberg-build
+          path: gutenberg/
+          if-no-files-found: error
+          include-hidden-files: true
+          retention-days: 1