Move the failed workflow re-running to a central workflow_run triggered workflow

.github/workflows/coding-standards.yml

@@ -81,35 +81,3 @@ jobs:
       SLACK_GHA_FIXED_WEBHOOK: ${{ secrets.SLACK_GHA_FIXED_WEBHOOK }}
       SLACK_GHA_FAILURE_WEBHOOK: ${{ secrets.SLACK_GHA_FAILURE_WEBHOOK }}
 
-  failed-workflow:
-    name: Failed workflow tasks
-    runs-on: ubuntu-24.04
-    permissions:
-      actions: write
-    needs: [ phpcs, jshint, slack-notifications ]
-    if: |
-      always() &&
-      github.repository == 'WordPress/wordpress-develop' &&
-      github.event_name != 'pull_request' &&
-      github.run_attempt < 2 &&
-      (
-        contains( needs.*.result, 'cancelled' ) ||
-        contains( needs.*.result, 'failure' )
-      )
-
-    steps:
-      - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          retries: 2
-          retry-exempt-status-codes: 418
-          script: |
-            github.rest.actions.createWorkflowDispatch({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: 'failed-workflow.yml',
-              ref: 'trunk',
-              inputs: {
-                run_id: `${context.runId}`,
-              }
-            });

.github/workflows/end-to-end-tests.yml

@@ -88,34 +88,3 @@ jobs:
       SLACK_GHA_FIXED_WEBHOOK: ${{ secrets.SLACK_GHA_FIXED_WEBHOOK }}
       SLACK_GHA_FAILURE_WEBHOOK: ${{ secrets.SLACK_GHA_FAILURE_WEBHOOK }}
 
-  failed-workflow:
-    name: Failed workflow tasks
-    runs-on: ubuntu-24.04
-    permissions:
-      actions: write
-    needs: [ e2e-tests, slack-notifications ]
-    if: |
-      always() &&
-      github.repository == 'WordPress/wordpress-develop' &&
-      github.event_name != 'pull_request' &&
-      github.run_attempt < 2 &&
-      (
-        contains( needs.*.result, 'cancelled' ) ||
-        contains( needs.*.result, 'failure' )
-      )
-    steps:
-      - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          retries: 2
-          retry-exempt-status-codes: 418
-          script: |
-            github.rest.actions.createWorkflowDispatch({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: 'failed-workflow.yml',
-              ref: 'trunk',
-              inputs: {
-                run_id: `${context.runId}`,
-              }
-            });

.github/workflows/failed-workflow.yml

@@ -3,13 +3,39 @@
 ##
 name: Failed Workflow
 
-on:
-  workflow_dispatch:
-    inputs:
-      run_id:
-        description: 'ID of the GitHub Action workflow run to rerun'
-        required: true
-        type: 'string'
+# `workflow_run` workflows run on the default branch with the secrets and token
+# permissions from the default branch of the target repo, not from the branch or
+# fork of the workflow run that triggered the event.
+#
+# The `workflow_run` trigger is safe in this context because:
+#
+# - Pull request events are excluded by the job-level `if` condition, preventing
+#   fork-based privilege escalation.
+# - Permissions are tightly constrained (`permissions: {}`), with only `actions: write`
+#   granted at the job level.
+# - No artifacts are consumed and no user-controlled data is interpolated into
+#   the script. Only workflow run metadata (run_attempt, conclusion, id) is read.
+on: # zizmor: ignore[dangerous-triggers]
+  workflow_run:
+    workflows:
+      - "Code Coverage Report"
+      - "Coding Standards"
+      - "End-to-end Tests"
+      - "Installation Tests"
+      - "JavaScript Tests"
+      - "JavaScript Type Checking"
+      - "Lint GitHub Actions workflow files"
+      - "Local Docker Environment"
+      - "Performance Tests"
+      - "PHP Compatibility"
+      - "PHPStan Static Analysis"
+      - "PHPUnit Tests"
+      - "Test Build Processes"
+      - "Test Default Themes & Create ZIPs"
+      - "Upgrade Develop Version Tests"
+      - "Upgrade Tests"
+    types:
+      - completed
 
 # Disable permissions for all available scopes by default.
 # Any needed permissions should be configured at the job level.
@@ -19,14 +45,21 @@ jobs:
   # Attempts to rerun a workflow.
   #
   # Performs the following steps:
-  # - Retrieves the workflow run that dispatched this workflow.
   # - Restarts all failed jobs when the workflow fails or is cancelled for the first time.
   failed-workflow:
     name: Rerun a workflow
     runs-on: ubuntu-24.04
     permissions:
       actions: write
     timeout-minutes: 30
+    if: |
+      github.repository == 'WordPress/wordpress-develop' &&
+      github.event.workflow_run.event != 'pull_request' &&
+      github.event.workflow_run.run_attempt < 2 &&
+      (
+        github.event.workflow_run.conclusion == 'failure' ||
+        github.event.workflow_run.conclusion == 'cancelled'
+      )
 
     steps:
       - name: Rerun a workflow
@@ -35,22 +68,9 @@ jobs:
           retries: 15
           retry-exempt-status-codes: 418
           script: |
-            const workflow_run = await github.rest.actions.getWorkflowRun({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              run_id: process.env.RUN_ID,
-            });
-
-            // Only rerun after the first run attempt.
-            if ( workflow_run.data.run_attempt > 1 ) {
-              return;
-            }
-
             const rerun = await github.rest.actions.reRunWorkflowFailedJobs({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              run_id: process.env.RUN_ID,
+              run_id: context.payload.workflow_run.id,
               enable_debug_logging: true
             });
-        env:
-          RUN_ID: ${{ inputs.run_id }}

.github/workflows/install-testing.yml

@@ -153,35 +153,3 @@ jobs:
       SLACK_GHA_FIXED_WEBHOOK: ${{ secrets.SLACK_GHA_FIXED_WEBHOOK }}
       SLACK_GHA_FAILURE_WEBHOOK: ${{ secrets.SLACK_GHA_FAILURE_WEBHOOK }}
 
-  failed-workflow:
-    name: Failed workflow tasks
-    runs-on: ubuntu-24.04
-    permissions:
-      actions: write
-    needs: [ slack-notifications ]
-    if: |
-      always() &&
-      github.repository == 'WordPress/wordpress-develop' &&
-      github.event_name != 'pull_request' &&
-      github.run_attempt < 2 &&
-      (
-        contains( needs.*.result, 'cancelled' ) ||
-        contains( needs.*.result, 'failure' )
-      )
-
-    steps:
-      - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          retries: 2
-          retry-exempt-status-codes: 418
-          script: |
-            github.rest.actions.createWorkflowDispatch({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: 'failed-workflow.yml',
-              ref: 'trunk',
-              inputs: {
-                run_id: `${context.runId}`,
-              }
-            });

.github/workflows/javascript-tests.yml

@@ -76,35 +76,3 @@ jobs:
       SLACK_GHA_FIXED_WEBHOOK: ${{ secrets.SLACK_GHA_FIXED_WEBHOOK }}
       SLACK_GHA_FAILURE_WEBHOOK: ${{ secrets.SLACK_GHA_FAILURE_WEBHOOK }}
 
-  failed-workflow:
-    name: Failed workflow tasks
-    runs-on: ubuntu-24.04
-    permissions:
-      actions: write
-    needs: [ slack-notifications ]
-    if: |
-      always() &&
-      github.repository == 'WordPress/wordpress-develop' &&
-      github.event_name != 'pull_request' &&
-      github.run_attempt < 2 &&
-      (
-        contains( needs.*.result, 'cancelled' ) ||
-        contains( needs.*.result, 'failure' )
-      )
-
-    steps:
-      - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          retries: 2
-          retry-exempt-status-codes: 418
-          script: |
-            github.rest.actions.createWorkflowDispatch({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: 'failed-workflow.yml',
-              ref: 'trunk',
-              inputs: {
-                run_id: `${context.runId}`,
-              }
-            });

.github/workflows/javascript-type-checking.yml

@@ -67,35 +67,3 @@ jobs:
       SLACK_GHA_FIXED_WEBHOOK: ${{ secrets.SLACK_GHA_FIXED_WEBHOOK }}
       SLACK_GHA_FAILURE_WEBHOOK: ${{ secrets.SLACK_GHA_FAILURE_WEBHOOK }}
 
-  failed-workflow:
-    name: Failed workflow tasks
-    runs-on: ubuntu-24.04
-    permissions:
-      actions: write
-    needs: [ slack-notifications ]
-    if: |
-      always() &&
-      github.repository == 'WordPress/wordpress-develop' &&
-      github.event_name != 'pull_request' &&
-      github.run_attempt < 2 &&
-      (
-        contains( needs.*.result, 'cancelled' ) ||
-        contains( needs.*.result, 'failure' )
-      )
-
-    steps:
-      - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          retries: 2
-          retry-exempt-status-codes: 418
-          script: |
-            github.rest.actions.createWorkflowDispatch({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: 'failed-workflow.yml',
-              ref: 'trunk',
-              inputs: {
-                run_id: `${context.runId}`,
-              }
-            });

.github/workflows/local-docker-environment.yml

@@ -136,35 +136,3 @@ jobs:
       SLACK_GHA_FIXED_WEBHOOK: ${{ secrets.SLACK_GHA_FIXED_WEBHOOK }}
       SLACK_GHA_FAILURE_WEBHOOK: ${{ secrets.SLACK_GHA_FAILURE_WEBHOOK }}
 
-  failed-workflow:
-    name: Failed workflow tasks
-    runs-on: ubuntu-24.04
-    permissions:
-      actions: write
-    needs: [ build-test-matrix, environment-tests-mysql, slack-notifications ]
-    if: |
-      always() &&
-      github.repository == 'WordPress/wordpress-develop' &&
-      github.event_name != 'pull_request' &&
-      github.run_attempt < 2 &&
-      (
-        contains( needs.*.result, 'cancelled' ) ||
-        contains( needs.*.result, 'failure' )
-      )
-
-    steps:
-      - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          retries: 2
-          retry-exempt-status-codes: 418
-          script: |
-            github.rest.actions.createWorkflowDispatch({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: 'failed-workflow.yml',
-              ref: 'trunk',
-              inputs: {
-                run_id: `${context.runId}`,
-              }
-            });

.github/workflows/performance.yml

@@ -150,35 +150,3 @@ jobs:
       SLACK_GHA_FIXED_WEBHOOK: ${{ secrets.SLACK_GHA_FIXED_WEBHOOK }}
       SLACK_GHA_FAILURE_WEBHOOK: ${{ secrets.SLACK_GHA_FAILURE_WEBHOOK }}
 
-  failed-workflow:
-    name: Failed workflow tasks
-    runs-on: ubuntu-24.04
-    permissions:
-      actions: write
-    needs: [ slack-notifications ]
-    if: |
-      always() &&
-      github.repository == 'WordPress/wordpress-develop' &&
-      github.event_name != 'pull_request' &&
-      github.run_attempt < 2 &&
-      (
-        contains( needs.*.result, 'cancelled' ) ||
-        contains( needs.*.result, 'failure' )
-      )
-
-    steps:
-      - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          retries: 2
-          retry-exempt-status-codes: 418
-          script: |
-            github.rest.actions.createWorkflowDispatch({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: 'failed-workflow.yml',
-              ref: 'trunk',
-              inputs: {
-                run_id: `${context.runId}`,
-              }
-            });

.github/workflows/php-compatibility.yml

@@ -65,35 +65,3 @@ jobs:
       SLACK_GHA_FIXED_WEBHOOK: ${{ secrets.SLACK_GHA_FIXED_WEBHOOK }}
       SLACK_GHA_FAILURE_WEBHOOK: ${{ secrets.SLACK_GHA_FAILURE_WEBHOOK }}
 
-  failed-workflow:
-    name: Failed workflow tasks
-    runs-on: ubuntu-24.04
-    permissions:
-      actions: write
-    needs: [ slack-notifications ]
-    if: |
-      always() &&
-      github.repository == 'WordPress/wordpress-develop' &&
-      github.event_name != 'pull_request' &&
-      github.run_attempt < 2 &&
-      (
-        contains( needs.*.result, 'cancelled' ) ||
-        contains( needs.*.result, 'failure' )
-      )
-
-    steps:
-      - name: Dispatch workflow run
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          retries: 2
-          retry-exempt-status-codes: 418
-          script: |
-            github.rest.actions.createWorkflowDispatch({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              workflow_id: 'failed-workflow.yml',
-              ref: 'trunk',
-              inputs: {
-                run_id: `${context.runId}`,
-              }
-            });