From 52d515911746f741d78732657f65526e2cbf143e Mon Sep 17 00:00:00 2001 From: nextcloud-command Date: Sun, 18 Oct 2026 07:11:01 +0000 Subject: [PATCH] ci(actions): Update workflow templates from organization template repository Signed-off-by: GitHub --- .github/actions-lock.txt | 12 ++--- .github/workflows/appstore-build-publish.yml | 4 +- .../workflows/dependabot-approve-merge.yml | 2 +- .github/workflows/lint-php-cs.yml | 2 +- .github/workflows/lint-php.yml | 2 +- .github/workflows/psalm.yml | 2 +- .github/workflows/update-nextcloud-ocp.yml | 45 +++++++++++++++---- 7 files changed, 48 insertions(+), 21 deletions(-) diff --git a/.github/actions-lock.txt b/.github/actions-lock.txt index 1ac32c2..7964151 100644 --- a/.github/actions-lock.txt +++ b/.github/actions-lock.txt @@ -1,14 +1,14 @@ # SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors # SPDX-License-Identifier: MIT -93826e24ee7f83d32dc39574505abc5a appstore-build-publish.yml +61aec074ea531e1039929ea028af5efe appstore-build-publish.yml 19ab9c47c8d96de93f37fab242c398cc block-unconventional-commits.yml -c1476a553c3223e70e49de980f22315e dependabot-approve-merge.yml +e6351c608939c31ae1e32923aa82aa10 dependabot-approve-merge.yml 2581a67c5bcdcd570427e6d51db767d7 fixup.yml 43fd0c5fb704cabc5f11cdfaf513236d lint-info-xml.yml -79006ab196f5664fc444e63645cfd8a7 lint-php-cs.yml -300be6a756abda800e40850918f2d964 lint-php.yml +230493ed3855e3f7d9209cc63e9dbe13 lint-php-cs.yml +994cce702e8c1ec02e45e113e48512b6 lint-php.yml 2639f2b96989a4fcbb441ca8f1fecb2f pr-feedback.yml -4f1080b33778a956a08efc7a41a11994 psalm.yml +dc1f60c242a2377a0de26a521c68b49a psalm.yml 2dbec18233063b42f4d8e03bbb43671c reuse.yml abcb8206c3f6c5a9dc86cccf57846bfc update-nextcloud-ocp-approve-merge.yml -8ce35c51ee3d9cc735faab60c5d6f350 update-nextcloud-ocp.yml +5165b2cbba7d5b36735419524e2fe4e9 update-nextcloud-ocp.yml diff --git a/.github/workflows/appstore-build-publish.yml b/.github/workflows/appstore-build-publish.yml index 27209c2..43461b1 100644 --- a/.github/workflows/appstore-build-publish.yml +++ b/.github/workflows/appstore-build-publish.yml @@ -69,7 +69,7 @@ jobs: - name: Set up node ${{ steps.versions.outputs.node-version }} # Skip if no package.json if: ${{ steps.versions.outcome == 'success' }} - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ steps.versions.outputs.node-version }} package-manager-cache: false @@ -86,7 +86,7 @@ jobs: filename: ${{ env.APP_NAME }}/appinfo/info.xml - name: Set up php ${{ steps.php-versions.outputs.php-min }} - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ steps.php-versions.outputs.php-min }} coverage: none diff --git a/.github/workflows/dependabot-approve-merge.yml b/.github/workflows/dependabot-approve-merge.yml index eaa1e9f..76340ac 100644 --- a/.github/workflows/dependabot-approve-merge.yml +++ b/.github/workflows/dependabot-approve-merge.yml @@ -9,7 +9,7 @@ name: Auto approve Dependabot PRs on: - pull_request: + pull_request_target: # zizmor: ignore[dangerous-triggers] branches: - main - master diff --git a/.github/workflows/lint-php-cs.yml b/.github/workflows/lint-php-cs.yml index 06d0842..6c92411 100644 --- a/.github/workflows/lint-php-cs.yml +++ b/.github/workflows/lint-php-cs.yml @@ -34,7 +34,7 @@ jobs: uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3 - name: Set up php${{ steps.versions.outputs.php-min }} - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ steps.versions.outputs.php-min }} extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite diff --git a/.github/workflows/lint-php.yml b/.github/workflows/lint-php.yml index e4c6e9b..53b6f38 100644 --- a/.github/workflows/lint-php.yml +++ b/.github/workflows/lint-php.yml @@ -49,7 +49,7 @@ jobs: persist-credentials: false - name: Set up php ${{ matrix.php-versions }} - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ matrix.php-versions }} extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite diff --git a/.github/workflows/psalm.yml b/.github/workflows/psalm.yml index d6e2d52..8500151 100644 --- a/.github/workflows/psalm.yml +++ b/.github/workflows/psalm.yml @@ -36,7 +36,7 @@ jobs: run: grep 'phpVersion="${{ steps.versions.outputs.php-min }}' psalm.xml - name: Set up php${{ steps.versions.outputs.php-available }} - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ steps.versions.outputs.php-available }} extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite diff --git a/.github/workflows/update-nextcloud-ocp.yml b/.github/workflows/update-nextcloud-ocp.yml index 894bc13..44c0201 100644 --- a/.github/workflows/update-nextcloud-ocp.yml +++ b/.github/workflows/update-nextcloud-ocp.yml @@ -11,7 +11,7 @@ name: Update nextcloud/ocp on: workflow_dispatch: schedule: - - cron: "5 2 * * 0" + - cron: "5 22 * * 6" permissions: contents: write @@ -49,9 +49,34 @@ jobs: submodules: true continue-on-error: true - - name: Set up php8.3 + - name: Check for active merge freeze + id: freeze if: steps.checkout.outcome == 'success' - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 + env: + BRANCH_NAME: ${{ matrix.branches }} + run: | + if [[ ! -f .github/workflows/block-merge-freeze.yml ]]; then + echo 'No block-merge-freeze workflow, continuing' + exit 0 + fi + if [[ "$BRANCH_NAME" == 'main' || "$BRANCH_NAME" == 'master' ]]; then + SERVER_REF='master' + elif [[ "$BRANCH_NAME" =~ ^stable[0-9]+$ ]]; then + SERVER_REF="$BRANCH_NAME" + else + echo 'Not based on master/main/stable*, so skipping freeze check' + exit 0 + fi + curl -sf "https://raw.githubusercontent.com/nextcloud/server/$SERVER_REF/version.php" --output version.php + if grep 'OC_VersionString' version.php | grep -q -i -E '(\.0\.0 RC[3-9]|\.[1-9][0-9]* RC)'; then + echo "Merge freeze is active for $SERVER_REF, skipping" + echo 'active=true' >> $GITHUB_OUTPUT + fi + rm version.php + + - name: Set up php8.3 + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: 8.3 # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation @@ -61,24 +86,26 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Read codeowners - if: steps.checkout.outcome == 'success' + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' id: codeowners run: | grep '/appinfo/info.xml' .github/CODEOWNERS | cut -f 2- -d ' ' | xargs | awk '{ print "codeowners="$0 }' >> $GITHUB_OUTPUT continue-on-error: true - name: Install composer dependencies - if: steps.checkout.outcome == 'success' + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0 - name: Check composer bin for nextcloud/ocp exists id: check_composer_bin + if: steps.freeze.outputs.active != 'true' uses: andstor/file-existence-action@558493d6c74bf472d87c84eab196434afc2fa029 # v3.1.0 with: files: vendor-bin/nextcloud-ocp/composer.json - name: Composer update nextcloud/ocp id: update_branch + if: steps.freeze.outputs.active != 'true' env: USE_COMPOSER_BIN: ${{ steps.check_composer_bin.outputs.files_exists }} BRANCH_NAME: ${{ matrix.branches }} @@ -98,7 +125,7 @@ jobs: - name: Raise on issue on failure uses: dacbd/create-issue-action@cdb57ab6ff8862aa09fee2be6ba77a59581921c2 # v2.0.0 - if: ${{ steps.checkout.outcome == 'success' && failure() && steps.update_branch.conclusion == 'failure' }} + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' && failure() && steps.update_branch.conclusion == 'failure' with: token: ${{ secrets.GITHUB_TOKEN }} title: 'Failed to update nextcloud/ocp package on branch ${{ matrix.branches }}' @@ -106,7 +133,7 @@ jobs: - name: Create Pull Request id: create-pull-request - if: steps.checkout.outcome == 'success' + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: token: ${{ secrets.COMMAND_BOT_PAT }} @@ -126,14 +153,14 @@ jobs: # Approve using the default GITHUB_TOKEN, as the PR itself was created # using COMMAND_BOT_PAT and GitHub does not allow an account to approve its own PR - name: GitHub actions bot approve - if: steps.create-pull-request.outputs.pull-request-operation != 'none' + if: steps.freeze.outputs.active != 'true' && steps.create-pull-request.outputs.pull-request-operation != 'none' run: gh pr review --approve "$PR_URL" env: PR_URL: ${{ steps.create-pull-request.outputs.pull-request-url }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Enable auto merge - if: steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE) + if: steps.freeze.outputs.active != 'true' && steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE) uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0 with: token: ${{ secrets.GITHUB_TOKEN }}