Release: merge development into beta

.github/workflows/beta-release.yaml

@@ -8,6 +8,8 @@ on:
 jobs:
   release-management:
     runs-on: ubuntu-latest
+    # Observed fleet-wide: n=26 runs, max 0.7 min; bounded loosely at 45 min because a spurious release failure is expensive
+    timeout-minutes: 45
     steps:
 
       - name: Checkout Code

.github/workflows/build-exapp.yaml

@@ -0,0 +1,62 @@
+name: Build and Push ExApp Docker Image
+
+on:
+  push:
+    branches:
+      - main
+      - beta
+    tags:
+      - 'v*'
+  pull_request:
+    branches:
+      - main
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: conductionnl/valtimo-exapp
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    # No successful runs observed yet (multi-arch docker build); bounded loosely at 30 min
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/pull-request-from-branch-check.yaml

@@ -0,0 +1,34 @@
+name: Branch Protection
+
+on:
+  pull_request:
+    branches:
+      - main
+      - beta
+
+jobs:
+  check-branch:
+    runs-on: ubuntu-latest
+    # Observed fleet-wide: n=123 runs, max 0.1 min
+    timeout-minutes: 10
+    steps:
+      - name: Check branch
+        run: |
+          TARGET="${{ github.base_ref }}"
+          SOURCE="${{ github.head_ref }}"
+
+          if [[ "$TARGET" == "main" ]]; then
+            if [[ "$SOURCE" != "beta" ]] && ! [[ "$SOURCE" =~ ^hotfix ]]; then
+              echo "Error: Pull requests to main must come from 'beta' or a branch starting with 'hotfix'"
+              echo "Source branch: $SOURCE"
+              exit 1
+            fi
+          elif [[ "$TARGET" == "beta" ]]; then
+            if [[ "$SOURCE" != "development" ]] && ! [[ "$SOURCE" =~ ^hotfix ]]; then
+              echo "Error: Pull requests to beta must come from 'development' or a branch starting with 'hotfix'"
+              echo "Source branch: $SOURCE"
+              exit 1
+            fi
+          fi
+
+          echo "Branch check passed: $SOURCE -> $TARGET"

.github/workflows/pull-request-lint-check.yaml

@@ -0,0 +1,35 @@
+name: Lint Check
+
+on:
+  pull_request:
+    branches:
+      - development
+      - main
+
+jobs:
+  lint-check:
+    runs-on: ubuntu-latest
+    # Observed fleet-wide: n=176 runs, median 0.6 min, max 1.4 min
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Check for package.json
+        id: has_pkg
+        run: |
+          if [ -f package.json ]; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::No package.json found at repo root; lint-check is a no-op for this repo."
+          fi
+
+      - name: Install dependencies
+        if: steps.has_pkg.outputs.exists == 'true'
+        run: npm i
+
+      - name: Linting
+        if: steps.has_pkg.outputs.exists == 'true'
+        run: npm run lint

.github/workflows/push-development-to-beta.yaml

@@ -0,0 +1,46 @@
+name: Create PR to Beta
+
+permissions:
+  contents: write
+  pull-requests: write
+
+on:
+  push:
+    branches:
+      - development
+
+jobs:
+  create-pr:
+    runs-on: ubuntu-latest
+    # Observed fleet-wide: n=152 runs, max 5.6 min
+    timeout-minutes: 20
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Create or update PR to beta
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Check if beta branch exists
+          if ! git ls-remote --heads origin beta | grep -q beta; then
+            echo "Beta branch does not exist yet. Creating from development..."
+            git push origin origin/development:refs/heads/beta
+          fi
+
+          # Check if a PR already exists
+          EXISTING_PR=$(gh pr list --base beta --head development --state open --json number --jq '.[0].number' || echo "")
+
+          if [ -n "$EXISTING_PR" ] && [ "$EXISTING_PR" != "null" ]; then
+            echo "PR #$EXISTING_PR already exists, it will auto-update with new commits"
+          else
+            gh pr create \
+              --base beta \
+              --head development \
+              --title "Release: merge development into beta" \
+              --body "Automated PR to sync development changes to beta for beta release.
+
+          Merging this PR will trigger the beta release workflow."
+          fi

.github/workflows/release-workflow.yaml

@@ -15,6 +15,8 @@ on:
 jobs:
   release-management:
     runs-on: ubuntu-latest
+    # Observed fleet-wide: n=26 runs, max 0.7 min; bounded loosely at 45 min because a spurious release failure is expensive
+    timeout-minutes: 45
     steps:
 
       - name: Checkout Code

.github/workflows/unstable-release.yaml

@@ -0,0 +1,179 @@
+name: Unstable Release
+
+on:
+  push:
+    branches:
+      - development
+
+jobs:
+  release-management:
+    runs-on: ubuntu-latest
+    # Observed fleet-wide: n=26 runs, max 0.7 min; bounded loosely at 45 min because a spurious release failure is expensive
+    timeout-minutes: 45
+    steps:
+
+      - name: Checkout Code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+          ssh-key: ${{ secrets.DEPLOY_KEY }}
+
+      - name: Set app env
+        run: |
+          echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV
+
+      - name: Get current version and append unstable suffix
+        id: increment_version
+        run: |
+          git fetch origin main
+          main_version=$(git show origin/main:appinfo/info.xml | grep -oP '(?<=<version>)[^<]+' || echo "")
+          current_version=$(grep -oP '(?<=<version>)[^<]+' appinfo/info.xml || echo "")
+
+          IFS='.' read -ra main_version_parts <<< "$main_version"
+          next_patch=$((main_version_parts[2] + 1))
+
+          unstable_counter=1
+          if [[ $current_version =~ -unstable\.([0-9]+)$ ]]; then
+            current_patch=$(echo $current_version | grep -oP '^[0-9]+\.[0-9]+\.(\d+)' | cut -d. -f3)
+            if [ "$current_patch" -eq "$next_patch" ]; then
+              unstable_counter=$((BASH_REMATCH[1] + 1))
+            fi
+          fi
+
+          unstable_version="${main_version_parts[0]}.${main_version_parts[1]}.${next_patch}-unstable.${unstable_counter}"
+
+          echo "NEW_VERSION=$unstable_version" >> $GITHUB_ENV
+          echo "new_version=$unstable_version" >> $GITHUB_OUTPUT
+          echo "Main version: $main_version"
+          echo "Current version: $current_version"
+          echo "Using unstable version: $unstable_version"
+
+      - name: Update version in info.xml
+        run: |
+          sed -i "s|<version>.*</version>|<version>${{ env.NEW_VERSION }}</version>|" appinfo/info.xml
+
+      - name: Commit version update
+        run: |
+          git config --local user.email "action@github.com"
+          git config --local user.name "GitHub Action"
+
+          if git diff --quiet && git diff --cached --quiet; then
+            echo "No changes to commit"
+          else
+            git add appinfo/info.xml
+            git commit -m "Bump unstable version to ${{ env.NEW_VERSION }} [skip ci]"
+            git push
+          fi
+
+      - name: Prepare Signing Certificate and Key
+        run: |
+          echo "${{ secrets.NEXTCLOUD_SIGNING_CERT }}" > signing-cert.crt
+          echo "${{ secrets.NEXTCLOUD_SIGNING_KEY }}" > signing-key.key
+
+      - name: Install npm dependencies
+        uses: actions/setup-node@v3
+        with:
+          node-version: '18.x'
+
+      - name: Set up PHP and install extensions
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.2'
+          extensions: zip, gd
+
+      - run: npm ci
+      - run: npm run build
+      - run: composer install --no-dev --optimize-autoloader --classmap-authoritative
+
+      - name: Copy the package files into the package
+        run: |
+          mkdir -p package/${{ github.event.repository.name }}
+          rsync -av --progress \
+            --exclude='/package' \
+            --exclude='/.git' \
+            --exclude='/.github' \
+            --exclude='/.cursor' \
+            --exclude='/.vscode' \
+            --exclude='/node_modules' \
+            --exclude='/src' \
+            --exclude='/tests' \
+            --exclude='/package.json' \
+            --exclude='/package-lock.json' \
+            --exclude='/composer.json' \
+            --exclude='/composer.lock' \
+            --exclude='/phpcs.xml' \
+            --exclude='/phpmd.xml' \
+            --exclude='/psalm.xml' \
+            --exclude='/phpunit.xml' \
+            --exclude='/.phpunit.cache' \
+            --exclude='.phpunit.result.cache' \
+            --exclude='/jest.config.js' \
+            --exclude='/webpack.config.js' \
+            --exclude='/tsconfig.json' \
+            --exclude='/.babelrc' \
+            --exclude='/.eslintrc.js' \
+            --exclude='/.prettierrc' \
+            --exclude='/stylelint.config.js' \
+            --exclude='/.gitignore' \
+            --exclude='/.gitattributes' \
+            --exclude='/signing-key.key' \
+            --exclude='/signing-cert.crt' \
+            ./ package/${{ github.event.repository.name }}/
+
+      - name: Create Tarball
+        run: |
+          cd package && tar -czf ../nextcloud-release.tar.gz ${{ github.event.repository.name }}
+
+      - name: Sign the TAR.GZ file with OpenSSL
+        run: |
+          openssl dgst -sha512 -sign signing-key.key nextcloud-release.tar.gz | openssl base64 -out nextcloud-release.signature
+
+      - name: Upload tarball as artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: nextcloud-release-${{ env.NEW_VERSION }}
+          path: |
+            nextcloud-release.tar.gz
+            nextcloud-release.signature
+          retention-days: 30
+
+      - name: Git Version
+        id: version
+        uses: codacy/git-version@2.7.1
+        with:
+          release-branch: development
+
+      - name: Upload Unstable Release
+        uses: ncipollo/release-action@v1.12.0
+        with:
+          tag: v${{ env.NEW_VERSION }}
+          name: Unstable Release ${{ env.NEW_VERSION }}
+          draft: false
+          prerelease: true
+          skipIfReleaseExists: true
+
+      - name: Attach tarball to GitHub release
+        uses: svenstaro/upload-release-action@v2
+        with:
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          file: nextcloud-release.tar.gz
+          asset_name: ${{ env.APP_NAME }}-${{ env.NEW_VERSION }}.tar.gz
+          tag: v${{ env.NEW_VERSION }}
+          overwrite: true
+
+      - name: Upload app to Nextcloud appstore
+        uses: nextcloud-releases/nextcloud-appstore-push-action@a011fe619bcf6e77ddebc96f9908e1af4071b9c1
+        with:
+          app_name: ${{ env.APP_NAME }}
+          appstore_token: ${{ secrets.NEXTCLOUD_APPSTORE_TOKEN }}
+          download_url: https://github.com/${{ github.repository }}/releases/download/v${{ env.NEW_VERSION }}/${{ env.APP_NAME }}-${{ env.NEW_VERSION }}.tar.gz
+          app_private_key: ${{ secrets.NEXTCLOUD_SIGNING_KEY }}
+          nightly: true
+
+      - name: Verify release
+        run: |
+          echo "App version: ${{ env.NEW_VERSION }}"
+          echo "Tarball contents:"
+          tar -tvf nextcloud-release.tar.gz | head -50
+          echo "info.xml contents:"
+          tar -xOf nextcloud-release.tar.gz ${{ env.APP_NAME }}/appinfo/info.xml