From 417cdc3877c5ba5d1093f32c40792e203cb8d4b7 Mon Sep 17 00:00:00 2001 From: nextcloud-command Date: Sun, 21 Jun 2026 03:26:50 +0000 Subject: [PATCH 1/3] ci(actions): Update workflow templates from organization template repository Signed-off-by: GitHub --- .github/actions-lock.txt | 45 ++++++++++--------- .github/workflows/appstore-build-publish.yml | 6 +-- .../block-unconventional-commits.yml | 2 +- .github/workflows/command-openapi.yml | 2 +- .../workflows/dependabot-approve-merge.yml | 42 ++++++----------- .github/workflows/lint-eslint.yml | 2 +- .github/workflows/lint-info-xml.yml | 2 +- .github/workflows/lint-php-cs.yml | 4 +- .github/workflows/lint-php.yml | 8 ++-- .github/workflows/lint-stylelint.yml | 2 +- .github/workflows/lint-typescript.yml | 2 +- .github/workflows/node-test.yml | 4 +- .github/workflows/npm-build.yml | 2 +- .github/workflows/openapi.yml | 4 +- .github/workflows/phpunit-mariadb.yml | 8 ++-- .github/workflows/phpunit-mysql.yml | 8 ++-- .github/workflows/phpunit-oci.yml | 8 ++-- .github/workflows/phpunit-pgsql.yml | 8 ++-- .github/workflows/phpunit-sqlite.yml | 8 ++-- .github/workflows/psalm.yml | 4 +- .github/workflows/reuse.yml | 2 +- .github/workflows/sync-workflow-templates.yml | 4 +- .../update-nextcloud-ocp-approve-merge.yml | 2 +- .github/workflows/update-nextcloud-ocp.yml | 11 +++-- 24 files changed, 89 insertions(+), 101 deletions(-) diff --git a/.github/actions-lock.txt b/.github/actions-lock.txt index 47b3bb62a05..fa63de5d964 100644 --- a/.github/actions-lock.txt +++ b/.github/actions-lock.txt @@ -1,28 +1,29 @@ # SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors # SPDX-License-Identifier: MIT -43851fd8e1125e1083be704056616c9a appstore-build-publish.yml -d42c24e161cb75a6394cb8bd347b9467 block-unconventional-commits.yml -779a27fda482f862faafbc191753d32a command-openapi.yml -cbffe424c47647a2e375f96f25b67af9 dependabot-approve-merge.yml +c5ce8fbd4caa30c89fb31be5a9aeb25d appstore-build-publish.yml +22ddcebff28350ddd79800a577323016 block-unconventional-commits.yml +943355ed4e3bf1876d32438fb6d131ec command-openapi.yml +003108ea0f5c12e1db591cd4613304d8 dependabot-approve-merge.yml 2581a67c5bcdcd570427e6d51db767d7 fixup.yml -7bcfba381bfb7c28d9ef6a7d55ac937b lint-eslint.yml -80a58e5584612def0e751fcfb7669814 lint-info-xml.yml -058024e4560ae1f18f6e4be9ecc0dacb lint-php-cs.yml -d86aa09feb6ce2ad244926aff7adcb36 lint-php.yml -bd5b5245dc07b5779031e13817663a3e lint-stylelint.yml -40fb68581bd8252e6a7ee8be6f1d99b7 node-test.yml +46a85bafa72379c179dd633e34abe000 lint-eslint.yml +784303cf47612e5c4eac621dfab5b4f4 lint-info-xml.yml +bb17aa6898f48f4caa83922c343731dc lint-php-cs.yml +70673e479df96e3e71fe966cb07c82fa lint-php.yml +a5238a69743b834ad15f2e4354b98dbd lint-stylelint.yml +2b6f997bc7021ff2577b382013d743f6 node-test.yml 03759c9dc0fa748cb927b9f9cadf2925 node.yml -887e74a10fb81844981217e649551793 openapi.yml -6da74afd101a7c60f4db81b124b1c977 phpunit-mariadb.yml -efac00595fcf8c91902a40467bb8e58a phpunit-mysql.yml -ea1ad2b41d5c8730af03c2923fd0d90d phpunit-oci.yml -5f7de35e496afb4f1206fe18017d6320 phpunit-pgsql.yml -10d907363827d671d37831b78c0a1137 phpunit-sqlite.yml +be43febd42db3d724ff73ebb3c086380 openapi.yml +883b4be7752bdbc342b6dbf7794dc378 phpunit-mariadb.yml +52f8aa335a0a3ca1eeee7380854ff5ad phpunit-mysql.yml +69b6d61696a328b8a17ad4aa6cb2a059 phpunit-oci.yml +8e00d464a8ef10740b95dc2132244626 phpunit-pgsql.yml +a7ae3a2b7529b41dae1302420eb72454 phpunit-sqlite.yml 3c4a096b3b7dbaef0f8e5190ffe13518 pr-feedback.yml -a965b7d4820a97cc232a24f6caf90d95 psalm.yml -7db5b820f3750eebe988005a0bb2febd reuse.yml -78bd5cbcc4b48cb9b0d1b0fbbb4403d7 update-nextcloud-ocp-approve-merge.yml -c62537b3800cce229cae328bd206a3d4 update-nextcloud-ocp.yml +a6e484812c25ced8bb714182656e0ab1 psalm.yml +e2bd0fc8a290e1a8641487944e27103b reuse.yml +a3440826636c0fd7c2d20b1de50363da update-nextcloud-ocp-approve-merge.yml +eb943a065c2a0711c14468fa76629eae update-nextcloud-ocp.yml 22604c31b526de270a080eb19967a638 update-stable-titles.yml -082385f85afa5bd2c42664b2ca2d6707 lint-typescript.yml -9dc6b717be0006fc7974a50351686fd7 sync-workflow-templates.yml +662cbdd012eeb980dbcd3373621d8207 lint-typescript.yml +e3c7b8f43850ad1d31c67fc0082b6bb8 sync-workflow-templates.yml +21036682b2608cb871b19731ffeef31f npm-build.yml diff --git a/.github/workflows/appstore-build-publish.yml b/.github/workflows/appstore-build-publish.yml index 637490157e5..ce9f8ce437a 100644 --- a/.github/workflows/appstore-build-publish.yml +++ b/.github/workflows/appstore-build-publish.yml @@ -35,7 +35,7 @@ jobs: echo "APP_VERSION=${GITHUB_REF##*/}" >> $GITHUB_ENV - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false path: ${{ env.APP_NAME }} @@ -88,7 +88,7 @@ jobs: filename: ${{ env.APP_NAME }}/appinfo/info.xml - name: Set up php ${{ steps.php-versions.outputs.php-min }} - uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: ${{ steps.php-versions.outputs.php-min }} coverage: none @@ -157,7 +157,7 @@ jobs: unzip nextcloud.zip - name: Checkout server master fallback - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 if: ${{ steps.server-download.outcome != 'success' }} with: persist-credentials: false diff --git a/.github/workflows/block-unconventional-commits.yml b/.github/workflows/block-unconventional-commits.yml index 258951e8e5b..19ff1c28000 100644 --- a/.github/workflows/block-unconventional-commits.yml +++ b/.github/workflows/block-unconventional-commits.yml @@ -27,7 +27,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false diff --git a/.github/workflows/command-openapi.yml b/.github/workflows/command-openapi.yml index 44ab38cb7fb..9660fd61afc 100644 --- a/.github/workflows/command-openapi.yml +++ b/.github/workflows/command-openapi.yml @@ -103,7 +103,7 @@ jobs: key: git-repo - name: Checkout ${{ needs.init.outputs.head_ref }} - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: # Needed to allow force push later persist-credentials: true diff --git a/.github/workflows/dependabot-approve-merge.yml b/.github/workflows/dependabot-approve-merge.yml index 40f9f319343..0450b9b1b2b 100644 --- a/.github/workflows/dependabot-approve-merge.yml +++ b/.github/workflows/dependabot-approve-merge.yml @@ -42,43 +42,27 @@ jobs: echo 'Can not approve PRs from forks' exit 1 + - uses: mdecoleman/pr-branch-name@55795d86b4566d300d237883103f052125cc7508 # v3.0.0 + id: branchname + with: + repo-token: ${{ secrets.GITHUB_TOKEN }} + - name: Dependabot metadata - if: github.event.pull_request.user.login == 'dependabot[bot]' id: metadata - uses: dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36 # v3.0.0 + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 with: github-token: ${{ secrets.GITHUB_TOKEN }} - - name: Check allowed dependency update - if: github.event.pull_request.user.login == 'dependabot[bot]' - id: validate + - name: GitHub actions bot approve + if: startsWith(steps.branchname.outputs.branch, 'dependabot/') + run: gh pr review --approve "$PR_URL" env: - IGNORE_PATTERN: ${{ env.IGNORE_PATTERN }} - DEPENDENCY_NAMES: ${{ steps.metadata.outputs.dependency-names }} - run: | - if [[ -z ${IGNORE_PATTERN} ]]; then - echo "ignore=false" >> "$GITHUB_OUTPUT" - elif [[ -z ${DEPENDENCY_NAMES} ]]; then - echo "ignore=false" >> "$GITHUB_OUTPUT" - elif [[ ${DEPENDENCY_NAMES} =~ ${IGNORE_PATTERN} ]]; then - echo "ignore=true" >> "$GITHUB_OUTPUT" - fi - - # GitHub actions bot approve - - name: Auto approve - id: auto_approve - uses: hmarr/auto-approve-action@f0939ea97e9205ef24d872e76833fa908a770363 # v4.0.0 - if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' - && steps.validate.outputs.ignore != 'true' - && ((fromJSON(env.ALLOW_MINOR) && steps.metadata.outputs.update-type == 'version-update:semver-minor') - || steps.metadata.outputs.update-type == 'version-update:semver-patch') - }} - with: - github-token: ${{ secrets.GITHUB_TOKEN }} + PR_URL: ${{ github.event.pull_request.html_url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Enable GitHub auto merge - name: Auto merge - uses: alexwilson/enable-github-automerge-action@56e3117d1ae1540309dc8f7a9f2825bc3c5f06ff # 2.0.0 - if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' && steps.auto_approve.conclusion == 'success' }} + uses: alexwilson/enable-github-automerge-action@2c32e18a76e0726ffe7a573bfff2d42a20885126 # 3.0.0 + if: startsWith(steps.branchname.outputs.branch, 'dependabot/') && (github.event.action == 'opened' || github.event.action == 'reopened') && (steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor') with: github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/lint-eslint.yml b/.github/workflows/lint-eslint.yml index 73436854651..fe436c9add5 100644 --- a/.github/workflows/lint-eslint.yml +++ b/.github/workflows/lint-eslint.yml @@ -56,7 +56,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false diff --git a/.github/workflows/lint-info-xml.yml b/.github/workflows/lint-info-xml.yml index d0c84cc92a5..f2335b70ea4 100644 --- a/.github/workflows/lint-info-xml.yml +++ b/.github/workflows/lint-info-xml.yml @@ -24,7 +24,7 @@ jobs: name: info.xml lint steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false diff --git a/.github/workflows/lint-php-cs.yml b/.github/workflows/lint-php-cs.yml index 57f7a2b1d80..fc215b4a94c 100644 --- a/.github/workflows/lint-php-cs.yml +++ b/.github/workflows/lint-php-cs.yml @@ -25,7 +25,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false @@ -34,7 +34,7 @@ jobs: uses: icewind1991/nextcloud-version-matrix@8a7bac6300b2f0f3100088b297995a229558ddba # v1.3.2 - name: Set up php${{ steps.versions.outputs.php-min }} - uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: ${{ steps.versions.outputs.php-min }} extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite diff --git a/.github/workflows/lint-php.yml b/.github/workflows/lint-php.yml index 47e4dc4f484..19d4bbac8cb 100644 --- a/.github/workflows/lint-php.yml +++ b/.github/workflows/lint-php.yml @@ -25,7 +25,7 @@ jobs: php-max: ${{ steps.versions.outputs.php-max }} steps: - name: Checkout app - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false @@ -34,7 +34,7 @@ jobs: uses: icewind1991/nextcloud-version-matrix@8a7bac6300b2f0f3100088b297995a229558ddba # v1.3.2 php-lint: - runs-on: ubuntu-latest + runs-on: ubuntu-latest-low needs: matrix strategy: matrix: @@ -44,12 +44,12 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - name: Set up php ${{ matrix.php-versions }} - uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: ${{ matrix.php-versions }} extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite diff --git a/.github/workflows/lint-stylelint.yml b/.github/workflows/lint-stylelint.yml index 52544acbb99..a7f139e6314 100644 --- a/.github/workflows/lint-stylelint.yml +++ b/.github/workflows/lint-stylelint.yml @@ -25,7 +25,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false diff --git a/.github/workflows/lint-typescript.yml b/.github/workflows/lint-typescript.yml index 6cecc809ae0..c053188f882 100644 --- a/.github/workflows/lint-typescript.yml +++ b/.github/workflows/lint-typescript.yml @@ -55,7 +55,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false diff --git a/.github/workflows/node-test.yml b/.github/workflows/node-test.yml index c463e26ffec..69ef6d5376f 100644 --- a/.github/workflows/node-test.yml +++ b/.github/workflows/node-test.yml @@ -60,7 +60,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false @@ -91,7 +91,7 @@ jobs: run: npm run test --if-present - name: Collect coverage - uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 with: files: ./coverage/lcov.info diff --git a/.github/workflows/npm-build.yml b/.github/workflows/npm-build.yml index 896bb7b8b8d..0782cf334a2 100644 --- a/.github/workflows/npm-build.yml +++ b/.github/workflows/npm-build.yml @@ -53,7 +53,7 @@ jobs: name: NPM build steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false diff --git a/.github/workflows/openapi.yml b/.github/workflows/openapi.yml index f97254c6a6f..b06063f7a81 100644 --- a/.github/workflows/openapi.yml +++ b/.github/workflows/openapi.yml @@ -26,7 +26,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false @@ -35,7 +35,7 @@ jobs: uses: icewind1991/nextcloud-version-matrix@8a7bac6300b2f0f3100088b297995a229558ddba # v1.3.2 - name: Set up php - uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: ${{ steps.php_versions.outputs.php-available }} extensions: xml diff --git a/.github/workflows/phpunit-mariadb.yml b/.github/workflows/phpunit-mariadb.yml index d4eb4121560..da68db8798b 100644 --- a/.github/workflows/phpunit-mariadb.yml +++ b/.github/workflows/phpunit-mariadb.yml @@ -25,7 +25,7 @@ jobs: server-max: ${{ steps.versions.outputs.branches-max-list }} steps: - name: Checkout app - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false @@ -91,7 +91,7 @@ jobs: echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV - name: Checkout server - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false submodules: true @@ -99,13 +99,13 @@ jobs: ref: ${{ matrix.server-versions }} - name: Checkout app - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false path: apps/${{ env.APP_NAME }} - name: Set up php ${{ matrix.php-versions }} - uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: ${{ matrix.php-versions }} # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation diff --git a/.github/workflows/phpunit-mysql.yml b/.github/workflows/phpunit-mysql.yml index 2802c4ce95f..dffba154d6d 100644 --- a/.github/workflows/phpunit-mysql.yml +++ b/.github/workflows/phpunit-mysql.yml @@ -24,7 +24,7 @@ jobs: matrix: ${{ steps.versions.outputs.sparse-matrix }} steps: - name: Checkout app - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false @@ -89,7 +89,7 @@ jobs: echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV - name: Checkout server - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false submodules: true @@ -97,13 +97,13 @@ jobs: ref: ${{ matrix.server-versions }} - name: Checkout app - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false path: apps/${{ env.APP_NAME }} - name: Set up php ${{ matrix.php-versions }} - uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: ${{ matrix.php-versions }} # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation diff --git a/.github/workflows/phpunit-oci.yml b/.github/workflows/phpunit-oci.yml index 9a2ac512b42..58190132829 100644 --- a/.github/workflows/phpunit-oci.yml +++ b/.github/workflows/phpunit-oci.yml @@ -25,7 +25,7 @@ jobs: server-max: ${{ steps.versions.outputs.branches-max-list }} steps: - name: Checkout app - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false @@ -101,7 +101,7 @@ jobs: echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV - name: Checkout server - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false submodules: true @@ -109,13 +109,13 @@ jobs: ref: ${{ matrix.server-versions }} - name: Checkout app - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false path: apps/${{ env.APP_NAME }} - name: Set up php ${{ matrix.php-versions }} - uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: ${{ matrix.php-versions }} # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation diff --git a/.github/workflows/phpunit-pgsql.yml b/.github/workflows/phpunit-pgsql.yml index 894612965fc..ea1ae68da4c 100644 --- a/.github/workflows/phpunit-pgsql.yml +++ b/.github/workflows/phpunit-pgsql.yml @@ -25,7 +25,7 @@ jobs: server-max: ${{ steps.versions.outputs.branches-max-list }} steps: - name: Checkout app - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false @@ -92,7 +92,7 @@ jobs: echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV - name: Checkout server - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false submodules: true @@ -100,13 +100,13 @@ jobs: ref: ${{ matrix.server-versions }} - name: Checkout app - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false path: apps/${{ env.APP_NAME }} - name: Set up php ${{ matrix.php-versions }} - uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: ${{ matrix.php-versions }} # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation diff --git a/.github/workflows/phpunit-sqlite.yml b/.github/workflows/phpunit-sqlite.yml index b35556a0745..9ae58a805de 100644 --- a/.github/workflows/phpunit-sqlite.yml +++ b/.github/workflows/phpunit-sqlite.yml @@ -25,7 +25,7 @@ jobs: server-max: ${{ steps.versions.outputs.branches-max-list }} steps: - name: Checkout app - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false @@ -81,7 +81,7 @@ jobs: echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV - name: Checkout server - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false submodules: true @@ -89,13 +89,13 @@ jobs: ref: ${{ matrix.server-versions }} - name: Checkout app - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false path: apps/${{ env.APP_NAME }} - name: Set up php ${{ matrix.php-versions }} - uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: ${{ matrix.php-versions }} # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation diff --git a/.github/workflows/psalm.yml b/.github/workflows/psalm.yml index 1784f416c13..0a5ec8db0f9 100644 --- a/.github/workflows/psalm.yml +++ b/.github/workflows/psalm.yml @@ -24,7 +24,7 @@ jobs: name: static-psalm-analysis steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false @@ -36,7 +36,7 @@ jobs: run: grep 'phpVersion="${{ steps.versions.outputs.php-min }}' psalm.xml - name: Set up php${{ steps.versions.outputs.php-available }} - uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: ${{ steps.versions.outputs.php-available }} extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml index 3f485f875f7..a60e9e262a8 100644 --- a/.github/workflows/reuse.yml +++ b/.github/workflows/reuse.yml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest-low steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false diff --git a/.github/workflows/sync-workflow-templates.yml b/.github/workflows/sync-workflow-templates.yml index 634dc987e43..89345b80a31 100644 --- a/.github/workflows/sync-workflow-templates.yml +++ b/.github/workflows/sync-workflow-templates.yml @@ -43,14 +43,14 @@ jobs: require: admin - name: Checkout workflow repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false path: source repository: nextcloud/.github - name: Checkout app - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false path: target diff --git a/.github/workflows/update-nextcloud-ocp-approve-merge.yml b/.github/workflows/update-nextcloud-ocp-approve-merge.yml index 51735a76da8..88c54da0ab3 100644 --- a/.github/workflows/update-nextcloud-ocp-approve-merge.yml +++ b/.github/workflows/update-nextcloud-ocp-approve-merge.yml @@ -53,7 +53,7 @@ jobs: # Enable GitHub auto merge - name: Auto merge - uses: alexwilson/enable-github-automerge-action@56e3117d1ae1540309dc8f7a9f2825bc3c5f06ff # 2.0.0 + uses: alexwilson/enable-github-automerge-action@2c32e18a76e0726ffe7a573bfff2d42a20885126 # 3.0.0 if: startsWith(steps.branchname.outputs.branch, 'automated/noid/') && endsWith(steps.branchname.outputs.branch, 'update-nextcloud-ocp') with: github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/update-nextcloud-ocp.yml b/.github/workflows/update-nextcloud-ocp.yml index e632a7b8f8a..8024bf7d4de 100644 --- a/.github/workflows/update-nextcloud-ocp.yml +++ b/.github/workflows/update-nextcloud-ocp.yml @@ -21,6 +21,9 @@ jobs: update-nextcloud-ocp: runs-on: ubuntu-latest + # Only allowed to be run on nextcloud repositories + if: ${{ github.repository_owner == 'nextcloud' }} + strategy: fail-fast: false matrix: @@ -34,18 +37,18 @@ jobs: steps: - id: checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false ref: ${{ matrix.branches }} submodules: true continue-on-error: true - - name: Set up php8.2 + - name: Set up php8.3 if: steps.checkout.outcome == 'success' - uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: - php-version: 8.2 + php-version: 8.3 # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite coverage: none From b90e9a35fd14a179ad7ecf7d94b56fec0029cd9e Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Sun, 21 Jun 2026 16:27:54 +0200 Subject: [PATCH 2/3] ci(workflow): Reset dependabot auto approval Signed-off-by: Joas Schilling --- .../workflows/dependabot-approve-merge.yml | 41 +++++++++++++++++-- 1 file changed, 37 insertions(+), 4 deletions(-) diff --git a/.github/workflows/dependabot-approve-merge.yml b/.github/workflows/dependabot-approve-merge.yml index 0450b9b1b2b..68f8ca09c20 100644 --- a/.github/workflows/dependabot-approve-merge.yml +++ b/.github/workflows/dependabot-approve-merge.yml @@ -27,8 +27,12 @@ jobs: if: github.event.pull_request.user.login == 'dependabot[bot]' runs-on: ubuntu-latest-low env: - ALLOW_MINOR: false - IGNORE_PATTERN: '(webrtc-adapter|\@nextcloud\/vue)' + # env variable for maintainers: 'true' allows to auto-merge 1.0.2 -> 2.0.0 + ALLOW_MAJOR: false + # env variable for maintainers: 'true' allows to auto-merge 1.0.2 -> 1.1.0 + ALLOW_MINOR: true + # env variable for maintainers: RegExp string to ignore some dependencies from auto-approve and auto-merge + IGNORE_PATTERN: '' permissions: # for auto-approve step to work pull-requests: write @@ -49,12 +53,32 @@ jobs: - name: Dependabot metadata id: metadata + if: startsWith(steps.branchname.outputs.branch, 'dependabot/') uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 with: github-token: ${{ secrets.GITHUB_TOKEN }} - - name: GitHub actions bot approve + - name: Check for ignored dependencies in the PR + id: validate if: startsWith(steps.branchname.outputs.branch, 'dependabot/') + env: + IGNORE_PATTERN: ${{ env.IGNORE_PATTERN }} + DEPENDENCY_NAMES: ${{ steps.metadata.outputs.dependency-names }} + run: | + if [[ -z ${IGNORE_PATTERN} ]]; then + echo "ignore=false" >> "$GITHUB_OUTPUT" + elif [[ -z ${DEPENDENCY_NAMES} ]]; then + echo "ignore=false" >> "$GITHUB_OUTPUT" + elif [[ ${DEPENDENCY_NAMES} =~ ${IGNORE_PATTERN} ]]; then + echo "ignore=true" >> "$GITHUB_OUTPUT" + fi + + - name: GitHub actions bot approve + id: auto_approve + if: ${{ + startsWith(steps.branchname.outputs.branch, 'dependabot/') + && steps.validate.outputs.ignore != 'true' + }} run: gh pr review --approve "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }} @@ -63,6 +87,15 @@ jobs: # Enable GitHub auto merge - name: Auto merge uses: alexwilson/enable-github-automerge-action@2c32e18a76e0726ffe7a573bfff2d42a20885126 # 3.0.0 - if: startsWith(steps.branchname.outputs.branch, 'dependabot/') && (github.event.action == 'opened' || github.event.action == 'reopened') && (steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor') + if: ${{ + startsWith(steps.branchname.outputs.branch, 'dependabot/') + && steps.auto_approve.conclusion == 'success' + && (github.event.action == 'opened' || github.event.action == 'reopened') + && ( + steps.metadata.outputs.update-type == 'version-update:semver-patch' + || (fromJSON(env.ALLOW_MINOR) && steps.metadata.outputs.update-type == 'version-update:semver-minor') + || (fromJSON(env.ALLOW_MAJOR) && steps.metadata.outputs.update-type == 'version-update:semver-major') + ) + }} with: github-token: ${{ secrets.GITHUB_TOKEN }} From 4566230ac610501d7c3cdacb7b774421a3c6ffa9 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Sun, 21 Jun 2026 16:30:07 +0200 Subject: [PATCH 3/3] ci(dependabot): Disallow Minor, @nextcloud/vue and webrtc-adapter Signed-off-by: Joas Schilling --- .../workflows/dependabot-approve-merge.yml | 4 +- .../dependabot-approve-merge.yml.patch | 66 +++---------------- 2 files changed, 11 insertions(+), 59 deletions(-) diff --git a/.github/workflows/dependabot-approve-merge.yml b/.github/workflows/dependabot-approve-merge.yml index 68f8ca09c20..3d34b9735a5 100644 --- a/.github/workflows/dependabot-approve-merge.yml +++ b/.github/workflows/dependabot-approve-merge.yml @@ -30,9 +30,9 @@ jobs: # env variable for maintainers: 'true' allows to auto-merge 1.0.2 -> 2.0.0 ALLOW_MAJOR: false # env variable for maintainers: 'true' allows to auto-merge 1.0.2 -> 1.1.0 - ALLOW_MINOR: true + ALLOW_MINOR: false # env variable for maintainers: RegExp string to ignore some dependencies from auto-approve and auto-merge - IGNORE_PATTERN: '' + IGNORE_PATTERN: '(webrtc-adapter|\@nextcloud\/vue)' permissions: # for auto-approve step to work pull-requests: write diff --git a/.github/workflows/dependabot-approve-merge.yml.patch b/.github/workflows/dependabot-approve-merge.yml.patch index d4d9a8074ff..c47734a24f9 100644 --- a/.github/workflows/dependabot-approve-merge.yml.patch +++ b/.github/workflows/dependabot-approve-merge.yml.patch @@ -1,64 +1,16 @@ diff --git a/.github/workflows/dependabot-approve-merge.yml b/.github/workflows/dependabot-approve-merge.yml -index e4fa4e58ff..a1127d8826 100644 +index 68f8ca09c2..3d34b9735a 100644 --- a/.github/workflows/dependabot-approve-merge.yml +++ b/.github/workflows/dependabot-approve-merge.yml -@@ -26,6 +26,9 @@ jobs: - auto-approve-merge: - if: github.event.pull_request.user.login == 'dependabot[bot]' || github.event.pull_request.user.login == 'renovate[bot]' - runs-on: ubuntu-latest-low -+ env: +@@ -30,9 +30,9 @@ jobs: + # env variable for maintainers: 'true' allows to auto-merge 1.0.2 -> 2.0.0 + ALLOW_MAJOR: false + # env variable for maintainers: 'true' allows to auto-merge 1.0.2 -> 1.1.0 +- ALLOW_MINOR: true + ALLOW_MINOR: false + # env variable for maintainers: RegExp string to ignore some dependencies from auto-approve and auto-merge +- IGNORE_PATTERN: '' + IGNORE_PATTERN: '(webrtc-adapter|\@nextcloud\/vue)' permissions: - # for hmarr/auto-approve-action to approve PRs + # for auto-approve step to work pull-requests: write -@@ -42,20 +42,43 @@ jobs: - echo 'Can not approve PRs from forks' - exit 1 - -- - uses: mdecoleman/pr-branch-name@55795d86b4566d300d237883103f052125cc7508 # v3.0.0 -- id: branchname -+ - name: Dependabot metadata -+ if: github.event.pull_request.user.login == 'dependabot[bot]' -+ id: metadata -+ uses: dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36 # v3.0.0 - with: -- repo-token: ${{ secrets.GITHUB_TOKEN }} -+ github-token: ${{ secrets.GITHUB_TOKEN }} -+ -+ - name: Check allowed dependency update -+ if: github.event.pull_request.user.login == 'dependabot[bot]' -+ id: validate -+ env: -+ IGNORE_PATTERN: ${{ env.IGNORE_PATTERN }} -+ DEPENDENCY_NAMES: ${{ steps.metadata.outputs.dependency-names }} -+ run: | -+ if [[ -z ${IGNORE_PATTERN} ]]; then -+ echo "ignore=false" >> "$GITHUB_OUTPUT" -+ elif [[ -z ${DEPENDENCY_NAMES} ]]; then -+ echo "ignore=false" >> "$GITHUB_OUTPUT" -+ elif [[ ${DEPENDENCY_NAMES} =~ ${IGNORE_PATTERN} ]]; then -+ echo "ignore=true" >> "$GITHUB_OUTPUT" -+ fi - - # GitHub actions bot approve -- - uses: hmarr/auto-approve-action@f0939ea97e9205ef24d872e76833fa908a770363 # v4.0.0 -- if: startsWith(steps.branchname.outputs.branch, 'dependabot/') -+ - name: Auto approve -+ id: auto_approve -+ uses: hmarr/auto-approve-action@f0939ea97e9205ef24d872e76833fa908a770363 # v4.0.0 -+ if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' -+ && steps.validate.outputs.ignore != 'true' -+ && ((fromJSON(env.ALLOW_MINOR) && steps.metadata.outputs.update-type == 'version-update:semver-minor') -+ || steps.metadata.outputs.update-type == 'version-update:semver-patch') -+ }} - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - - # Enable GitHub auto merge - - name: Auto merge - uses: alexwilson/enable-github-automerge-action@56e3117d1ae1540309dc8f7a9f2825bc3c5f06ff # v2.0.0 -- if: startsWith(steps.branchname.outputs.branch, 'dependabot/') -+ if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' && steps.auto_approve.conclusion == 'success' }} - with: - github-token: ${{ secrets.GITHUB_TOKEN }}