Build/Test Tools: Backport GitHub Action and build improvements to the 4.1 branch.

This backports several build and test tool improvements to the 4.1 branch. Most notably, this includes:

- The changes required to allow each workflow to be triggered by the `workflow_dispatch` event so that tests can be run on a schedule [50590].
- Splitting single site and multisite tests into parallel jobs [50379].
- Split slow tests into separate, parallel jobs for PHP <= 5.6 [50444].
- Better branch and path scoping for GitHub Action workflows when running on `pull_request` [50432,50479].
- Several `devDependency` updates.

Merges [50379,50387,50416,50432,50435-50436,50444,50446,50473-50474,50476,50479,50485-50487,50545,50590] to the 4.1 branch.
See #50401, #51801, #51802, #52548, #52612, #52624, #52625, #52645, #52653, #52658, #52660, #52667.

git-svn-id: https://develop.svn.wordpress.org/branches/4.1@50643 602fd350-edb4-49c9-b593-d223f7449a82

10 files changed, 363 insertions, 211 deletions

diff --git a/.github/workflows/coding-standards.yml b/.github/workflows/coding-standards.yml
index 218142ffed..a3a69d34ea 100644
--- a/.github/workflows/coding-standards.yml
+++ b/.github/workflows/coding-standards.yml
@@ -1,17 +1,38 @@
 name: Coding Standards
 
 on:
+  # JSHint was introduced in WordPress 3.8.
+  # PHPCS checking was introduced in WordPress 5.1.
   push:
     branches:
       - master
-      # JSHint was introduced in WordPress 3.8.
-      # PHPCS checking was introduced in WordPress 5.1.
+      - trunk
       - '3.[89]'
       - '[4-9].[0-9]'
     tags:
       - '3.[89]*'
       - '[4-9].[0-9]*'
   pull_request:
+    branches:
+      - master
+      - trunk
+      - '3.[89]'
+      - '[4-9].[0-9]'
+    paths:
+      # Any change to a PHP or JavaScript file should run checks.
+      - '**.js'
+      - '**.php'
+      # These files configure NPM. Changes could affect the outcome.
+      - 'package*.json'
+      # These files configure Composer. Changes could affect the outcome.
+      - 'composer.*'
+      # This file configures JSHint. Changes could affect the outcome.
+      - '.jshintrc'
+      # This file configures PHPCS. Changes could affect the outcome.
+      - 'phpcs.xml.dist'
+      # Changes to workflow files should always verify all workflows are successful.
+      - '.github/workflows/*.yml'
+  workflow_dispatch:
 
 jobs:
   # Runs the JavaScript coding standards checks.
@@ -36,7 +57,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
 
       - name: Log debug information
         run: |
@@ -46,20 +67,18 @@ jobs:
           svn --version
 
       - name: Install NodeJS
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@46071b5c7a2e0c34e49c3cb8a0e792e86e18d5ea # v2.1.5
         with:
           node-version: 14
 
       - name: Cache NodeJS modules
-        uses: actions/cache@v2
+        uses: actions/cache@26968a09c0ea4f3e233fdddbafd1166051a095f6 # v2.1.4
         env:
           cache-name: cache-node-modules
         with:
           # npm cache files are stored in `~/.npm` on Linux/macOS
           path: ~/.npm
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-npm-
 
       - name: Log debug information
         run: |
@@ -67,7 +86,7 @@ jobs:
           node --version
 
       - name: Install Dependencies
-        run: npx install-changed --install-command="npm ci"
+        run: npm ci
 
       - name: Run JSHint
         run: npm run grunt jshint
diff --git a/.github/workflows/end-to-end-tests.yml b/.github/workflows/end-to-end-tests.yml
index f895e9c3f6..0a59c51a4c 100644
--- a/.github/workflows/end-to-end-tests.yml
+++ b/.github/workflows/end-to-end-tests.yml
@@ -1,16 +1,23 @@
 name: End-to-end Tests
 
 on:
+  # The end to end test suite was introduced in WordPress 5.3.
   push:
     branches:
       - master
-      # The end to end test suite was introduced in WordPress 5.3.
+      - trunk
       - '5.[3-9]'
       - '[6-9].[0-9]'
     tags:
       - '5.[3-9]*'
       - '[6-9].[0-9]*'
   pull_request:
+    branches:
+      - master
+      - trunk
+      - '5.[3-9]'
+      - '[6-9].[0-9]'
+  workflow_dispatch:
 
 env:
   LOCAL_DIR: build
@@ -42,9 +49,7 @@ jobs:
     steps:
       - name: Cancel previous runs of this workflow (pull requests only)
         if: ${{ github.event_name == 'pull_request' }}
-        uses: styfle/cancel-workflow-action@0.5.0
-        with:
-          access_token: ${{ github.token }}
+        uses: styfle/cancel-workflow-action@3d86a7cc43670094ac248017207be0295edbc31d # v0.8.0
 
       - name: Configure environment variables
         run: |
@@ -52,7 +57,7 @@ jobs:
           echo "PHP_FPM_GID=$(id -g)" >> $GITHUB_ENV
 
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
 
       - name: Log debug information
         run: |
@@ -66,23 +71,21 @@ jobs:
           locale -a
 
       - name: Install NodeJS
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@46071b5c7a2e0c34e49c3cb8a0e792e86e18d5ea # v2.1.5
         with:
           node-version: 14
 
       - name: Cache NodeJS modules
-        uses: actions/cache@v2
+        uses: actions/cache@26968a09c0ea4f3e233fdddbafd1166051a095f6 # v2.1.4
         env:
           cache-name: cache-node-modules
         with:
           # npm cache files are stored in `~/.npm` on Linux/macOS
           path: ~/.npm
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-npm-
 
       - name: Install Dependencies
-        run: npx install-changed --install-command="npm ci"
+        run: npm ci
 
       - name: Build WordPress
         run: npm run build
diff --git a/.github/workflows/javascript-tests.yml b/.github/workflows/javascript-tests.yml
index 31dc88fe3e..0bf9f5a461 100644
--- a/.github/workflows/javascript-tests.yml
+++ b/.github/workflows/javascript-tests.yml
@@ -1,16 +1,36 @@
 name: JavaScript Tests
 
 on:
+  # JavaScript testing was introduced in WordPress 3.8.
   push:
     branches:
       - master
-      # JavaScript testing was introduced in WordPress 3.8.
+      - trunk
       - '3.[89]'
       - '[4-9].[0-9]'
     tags:
       - '3.[89]*'
       - '[4-9].[0-9]*'
   pull_request:
+    branches:
+      - master
+      - trunk
+      - '3.[89]'
+      - '[4-9].[0-9]'
+    paths:
+      # Any change to a JavaScript file should run tests.
+      - '**.js'
+      # These files configure NPM. Changes could affect the outcome.
+      - 'package*.json'
+      # This file configures ESLint. Changes could affect the outcome.
+      - '.eslintignore'
+      # This file configures JSHint. Changes could affect the outcome.
+      - '.jshintrc'
+      # Any change to the QUnit directory should run tests.
+      - 'tests/qunit/**'
+      # Changes to workflow files should always verify all workflows are successful.
+      - '.github/workflows/*.yml'
+  workflow_dispatch:
 
 jobs:
   # Runs the QUnit tests for WordPress.
@@ -33,12 +53,10 @@ jobs:
     steps:
       - name: Cancel previous runs of this workflow (pull requests only)
         if: ${{ github.event_name == 'pull_request' }}
-        uses: styfle/cancel-workflow-action@0.5.0
-        with:
-          access_token: ${{ github.token }}
+        uses: styfle/cancel-workflow-action@3d86a7cc43670094ac248017207be0295edbc31d # v0.8.0
 
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
 
       - name: Log debug information
         run: |
@@ -48,20 +66,18 @@ jobs:
           svn --version
 
       - name: Install NodeJS
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@46071b5c7a2e0c34e49c3cb8a0e792e86e18d5ea # v2.1.5
         with:
           node-version: 14
 
       - name: Cache NodeJS modules
-        uses: actions/cache@v2
+        uses: actions/cache@26968a09c0ea4f3e233fdddbafd1166051a095f6 # v2.1.4
         env:
           cache-name: cache-node-modules
         with:
           # npm cache files are stored in `~/.npm` on Linux/macOS
           path: ~/.npm
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-npm-
 
       - name: Log debug information
         run: |
@@ -69,7 +85,7 @@ jobs:
           node --version
 
       - name: Install Dependencies
-        run: npx install-changed --install-command="npm ci"
+        run: npm ci
 
       - name: Run QUnit tests
         run: npm run grunt qunit:compiled
diff --git a/.github/workflows/php-compatibility.yml b/.github/workflows/php-compatibility.yml
index d213c2612f..78b63abccf 100644
--- a/.github/workflows/php-compatibility.yml
+++ b/.github/workflows/php-compatibility.yml
@@ -1,16 +1,32 @@
 name: PHP Compatibility
 
 on:
+  # PHP compatibility testing was introduced in WordPress 5.5.
   push:
     branches:
       - master
-      # The PHP compatibility testing was introduced in WordPress 5.5.
+      - trunk
       - '5.[5-9]'
       - '[6-9].[0-9]'
     tags:
       - '5.[5-9]*'
       - '[6-9].[0-9]*'
   pull_request:
+    branches:
+      - master
+      - trunk
+      - '5.[5-9]'
+      - '[6-9].[0-9]'
+    paths:
+      # This workflow only scans PHP files.
+      - '**.php'
+      # These files configure Composer. Changes could affect the outcome.
+      - 'composer.*'
+      # This file configures PHP Compatibility scanning. Changes could affect the outcome.
+      - 'phpcompat.xml.dist'
+      # Changes to workflow files should always verify all workflows are successful.
+      - '.github/workflows/*.yml'
+  workflow_dispatch:
 
 jobs:
 
@@ -34,10 +50,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@afefcaf556d98dc7896cca380e181decb609ca44 # v2.10.0
         with:
           php-version: '7.4'
           coverage: none
@@ -49,7 +65,7 @@ jobs:
           composer --version
 
       - name: Install Composer dependencies
-        uses: ramsey/composer-install@v1
+        uses: ramsey/composer-install@92a7904348d4ad30236f3611e33b7f0c6f9edd70 # v1.1.0
         with:
           composer-options: "--no-progress --no-ansi --no-interaction"
 
diff --git a/.github/workflows/phpunit-tests.yml b/.github/workflows/phpunit-tests.yml
index 1634abc2d7..801e8b020d 100644
--- a/.github/workflows/phpunit-tests.yml
+++ b/.github/workflows/phpunit-tests.yml
@@ -4,12 +4,19 @@ on:
   push:
     branches:
       - master
+      - trunk
       - '3.[7-9]'
       - '[4-9].[0-9]'
     tags:
       - '3.[7-9]*'
       - '[4-9].[0-9]*'
   pull_request:
+    branches:
+      - master
+      - trunk
+      - '3.[7-9]'
+      - '[4-9].[0-9]'
+  workflow_dispatch:
   # Once weekly On Sundays at 00:00 UTC.
   schedule:
     - cron: '0 0 * * 0'
@@ -43,12 +50,10 @@ jobs:
     steps:
       - name: Cancel previous runs of this workflow (pull requests only)
         if: ${{ github.event_name == 'pull_request' }}
-        uses: styfle/cancel-workflow-action@0.5.0
-        with:
-          access_token: ${{ github.token }}
+        uses: styfle/cancel-workflow-action@3d86a7cc43670094ac248017207be0295edbc31d # v0.8.0
 
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
 
       - name: Log debug information
         run: |
@@ -64,35 +69,33 @@ jobs:
           locale -a
 
       - name: Install NodeJS
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@46071b5c7a2e0c34e49c3cb8a0e792e86e18d5ea # v2.1.5
         with:
           node-version: 14
 
       - name: Cache NodeJS modules
-        uses: actions/cache@v2
+        uses: actions/cache@26968a09c0ea4f3e233fdddbafd1166051a095f6 # v2.1.4
         env:
           cache-name: cache-node-modules
         with:
           # npm cache files are stored in `~/.npm` on Linux/macOS
           path: ~/.npm
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-npm-
 
       - name: Install Dependencies
-        run: npx install-changed --install-command="npm ci"
+        run: npm ci
 
       - name: Build WordPress
         run: npm run build
 
       - name: Create ZIP artifact
-        uses: thedoctor0/zip-release@0.4.1
+        uses: thedoctor0/zip-release@a1afcab9c664c9976ac398fa831eac67bed1eb0e # v0.4.1
         with:
           filename: built-wp-${{ github.sha }}.zip
           exclusions: '*.git* /*node_modules/* packagehash.txt'
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@e448a9b857ee2131e752b06002bf0e093c65e571 # v2.2.2
         with:
           name: built-wp-${{ github.sha }}
           path: built-wp-${{ github.sha }}.zip
@@ -124,32 +127,48 @@ jobs:
   # - Submit the test results to the WordPress.org host test results.
   # - todo: Configure Slack notifications for failing tests.
   test-php:
-    name: ${{ matrix.php }}${{ matrix.memcached && ' with memcached' || '' }} on ${{ matrix.os }}
+    name: ${{ matrix.php }}${{ matrix.multisite && ' multisite' || '' }}${{ matrix.split_slow && ' slow tests' || '' }} ${{ matrix.memcached && ' with memcached' || '' }} on ${{ matrix.os }}
     needs: setup-wordpress
     runs-on: ${{ matrix.os }}
     strategy:
+      fail-fast: false
       matrix:
-        php: [ '5.6' ]
-        phpunit: [ '4-php-5.6' ]
+        php: [ '5.3', '5.4', '5.5' ]
         os: [ ubuntu-latest ]
+        split_slow: [ false, true ]
+        multisite: [ false, true ]
         memcached: [ false ]
         include:
-          - php: '5.5'
-            phpunit: '5.5'
+          - php: '5.6'
+            phpunit: '4-php-5.6'
+            os: ubuntu-latest
+            split_slow: false
+            multisite: false
+            memcached: false
+          - php: '5.6'
+            phpunit: '4-php-5.6'
             os: ubuntu-latest
+            split_slow: false
+            multisite: true
             memcached: false
-          - php: '5.4'
-            phpunit: '5.4'
+          - php: '5.6'
+            phpunit: '4-php-5.6'
             os: ubuntu-latest
+            split_slow: true
+            multisite: false
             memcached: false
-          - php: '5.3'
-            phpunit: '5.3'
+          - php: '5.6'
+            phpunit: '4-php-5.6'
             os: ubuntu-latest
+            split_slow: true
+            multisite: true
             memcached: false
     env:
       LOCAL_PHP: ${{ matrix.php }}-fpm
-      LOCAL_PHPUNIT: ${{ matrix.phpunit }}-fpm
+      LOCAL_PHPUNIT: ${{ matrix.phpunit && matrix.phpunit || matrix.php }}-fpm
       LOCAL_PHP_MEMCACHED: ${{ matrix.memcached }}
+      PHPUNIT_CONFIG: ${{ matrix.multisite && 'tests/phpunit/multisite.xml' || 'phpunit.xml.dist' }}
+      SLOW_TESTS: 'external-http,media'
 
     steps:
       - name: Configure environment variables
@@ -158,7 +177,7 @@ jobs:
           echo "PHP_FPM_GID=$(id -g)" >> $GITHUB_ENV
 
       - name: Download the built WordPress artifact
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@4a7a711286f30c025902c28b541c10e147a9b843 # v2.0.8
         with:
           name: built-wp-${{ github.sha }}
 
@@ -166,34 +185,30 @@ jobs:
         run: unzip built-wp-${{ github.sha }}.zip
 
       - name: Install NodeJS
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@46071b5c7a2e0c34e49c3cb8a0e792e86e18d5ea # v2.1.5
         with:
           node-version: 14
 
       - name: Use cached Node modules
-        uses: actions/cache@v2
+        uses: actions/cache@26968a09c0ea4f3e233fdddbafd1166051a095f6 # v2.1.4
         env:
           cache-name: cache-node-modules
         with:
           # npm cache files are stored in `~/.npm` on Linux/macOS
           path: ~/.npm
           key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-npm-
 
       - name: Install Dependencies
-        run: npx install-changed --install-command="npm ci"
+        run: npm ci
 
       - name: Cache Composer dependencies
         if: ${{ env.COMPOSER_INSTALL == true }}
-        uses: actions/cache@v2
+        uses: actions/cache@26968a09c0ea4f3e233fdddbafd1166051a095f6 # v2.1.4
         env:
           cache-name: cache-composer-dependencies
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-php-${{ matrix.php }}-composer-${{ hashFiles('**/composer.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-php-${{ matrix.php }}-composer-
 
       - name: Install Composer dependencies
         if: ${{ env.COMPOSER_INSTALL == true }}
@@ -239,24 +254,33 @@ jobs:
       - name: Install WordPress
         run: npm run env:install
 
-      - name: Run PHPUnit tests
-        run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c phpunit.xml.dist
+      - name: Run slow PHPUnit tests
+        if: ${{ matrix.split_slow }}
+        run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c ${{ env.PHPUNIT_CONFIG }} --group ${{ env.SLOW_TESTS }}
 
-      - name: Run AJAX tests
-        run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c phpunit.xml.dist --group ajax
+      - name: Run PHPUnit tests for single site excluding slow tests
+        if: ${{ matrix.php < '7.0' && ! matrix.split_slow && ! matrix.multisite }}
+        run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c ${{ env.PHPUNIT_CONFIG }} --exclude-group ${{ env.SLOW_TESTS }},ajax,ms-files,ms-required
 
-      - name: Run tests as a multisite install
-        run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c tests/phpunit/multisite.xml
+      - name: Run PHPUnit tests for Multisite excluding slow tests
+        if: ${{ matrix.php < '7.0' && ! matrix.split_slow && matrix.multisite }}
+        run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c ${{ env.PHPUNIT_CONFIG }} --exclude-group ${{ env.SLOW_TESTS }},ajax,ms-files,ms-excluded,oembed-headers
 
-      - name: Run ms-files tests as a multisite install
-        run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c tests/phpunit/multisite.xml --group ms-files
+      - name: Run PHPUnit tests
+        if: ${{ matrix.php >= '7.0' }}
+        run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c ${{ env.PHPUNIT_CONFIG }}
+
+      - name: Run AJAX tests
+        if: ${{ ! matrix.multisite && ! matrix.split_slow }}
+        run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c ${{ env.PHPUNIT_CONFIG }} --group ajax
 
       - name: Run external HTTP tests
+        if: ${{ ! matrix.multisite && ! matrix.split_slow }}
         run: npm run test:${{ env.PHPUNIT_SCRIPT }} -- --verbose -c phpunit.xml.dist --group external-http
 
       - name: Checkout the WordPress Test Reporter
         if: ${{ github.repository == 'WordPress/wordpress-develop' && github.ref == 'refs/heads/master' && matrix.report }}
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
         with:
           repository: 'WordPress/phpunit-test-runner'
           path: 'test-runner'
diff --git a/.github/workflows/test-npm.yml b/.github/workflows/test-npm.yml
new file mode 100644
index 0000000000..ba23f02557
--- /dev/null
+++ b/.github/workflows/test-npm.yml
@@ -0,0 +1,158 @@
+name: Test NPM
+
+on:
+  push:
+    branches:
+      - master
+      - trunk
+      - '3.[7-9]'
+      - '[4-9].[0-9]'
+  pull_request:
+    branches:
+      - master
+      - trunk
+      - '3.[7-9]'
+      - '[4-9].[0-9]'
+    paths:
+      # These files configure NPM. Changes could affect the outcome.
+      - 'package*.json'
+      # JavaScript files are built using NPM.
+      - '**.js'
+      # CSS and SCSS files are built using NPM.
+      - '**.scss'
+      - '**.css'
+      # Changes to workflow files should always verify all workflows are successful.
+      - '.github/workflows/**.yml'
+  workflow_dispatch:
+
+env:
+  PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: ${{ true }}
+
+jobs:
+  # Prepares the workflow.
+  #
+  # Performs the following steps:
+  # - Cancels all previous workflow runs for pull requests that have not completed.
+  prepare-workflow:
+    name: Prepare the workflow
+    runs-on: ubuntu-latest
+    if: ${{ github.repository == 'WordPress/wordpress-develop' || github.event_name == 'pull_request' }}
+
+    steps:
+      - name: Cancel previous runs of this workflow (pull requests only)
+        if: ${{ github.event_name == 'pull_request' }}
+        uses: styfle/cancel-workflow-action@3d86a7cc43670094ac248017207be0295edbc31d # v0.8.0
+
+  # Verifies that installing NPM dependencies and building WordPress works as expected.
+  #
+  # Performs the following steps:
+  # - Checks out the repository.
+  # - Logs debug information about the runner container.
+  # - Installs NodeJS 14.
+  # - Sets up caching for NPM.
+  # _ Installs NPM dependencies using install-changed to hash the `package.json` file.
+  # - Builds WordPress to run from the `build` directory.
+  # - Cleans up after building WordPress to the `build` directory.
+  test-npm:
+    name: Test NPM on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    if: ${{ github.repository == 'WordPress/wordpress-develop' || github.event_name == 'pull_request' }}
+    needs: prepare-workflow
+    strategy:
+      matrix:
+        os: [ ubuntu-latest, windows-latest ]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
+
+      - name: Log debug information
+        run: |
+          npm --version
+          node --version
+          curl --version
+          git --version
+          svn --version
+
+      - name: Install NodeJS
+        uses: actions/setup-node@46071b5c7a2e0c34e49c3cb8a0e792e86e18d5ea # v2.1.5
+        with:
+          node-version: 14
+
+      - name: Cache NodeJS modules (Ubuntu & MacOS)
+        uses: actions/cache@26968a09c0ea4f3e233fdddbafd1166051a095f6 # v2.1.4
+        if: ${{ matrix.os != 'windows-latest' }}
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+
+      - name: Get NPM cache directory (Windows only)
+        if: ${{ matrix.os == 'windows-latest' }}
+        id: npm-cache
+        run: echo "::set-output name=dir::$(npm config get cache)"
+
+      - name: Cache NodeJS modules (Windows only)
+        uses: actions/cache@26968a09c0ea4f3e233fdddbafd1166051a095f6 # v2.1.4
+        if: ${{ matrix.os == 'windows-latest' }}
+        with:
+          path: ${{ steps.npm-cache.outputs.dir }}
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+
+      - name: Install Dependencies
+        run: npm ci
+
+      - name: Build WordPress
+        run: npm run build
+
+      - name: Clean after building
+        run: npm run grunt clean
+
+  # Verifies that installing NPM dependencies and building WordPress works as expected on MacOS.
+  #
+  # This is a separate job in order to that more strict conditions can be used.
+  #
+  # Performs the following steps:
+  # - Checks out the repository.
+  # - Logs debug information about the runner container.
+  # - Installs NodeJS 14.
+  # - Sets up caching for NPM.
+  # _ Installs NPM dependencies using install-changed to hash the `package.json` file.
+  # - Builds WordPress to run from the `build` directory.
+  # - Cleans up after building WordPress to the `build` directory.
+  test-npm-macos:
+    name: Test NPM on MacOS
+    runs-on: macos-latest
+    if: ${{ github.repository == 'WordPress/wordpress-develop' }}
+    needs: prepare-workflow
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
+
+      - name: Log debug information
+        run: |
+          npm --version
+          node --version
+          curl --version
+          git --version
+          svn --version
+
+      - name: Install NodeJS
+        uses: actions/setup-node@46071b5c7a2e0c34e49c3cb8a0e792e86e18d5ea # v2.1.5
+        with:
+          node-version: 14
+
+      - name: Cache NodeJS modules
+        uses: actions/cache@26968a09c0ea4f3e233fdddbafd1166051a095f6 # v2.1.4
+        if: ${{ matrix.os != 'windows-latest' }}
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+
+      - name: Install Dependencies
+        run: npm ci
+
+      - name: Build WordPress
+        run: npm run build
+
+      - name: Clean after building
+        run: npm run grunt clean
diff --git a/.github/workflows/verify-npm-on-windows.yml b/.github/workflows/verify-npm-on-windows.yml
deleted file mode 100644
index adc3f84b5b..0000000000
--- a/.github/workflows/verify-npm-on-windows.yml
+++ /dev/null
@@ -1,71 +0,0 @@
-name: Test NPM on Windows
-
-on:
-  push:
-    branches:
-      - master
-      - '3.[7-9]'
-      - '[4-9].[0-9]'
-  pull_request:
-
-env:
-  PUPPETEER_SKIP_CHROMIUM_DOWNLOAD: ${{ true }}
-
-jobs:
-  # Verifies that installing NPM dependencies and building WordPress works on Windows.
-  #
-  # Performs the following steps:
-  # - Cancels all previous workflow runs for pull requests that have not completed.
-  # - Checks out the repository.
-  # - Logs debug information about the runner container.
-  # - Installs NodeJS 14.
-  # - Sets up caching for NPM.
-  # _ Installs NPM dependencies using install-changed to hash the `package.json` file.
-  # - Builds WordPress to run from the `build` directory.
-  test-npm:
-    name: Tests NPM on Windows
-    runs-on: windows-latest
-    if: ${{ github.repository == 'WordPress/wordpress-develop' || github.event_name == 'pull_request' }}
-
-    steps:
-      - name: Cancel previous runs of this workflow (pull requests only)
-        if: ${{ github.event_name == 'pull_request' }}
-        uses: styfle/cancel-workflow-action@0.5.0
-        with:
-          access_token: ${{ github.token }}
-
-      - name: Checkout repository
-        uses: actions/checkout@v2
-
-      - name: Log debug information
-        run: |
-          npm --version
-          node --version
-          curl --version
-          git --version
-          svn --version
-
-      - name: Install NodeJS
-        uses: actions/setup-node@v1
-        with:
-          node-version: 14
-
-      - name: Get NPM cache directory
-        id: npm-cache
-        run: echo "::set-output name=dir::$(npm config get cache)"
-
-      - name: Cache NodeJS modules
-        uses: actions/cache@v2
-        env:
-          cache-name: cache-node-modules
-        with:
-          path: ${{ steps.npm-cache.outputs.dir }}
-          key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-npm-
-
-      - name: Install Dependencies
-        run: npx install-changed --install-command="npm ci"
-
-      - name: Build WordPress
-        run: npm run build
diff --git a/.github/workflows/welcome-new-contributors.yml b/.github/workflows/welcome-new-contributors.yml
index 2522a5c4c2..f475a432a0 100644
--- a/.github/workflows/welcome-new-contributors.yml
+++ b/.github/workflows/welcome-new-contributors.yml
@@ -11,7 +11,7 @@ jobs:
     if: ${{ github.repository == 'WordPress/wordpress-develop' }}
 
     steps:
-      - uses: bubkoo/welcome-action@v1
+      - uses: bubkoo/welcome-action@8dbbac2540d155744c90e4e37da6b05ffc9c5e2c # v1.0.3
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           FIRST_PR_COMMENT: >
diff --git a/package-lock.json b/package-lock.json
index 5703c1c314..87672571f4 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -974,9 +974,9 @@
 					}
 				},
 				"glob-parent": {
-					"version": "5.1.1",
-					"resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.1.tgz",
-					"integrity": "sha512-FnI+VGOpnlGHWZxthPGR+QhR78fuiK0sNLkHQv+bL9fQi57lNNdquIbna/WrfROrolq8GK5Ek6BiMwqL/voRYQ==",
+					"version": "5.1.2",
+					"resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+					"integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
 					"dev": true,
 					"requires": {
 						"is-glob": "^4.0.1"
@@ -1038,9 +1038,9 @@
 			}
 		},
 		"clean-css": {
-			"version": "4.2.3",
-			"resolved": "https://registry.npmjs.org/clean-css/-/clean-css-4.2.3.tgz",
-			"integrity": "sha512-VcMWDN54ZN/DS+g58HYL5/n4Zrqe8vHJpGA8KdgUXFU4fuP/aHNw8eld9SyEIyabIMJX/0RaY/fplOo5hYLSFA==",
+			"version": "5.1.2",
+			"resolved": "https://registry.npmjs.org/clean-css/-/clean-css-5.1.2.tgz",
+			"integrity": "sha512-QcaGg9OuMo+0Ds933yLOY+gHPWbxhxqF0HDexmToPf8pczvmvZGYzd+QqWp9/mkucAOKViI+dSFOqoZIvXbeBw==",
 			"dev": true,
 			"requires": {
 				"source-map": "~0.6.0"
@@ -2407,9 +2407,9 @@
 			"dev": true
 		},
 		"follow-redirects": {
-			"version": "1.13.2",
-			"resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.2.tgz",
-			"integrity": "sha512-6mPTgLxYm3r6Bkkg0vNM0HTjfGrOEtsfbhagQvbxDEsEkpNhw582upBaoRZylzen6krEmxXJgt9Ju6HiI4O7BA==",
+			"version": "1.13.3",
+			"resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.3.tgz",
+			"integrity": "sha512-DUgl6+HDzB0iEptNQEXLx/KhTmDb8tZUHSeLqpnjpknR70H0nC2t9N73BK6fN4hOvJ84pKlIQVQ4k5FFlBedKA==",
 			"dev": true
 		},
 		"for-in": {
@@ -2495,9 +2495,9 @@
 			"dev": true
 		},
 		"fsevents": {
-			"version": "2.3.1",
-			"resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.1.tgz",
-			"integrity": "sha512-YR47Eg4hChJGAB1O3yEAOkGO+rlzutoICGqGo9EZ4lKWokzZRSyIW1QmTzqjtw8MJdj9srP869CuWw/hyzSiBw==",
+			"version": "2.3.2",
+			"resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+			"integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
 			"dev": true,
 			"optional": true
 		},
@@ -3000,64 +3000,45 @@
 			}
 		},
 		"grunt-contrib-cssmin": {
-			"version": "3.0.0",
-			"resolved": "https://registry.npmjs.org/grunt-contrib-cssmin/-/grunt-contrib-cssmin-3.0.0.tgz",
-			"integrity": "sha512-eXpooYmVGKMs/xV7DzTLgJFPVOfMuawPD3x0JwhlH0mumq2NtH3xsxaHxp1Y3NKxp0j0tRhFS6kSBRsz6TuTGg==",
+			"version": "4.0.0",
+			"resolved": "https://registry.npmjs.org/grunt-contrib-cssmin/-/grunt-contrib-cssmin-4.0.0.tgz",
+			"integrity": "sha512-jXU+Zlk8Q8XztOGNGpjYlD/BDQ0n95IHKrQKtFR7Gd8hZrzgqiG1Ra7cGYc8h2DD9vkSFGNlweb9Q00rBxOK2w==",
 			"dev": true,
 			"requires": {
-				"chalk": "^2.4.1",
-				"clean-css": "~4.2.1",
-				"maxmin": "^2.1.0"
+				"chalk": "^4.1.0",
+				"clean-css": "^5.0.1",
+				"maxmin": "^3.0.0"
 			},
 			"dependencies": {
-				"ansi-styles": {
-					"version": "3.2.1",
-					"resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
-					"integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
-					"dev": true,
-					"requires": {
-						"color-convert": "^1.9.0"
-					}
-				},
-				"chalk": {
-					"version": "2.4.2",
-					"resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
-					"integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
+				"figures": {
+					"version": "3.2.0",
+					"resolved": "https://registry.npmjs.org/figures/-/figures-3.2.0.tgz",
+					"integrity": "sha512-yaduQFRKLXYOGgEn6AZau90j3ggSOyiqXU0F9JZfeXYhNa+Jk4X+s45A2zg5jns87GAFa34BBm2kXw4XpNcbdg==",
 					"dev": true,
 					"requires": {
-						"ansi-styles": "^3.2.1",
-						"escape-string-regexp": "^1.0.5",
-						"supports-color": "^5.3.0"
+						"escape-string-regexp": "^1.0.5"
 					}
 				},
-				"color-convert": {
-					"version": "1.9.3",
-					"resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
-					"integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
+				"gzip-size": {
+					"version": "5.1.1",
+					"resolved": "https://registry.npmjs.org/gzip-size/-/gzip-size-5.1.1.tgz",
+					"integrity": "sha512-FNHi6mmoHvs1mxZAds4PpdCS6QG8B4C1krxJsMutgxl5t3+GlRTzzI3NEkifXx2pVsOvJdOGSmIgDhQ55FwdPA==",
 					"dev": true,
 					"requires": {
-						"color-name": "1.1.3"
+						"duplexer": "^0.1.1",
+						"pify": "^4.0.1"
 					}
 				},
-				"color-name": {
-					"version": "1.1.3",
-					"resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
-					"integrity": "sha1-p9BVi9icQveV3UIyj3QIMcpTvCU=",
-					"dev": true
-				},
-				"has-flag": {
+				"maxmin": {
 					"version": "3.0.0",
-					"resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
-					"integrity": "sha1-tdRU3CGZriJWmfNGfloH87lVuv0=",
-					"dev": true
-				},
-				"supports-color": {
-					"version": "5.5.0",
-					"resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
-					"integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
+					"resolved": "https://registry.npmjs.org/maxmin/-/maxmin-3.0.0.tgz",
+					"integrity": "sha512-wcahMInmGtg/7c6a75fr21Ch/Ks1Tb+Jtoan5Ft4bAI0ZvJqyOw8kkM7e7p8hDSzY805vmxwHT50KcjGwKyJ0g==",
 					"dev": true,
 					"requires": {
-						"has-flag": "^3.0.0"
+						"chalk": "^4.1.0",
+						"figures": "^3.2.0",
+						"gzip-size": "^5.1.1",
+						"pretty-bytes": "^5.3.0"
 					}
 				}
 			}
@@ -5770,9 +5751,9 @@
 			"dev": true
 		},
 		"sass": {
-			"version": "1.32.6",
-			"resolved": "https://registry.npmjs.org/sass/-/sass-1.32.6.tgz",
-			"integrity": "sha512-1bcDHDcSqeFtMr0JXI3xc/CXX6c4p0wHHivJdru8W7waM7a1WjKMm4m/Z5sY7CbVw4Whi2Chpcw6DFfSWwGLzQ==",
+			"version": "1.32.8",
+			"resolved": "https://registry.npmjs.org/sass/-/sass-1.32.8.tgz",
+			"integrity": "sha512-Sl6mIeGpzjIUZqvKnKETfMf0iDAswD9TNlv13A7aAF3XZlRPMq4VvJWBC2N2DXbp94MQVdNSFG6LfF/iOXrPHQ==",
 			"dev": true,
 			"requires": {
 				"chokidar": ">=2.0.0 <4.0.0"
@@ -6850,22 +6831,28 @@
 			}
 		},
 		"wait-on": {
-			"version": "5.2.1",
-			"resolved": "https://registry.npmjs.org/wait-on/-/wait-on-5.2.1.tgz",
-			"integrity": "sha512-H2F986kNWMU9hKlI9l/ppO6tN8ZSJd35yBljMLa1/vjzWP++Qh6aXyt77/u7ySJFZQqBtQxnvm/xgG48AObXcw==",
+			"version": "5.3.0",
+			"resolved": "https://registry.npmjs.org/wait-on/-/wait-on-5.3.0.tgz",
+			"integrity": "sha512-DwrHrnTK+/0QFaB9a8Ol5Lna3k7WvUR4jzSKmz0YaPBpuN2sACyiPVKVfj6ejnjcajAcvn3wlbTyMIn9AZouOg==",
 			"dev": true,
 			"requires": {
 				"axios": "^0.21.1",
 				"joi": "^17.3.0",
-				"lodash": "^4.17.20",
+				"lodash": "^4.17.21",
 				"minimist": "^1.2.5",
 				"rxjs": "^6.6.3"
 			},
 			"dependencies": {
+				"lodash": {
+					"version": "4.17.21",
+					"resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
+					"integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+					"dev": true
+				},
 				"rxjs": {
-					"version": "6.6.3",
-					"resolved": "https://registry.npmjs.org/rxjs/-/rxjs-6.6.3.tgz",
-					"integrity": "sha512-trsQc+xYYXZ3urjOiJOuCOa5N3jAZ3eiSpQB5hIT8zGlL2QfnHLJ2r7GMkBGuIausdJN1OneaI6gQlsqNHHmZQ==",
+					"version": "6.6.7",
+					"resolved": "https://registry.npmjs.org/rxjs/-/rxjs-6.6.7.tgz",
+					"integrity": "sha512-hTdwr+7yYNIT5n4AMYp85KA6yw2Va0FLa3Rguvbpa4W3I5xynaBZo41cM3XM+4Q6fRMj3sBYIR1VAmZMXYJvRQ==",
 					"dev": true,
 					"requires": {
 						"tslib": "^1.9.0"
diff --git a/package.json b/package.json
index e0a5d4ea64..d726f39801 100644
--- a/package.json
+++ b/package.json
@@ -21,7 +21,7 @@
 		"grunt-contrib-compress": "~2.0.0",
 		"grunt-contrib-concat": "1.0.1",
 		"grunt-contrib-copy": "~1.0.0",
-		"grunt-contrib-cssmin": "~3.0.0",
+		"grunt-contrib-cssmin": "~4.0.0",
 		"grunt-contrib-imagemin": "~4.0.0",
 		"grunt-contrib-jshint": "3.0.0",
 		"grunt-contrib-qunit": "^4.0.0",
@@ -33,8 +33,8 @@
 		"grunt-patch-wordpress": "~3.0.0",
 		"grunt-sass": "~3.1.0",
 		"matchdep": "~2.0.0",
-		"sass": "^1.32.6",
-		"wait-on": "5.2.1"
+		"sass": "^1.32.8",
+		"wait-on": "^5.3.0"
 	},
 	"scripts": {
 		"build": "grunt build",