diff --git a/.github/actions-lock.txt b/.github/actions-lock.txt
new file mode 100644
index 000000000..1431225d8
--- /dev/null
+++ b/.github/actions-lock.txt
@@ -0,0 +1,21 @@
+# SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: MIT
+9f2b534bea27e8ec2dda7c1d772a664b block-merge-eol.yml
+acad44f3e99b665897766ce90374dd03 block-merge-freeze.yml
+19ab9c47c8d96de93f37fab242c398cc block-unconventional-commits.yml
+83fc862cd4312894dfd2be81fb88c0b5 command-compile.yml
+c1476a553c3223e70e49de980f22315e dependabot-approve-merge.yml
+2581a67c5bcdcd570427e6d51db767d7 fixup.yml
+92d7708f80f4e09d3aeb7d1d93168988 lint-eslint.yml
+230493ed3855e3f7d9209cc63e9dbe13 lint-php-cs.yml
+994cce702e8c1ec02e45e113e48512b6 lint-php.yml
+c020389618342a238fdc232439a486ef node-test.yml
+03759c9dc0fa748cb927b9f9cadf2925 node.yml
+b7e9debcd278ab33bbe8e272e010d8e0 npm-audit-fix.yml
+eaef9ddd2f5552e34c3bc921a48c5e1f phpunit-sqlite.yml
+2639f2b96989a4fcbb441ca8f1fecb2f pr-feedback.yml
+d1e7dba2e25a3921ba09a8357bcd47c5 psalm-matrix.yml
+2dbec18233063b42f4d8e03bbb43671c reuse.yml
+abcb8206c3f6c5a9dc86cccf57846bfc update-nextcloud-ocp-approve-merge.yml
+5165b2cbba7d5b36735419524e2fe4e9 update-nextcloud-ocp.yml
+22604c31b526de270a080eb19967a638 update-stable-titles.yml
diff --git a/.github/workflows/block-merge-eol.yml b/.github/workflows/block-merge-eol.yml
index 3ea4d268d..ab0494568 100644
--- a/.github/workflows/block-merge-eol.yml
+++ b/.github/workflows/block-merge-eol.yml
@@ -27,7 +27,7 @@ jobs:
steps:
- name: Set server major version environment
- uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
github-token: ${{secrets.GITHUB_TOKEN}}
script: |
diff --git a/.github/workflows/block-merge-freeze.yml b/.github/workflows/block-merge-freeze.yml
index 616608083..e6652565b 100644
--- a/.github/workflows/block-merge-freeze.yml
+++ b/.github/workflows/block-merge-freeze.yml
@@ -29,7 +29,7 @@ jobs:
steps:
- name: Register server reference to fallback to master branch
- uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
github-token: ${{secrets.GITHUB_TOKEN}}
script: |
@@ -54,4 +54,4 @@ jobs:
- name: Run check
if: ${{ env.server_ref != '' }}
- run: cat version.php | grep 'OC_VersionString' | grep -i -v 'RC'
+ run: cat version.php | grep 'OC_VersionString' | grep -i -v -E '(\.0\.0 RC[3-9]|\.[1-9][0-9]* RC)'
diff --git a/.github/workflows/block-unconventional-commits.yml b/.github/workflows/block-unconventional-commits.yml
index 01c4deaf3..4972f8bb3 100644
--- a/.github/workflows/block-unconventional-commits.yml
+++ b/.github/workflows/block-unconventional-commits.yml
@@ -27,10 +27,10 @@ jobs:
steps:
- name: Checkout
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- - uses: webiny/action-conventional-commits@faccb24fc2550dd15c0390d944379d2d8ed9690e # v1.3.1
+ - uses: webiny/action-conventional-commits@7f91b1595ca1951cdb671ddc9f07a49081ec5b69 # v1.4.2
with:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/command-compile.yml b/.github/workflows/command-compile.yml
index e207e33aa..222576cf7 100644
--- a/.github/workflows/command-compile.yml
+++ b/.github/workflows/command-compile.yml
@@ -8,7 +8,7 @@
name: Compile Command
on:
- issue_comment:
+ issue_comment: # zizmor: ignore[dangerous-triggers]
types: [created]
permissions:
@@ -30,7 +30,7 @@ jobs:
steps:
- name: Get repository from pull request comment
- uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+ uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
id: get-repository
with:
github-token: ${{secrets.GITHUB_TOKEN}}
@@ -52,7 +52,7 @@ jobs:
exit 1
- name: Check actor permission
- uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v2
+ uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0
with:
require: write
@@ -65,7 +65,7 @@ jobs:
reactions: '+1'
- name: Parse command
- uses: skjnldsv/parse-command-comment@5c955203c52424151e6d0e58fb9de8a9f6a605a1 # v2
+ uses: skjnldsv/parse-command-comment@5c955203c52424151e6d0e58fb9de8a9f6a605a1 # v3.1
id: command
# Init path depending on which command is run
@@ -97,16 +97,15 @@ jobs:
steps:
- name: Restore cached git repository
- uses: buildjet/cache@3e70d19e31d6a8030aeddf6ed8dbe601f94d09f4 # v4.0.2
+ uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: .git
key: git-repo
- name: Checkout ${{ needs.init.outputs.head_ref }}
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
- # Needed to allow force push later
- persist-credentials: true
+ persist-credentials: false
token: ${{ secrets.COMMAND_BOT_PAT }}
fetch-depth: 0
ref: ${{ needs.init.outputs.head_ref }}
@@ -117,28 +116,27 @@ jobs:
git config --local user.name 'nextcloud-command'
- name: Read package.json node and npm engines version
- uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+ uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
id: package-engines-versions
- with:
- fallbackNode: '^24'
- fallbackNpm: '^11.3'
- - name: Set up node ${{ steps.package-engines-versions.outputs.nodeVersion }}
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+ - name: Set up node ${{ steps.package-engines-versions.outputs.node-version }}
+ uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
- node-version: ${{ steps.package-engines-versions.outputs.nodeVersion }}
+ node-version: ${{ steps.package-engines-versions.outputs.node-version }}
cache: npm
- - name: Set up npm ${{ steps.package-engines-versions.outputs.npmVersion }}
- run: npm i -g 'npm@${{ steps.package-engines-versions.outputs.npmVersion }}'
+ - name: Set up npm ${{ steps.package-engines-versions.outputs.package-manager-version }}
+ run: npm i -g 'npm@${{ steps.package-engines-versions.outputs.package-manager-version }}'
- name: Rebase to ${{ needs.init.outputs.base_ref }}
if: ${{ contains(needs.init.outputs.arg1, 'rebase') }}
+ env:
+ BASE_REF: ${{ needs.init.outputs.base_ref }}
run: |
- git fetch origin '${{ needs.init.outputs.base_ref }}:${{ needs.init.outputs.base_ref }}'
+ git fetch origin "${BASE_REF}:${BASE_REF}"
# Start the rebase
- git rebase 'origin/${{ needs.init.outputs.base_ref }}' || {
+ git rebase "origin/${BASE_REF}" || {
# Handle rebase conflicts in a loop
while [ -d .git/rebase-merge ] || [ -d .git/rebase-apply ]; do
echo "Handling rebase conflict..."
@@ -146,11 +144,11 @@ jobs:
# Remove and checkout /dist and /js folders from the base branch
if [ -d "dist" ]; then
rm -rf dist
- git checkout origin/${{ needs.init.outputs.base_ref }} -- dist/ 2>/dev/null || echo "No dist folder in base branch"
+ git checkout "origin/${BASE_REF}" -- dist/ 2>/dev/null || echo "No dist folder in base branch"
fi
if [ -d "js" ]; then
rm -rf js
- git checkout origin/${{ needs.init.outputs.base_ref }} -- js/ 2>/dev/null || echo "No js folder in base branch"
+ git checkout "origin/${BASE_REF}" -- js/ 2>/dev/null || echo "No js folder in base branch"
fi
# Stage all changes
@@ -182,20 +180,26 @@ jobs:
- name: Commit default
if: ${{ !contains(needs.init.outputs.arg1, 'fixup') && !contains(needs.init.outputs.arg1, 'amend') }}
+ env:
+ GIT_PATH: ${{ needs.init.outputs.git_path }}
run: |
- git add '${{ github.workspace }}${{ needs.init.outputs.git_path }}'
+ git add "${GITHUB_WORKSPACE}${GIT_PATH}"
git commit --signoff -m 'chore(assets): Recompile assets'
- name: Commit fixup
if: ${{ contains(needs.init.outputs.arg1, 'fixup') }}
+ env:
+ GIT_PATH: ${{ needs.init.outputs.git_path }}
run: |
- git add '${{ github.workspace }}${{ needs.init.outputs.git_path }}'
+ git add "${GITHUB_WORKSPACE}${GIT_PATH}"
git commit --fixup=HEAD --signoff
- name: Commit amend
if: ${{ contains(needs.init.outputs.arg1, 'amend') }}
+ env:
+ GIT_PATH: ${{ needs.init.outputs.git_path }}
run: |
- git add '${{ github.workspace }}${{ needs.init.outputs.git_path }}'
+ git add "${GITHUB_WORKSPACE}${GIT_PATH}"
git commit --amend --no-edit --signoff
# Remove any [skip ci] from the amended commit
git commit --amend -m "$(git log -1 --format='%B' | sed '/\[skip ci\]/d')"
@@ -204,13 +208,19 @@ jobs:
if: ${{ !contains(needs.init.outputs.arg1, 'rebase') && !contains(needs.init.outputs.arg1, 'amend') }}
env:
HEAD_REF: ${{ needs.init.outputs.head_ref }}
- run: git push origin "$HEAD_REF"
+ BOT_TOKEN: ${{ secrets.COMMAND_BOT_PAT }} # zizmor: ignore[secrets-outside-env]
+ run: |
+ git remote set-url origin "https://x-access-token:${BOT_TOKEN}@github.com/${{ github.repository }}.git"
+ git push origin "$HEAD_REF"
- name: Force push
if: ${{ contains(needs.init.outputs.arg1, 'rebase') || contains(needs.init.outputs.arg1, 'amend') }}
env:
HEAD_REF: ${{ needs.init.outputs.head_ref }}
- run: git push --force-with-lease origin "$HEAD_REF"
+ BOT_TOKEN: ${{ secrets.COMMAND_BOT_PAT }} # zizmor: ignore[secrets-outside-env]
+ run: |
+ git remote set-url origin "https://x-access-token:${BOT_TOKEN}@github.com/${{ github.repository }}.git"
+ git push --force-with-lease origin "$HEAD_REF"
- name: Add reaction on failure
uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
diff --git a/.github/workflows/dependabot-approve-merge.yml b/.github/workflows/dependabot-approve-merge.yml
index c0411c057..eaa1e9f28 100644
--- a/.github/workflows/dependabot-approve-merge.yml
+++ b/.github/workflows/dependabot-approve-merge.yml
@@ -9,7 +9,7 @@
name: Auto approve Dependabot PRs
on:
- pull_request_target: # zizmor: ignore[dangerous-triggers]
+ pull_request:
branches:
- main
- master
@@ -24,10 +24,17 @@ concurrency:
jobs:
auto-approve-merge:
- if: github.event.pull_request.user.login == 'dependabot[bot]' || github.event.pull_request.user.login == 'renovate[bot]'
+ if: github.event.pull_request.user.login == 'dependabot[bot]'
runs-on: ubuntu-latest-low
+ env:
+ # env variable for maintainers: 'true' allows to auto-merge 1.0.2 -> 2.0.0
+ ALLOW_MAJOR: false
+ # env variable for maintainers: 'true' allows to auto-merge 1.0.2 -> 1.1.0
+ ALLOW_MINOR: true
+ # env variable for maintainers: RegExp string to ignore some dependencies from auto-approve and auto-merge
+ IGNORE_PATTERN: ''
permissions:
- # for hmarr/auto-approve-action to approve PRs
+ # for auto-approve step to work
pull-requests: write
# for alexwilson/enable-github-automerge-action to approve PRs
contents: write
@@ -44,15 +51,51 @@ jobs:
with:
repo-token: ${{ secrets.GITHUB_TOKEN }}
- # GitHub actions bot approve
- - uses: hmarr/auto-approve-action@f0939ea97e9205ef24d872e76833fa908a770363 # v4.0.0
+ - name: Dependabot metadata
+ id: metadata
if: startsWith(steps.branchname.outputs.branch, 'dependabot/')
+ uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
+ - name: Check for ignored dependencies in the PR
+ id: validate
+ if: startsWith(steps.branchname.outputs.branch, 'dependabot/')
+ env:
+ IGNORE_PATTERN: ${{ env.IGNORE_PATTERN }}
+ DEPENDENCY_NAMES: ${{ steps.metadata.outputs.dependency-names }}
+ run: |
+ if [[ -z ${IGNORE_PATTERN} ]]; then
+ echo "ignore=false" >> "$GITHUB_OUTPUT"
+ elif [[ -z ${DEPENDENCY_NAMES} ]]; then
+ echo "ignore=false" >> "$GITHUB_OUTPUT"
+ elif [[ ${DEPENDENCY_NAMES} =~ ${IGNORE_PATTERN} ]]; then
+ echo "ignore=true" >> "$GITHUB_OUTPUT"
+ fi
+
+ - name: GitHub actions bot approve
+ id: auto_approve
+ if: ${{
+ startsWith(steps.branchname.outputs.branch, 'dependabot/')
+ && steps.validate.outputs.ignore != 'true'
+ }}
+ run: gh pr review --approve "$PR_URL"
+ env:
+ PR_URL: ${{ github.event.pull_request.html_url }}
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
# Enable GitHub auto merge
- name: Auto merge
- uses: alexwilson/enable-github-automerge-action@56e3117d1ae1540309dc8f7a9f2825bc3c5f06ff # v2.0.0
- if: startsWith(steps.branchname.outputs.branch, 'dependabot/')
+ uses: alexwilson/enable-github-automerge-action@2c32e18a76e0726ffe7a573bfff2d42a20885126 # 3.0.0
+ if: ${{
+ startsWith(steps.branchname.outputs.branch, 'dependabot/')
+ && steps.auto_approve.conclusion == 'success'
+ && (github.event.action == 'opened' || github.event.action == 'reopened')
+ && (
+ steps.metadata.outputs.update-type == 'version-update:semver-patch'
+ || (fromJSON(env.ALLOW_MINOR) && steps.metadata.outputs.update-type == 'version-update:semver-minor')
+ || (fromJSON(env.ALLOW_MAJOR) && steps.metadata.outputs.update-type == 'version-update:semver-major')
+ )
+ }}
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/lint-eslint.yml b/.github/workflows/lint-eslint.yml
index 584543a71..c1353ce58 100644
--- a/.github/workflows/lint-eslint.yml
+++ b/.github/workflows/lint-eslint.yml
@@ -28,7 +28,7 @@ jobs:
src: ${{ steps.changes.outputs.src}}
steps:
- - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+ - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
id: changes
continue-on-error: true
with:
@@ -56,24 +56,21 @@ jobs:
steps:
- name: Checkout
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Read package.json node and npm engines version
- uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+ uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
id: versions
- with:
- fallbackNode: '^24'
- fallbackNpm: '^11.3'
- - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+ - name: Set up node ${{ steps.versions.outputs.node-version }}
+ uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
- node-version: ${{ steps.versions.outputs.nodeVersion }}
+ node-version: ${{ steps.versions.outputs.node-version }}
- - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
- run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
+ - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
+ run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
- name: Install dependencies
env:
diff --git a/.github/workflows/lint-php-cs.yml b/.github/workflows/lint-php-cs.yml
index f55a05e57..6c924112d 100644
--- a/.github/workflows/lint-php-cs.yml
+++ b/.github/workflows/lint-php-cs.yml
@@ -25,16 +25,16 @@ jobs:
steps:
- name: Checkout
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Get php version
id: versions
- uses: icewind1991/nextcloud-version-matrix@8a7bac6300b2f0f3100088b297995a229558ddba # v1.3.2
+ uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3
- name: Set up php${{ steps.versions.outputs.php-min }}
- uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0
+ uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
with:
php-version: ${{ steps.versions.outputs.php-min }}
extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite
@@ -43,10 +43,12 @@ jobs:
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- - name: Install dependencies
+ - name: Remove nextcloud/ocp
run: |
composer remove nextcloud/ocp --dev --no-scripts
- composer i
+
+ - name: Install composer dependencies
+ uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
- name: Lint
run: composer run cs:check || ( echo 'Please run `composer run cs:fix` to format your code' && exit 1 )
diff --git a/.github/workflows/lint-php.yml b/.github/workflows/lint-php.yml
index 6e68da787..53b6f38ec 100644
--- a/.github/workflows/lint-php.yml
+++ b/.github/workflows/lint-php.yml
@@ -25,16 +25,16 @@ jobs:
php-max: ${{ steps.versions.outputs.php-max }}
steps:
- name: Checkout app
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Get version matrix
id: versions
- uses: icewind1991/nextcloud-version-matrix@8a7bac6300b2f0f3100088b297995a229558ddba # v1.3.2
+ uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3
php-lint:
- runs-on: ubuntu-latest
+ runs-on: ubuntu-latest-low
needs: matrix
strategy:
matrix:
@@ -44,12 +44,12 @@ jobs:
steps:
- name: Checkout
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Set up php ${{ matrix.php-versions }}
- uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0
+ uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
with:
php-version: ${{ matrix.php-versions }}
extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite
diff --git a/.github/workflows/node-test.yml b/.github/workflows/node-test.yml
index 2d4f71add..5e3b6341e 100644
--- a/.github/workflows/node-test.yml
+++ b/.github/workflows/node-test.yml
@@ -34,7 +34,7 @@ jobs:
src: ${{ steps.changes.outputs.src}}
steps:
- - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+ - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
id: changes
continue-on-error: true
with:
@@ -60,24 +60,21 @@ jobs:
steps:
- name: Checkout
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Read package.json node and npm engines version
- uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+ uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
id: versions
- with:
- fallbackNode: '^24'
- fallbackNpm: '^11.3'
- - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+ - name: Set up node ${{ steps.versions.outputs.node-version }}
+ uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
- node-version: ${{ steps.versions.outputs.nodeVersion }}
+ node-version: ${{ steps.versions.outputs.node-version }}
- - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
- run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
+ - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
+ run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
- name: Install dependencies & build
env:
@@ -93,7 +90,7 @@ jobs:
run: npm run test:coverage --if-present
- name: Collect coverage
- uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+ uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
with:
files: ./coverage/lcov.info
diff --git a/.github/workflows/npm-audit-fix.yml b/.github/workflows/npm-audit-fix.yml
index 515ce54a9..f34c17741 100644
--- a/.github/workflows/npm-audit-fix.yml
+++ b/.github/workflows/npm-audit-fix.yml
@@ -11,56 +11,88 @@ name: Npm audit fix and compile
on:
workflow_dispatch:
schedule:
- # At 2:30 on Sundays
- - cron: '30 2 * * 0'
+ # At 22:30 on Saturdays
+ - cron: '30 22 * * 6'
permissions:
- contents: read
+ contents: write
+ pull-requests: write
jobs:
build:
runs-on: ubuntu-latest
+ env:
+ # env variable for maintainers: 'false' disables auto-merge for these pull requests
+ AUTOMERGE: true
+
strategy:
fail-fast: false
matrix:
branches:
- ${{ github.event.repository.default_branch }}
+ - 'stable35'
+ - 'stable34'
- 'stable33'
- - 'stable32'
name: npm-audit-fix-${{ matrix.branches }}
steps:
- name: Checkout
id: checkout
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
ref: ${{ matrix.branches }}
continue-on-error: true
+ - name: Check for active merge freeze
+ id: freeze
+ if: steps.checkout.outcome == 'success'
+ env:
+ BRANCH_NAME: ${{ matrix.branches }}
+ run: |
+ if [[ ! -f .github/workflows/block-merge-freeze.yml ]]; then
+ echo 'No block-merge-freeze workflow, continuing'
+ exit 0
+ fi
+ if [[ "$BRANCH_NAME" == 'main' || "$BRANCH_NAME" == 'master' ]]; then
+ SERVER_REF='master'
+ elif [[ "$BRANCH_NAME" =~ ^stable[0-9]+$ ]]; then
+ SERVER_REF="$BRANCH_NAME"
+ else
+ echo 'Not based on master/main/stable*, so skipping freeze check'
+ exit 0
+ fi
+ curl -sf "https://raw.githubusercontent.com/nextcloud/server/$SERVER_REF/version.php" --output version.php
+ if grep 'OC_VersionString' version.php | grep -q -i -E '(\.0\.0 RC[3-9]|\.[1-9][0-9]* RC)'; then
+ echo "Merge freeze is active for $SERVER_REF, skipping"
+ echo 'active=true' >> $GITHUB_OUTPUT
+ fi
+ rm version.php
+
- name: Read package.json node and npm engines version
- uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+ if: steps.freeze.outputs.active != 'true'
+ uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
id: versions
- with:
- fallbackNode: '^24'
- fallbackNpm: '^11.3'
- - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+ - name: Set up node ${{ steps.versions.outputs.node-version }}
+ if: steps.freeze.outputs.active != 'true'
+ uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
- node-version: ${{ steps.versions.outputs.nodeVersion }}
+ node-version: ${{ steps.versions.outputs.node-version }}
- - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
- run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
+ - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
+ if: steps.freeze.outputs.active != 'true'
+ run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
- name: Fix npm audit
id: npm-audit
+ if: steps.freeze.outputs.active != 'true'
uses: nextcloud-libraries/npm-audit-action@1b1728b2b4a7a78d69de65608efcf4db0e3e42d0 # v0.2.0
- name: Run npm ci and npm run build
- if: steps.checkout.outcome == 'success'
+ if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success'
env:
CYPRESS_INSTALL_BINARY: 0
run: |
@@ -68,8 +100,9 @@ jobs:
npm run build --if-present
- name: Create Pull Request
- if: steps.checkout.outcome == 'success'
- uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
+ id: create-pull-request
+ if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success'
+ uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
with:
token: ${{ secrets.COMMAND_BOT_PAT }}
commit-message: 'fix(deps): Fix npm audit'
@@ -82,3 +115,19 @@ jobs:
labels: |
dependencies
3. to review
+
+ # Approve using the default GITHUB_TOKEN, as the PR itself was created
+ # using COMMAND_BOT_PAT and GitHub does not allow an account to approve its own PR
+ - name: GitHub actions bot approve
+ if: steps.freeze.outputs.active != 'true' && steps.create-pull-request.outputs.pull-request-operation != 'none'
+ run: gh pr review --approve "$PR_URL"
+ env:
+ PR_URL: ${{ steps.create-pull-request.outputs.pull-request-url }}
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+ - name: Enable auto merge
+ if: steps.freeze.outputs.active != 'true' && steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE)
+ uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0
+ with:
+ token: ${{ secrets.GITHUB_TOKEN }}
+ pull-request-number: ${{ steps.create-pull-request.outputs.pull-request-number }}
diff --git a/.github/workflows/node.yml b/.github/workflows/npm-build.yml
similarity index 78%
rename from .github/workflows/node.yml
rename to .github/workflows/npm-build.yml
index 240034840..22783c4a1 100644
--- a/.github/workflows/node.yml
+++ b/.github/workflows/npm-build.yml
@@ -6,7 +6,7 @@
# SPDX-FileCopyrightText: 2021-2024 Nextcloud GmbH and Nextcloud contributors
# SPDX-License-Identifier: MIT
-name: Node
+name: Build Javascript
on: pull_request
@@ -28,7 +28,7 @@ jobs:
src: ${{ steps.changes.outputs.src}}
steps:
- - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+ - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
id: changes
continue-on-error: true
with:
@@ -53,24 +53,21 @@ jobs:
name: NPM build
steps:
- name: Checkout
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Read package.json node and npm engines version
- uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+ uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
id: versions
- with:
- fallbackNode: '^24'
- fallbackNpm: '^11.3'
- - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
- uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+ - name: Set up node ${{ steps.versions.outputs.node-version }}
+ uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
with:
- node-version: ${{ steps.versions.outputs.nodeVersion }}
+ node-version: ${{ steps.versions.outputs.node-version }}
- - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
- run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
+ - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
+ run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
- name: Validate package-lock.json # See https://github.com/npm/cli/issues/4460
run: |
diff --git a/.github/workflows/phpunit-sqlite.yml b/.github/workflows/phpunit-sqlite.yml
index c4bc7b02c..ccafc63d3 100644
--- a/.github/workflows/phpunit-sqlite.yml
+++ b/.github/workflows/phpunit-sqlite.yml
@@ -18,32 +18,19 @@ concurrency:
cancel-in-progress: true
jobs:
- matrix:
- runs-on: ubuntu-latest-low
- outputs:
- php-version: ${{ steps.versions.outputs.php-available-list }}
- server-max: ${{ steps.versions.outputs.branches-max-list }}
- steps:
- - name: Checkout app
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- with:
- persist-credentials: false
-
- - name: Get version matrix
- id: versions
- uses: icewind1991/nextcloud-version-matrix@8a7bac6300b2f0f3100088b297995a229558ddba # v1.3.2
-
- changes:
+ changes-and-matrix:
runs-on: ubuntu-latest-low
permissions:
contents: read
pull-requests: read
outputs:
- src: ${{ steps.changes.outputs.src}}
+ src: ${{ steps.changes.outputs.src }}
+ php-version: ${{ steps.versions.outputs.php-available-list }}
+ server-max: ${{ steps.versions.outputs.branches-max-list }}
steps:
- - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+ - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
id: changes
continue-on-error: true
with:
@@ -60,16 +47,28 @@ jobs:
- 'composer.json'
- 'composer.lock'
+ - name: Checkout app
+ if: steps.changes.outputs.src != 'false'
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ persist-credentials: false
+
+ - name: Get version matrix
+ if: steps.changes.outputs.src != 'false'
+ id: versions
+ uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3
+
phpunit-sqlite:
runs-on: ubuntu-latest
- needs: [changes, matrix]
- if: needs.changes.outputs.src != 'false'
+ needs: changes-and-matrix
+ if: needs.changes-and-matrix.outputs.src != 'false'
strategy:
+ fail-fast: false
matrix:
- php-versions: ${{ fromJson(needs.matrix.outputs.php-version) }}
- server-versions: ${{ fromJson(needs.matrix.outputs.server-max) }}
+ php-versions: ${{ fromJson(needs.changes-and-matrix.outputs.php-version) }}
+ server-versions: ${{ fromJson(needs.changes-and-matrix.outputs.server-max) }}
name: SQLite PHP ${{ matrix.php-versions }} Nextcloud ${{ matrix.server-versions }}
@@ -81,7 +80,7 @@ jobs:
echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV
- name: Checkout server
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
submodules: true
@@ -89,13 +88,13 @@ jobs:
ref: ${{ matrix.server-versions }}
- name: Checkout app
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
path: apps/${{ env.APP_NAME }}
- name: Set up php ${{ matrix.php-versions }}
- uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0
+ uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
with:
php-version: ${{ matrix.php-versions }}
# https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation
@@ -109,17 +108,21 @@ jobs:
- name: Check composer file existence
id: check_composer
- uses: andstor/file-existence-action@076e0072799f4942c8bc574a82233e1e4d13e9d6 # v3.0.0
+ uses: andstor/file-existence-action@558493d6c74bf472d87c84eab196434afc2fa029 # v3.1.0
with:
files: apps/${{ env.APP_NAME }}/composer.json
- - name: Set up dependencies
+ - name: Remove nextcloud/ocp
# Only run if phpunit config file exists
if: steps.check_composer.outputs.files_exists == 'true'
working-directory: apps/${{ env.APP_NAME }}
run: |
composer remove nextcloud/ocp --dev --no-scripts
- composer i
+
+ - name: Install composer dependencies
+ uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
+ with:
+ working-directory: apps/${{ env.APP_NAME }}
- name: Set up Nextcloud
env:
@@ -176,7 +179,7 @@ jobs:
permissions:
contents: none
runs-on: ubuntu-latest-low
- needs: [changes, phpunit-sqlite]
+ needs: [changes-and-matrix, phpunit-sqlite]
if: always()
@@ -184,4 +187,4 @@ jobs:
steps:
- name: Summary status
- run: if ${{ needs.changes.outputs.src != 'false' && needs.phpunit-sqlite.result != 'success' }}; then exit 1; fi
+ run: if ${{ needs.changes-and-matrix.outputs.src != 'false' && needs.phpunit-sqlite.result != 'success' }}; then exit 1; fi
diff --git a/.github/workflows/pr-feedback.yml b/.github/workflows/pr-feedback.yml
index f4c0477ce..e93d2be9b 100644
--- a/.github/workflows/pr-feedback.yml
+++ b/.github/workflows/pr-feedback.yml
@@ -36,7 +36,7 @@ jobs:
blocklist=$(curl https://raw.githubusercontent.com/nextcloud/.github/master/non-community-usernames.txt | paste -s -d, -)
echo "blocklist=$blocklist" >> "$GITHUB_OUTPUT"
- - uses: nextcloud/pr-feedback-action@f0cab224dea8e1f282f9451de322f323c78fc7a5 # main
+ - uses: nextcloud-libraries/pr-feedback-action@4738cf661995d96df3512409ec17c900a4081d33 # v2.0.0
with:
feedback-message: |
Hello there,
@@ -50,6 +50,6 @@ jobs:
(If you believe you should not receive this message, you can add yourself to the [blocklist](https://github.com/nextcloud/.github/blob/master/non-community-usernames.txt).)
days-before-feedback: 14
- start-date: '2025-06-12'
+ max-days-overdue: 7
exempt-authors: '${{ steps.blocklist.outputs.blocklist }},${{ steps.scrape.outputs.users }}'
exempt-bots: true
diff --git a/.github/workflows/psalm-matrix.yml b/.github/workflows/psalm-matrix.yml
index 54ed70002..ec7340524 100644
--- a/.github/workflows/psalm-matrix.yml
+++ b/.github/workflows/psalm-matrix.yml
@@ -22,15 +22,16 @@ jobs:
runs-on: ubuntu-latest-low
outputs:
ocp-matrix: ${{ steps.versions.outputs.ocp-matrix }}
+ php-min: ${{ steps.versions.outputs.php-min }}
steps:
- name: Checkout app
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Get version matrix
id: versions
- uses: icewind1991/nextcloud-version-matrix@8a7bac6300b2f0f3100088b297995a229558ddba # v1.3.2
+ uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3
- name: Check enforcement of minimum PHP version ${{ steps.versions.outputs.php-min }} in psalm.xml
run: grep 'phpVersion="${{ steps.versions.outputs.php-min }}' psalm.xml
@@ -46,14 +47,14 @@ jobs:
name: static-psalm-analysis ${{ matrix.ocp-version }}
steps:
- name: Checkout
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- - name: Set up php${{ matrix.php-min }}
- uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0
+ - name: Set up php${{ needs.matrix.outputs.php-min }}
+ uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
with:
- php-version: ${{ matrix.php-min }}
+ php-version: ${{ needs.matrix.outputs.php-min }}
extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite
coverage: none
ini-file: development
@@ -62,16 +63,17 @@ jobs:
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- - name: Install dependencies
+ - name: Remove nextcloud/ocp
run: |
composer remove nextcloud/ocp --dev --no-scripts
- composer i
- - name: Check for vulnerable PHP dependencies
- run: composer require --dev roave/security-advisories:dev-latest
+ - name: Install composer dependencies
+ uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
- - name: Install dependencies # zizmor: ignore[template-injection]
- run: composer require --dev 'nextcloud/ocp:${{ matrix.ocp-version }}' --ignore-platform-reqs --with-dependencies
+ - name: Install nextcloud/ocp:${{ matrix.ocp-version }}
+ env:
+ OCP_VERSION: ${{ matrix.ocp-version }}
+ run: composer require --dev "nextcloud/ocp:$OCP_VERSION" --ignore-platform-reqs --with-dependencies
- name: Run coding standards check
run: composer run psalm -- --threads=1 --monochrome --no-progress --output-format=github
diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml
index 3f485f875..67fdafc44 100644
--- a/.github/workflows/reuse.yml
+++ b/.github/workflows/reuse.yml
@@ -19,7 +19,7 @@ jobs:
runs-on: ubuntu-latest-low
steps:
- name: Checkout
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
diff --git a/.github/workflows/update-nextcloud-ocp-approve-merge.yml b/.github/workflows/update-nextcloud-ocp-approve-merge.yml
deleted file mode 100644
index dfe0ef4e9..000000000
--- a/.github/workflows/update-nextcloud-ocp-approve-merge.yml
+++ /dev/null
@@ -1,58 +0,0 @@
-# This workflow is provided via the organization template repository
-#
-# https://github.com/nextcloud/.github
-# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
-#
-# SPDX-FileCopyrightText: 2023-2024 Nextcloud GmbH and Nextcloud contributors
-# SPDX-License-Identifier: MIT
-
-name: Auto approve nextcloud/ocp
-
-on:
- pull_request_target: # zizmor: ignore[dangerous-triggers]
- branches:
- - main
- - master
- - stable*
-
-permissions:
- contents: read
-
-concurrency:
- group: update-nextcloud-ocp-approve-merge-${{ github.head_ref || github.run_id }}
- cancel-in-progress: true
-
-jobs:
- auto-approve-merge:
- if: github.actor == 'nextcloud-command'
- runs-on: ubuntu-latest-low
- permissions:
- # for hmarr/auto-approve-action to approve PRs
- pull-requests: write
- # for alexwilson/enable-github-automerge-action to approve PRs
- contents: write
-
- steps:
- - name: Disabled on forks
- if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
- run: |
- echo 'Can not approve PRs from forks'
- exit 1
-
- - uses: mdecoleman/pr-branch-name@55795d86b4566d300d237883103f052125cc7508 # v3.0.0
- id: branchname
- with:
- repo-token: ${{ secrets.GITHUB_TOKEN }}
-
- # GitHub actions bot approve
- - uses: hmarr/auto-approve-action@b40d6c9ed2fa10c9a2749eca7eb004418a705501 # v2
- if: startsWith(steps.branchname.outputs.branch, 'automated/noid/') && endsWith(steps.branchname.outputs.branch, 'update-nextcloud-ocp')
- with:
- github-token: ${{ secrets.GITHUB_TOKEN }}
-
- # Enable GitHub auto merge
- - name: Auto merge
- uses: alexwilson/enable-github-automerge-action@56e3117d1ae1540309dc8f7a9f2825bc3c5f06ff # v2.0.0
- if: startsWith(steps.branchname.outputs.branch, 'automated/noid/') && endsWith(steps.branchname.outputs.branch, 'update-nextcloud-ocp')
- with:
- github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/update-nextcloud-ocp.yml b/.github/workflows/update-nextcloud-ocp.yml
index 5dc5f9a59..44c02012e 100644
--- a/.github/workflows/update-nextcloud-ocp.yml
+++ b/.github/workflows/update-nextcloud-ocp.yml
@@ -11,40 +11,74 @@ name: Update nextcloud/ocp
on:
workflow_dispatch:
schedule:
- - cron: "5 2 * * 0"
+ - cron: "5 22 * * 6"
permissions:
- contents: read
+ contents: write
issues: write
+ pull-requests: write
jobs:
update-nextcloud-ocp:
runs-on: ubuntu-latest
+ # Only allowed to be run on nextcloud repositories
+ if: ${{ github.repository_owner == 'nextcloud' }}
+
+ env:
+ # env variable for maintainers: 'false' disables auto-merge for these pull requests
+ AUTOMERGE: true
+
strategy:
fail-fast: false
matrix:
branches:
- ${{ github.event.repository.default_branch }}
+ - 'stable35'
+ - 'stable34'
- 'stable33'
- - 'stable32'
name: update-nextcloud-ocp-${{ matrix.branches }}
steps:
- id: checkout
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
ref: ${{ matrix.branches }}
submodules: true
continue-on-error: true
- - name: Set up php8.2
+ - name: Check for active merge freeze
+ id: freeze
if: steps.checkout.outcome == 'success'
- uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0
+ env:
+ BRANCH_NAME: ${{ matrix.branches }}
+ run: |
+ if [[ ! -f .github/workflows/block-merge-freeze.yml ]]; then
+ echo 'No block-merge-freeze workflow, continuing'
+ exit 0
+ fi
+ if [[ "$BRANCH_NAME" == 'main' || "$BRANCH_NAME" == 'master' ]]; then
+ SERVER_REF='master'
+ elif [[ "$BRANCH_NAME" =~ ^stable[0-9]+$ ]]; then
+ SERVER_REF="$BRANCH_NAME"
+ else
+ echo 'Not based on master/main/stable*, so skipping freeze check'
+ exit 0
+ fi
+ curl -sf "https://raw.githubusercontent.com/nextcloud/server/$SERVER_REF/version.php" --output version.php
+ if grep 'OC_VersionString' version.php | grep -q -i -E '(\.0\.0 RC[3-9]|\.[1-9][0-9]* RC)'; then
+ echo "Merge freeze is active for $SERVER_REF, skipping"
+ echo 'active=true' >> $GITHUB_OUTPUT
+ fi
+ rm version.php
+
+ - name: Set up php8.3
+ if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success'
+ uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
with:
- php-version: 8.2
+ php-version: 8.3
# https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation
extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite
coverage: none
@@ -52,66 +86,55 @@ jobs:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Read codeowners
- if: steps.checkout.outcome == 'success'
+ if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success'
id: codeowners
run: |
grep '/appinfo/info.xml' .github/CODEOWNERS | cut -f 2- -d ' ' | xargs | awk '{ print "codeowners="$0 }' >> $GITHUB_OUTPUT
continue-on-error: true
- - name: Composer install
- if: steps.checkout.outcome == 'success'
- run: composer install
-
- - name: Composer update nextcloud/ocp # zizmor: ignore[template-injection]
- id: update_branch
- if: ${{ steps.checkout.outcome == 'success' && matrix.branches != 'main' }}
- run: composer require --dev 'nextcloud/ocp:dev-${{ matrix.branches }}'
+ - name: Install composer dependencies
+ if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success'
+ uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
- - name: Raise on issue on failure
- uses: dacbd/create-issue-action@cdb57ab6ff8862aa09fee2be6ba77a59581921c2 # v2.0.0
- if: ${{ steps.checkout.outcome == 'success' && failure() && steps.update_branch.conclusion == 'failure' }}
+ - name: Check composer bin for nextcloud/ocp exists
+ id: check_composer_bin
+ if: steps.freeze.outputs.active != 'true'
+ uses: andstor/file-existence-action@558493d6c74bf472d87c84eab196434afc2fa029 # v3.1.0
with:
- token: ${{ secrets.GITHUB_TOKEN }}
- title: 'Failed to update nextcloud/ocp package on branch ${{ matrix.branches }}'
- body: 'Please check the output of the GitHub action and manually resolve the issues
${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
${{ steps.codeowners.outputs.codeowners }}'
+ files: vendor-bin/nextcloud-ocp/composer.json
- name: Composer update nextcloud/ocp
- id: update_main
- if: ${{ steps.checkout.outcome == 'success' && matrix.branches == 'main' }}
- run: composer require --dev nextcloud/ocp:dev-master
+ id: update_branch
+ if: steps.freeze.outputs.active != 'true'
+ env:
+ USE_COMPOSER_BIN: ${{ steps.check_composer_bin.outputs.files_exists }}
+ BRANCH_NAME: ${{ matrix.branches }}
+ run: |
+ COMPOSER_CMD='composer'
+ if [[ "$USE_COMPOSER_BIN" == 'true' ]]; then
+ COMPOSER_CMD='composer bin nextcloud-ocp'
+ fi
+
+ PACKAGE_VERSION="nextcloud/ocp:dev-$BRANCH_NAME"
+ if [[ "$BRANCH_NAME" == 'main' ]]; then
+ PACKAGE_VERSION='nextcloud/ocp:dev-master'
+ fi
+
+ echo $COMPOSER_CMD require --dev $PACKAGE_VERSION
+ $COMPOSER_CMD require --dev $PACKAGE_VERSION
- name: Raise on issue on failure
uses: dacbd/create-issue-action@cdb57ab6ff8862aa09fee2be6ba77a59581921c2 # v2.0.0
- if: ${{ steps.checkout.outcome == 'success' && failure() && steps.update_main.conclusion == 'failure' }}
+ if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' && failure() && steps.update_branch.conclusion == 'failure'
with:
token: ${{ secrets.GITHUB_TOKEN }}
title: 'Failed to update nextcloud/ocp package on branch ${{ matrix.branches }}'
body: 'Please check the output of the GitHub action and manually resolve the issues
${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
${{ steps.codeowners.outputs.codeowners }}'
- - name: Reset checkout 3rdparty
- if: steps.checkout.outcome == 'success'
- run: |
- git clean -f 3rdparty
- git checkout 3rdparty
- continue-on-error: true
-
- - name: Reset checkout vendor
- if: steps.checkout.outcome == 'success'
- run: |
- git clean -f vendor
- git checkout vendor
- continue-on-error: true
-
- - name: Reset checkout vendor-bin
- if: steps.checkout.outcome == 'success'
- run: |
- git clean -f vendor-bin
- git checkout vendor-bin
- continue-on-error: true
-
- name: Create Pull Request
- if: steps.checkout.outcome == 'success'
- uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
+ id: create-pull-request
+ if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success'
+ uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
with:
token: ${{ secrets.COMMAND_BOT_PAT }}
commit-message: 'chore(dev-deps): Bump nextcloud/ocp package'
@@ -120,8 +143,25 @@ jobs:
signoff: true
branch: 'automated/noid/${{ matrix.branches }}-update-nextcloud-ocp'
title: '[${{ matrix.branches }}] Update nextcloud/ocp dependency'
+ add-paths: ${{ steps.check_composer_bin.outputs.files_exists == 'true' && 'vendor-bin/nextcloud-ocp/composer.json,vendor-bin/nextcloud-ocp/composer.lock' || 'composer.json,composer.lock' }}
body: |
Auto-generated update of [nextcloud/ocp](https://github.com/nextcloud-deps/ocp/) dependency
labels: |
dependencies
3. to review
+
+ # Approve using the default GITHUB_TOKEN, as the PR itself was created
+ # using COMMAND_BOT_PAT and GitHub does not allow an account to approve its own PR
+ - name: GitHub actions bot approve
+ if: steps.freeze.outputs.active != 'true' && steps.create-pull-request.outputs.pull-request-operation != 'none'
+ run: gh pr review --approve "$PR_URL"
+ env:
+ PR_URL: ${{ steps.create-pull-request.outputs.pull-request-url }}
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+ - name: Enable auto merge
+ if: steps.freeze.outputs.active != 'true' && steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE)
+ uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0
+ with:
+ token: ${{ secrets.GITHUB_TOKEN }}
+ pull-request-number: ${{ steps.create-pull-request.outputs.pull-request-number }}