From c92870aac60c41c8af5bcd13667d1bc703e5bb05 Mon Sep 17 00:00:00 2001 From: "Misha M.-Kupriyanov" Date: Sun, 30 Aug 2026 20:45:19 +0200 Subject: [PATCH 1/3] IONOS(ci): gate the remote trigger on REMOTE_TRIGGER_NC_VERSION / REMOTE_TRIGGER_RC_BRANCH MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Nextcloud-major freeze was hard-coded in `trigger-remote-dev-workflow`'s `if:` as exact-equality arms on `ionos-dev`/`ionos-stable`: the per-major lanes appeared in `on: push: branches` and in the upload-to-artifactory gate, but could never trigger a remote deploy. Moving the deployed major therefore meant editing this workflow — on every lane's own copy of it, since GitHub reads the `on:`/`if:` blocks only from the pushed branch's copy. Port nc-server's variable-driven gate (IONOS-Productivity/nc-server 01816be5fdd) so the freeze lives in repository variables instead: - bare `ionos-dev`/`ionos-stable` are always exempt - `ionos-(dev|stable)-v*` must end with REMOTE_TRIGGER_NC_VERSION - `rc/*` must equal REMOTE_TRIGGER_RC_BRANCH exactly - `*/dev/*` bypasses the version gate - REMOTE_TRIGGER_NC_VERSION unset means all versions are allowed The suffix check is deliberately scoped to the `ionos-*-v*` lanes. Applied to `rc/*` it would admit any RC branch whose name happened to end with the whitelisted version string, bypassing the exact RC whitelist — and ncw's current train, `rc/ncw-7`, encodes no major at all. Behaviour-neutral as configured. With REMOTE_TRIGGER_NC_VERSION='v31' and REMOTE_TRIGGER_RC_BRANCH='rc/ncw-7', ionos-dev (NC31), ionos-stable and rc/ncw-7 trigger exactly as before and ionos-dev-v32 (NC32) stays frozen — now because v32 is not the whitelisted major rather than because the YAML excludes it. DISABLE_REMOTE_TRIGGER='true' is set repo-wide, so this lands inert regardless. The BUILD_TYPE stable arm has to widen in the same commit: suffixed stable lanes can now reach the job and would otherwise deploy as BUILD_TYPE=dev. It uses the same idiom the upload job's stage-prefix arm already does. The `Check configuration` preflight and the debug-pipeline-status variable dump are part of the same change, not a follow-up: the preflight predicts whether the trigger job will run, so leaving it unaware of the new variables would make it report an outcome the pipeline does not produce. Adapted from nc-server rather than copied: ncw's VALID_BRANCH_PATTERN is already per-major aware and is kept over nc-server's looser variant, and the ncw-only `Assert branch major matches version.php` guard stays the thing that stops a lane building one major and deploying under the name of another. Signed-off-by: Misha M.-Kupriyanov --- .github/workflows/build-artifact.yml | 113 ++++++++++++++++++++------- 1 file changed, 86 insertions(+), 27 deletions(-) diff --git a/.github/workflows/build-artifact.yml b/.github/workflows/build-artifact.yml index dbc610e06c6e0..1b720d86c2d89 100644 --- a/.github/workflows/build-artifact.yml +++ b/.github/workflows/build-artifact.yml @@ -186,6 +186,8 @@ jobs: echo "### 🔧 Remote Trigger Configuration" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "**DISABLE_REMOTE_TRIGGER value:** \`${{ vars.DISABLE_REMOTE_TRIGGER }}\`" >> $GITHUB_STEP_SUMMARY + echo "**REMOTE_TRIGGER_NC_VERSION:** \`${{ vars.REMOTE_TRIGGER_NC_VERSION }}\`" >> $GITHUB_STEP_SUMMARY + echo "**REMOTE_TRIGGER_RC_BRANCH:** \`${{ vars.REMOTE_TRIGGER_RC_BRANCH }}\`" >> $GITHUB_STEP_SUMMARY echo "**Event type:** \`${{ github.event_name }}\`" >> $GITHUB_STEP_SUMMARY echo "**Branch:** \`${{ github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY @@ -193,9 +195,11 @@ jobs: echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" echo "🔧 Remote Trigger Configuration" echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" - echo "DISABLE_REMOTE_TRIGGER = '${{ vars.DISABLE_REMOTE_TRIGGER }}'" - echo "Event type = '${{ github.event_name }}'" - echo "Branch = '${{ github.ref_name }}'" + echo "DISABLE_REMOTE_TRIGGER = '${{ vars.DISABLE_REMOTE_TRIGGER }}'" + echo "REMOTE_TRIGGER_NC_VERSION = '${{ vars.REMOTE_TRIGGER_NC_VERSION }}'" + echo "REMOTE_TRIGGER_RC_BRANCH = '${{ vars.REMOTE_TRIGGER_RC_BRANCH }}'" + echo "Event type = '${{ github.event_name }}'" + echo "Branch = '${{ github.ref_name }}'" echo "" if [ "${{ vars.DISABLE_REMOTE_TRIGGER }}" == "true" ]; then @@ -230,6 +234,7 @@ jobs: # Check if branch matches expected patterns: ionos-dev[-v], ionos-stable[-v], rc/* or */dev/* VALID_BRANCH_PATTERN='^(ionos-dev|ionos-stable)(-v[0-9]+)?$|^rc/.*$|^[^/]+/dev/.*$' VALID_BRANCH_DESC="'ionos-dev[-v]', 'ionos-stable[-v]', 'rc/*' or '*/dev/*'" + USER_DEV_PATTERN='^[^/]+/dev/.*$' if [[ ! "${{ github.ref_name }}" =~ $VALID_BRANCH_PATTERN ]]; then echo "- ❌ Branch must be ${VALID_BRANCH_DESC} (current: \`${{ github.ref_name }}\`)" >> $GITHUB_STEP_SUMMARY echo " ❌ Branch is '${{ github.ref_name }}' (must be ${VALID_BRANCH_DESC})" @@ -239,6 +244,43 @@ jobs: echo " ✅ Branch is '${{ github.ref_name }}'" fi + # This block is the shell twin of the version gate in the + # 'trigger-remote-dev-workflow' if: condition. The two are one rule written + # twice — an edit to either must be mirrored in the other, or this summary + # reports an outcome the pipeline does not produce. + if [[ "${{ github.ref_name }}" =~ $USER_DEV_PATTERN ]]; then + echo "- ✅ Version gate: '*/dev/*' branches are not version-gated" >> $GITHUB_STEP_SUMMARY + echo " ✅ Version gate: '*/dev/*' branches are not version-gated" + else + # Bare ionos-dev/ionos-stable are always exempt; the ionos-(dev|stable)-v* branches + # must end with REMOTE_TRIGGER_NC_VERSION; all other branches reaching here (rc/*) + # must match REMOTE_TRIGGER_RC_BRANCH exactly — the suffix check must NOT apply to + # rc/* or an RC branch could pass by coincidence of name. + NC_VERSION="${{ vars.REMOTE_TRIGGER_NC_VERSION }}" + RC_BRANCH="${{ vars.REMOTE_TRIGGER_RC_BRANCH }}" + BRANCH="${{ github.ref_name }}" + + if [ "$BRANCH" == "ionos-dev" ] || [ "$BRANCH" == "ionos-stable" ]; then + echo "- ✅ Version gate: '$BRANCH' is always exempt" >> $GITHUB_STEP_SUMMARY + echo " ✅ Version gate: '$BRANCH' is always exempt" + elif [ -z "$NC_VERSION" ]; then + echo "- ✅ Version gate: not set — all versions allowed" >> $GITHUB_STEP_SUMMARY + echo " ✅ Version gate: not set — all versions allowed" + elif [[ "$BRANCH" == ionos-dev-v* || "$BRANCH" == ionos-stable-v* ]] && [[ "$BRANCH" == *"$NC_VERSION" ]]; then + echo "- ✅ Version gate: branch \`$BRANCH\` matches \`$NC_VERSION\`" >> $GITHUB_STEP_SUMMARY + echo " ✅ Version gate: branch '$BRANCH' matches '$NC_VERSION'" + elif [ -n "$RC_BRANCH" ] && [ "$BRANCH" == "$RC_BRANCH" ]; then + echo "- ✅ Version gate: branch \`$BRANCH\` matches RC whitelist \`$RC_BRANCH\`" >> $GITHUB_STEP_SUMMARY + echo " ✅ Version gate: branch '$BRANCH' matches RC whitelist '$RC_BRANCH'" + else + echo "- ❌ Version gate: branch \`$BRANCH\` does not match version \`$NC_VERSION\` or RC branch \`$RC_BRANCH\`" >> $GITHUB_STEP_SUMMARY + echo "- ℹī¸ Build & image push will still run — only QA deployment is skipped" >> $GITHUB_STEP_SUMMARY + echo " ❌ Version gate: branch '$BRANCH' does not match version '$NC_VERSION' or RC branch '$RC_BRANCH'" + echo " ℹī¸ Build & image push will still run — only QA deployment is skipped" + WILL_TRIGGER=false + fi + fi + echo "- ℹī¸ All dependent jobs must succeed (checked at job runtime)" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY @@ -1046,30 +1088,46 @@ jobs: name: Trigger remote workflow needs: [build-artifact, upload-to-artifactory] - # Trigger remote build on "ionos-dev|ionos-stable|rc/*|*/dev/*" branch *push* defined in the on:push:branches + # Trigger remote build on "ionos-dev|ionos-stable|ionos-*-v*|rc/*|*/dev/*" branch *push* + # defined in the on:push:branches # Can be disabled via repository variable 'DISABLE_REMOTE_TRIGGER' (set to 'true' to disable) # Configure at: https://github.com/IONOS-Productivity/ncw-server/settings/variables/actions # - # NOTE (NSW-944): the per-major lanes — 'ionos-dev-v*' AND 'ionos-stable-v*' — are deliberately - # absent from the condition below while they DO appear in on:push:branches and in the - # upload-to-artifactory condition. That combination is the Nextcloud-major freeze: a per-major - # integration branch produces build artifacts you can pull with check_release.sh, but can never - # trigger a remote deploy. + # NOTE (NSW-944): the Nextcloud-major freeze lives in repository *variables*, not in this + # condition. The per-major lanes are admitted below and then gated on + # REMOTE_TRIGGER_NC_VERSION, so moving the deployed major is a variable edit rather than a + # workflow edit. Until this change the freeze was hard-coded here as exact-equality arms. # - # The arms below are exact equality on purpose. 'ionos-dev' does not match 'ionos-dev-v32', so - # the freeze holds for every future major without further edits — do not "tidy" these into - # startsWith(), which would silently start deploying the next major. + # Version-gate: only trigger QA deployment for the whitelisted NC major version. + # Set repository variable 'REMOTE_TRIGGER_NC_VERSION' to the deployed version (e.g. "v32"). + # Applies only to 'ionos-dev-v*'/'ionos-stable-v*' branches (checked by suffix); lanes for + # other majors still build & push images but will NOT trigger the remote QA workflow. + # Leave unset (empty) to allow all versions. + # The bare 'ionos-dev'/'ionos-stable' lanes are always exempt from this gate. + # RC-gate: rc/* branches are NOT covered by the NC-version suffix check above — the current + # train 'rc/ncw-7' encodes no major at all, and applying a suffix check to rc/* would let a + # branch pass by coincidence of name. Set 'REMOTE_TRIGGER_RC_BRANCH' to the exact RC branch + # that should trigger QA (e.g. "rc/ncw-7", or "rc/ncw-v32-1" in the current naming era). + # Only one RC at a time; when promoting a new RC, update the variable to the new branch name. + # */dev/* branches bypass the version gate entirely. # - # Widen this only at a cutover, when the deployed major is meant to change. Doing so also - # requires widening the BUILD_TYPE stable arm further down, which is exact-match for the same - # reason; otherwise a newly-admitted ionos-stable-v would deploy as BUILD_TYPE=dev. + # Widening the gate at a cutover also requires widening the BUILD_TYPE stable arm further + # down; otherwise a newly-admitted ionos-stable-v would deploy as BUILD_TYPE=dev. if: | always() && github.event_name == 'push' && - (github.ref_name == 'ionos-dev' || github.ref_name == 'ionos-stable' || startsWith(github.ref_name, 'rc/') || contains(github.ref_name, '/dev/')) && + (github.ref_name == 'ionos-dev' || github.ref_name == 'ionos-stable' || + startsWith(github.ref_name, 'ionos-dev-v') || startsWith(github.ref_name, 'ionos-stable-v') || + startsWith(github.ref_name, 'rc/') || contains(github.ref_name, '/dev/')) && needs.build-artifact.result == 'success' && needs.upload-to-artifactory.result == 'success' && - vars.DISABLE_REMOTE_TRIGGER != 'true' + vars.DISABLE_REMOTE_TRIGGER != 'true' && + (contains(github.ref_name, '/dev/') || + github.ref_name == 'ionos-dev' || github.ref_name == 'ionos-stable' || + vars.REMOTE_TRIGGER_NC_VERSION == '' || + ((startsWith(github.ref_name, 'ionos-dev-v') || startsWith(github.ref_name, 'ionos-stable-v')) && + endsWith(github.ref_name, vars.REMOTE_TRIGGER_NC_VERSION)) || + github.ref_name == vars.REMOTE_TRIGGER_RC_BRANCH) steps: - name: Check prerequisites run: | @@ -1140,14 +1198,14 @@ jobs: # | ref_name | GITLAB_REF | BUILD_TYPE | # |------------------|--------------|-------------| # | ionos-dev | main | dev | + # | ionos-dev-v* | main | dev | # | ionos-stable | main | stable | + # | ionos-stable-v* | main | stable | # | rc/* | main | rc | # | */dev/* | main | dev-* | # - # The per-major lanes — ionos-dev-v* and ionos-stable-v* — have no rows because they - # never reach this job: the if: condition above matches the unsuffixed names by exact - # equality. That is the freeze. Do not add speculative arms for them here; an - # unreachable arm reads as support that does not exist. + # BUILD_TYPE only says which lane a build came from — which major it carries is + # NC_MAJOR below, so the per-major lanes share their unsuffixed lane's BUILD_TYPE. # # GITLAB_REF stays 'main' for every lane and BUILD_TYPE keeps its existing values — # both are consumed on the GitLab side, so changing either needs a coordinated change @@ -1155,12 +1213,11 @@ jobs: BUILD_TYPE="dev" - # Override build type for the stable branch. Exact match, deliberately unlike the - # upload job's stage-prefix arm, which does accept ionos-stable-v: that job's gate - # admits the per-major lanes and this one does not. Widening the gate at a cutover - # must widen this arm in the same change, or a suffixed stable lane would deploy as - # BUILD_TYPE=dev. - if [ "${{ github.ref_name }}" == "ionos-stable" ]; then + # Override build type for the stable branches. Matches the suffixed form too, the same + # way the upload job's stage-prefix arm does: both jobs now admit the per-major lanes, + # and without this arm a suffixed stable lane would deploy as BUILD_TYPE=dev. The dev + # lanes need no arm — ionos-dev and ionos-dev-v both fall through to the default. + if [[ "${{ github.ref_name }}" == "ionos-stable" || "${{ github.ref_name }}" == ionos-stable-v[0-9]* ]]; then BUILD_TYPE="stable" # Override build type for rc/* branches elif [[ "${{ github.ref_name }}" =~ ^rc/ ]]; then @@ -1469,6 +1526,8 @@ jobs: echo "" echo "### Repository Variables" echo "DISABLE_REMOTE_TRIGGER: ${{ vars.DISABLE_REMOTE_TRIGGER || 'not set' }}" + echo "REMOTE_TRIGGER_NC_VERSION: ${{ vars.REMOTE_TRIGGER_NC_VERSION || 'not set' }}" + echo "REMOTE_TRIGGER_RC_BRANCH: ${{ vars.REMOTE_TRIGGER_RC_BRANCH || 'not set' }}" echo "" echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" From ca8eea4e14c3a097c3d8cf3bc95e3f2725f5bab8 Mon Sep 17 00:00:00 2001 From: "Misha M.-Kupriyanov" Date: Sun, 30 Aug 2026 20:47:08 +0200 Subject: [PATCH 2/3] IONOS(ci): gate */dev/* GitLab trigger behind ENABLE_REMOTE_TRIGGER_USER_DEV MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every push to a `*/dev/*` user dev branch triggers a QA deployment today. That is unconditional: the only kill switch is DISABLE_REMOTE_TRIGGER, which is repo-wide and takes the protected lanes down with it. Port nc-server's opt-in (IONOS-Productivity/nc-server e3e638e1201): the trigger job now additionally requires ENABLE_REMOTE_TRIGGER_USER_DEV == 'true' for that branch class. `*/dev/*` branches keep building and keep uploading to Artifactory — only the GitLab QA trigger becomes opt-in. This is the one intentional behaviour change in this series. Set the repository variable to 'true' to restore the previous behaviour: https://github.com/IONOS-Productivity/ncw-server/settings/variables/actions The opt-in sits in the branch-admission clause, not in the version gate, so `*/dev/*` still bypasses REMOTE_TRIGGER_NC_VERSION once opted in — a user dev branch carries no major in its name and there is nothing to compare against. Signed-off-by: Misha M.-Kupriyanov --- .github/workflows/build-artifact.yml | 31 ++++++++++++++++++++++++---- 1 file changed, 27 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build-artifact.yml b/.github/workflows/build-artifact.yml index 1b720d86c2d89..89a4fc1961d99 100644 --- a/.github/workflows/build-artifact.yml +++ b/.github/workflows/build-artifact.yml @@ -186,6 +186,10 @@ jobs: echo "### 🔧 Remote Trigger Configuration" >> $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "**DISABLE_REMOTE_TRIGGER value:** \`${{ vars.DISABLE_REMOTE_TRIGGER }}\`" >> $GITHUB_STEP_SUMMARY + echo "**ENABLE_REMOTE_TRIGGER_USER_DEV value:** \`${{ vars.ENABLE_REMOTE_TRIGGER_USER_DEV }}\`" >> $GITHUB_STEP_SUMMARY + if [ "${{ vars.ENABLE_REMOTE_TRIGGER_USER_DEV }}" != "true" ]; then + echo " - 💡 To enable the GitLab trigger for \`*/dev/*\` branches, set repository variable \`ENABLE_REMOTE_TRIGGER_USER_DEV\` to \`true\` at [Settings → Variables → Actions](https://github.com/${{ github.repository }}/settings/variables/actions)." >> $GITHUB_STEP_SUMMARY + fi echo "**REMOTE_TRIGGER_NC_VERSION:** \`${{ vars.REMOTE_TRIGGER_NC_VERSION }}\`" >> $GITHUB_STEP_SUMMARY echo "**REMOTE_TRIGGER_RC_BRANCH:** \`${{ vars.REMOTE_TRIGGER_RC_BRANCH }}\`" >> $GITHUB_STEP_SUMMARY echo "**Event type:** \`${{ github.event_name }}\`" >> $GITHUB_STEP_SUMMARY @@ -196,6 +200,12 @@ jobs: echo "🔧 Remote Trigger Configuration" echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" echo "DISABLE_REMOTE_TRIGGER = '${{ vars.DISABLE_REMOTE_TRIGGER }}'" + echo "ENABLE_REMOTE_TRIGGER_USER_DEV = '${{ vars.ENABLE_REMOTE_TRIGGER_USER_DEV }}'" + if [ "${{ vars.ENABLE_REMOTE_TRIGGER_USER_DEV }}" != "true" ]; then + echo " 💡 To enable the GitLab trigger for '*/dev/*' branches," + echo " set repository variable ENABLE_REMOTE_TRIGGER_USER_DEV to 'true' at:" + echo " https://github.com/${{ github.repository }}/settings/variables/actions" + fi echo "REMOTE_TRIGGER_NC_VERSION = '${{ vars.REMOTE_TRIGGER_NC_VERSION }}'" echo "REMOTE_TRIGGER_RC_BRANCH = '${{ vars.REMOTE_TRIGGER_RC_BRANCH }}'" echo "Event type = '${{ github.event_name }}'" @@ -249,8 +259,17 @@ jobs: # twice — an edit to either must be mirrored in the other, or this summary # reports an outcome the pipeline does not produce. if [[ "${{ github.ref_name }}" =~ $USER_DEV_PATTERN ]]; then - echo "- ✅ Version gate: '*/dev/*' branches are not version-gated" >> $GITHUB_STEP_SUMMARY - echo " ✅ Version gate: '*/dev/*' branches are not version-gated" + # Not version-gated; governed solely by the ENABLE_REMOTE_TRIGGER_USER_DEV opt-in. + if [ "${{ vars.ENABLE_REMOTE_TRIGGER_USER_DEV }}" == "true" ]; then + echo "- ✅ User-dev branch opt-in (\`ENABLE_REMOTE_TRIGGER_USER_DEV='true'\`)" >> $GITHUB_STEP_SUMMARY + echo " ✅ ENABLE_REMOTE_TRIGGER_USER_DEV='true' — '*/dev/*' trigger is opted in" + else + echo "- ❌ User-dev branch requires \`ENABLE_REMOTE_TRIGGER_USER_DEV='true'\` (current: \`${{ vars.ENABLE_REMOTE_TRIGGER_USER_DEV }}\`)" >> $GITHUB_STEP_SUMMARY + echo "- ℹī¸ Build & image push will still run — only QA deployment is skipped" >> $GITHUB_STEP_SUMMARY + echo " ❌ '*/dev/*' branch requires ENABLE_REMOTE_TRIGGER_USER_DEV='true' (current: '${{ vars.ENABLE_REMOTE_TRIGGER_USER_DEV }}')" + echo " ℹī¸ Build & image push will still run — only QA deployment is skipped" + WILL_TRIGGER=false + fi else # Bare ionos-dev/ionos-stable are always exempt; the ionos-(dev|stable)-v* branches # must end with REMOTE_TRIGGER_NC_VERSION; all other branches reaching here (rc/*) @@ -1109,7 +1128,9 @@ jobs: # branch pass by coincidence of name. Set 'REMOTE_TRIGGER_RC_BRANCH' to the exact RC branch # that should trigger QA (e.g. "rc/ncw-7", or "rc/ncw-v32-1" in the current naming era). # Only one RC at a time; when promoting a new RC, update the variable to the new branch name. - # */dev/* branches bypass the version gate entirely. + # */dev/* branches bypass the version gate entirely and are controlled solely by repository + # variable 'ENABLE_REMOTE_TRIGGER_USER_DEV' (default off — set to 'true' to let user dev + # branches deploy to QA). They still build and still upload to Artifactory when off. # # Widening the gate at a cutover also requires widening the BUILD_TYPE stable arm further # down; otherwise a newly-admitted ionos-stable-v would deploy as BUILD_TYPE=dev. @@ -1118,7 +1139,8 @@ jobs: github.event_name == 'push' && (github.ref_name == 'ionos-dev' || github.ref_name == 'ionos-stable' || startsWith(github.ref_name, 'ionos-dev-v') || startsWith(github.ref_name, 'ionos-stable-v') || - startsWith(github.ref_name, 'rc/') || contains(github.ref_name, '/dev/')) && + startsWith(github.ref_name, 'rc/') || + (contains(github.ref_name, '/dev/') && vars.ENABLE_REMOTE_TRIGGER_USER_DEV == 'true')) && needs.build-artifact.result == 'success' && needs.upload-to-artifactory.result == 'success' && vars.DISABLE_REMOTE_TRIGGER != 'true' && @@ -1526,6 +1548,7 @@ jobs: echo "" echo "### Repository Variables" echo "DISABLE_REMOTE_TRIGGER: ${{ vars.DISABLE_REMOTE_TRIGGER || 'not set' }}" + echo "ENABLE_REMOTE_TRIGGER_USER_DEV: ${{ vars.ENABLE_REMOTE_TRIGGER_USER_DEV || 'not set' }}" echo "REMOTE_TRIGGER_NC_VERSION: ${{ vars.REMOTE_TRIGGER_NC_VERSION || 'not set' }}" echo "REMOTE_TRIGGER_RC_BRANCH: ${{ vars.REMOTE_TRIGGER_RC_BRANCH || 'not set' }}" echo "" From d42269f68152638b24efbe3091e70a1ee61b6221 Mon Sep 17 00:00:00 2001 From: "Misha M.-Kupriyanov" Date: Sun, 30 Aug 2026 20:47:33 +0200 Subject: [PATCH 3/3] IONOS(ci): forward the source ref name to the remote trigger BUILD_TYPE says which lane a build came from ('dev', 'stable', 'rc', 'dev-') and NC_MAJOR says which Nextcloud major it carries, but neither names the branch. A downstream release report could not tell 'rc/ncw-6' from 'rc/ncw-7', nor link back to the source branch. Forward github.ref_name and github.repository as GITHUB_REF_NAME and GITHUB_REPOSITORY, as nc-server does (IONOS-Productivity/nc-server 3b676abd6da, HDNEXT-1373). Purely additive: two new trigger variables. Existing GitLab-side consumers of GITHUB_SHA, NC_VERSION, NC_MAJOR, BUILD_ID, BUILD_TYPE and SOURCE_BUILD_URL are untouched, so this needs no coordinated change there. Signed-off-by: Misha M.-Kupriyanov --- .github/workflows/build-artifact.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/build-artifact.yml b/.github/workflows/build-artifact.yml index 89a4fc1961d99..38a9d8d104734 100644 --- a/.github/workflows/build-artifact.yml +++ b/.github/workflows/build-artifact.yml @@ -1228,6 +1228,8 @@ jobs: # # BUILD_TYPE only says which lane a build came from — which major it carries is # NC_MAJOR below, so the per-major lanes share their unsuffixed lane's BUILD_TYPE. + # The ref name is forwarded verbatim as well, so the downstream release report can + # name the exact RC or branch and link back to it. # # GITLAB_REF stays 'main' for every lane and BUILD_TYPE keeps its existing values — # both are consumed on the GitLab side, so changing either needs a coordinated change @@ -1286,6 +1288,8 @@ jobs: --form "variables[NC_MAJOR]=${NC_MAJOR}" \ --form "variables[BUILD_ID]=${{ github.run_id }}" \ --form "variables[BUILD_TYPE]=${BUILD_TYPE}" \ + --form "variables[GITHUB_REF_NAME]=${{ github.ref_name }}" \ + --form "variables[GITHUB_REPOSITORY]=${{ github.repository }}" \ --form "variables[SOURCE_BUILD_URL]=${SOURCE_BUILD_URL}" \ "${{ secrets.GITLAB_TRIGGER_URL }}"; then TRIGGER_SUCCESS=true