feat: add post-release check workflow [ED-25263]

[Svitlana-Dykun]

Summary

• Adds a dispatchable Post-Release Check workflow that verifies GitHub releases, changelog on main, wordpress.org SVN/Stable tag, and zip version headers for published Core (and optional Pro).
• Upgrade-path smoke (same idea as Core plugin-upgrade-test.yml): install current wordpress.org Elementor, import a heading page, --force install the released zip, then Playwright for frontend + create/edit canvas.
• PRs that touch this workflow/actions also run it against current wordpress.org Core so the pipeline is exercised before a real GA.

https://elementor.atlassian.net/browse/ED-25263

Test plan

• Open this PR and confirm Post-Release Check runs (verify + upgrade smoke) against current wordpress.org Core.
• After merge, dispatch the workflow with core_version=4.2.2 (Pro empty) and confirm the job summary checklist is green.
• Optional: dispatch with a Pro version once MAINTAIN_TOKEN can read elementor/elementor-pro releases.

Made with Cursor

✨ PR Description

1. Problem & Context

Implements a post-release validation suite ED-25263 to automate the verification of published Core and Pro artifacts. It ensures GitHub releases, changelogs, and WordPress.org tags match the intended versions before verifying editor stability via smoke tests.

2. What Changed (Where)

Component/File	Change
.github/workflows/post-release-check.yml	Orchestrates the entire verification and smoke test pipeline.
actions/post-release-verify/	New Node.js action to validate API releases, changelogs, and zip headers.
actions/post-release-smoke/	New Playwright suite to verify editor boot and upgrade stability.
packages/editor-github-actions-utils/	Added utilities for version comparison and PHP/Readme header parsing.
stubs/upgrade-templates/	Added JSON templates for smoke test page seeding.

3. How It Works

The verify-published job resolves versions and uses the post-release-verify action to check GitHub/WP.org APIs and validate downloaded zip headers. If successful, the smoke-editor job spins up a wp-env instance, performs a plugin upgrade from the current .org version to the released zip, and runs Playwright tests to ensure the editor remains functional.

4. Risks

• Token Permissions: Pro verification requires a PAT with repo access; github.token will fail.
• Sync Lag: WordPress.org SVN may lag behind GitHub; mitigated by allowing a "skipped" status.

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using.
💡 Tip: You can customize your AI Description using Guidelines Learn how}

[wiz-9a149474ff]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	7  2
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	14
Software Management Findings	-
Total	21  2

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio.