From cf24e9da6f058df0b06898d0197062e27b8bd796 Mon Sep 17 00:00:00 2001 From: Carl Schwan Date: Mon, 10 Aug 2026 10:41:44 +0200 Subject: [PATCH] feat: Update standard workflows Signed-off-by: Carl Schwan --- .../workflows/dependabot-approve-merge.yml | 31 ++-- .github/workflows/sync-workflow-templates.yml | 140 ++++++++++++++++++ .../update-nextcloud-ocp-approve-merge.yml | 58 ++++++++ .github/workflows/update-nextcloud-ocp.yml | 128 ++++++++++++++++ 4 files changed, 346 insertions(+), 11 deletions(-) create mode 100644 .github/workflows/sync-workflow-templates.yml create mode 100644 .github/workflows/update-nextcloud-ocp-approve-merge.yml create mode 100644 .github/workflows/update-nextcloud-ocp.yml diff --git a/.github/workflows/dependabot-approve-merge.yml b/.github/workflows/dependabot-approve-merge.yml index ea4056090..c0411c057 100644 --- a/.github/workflows/dependabot-approve-merge.yml +++ b/.github/workflows/dependabot-approve-merge.yml @@ -3,13 +3,13 @@ # https://github.com/nextcloud/.github # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization # -# SPDX-FileCopyrightText: 2021-2024 Nextcloud GmbH and Nextcloud contributors +# SPDX-FileCopyrightText: Nextcloud GmbH and Nextcloud contributors # SPDX-License-Identifier: MIT -name: Dependabot +name: Auto approve Dependabot PRs on: - pull_request_target: + pull_request_target: # zizmor: ignore[dangerous-triggers] branches: - main - master @@ -24,26 +24,35 @@ concurrency: jobs: auto-approve-merge: - if: github.actor == 'dependabot[bot]' + if: github.event.pull_request.user.login == 'dependabot[bot]' || github.event.pull_request.user.login == 'renovate[bot]' runs-on: ubuntu-latest-low permissions: # for hmarr/auto-approve-action to approve PRs pull-requests: write + # for alexwilson/enable-github-automerge-action to approve PRs + contents: write steps: - name: Disabled on forks if: ${{ github.event.pull_request.head.repo.full_name != github.repository }} run: | - echo 'Can not approve PRs from forks' - exit 1 + echo 'Can not approve PRs from forks' + exit 1 - # Github actions bot approve + - uses: mdecoleman/pr-branch-name@55795d86b4566d300d237883103f052125cc7508 # v3.0.0 + id: branchname + with: + repo-token: ${{ secrets.GITHUB_TOKEN }} + + # GitHub actions bot approve - uses: hmarr/auto-approve-action@f0939ea97e9205ef24d872e76833fa908a770363 # v4.0.0 + if: startsWith(steps.branchname.outputs.branch, 'dependabot/') with: github-token: ${{ secrets.GITHUB_TOKEN }} - # Nextcloud bot approve and merge request - - uses: ahmadnassri/action-dependabot-auto-merge@45fc124d949b19b6b8bf6645b6c9d55f4f9ac61a # v2.6.6 + # Enable GitHub auto merge + - name: Auto merge + uses: alexwilson/enable-github-automerge-action@56e3117d1ae1540309dc8f7a9f2825bc3c5f06ff # v2.0.0 + if: startsWith(steps.branchname.outputs.branch, 'dependabot/') with: - target: minor - github-token: ${{ secrets.DEPENDABOT_AUTOMERGE_TOKEN }} + github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/sync-workflow-templates.yml b/.github/workflows/sync-workflow-templates.yml new file mode 100644 index 000000000..634dc987e --- /dev/null +++ b/.github/workflows/sync-workflow-templates.yml @@ -0,0 +1,140 @@ +# This workflow is provided via the organization template repository +# +# https://github.com/nextcloud/.github +# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization +# +# SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors +# SPDX-License-Identifier: MIT + +# This workflow will update all workflow templates +# Additionally it will reapply `workflow.yml.patch` files after syncing and only then commit the result +name: Update workflows +on: + workflow_dispatch: + schedule: + - cron: "5 2 * * 0" + +permissions: + contents: read + +jobs: + dispatch: + runs-on: ubuntu-latest + + strategy: + fail-fast: false + matrix: + branches: + - ${{ github.event.repository.default_branch }} + - 'stable34' + - 'stable33' + - 'stable32' + + name: Update workflows in ${{ matrix.branches }} + + permissions: + contents: write + pull-requests: write + + steps: + - name: Check actor permission + uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0 + with: + require: admin + + - name: Checkout workflow repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + path: source + repository: nextcloud/.github + + - name: Checkout app + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + path: target + ref: ${{ matrix.branches }} + + - name: Copy all workflow templates + run: | + echo 'SUMMARY<> $GITHUB_ENV + draft_only=0 + for workflow in ./source/workflow-templates/*.yml; do + echo "❓ Looking for $workflow" + if [ -f "$workflow" ]; then + filename=$(basename "$workflow") + target_file="./target/.github/workflows/$filename" + + # Only copy if the file exists in the target repository + if [ -f "$target_file" ]; then + if [ -f "./target/.github/actions-lock.txt" ]; then + locked_version=$(grep " $filename" ./target/.github/actions-lock.txt | cat) + else + echo "# SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors" >> ./target/.github/actions-lock.txt + echo "# SPDX-License""-Identifier: MIT" >> ./target/.github/actions-lock.txt + locked_version="" + fi + locked_version=$(echo $locked_version | cut -f 1 -d " ") + new_version=$(md5sum $workflow | cut -f 1 -d " ") + + # Only update if the action changes + if [[ "$locked_version" != "$new_version" ]]; then + echo "ℹ️ Locked version: $locked_version" + echo "ℹ️ Current version: $new_version" + echo "🆙 Updating existing workflow: $filename" + echo "- 🆙 Updated [$filename](https://github.com/nextcloud/.github/commits/master/workflow-templates/$filename)" >> $GITHUB_ENV + + cp "$workflow" "$target_file" + + # Apply patch if one exists + if [ -f "$target_file.patch" ]; then + echo "🩹 Applying patch" + cd ./target + set +e + patch -p1 < ".github/workflows/$filename.patch" + patch_worked=$? + set -e + cd - + if [[ "$patch_worked" == "0" ]]; then + echo " - Patch applied" >> $GITHUB_ENV + else + echo " - [ ] ❌ Patch failed" >> $GITHUB_ENV + draft_only=1 + fi + fi + + if [[ "$locked_version" != "" ]]; then + sed -i "s/$locked_version $filename/$new_version $filename/" ./target/.github/actions-lock.txt + else + echo "$new_version $filename" >> ./target/.github/actions-lock.txt + fi + else + echo "✅ Skipping $filename: already up to date" + fi + else + echo "⏭️ Skipping $filename: does not exist in target repository" + fi + fi + done + echo 'EOF' >> $GITHUB_ENV + echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV + + - name: Create Pull Request + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 + with: + token: ${{ secrets.COMMAND_BOT_WORKFLOWS }} + commit-message: 'ci(actions): Update workflow templates from organization template repository' + committer: GitHub + author: nextcloud-command + path: target + signoff: true + branch: 'automated/noid/${{ matrix.branches }}-update-workflows' + title: '[${{ matrix.branches }}] ci(actions): Update workflow templates from organization template repository' + draft: ${{ env.DRAFT_ONLY == 1 }} + add-paths: .github/workflows/*.yml,.github/actions-lock.txt + body: | + Automated update of all workflow templates from [nextcloud/.github](https://github.com/nextcloud/.github) + ${{ env.SUMMARY }} + labels: | + dependencies diff --git a/.github/workflows/update-nextcloud-ocp-approve-merge.yml b/.github/workflows/update-nextcloud-ocp-approve-merge.yml new file mode 100644 index 000000000..dfe0ef4e9 --- /dev/null +++ b/.github/workflows/update-nextcloud-ocp-approve-merge.yml @@ -0,0 +1,58 @@ +# This workflow is provided via the organization template repository +# +# https://github.com/nextcloud/.github +# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization +# +# SPDX-FileCopyrightText: 2023-2024 Nextcloud GmbH and Nextcloud contributors +# SPDX-License-Identifier: MIT + +name: Auto approve nextcloud/ocp + +on: + pull_request_target: # zizmor: ignore[dangerous-triggers] + branches: + - main + - master + - stable* + +permissions: + contents: read + +concurrency: + group: update-nextcloud-ocp-approve-merge-${{ github.head_ref || github.run_id }} + cancel-in-progress: true + +jobs: + auto-approve-merge: + if: github.actor == 'nextcloud-command' + runs-on: ubuntu-latest-low + permissions: + # for hmarr/auto-approve-action to approve PRs + pull-requests: write + # for alexwilson/enable-github-automerge-action to approve PRs + contents: write + + steps: + - name: Disabled on forks + if: ${{ github.event.pull_request.head.repo.full_name != github.repository }} + run: | + echo 'Can not approve PRs from forks' + exit 1 + + - uses: mdecoleman/pr-branch-name@55795d86b4566d300d237883103f052125cc7508 # v3.0.0 + id: branchname + with: + repo-token: ${{ secrets.GITHUB_TOKEN }} + + # GitHub actions bot approve + - uses: hmarr/auto-approve-action@b40d6c9ed2fa10c9a2749eca7eb004418a705501 # v2 + if: startsWith(steps.branchname.outputs.branch, 'automated/noid/') && endsWith(steps.branchname.outputs.branch, 'update-nextcloud-ocp') + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + + # Enable GitHub auto merge + - name: Auto merge + uses: alexwilson/enable-github-automerge-action@56e3117d1ae1540309dc8f7a9f2825bc3c5f06ff # v2.0.0 + if: startsWith(steps.branchname.outputs.branch, 'automated/noid/') && endsWith(steps.branchname.outputs.branch, 'update-nextcloud-ocp') + with: + github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/update-nextcloud-ocp.yml b/.github/workflows/update-nextcloud-ocp.yml new file mode 100644 index 000000000..4b4ae7295 --- /dev/null +++ b/.github/workflows/update-nextcloud-ocp.yml @@ -0,0 +1,128 @@ +# This workflow is provided via the organization template repository +# +# https://github.com/nextcloud/.github +# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization +# +# SPDX-FileCopyrightText: 2022-2024 Nextcloud GmbH and Nextcloud contributors +# SPDX-License-Identifier: MIT + +name: Update nextcloud/ocp + +on: + workflow_dispatch: + schedule: + - cron: "5 2 * * 0" + +permissions: + contents: read + issues: write + +jobs: + update-nextcloud-ocp: + runs-on: ubuntu-latest + + strategy: + fail-fast: false + matrix: + branches: + - ${{ github.event.repository.default_branch }} + - 'stable34' + - 'stable33' + - 'stable32' + + name: update-nextcloud-ocp-${{ matrix.branches }} + + steps: + - id: checkout + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + ref: ${{ matrix.branches }} + submodules: true + continue-on-error: true + + - name: Set up php8.2 + if: steps.checkout.outcome == 'success' + uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0 + with: + php-version: 8.2 + # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation + extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite + coverage: none + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Read codeowners + if: steps.checkout.outcome == 'success' + id: codeowners + run: | + grep '/appinfo/info.xml' .github/CODEOWNERS | cut -f 2- -d ' ' | xargs | awk '{ print "codeowners="$0 }' >> $GITHUB_OUTPUT + continue-on-error: true + + - name: Composer install + if: steps.checkout.outcome == 'success' + run: composer install + + - name: Composer update nextcloud/ocp # zizmor: ignore[template-injection] + id: update_branch + if: ${{ steps.checkout.outcome == 'success' && matrix.branches != 'main' }} + run: composer require --dev 'nextcloud/ocp:dev-${{ matrix.branches }}' + + - name: Raise on issue on failure + uses: dacbd/create-issue-action@cdb57ab6ff8862aa09fee2be6ba77a59581921c2 # v2.0.0 + if: ${{ steps.checkout.outcome == 'success' && failure() && steps.update_branch.conclusion == 'failure' }} + with: + token: ${{ secrets.GITHUB_TOKEN }} + title: 'Failed to update nextcloud/ocp package on branch ${{ matrix.branches }}' + body: 'Please check the output of the GitHub action and manually resolve the issues
${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
${{ steps.codeowners.outputs.codeowners }}' + + - name: Composer update nextcloud/ocp + id: update_main + if: ${{ steps.checkout.outcome == 'success' && matrix.branches == 'main' }} + run: composer require --dev nextcloud/ocp:dev-master + + - name: Raise on issue on failure + uses: dacbd/create-issue-action@cdb57ab6ff8862aa09fee2be6ba77a59581921c2 # v2.0.0 + if: ${{ steps.checkout.outcome == 'success' && failure() && steps.update_main.conclusion == 'failure' }} + with: + token: ${{ secrets.GITHUB_TOKEN }} + title: 'Failed to update nextcloud/ocp package on branch ${{ matrix.branches }}' + body: 'Please check the output of the GitHub action and manually resolve the issues
${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
${{ steps.codeowners.outputs.codeowners }}' + + - name: Reset checkout 3rdparty + if: steps.checkout.outcome == 'success' + run: | + git clean -f 3rdparty + git checkout 3rdparty + continue-on-error: true + + - name: Reset checkout vendor + if: steps.checkout.outcome == 'success' + run: | + git clean -f vendor + git checkout vendor + continue-on-error: true + + - name: Reset checkout vendor-bin + if: steps.checkout.outcome == 'success' + run: | + git clean -f vendor-bin + git checkout vendor-bin + continue-on-error: true + + - name: Create Pull Request + if: steps.checkout.outcome == 'success' + uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0 + with: + token: ${{ secrets.COMMAND_BOT_PAT }} + commit-message: 'chore(dev-deps): Bump nextcloud/ocp package' + committer: GitHub + author: nextcloud-command + signoff: true + branch: 'automated/noid/${{ matrix.branches }}-update-nextcloud-ocp' + title: '[${{ matrix.branches }}] Update nextcloud/ocp dependency' + body: | + Auto-generated update of [nextcloud/ocp](https://github.com/nextcloud-deps/ocp/) dependency + labels: | + dependencies + 3. to review