chore(deps-dev): bump rector/rector from 2.6.4 to 2.6.6 in /vendor-bin/rector #519
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow is provided via the organization template repository | |
| # | |
| # https://github.com/nextcloud/.github | |
| # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization | |
| # | |
| # SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors | |
| # SPDX-FileCopyrightText: 2024 Arthur Schiwon <blizzz@arthur-schiwon.de> | |
| # SPDX-License-Identifier: MIT | |
| name: OpenAPI | |
| # This job had NEVER ONCE PASSED, for a reason that had nothing to do with this | |
| # repository's code: | |
| # | |
| # PHP Fatal error: license: Unable to convert EUPL-1.2 to SPDX identifier | |
| # | |
| # nextcloud/openapi-extractor maps licences through a hardcoded match() in | |
| # src/Helpers.php that accepts agpl / mit / mpl / apache / gpl3 and five SPDX | |
| # spellings, and calls Logger::panic() — a fatal, not a warning — on anything | |
| # else. EUPL-1.2 is a valid SPDX identifier and is what every Conduction app | |
| # ships under, so the tool could not run against any of them. Upstream `main` | |
| # still had the same list on 2026-08-18. | |
| # | |
| # We do not get to wait on an upstream fix, and we do not get to disable a | |
| # check to hide it. So the tool is PATCHED at install time — see | |
| # vendor-bin/openapi-extractor/patches/ and the composer-patches wiring beside | |
| # it. The patch is pinned to the exact version this repo already pinned | |
| # (v1.8.7); if that pin moves and the patch stops applying, composer fails | |
| # LOUDLY rather than silently reverting to the broken behaviour. | |
| # | |
| # Two dishonest routes were rejected on the way: mislabelling the licence to | |
| # suit the tool, and marking the step continue-on-error so a broken job | |
| # reports green. The second is worse than the red. | |
| # | |
| # With the fatal gone the extractor reaches this app's controllers for the | |
| # first time and reports real findings about them. Those are ours, and the | |
| # trigger is back on so they stay visible. | |
| on: pull_request | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: openapi-${{ github.head_ref || github.run_id }} | |
| cancel-in-progress: true | |
| jobs: | |
| openapi: | |
| runs-on: ubuntu-latest | |
| # Observed fleet-wide: max 1.0 min (n=5). Deliberately loose. | |
| timeout-minutes: 20 | |
| if: ${{ github.repository_owner != 'nextcloud-gmbh' }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Get php version | |
| id: php_versions | |
| uses: icewind1991/nextcloud-version-matrix@8a7bac6300b2f0f3100088b297995a229558ddba # v1.3.2 | |
| - name: Set up php | |
| uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0 | |
| with: | |
| php-version: ${{ steps.php_versions.outputs.php-available }} | |
| extensions: xml | |
| coverage: none | |
| ini-file: development | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Check Typescript OpenApi types | |
| id: check_typescript_openapi | |
| uses: andstor/file-existence-action@076e0072799f4942c8bc574a82233e1e4d13e9d6 # v3.0.0 | |
| with: | |
| files: "src/types/openapi/openapi*.ts" | |
| - name: Read package.json node and npm engines version | |
| if: steps.check_typescript_openapi.outputs.files_exists == 'true' | |
| uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3 | |
| id: node_versions | |
| # Continue if no package.json | |
| continue-on-error: true | |
| with: | |
| fallbackNode: '^24' | |
| fallbackNpm: '^11.3' | |
| - name: Set up node ${{ steps.node_versions.outputs.nodeVersion }} | |
| if: ${{ steps.node_versions.outputs.nodeVersion }} | |
| uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 | |
| with: | |
| node-version: ${{ steps.node_versions.outputs.nodeVersion }} | |
| - name: Set up npm ${{ steps.node_versions.outputs.npmVersion }} | |
| if: ${{ steps.node_versions.outputs.nodeVersion }} | |
| run: npm i -g 'npm@${{ steps.node_versions.outputs.npmVersion }}' | |
| - name: Install dependencies | |
| if: ${{ steps.node_versions.outputs.nodeVersion }} | |
| env: | |
| CYPRESS_INSTALL_BINARY: 0 | |
| PUPPETEER_SKIP_DOWNLOAD: true | |
| run: | | |
| npm ci | |
| - name: Set up dependencies | |
| run: composer i | |
| - name: Regenerate OpenAPI | |
| run: composer run openapi | |
| # `info.version` HAS TWO WRITERS, and they can never agree. | |
| # | |
| # release.yml deliberately writes the release version into | |
| # openapi.json's `info.version` as well as appinfo/info.xml — it says so | |
| # itself ("a SECOND time, in openapi.json's info.version") and refuses to | |
| # commit if the patch did not land, because an OpenAPI document whose | |
| # version drifts from the app's is wrong. | |
| # | |
| # The extractor regenerates that field from its own default. Measured on | |
| # 2026-08-30, versioniq #245: the ONLY difference between the committed | |
| # document and the regenerated one was | |
| # | |
| # - "version": "1.4.3-unstable.20260830082124", | |
| # + "version": "0.0.1", | |
| # | |
| # so this check failed on a document that was otherwise byte-identical, | |
| # and would fail again after every single release. | |
| # | |
| # Restoring the committed value before comparing keeps the check honest: | |
| # it still catches real drift in paths, schemas and responses — the thing | |
| # it exists to catch — and stops failing on the one field it does not own. | |
| # Deliberately NOT `continue-on-error` or a deleted step: this narrows the | |
| # comparison, it does not silence it. | |
| # EDIT THE TEXT, NEVER RE-SERIALISE. The first attempt round-tripped the | |
| # document through json.load/json.dump and turned every non-ASCII | |
| # character into a \uXXXX escape (json.dump defaults to | |
| # ensure_ascii=True), so an em dash in a description became — and | |
| # the check failed on hundreds of lines it had just rewritten itself. | |
| # Replacing only the version token leaves every other byte untouched, | |
| # which is the whole point of a freshness comparison. | |
| - name: Restore the info.version that release.yml owns | |
| run: | | |
| set -euo pipefail | |
| for f in openapi*.json; do | |
| [ -e "$f" ] || continue | |
| committed=$(git show "HEAD:$f" | python3 -c 'import json,sys; print(json.load(sys.stdin)["info"]["version"])') | |
| COMMITTED="$committed" python3 - "$f" <<'PY' | |
| import json, os, re, sys | |
| path = sys.argv[1] | |
| want = os.environ["COMMITTED"] | |
| with open(path, encoding="utf-8") as fh: | |
| text = fh.read() | |
| have = json.loads(text)["info"]["version"] | |
| if have == want: | |
| print(f"{path}: info.version already {want}") | |
| raise SystemExit(0) | |
| # Anchored on the "info" object's own version, so a "version" key | |
| # anywhere else in the document (a parameter, a schema) is untouched. | |
| pattern = re.compile( | |
| r'("info"\s*:\s*\{(?:[^{}]|\{[^{}]*\})*?"version"\s*:\s*)"' | |
| + re.escape(have) + r'"', | |
| re.S, | |
| ) | |
| new_text, n = pattern.subn(lambda m: m.group(1) + json.dumps(want), text, count=1) | |
| if n != 1: | |
| sys.exit(f"{path}: expected exactly one info.version to replace, matched {n}") | |
| with open(path, "w", encoding="utf-8") as fh: | |
| fh.write(new_text) | |
| print(f"{path}: info.version {have} -> {want}") | |
| PY | |
| done | |
| - name: Check openapi*.json and typescript changes | |
| run: | | |
| bash -c "[[ ! \"`git status --porcelain `\" ]] || (echo 'Please run \"composer run openapi\" and commit the openapi*.json files and (if applicable) src/types/openapi/openapi*.ts, see the section \"Show changes on failure\" for details' && exit 1)" | |
| - name: Show changes on failure | |
| if: failure() | |
| run: | | |
| git status | |
| git --no-pager diff | |
| exit 1 # make it red to grab attention |