From 0a4fbbbefd757641f7b6e7e15fed7fe62b63099c Mon Sep 17 00:00:00 2001 From: nextcloud-command Date: Sun, 8 Nov 2026 08:53:41 +0000 Subject: [PATCH] ci(actions): Update workflow templates from organization template repository Signed-off-by: GitHub --- .github/actions-lock.txt | 30 +++++------ .github/workflows/ai-policy.yml | 3 ++ .github/workflows/command-compile.yml | 6 +-- .../workflows/dependabot-approve-merge.yml | 2 +- .github/workflows/lint-php-cs.yml | 4 +- .github/workflows/lint-php.yml | 4 +- .github/workflows/npm-audit-fix.yml | 45 +++++++++++++--- .github/workflows/npm-build.yml | 4 +- .github/workflows/phpunit-mariadb.yml | 4 +- .github/workflows/phpunit-mysql.yml | 4 +- .github/workflows/phpunit-oci.yml | 4 +- .github/workflows/phpunit-pgsql.yml | 4 +- .github/workflows/phpunit-sqlite.yml | 4 +- .github/workflows/psalm.yml | 4 +- .github/workflows/sync-workflow-templates.yml | 34 ++++++++++-- .github/workflows/update-nextcloud-ocp.yml | 52 +++++++++++++++---- 16 files changed, 149 insertions(+), 59 deletions(-) diff --git a/.github/actions-lock.txt b/.github/actions-lock.txt index 801789c0a..8fc3acc7c 100644 --- a/.github/actions-lock.txt +++ b/.github/actions-lock.txt @@ -2,23 +2,23 @@ # SPDX-License-Identifier: MIT acad44f3e99b665897766ce90374dd03 block-merge-freeze.yml 19ab9c47c8d96de93f37fab242c398cc block-unconventional-commits.yml -c1476a553c3223e70e49de980f22315e dependabot-approve-merge.yml +e6351c608939c31ae1e32923aa82aa10 dependabot-approve-merge.yml 2581a67c5bcdcd570427e6d51db767d7 fixup.yml -79006ab196f5664fc444e63645cfd8a7 lint-php-cs.yml -300be6a756abda800e40850918f2d964 lint-php.yml -6d8eebf482b2932971b7912139f16d9f phpunit-mariadb.yml -3cacf28a710b387e83d3858af40b7ffe phpunit-mysql.yml -f89c18551d6a29af9bca63a0fd30a039 phpunit-oci.yml -12a43f55ac6aedc321b62e00f9d864f0 phpunit-pgsql.yml -ba5a538fea1a9e53dfcbeb53b83ea6fa phpunit-sqlite.yml +6279c9e39a0d2bbc94e7f44db2e8cc6e lint-php-cs.yml +418deda6469a90f8626a9705ebea4a85 lint-php.yml +5df0eeb359d5e02097b4a437c722b121 phpunit-mariadb.yml +6848ba5ea359d6ca698e209306e18e39 phpunit-mysql.yml +a7f5f136dfc5bc09d784cb2d1568d251 phpunit-oci.yml +552ee7ffcb4be38bb5d6ab95b81d05d1 phpunit-pgsql.yml +ad9c8d16e90d7b60092d9770ba7646e5 phpunit-sqlite.yml 2639f2b96989a4fcbb441ca8f1fecb2f pr-feedback.yml -4f1080b33778a956a08efc7a41a11994 psalm.yml +fa1cab1471a6a7a7a0622744f8d6ab12 psalm.yml 2dbec18233063b42f4d8e03bbb43671c reuse.yml -511439ba27869e0324f283142cc8b3df sync-workflow-templates.yml +3688c8c5aa6a98dcd3b5019dcecccddd sync-workflow-templates.yml abcb8206c3f6c5a9dc86cccf57846bfc update-nextcloud-ocp-approve-merge.yml -8ce35c51ee3d9cc735faab60c5d6f350 update-nextcloud-ocp.yml +24a8e4ff76d12a99ef6ba91d392b418c update-nextcloud-ocp.yml 43fd0c5fb704cabc5f11cdfaf513236d lint-info-xml.yml -9cd1e572898a8118b6df3fc47eeb3b8a npm-audit-fix.yml -deb0d5cd79d29e8b73f689be32b4108d npm-build.yml -e456e5920f7020b8fef59329ab6ce54e ai-policy.yml -87f8d9641dd087995de99f3da38ab23d command-compile.yml +f1909c78987565cb19a471c60dc53950 npm-audit-fix.yml +6e07ed85ca156b6bf121a50dc1af6712 npm-build.yml +92678f1f5453d90fc2fd01698ade497c ai-policy.yml +4fb9690e44e3728c1d21c9a34037e83c command-compile.yml diff --git a/.github/workflows/ai-policy.yml b/.github/workflows/ai-policy.yml index 4b4653ee6..9b6d49435 100644 --- a/.github/workflows/ai-policy.yml +++ b/.github/workflows/ai-policy.yml @@ -140,6 +140,9 @@ jobs: - name: Label PR as AI assisted if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true' + # Fork-triggered runs only get a read-only token, so labelling fails with HTTP 403. + # The label is informational; the checks below must still decide the job result. + continue-on-error: true env: # Fall back to the default token when the PAT is unavailable # (e.g. Dependabot- or fork-triggered runs don't receive Actions secrets) diff --git a/.github/workflows/command-compile.yml b/.github/workflows/command-compile.yml index a6809f7e9..6ff8ec8cc 100644 --- a/.github/workflows/command-compile.yml +++ b/.github/workflows/command-compile.yml @@ -8,7 +8,7 @@ name: Compile Command on: - issue_comment: + issue_comment: # zizmor: ignore[dangerous-triggers] types: [created] permissions: @@ -116,11 +116,11 @@ jobs: git config --local user.name 'nextcloud-command' - name: Read package.json node and npm engines version - uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0 + uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0 id: package-engines-versions - name: Set up node ${{ steps.package-engines-versions.outputs.node-version }} - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ steps.package-engines-versions.outputs.node-version }} cache: npm diff --git a/.github/workflows/dependabot-approve-merge.yml b/.github/workflows/dependabot-approve-merge.yml index eaa1e9f28..76340acb5 100644 --- a/.github/workflows/dependabot-approve-merge.yml +++ b/.github/workflows/dependabot-approve-merge.yml @@ -9,7 +9,7 @@ name: Auto approve Dependabot PRs on: - pull_request: + pull_request_target: # zizmor: ignore[dangerous-triggers] branches: - main - master diff --git a/.github/workflows/lint-php-cs.yml b/.github/workflows/lint-php-cs.yml index 06d0842fd..d2b01ca83 100644 --- a/.github/workflows/lint-php-cs.yml +++ b/.github/workflows/lint-php-cs.yml @@ -31,10 +31,10 @@ jobs: - name: Get php version id: versions - uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3 + uses: nextcloud-libraries/nextcloud-version-matrix@71959de73c244b11ecbf4503b87c41d65b0f64ae # v1.3.4 - name: Set up php${{ steps.versions.outputs.php-min }} - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ steps.versions.outputs.php-min }} extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite diff --git a/.github/workflows/lint-php.yml b/.github/workflows/lint-php.yml index e4c6e9ba6..fe3f8ff96 100644 --- a/.github/workflows/lint-php.yml +++ b/.github/workflows/lint-php.yml @@ -31,7 +31,7 @@ jobs: - name: Get version matrix id: versions - uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3 + uses: nextcloud-libraries/nextcloud-version-matrix@71959de73c244b11ecbf4503b87c41d65b0f64ae # v1.3.4 php-lint: runs-on: ubuntu-latest-low @@ -49,7 +49,7 @@ jobs: persist-credentials: false - name: Set up php ${{ matrix.php-versions }} - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ matrix.php-versions }} extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite diff --git a/.github/workflows/npm-audit-fix.yml b/.github/workflows/npm-audit-fix.yml index 338e5f5ba..a8c8d1205 100644 --- a/.github/workflows/npm-audit-fix.yml +++ b/.github/workflows/npm-audit-fix.yml @@ -11,8 +11,8 @@ name: Npm audit fix and compile on: workflow_dispatch: schedule: - # At 2:30 on Sundays - - cron: '30 2 * * 0' + # At 22:30 on Saturdays + - cron: '30 22 * * 6' permissions: contents: write @@ -46,24 +46,53 @@ jobs: ref: ${{ matrix.branches }} continue-on-error: true + - name: Check for active merge freeze + id: freeze + if: steps.checkout.outcome == 'success' + env: + BRANCH_NAME: ${{ matrix.branches }} + run: | + if [[ ! -f .github/workflows/block-merge-freeze.yml ]]; then + echo 'No block-merge-freeze workflow, continuing' + exit 0 + fi + if [[ "$BRANCH_NAME" == 'main' || "$BRANCH_NAME" == 'master' ]]; then + SERVER_REF='master' + elif [[ "$BRANCH_NAME" =~ ^stable[0-9]+$ ]]; then + SERVER_REF="$BRANCH_NAME" + else + echo 'Not based on master/main/stable*, so skipping freeze check' + exit 0 + fi + curl -sf "https://raw.githubusercontent.com/nextcloud/server/$SERVER_REF/version.php" --output version.php + if grep 'OC_VersionString' version.php | grep -q -i -E '(\.0\.0 RC[3-9]|\.[1-9][0-9]* RC)'; then + echo "Merge freeze is active for $SERVER_REF, skipping" + echo 'active=true' >> $GITHUB_OUTPUT + fi + rm version.php + - name: Read package.json node and npm engines version - uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0 + if: steps.freeze.outputs.active != 'true' + uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0 id: versions - name: Set up node ${{ steps.versions.outputs.node-version }} - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + if: steps.freeze.outputs.active != 'true' + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ steps.versions.outputs.node-version }} - name: Set up npm ${{ steps.versions.outputs.package-manager-version }} + if: steps.freeze.outputs.active != 'true' run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}' - name: Fix npm audit id: npm-audit + if: steps.freeze.outputs.active != 'true' uses: nextcloud-libraries/npm-audit-action@1b1728b2b4a7a78d69de65608efcf4db0e3e42d0 # v0.2.0 - name: Run npm ci and npm run build - if: steps.checkout.outcome == 'success' + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' env: CYPRESS_INSTALL_BINARY: 0 run: | @@ -72,7 +101,7 @@ jobs: - name: Create Pull Request id: create-pull-request - if: steps.checkout.outcome == 'success' + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: token: ${{ secrets.COMMAND_BOT_PAT }} @@ -90,14 +119,14 @@ jobs: # Approve using the default GITHUB_TOKEN, as the PR itself was created # using COMMAND_BOT_PAT and GitHub does not allow an account to approve its own PR - name: GitHub actions bot approve - if: steps.create-pull-request.outputs.pull-request-operation != 'none' + if: steps.freeze.outputs.active != 'true' && steps.create-pull-request.outputs.pull-request-operation != 'none' run: gh pr review --approve "$PR_URL" env: PR_URL: ${{ steps.create-pull-request.outputs.pull-request-url }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Enable auto merge - if: steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE) + if: steps.freeze.outputs.active != 'true' && steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE) uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0 with: token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/npm-build.yml b/.github/workflows/npm-build.yml index f81723bd1..66c2538be 100644 --- a/.github/workflows/npm-build.yml +++ b/.github/workflows/npm-build.yml @@ -58,11 +58,11 @@ jobs: persist-credentials: false - name: Read package.json node and npm engines version - uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0 + uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0 id: versions - name: Set up node ${{ steps.versions.outputs.node-version }} - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ steps.versions.outputs.node-version }} diff --git a/.github/workflows/phpunit-mariadb.yml b/.github/workflows/phpunit-mariadb.yml index 55139b44f..c132ab9ef 100644 --- a/.github/workflows/phpunit-mariadb.yml +++ b/.github/workflows/phpunit-mariadb.yml @@ -56,7 +56,7 @@ jobs: - name: Get version matrix if: steps.changes.outputs.src != 'false' id: versions - uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3 + uses: nextcloud-libraries/nextcloud-version-matrix@71959de73c244b11ecbf4503b87c41d65b0f64ae # v1.3.4 phpunit-mariadb: runs-on: ubuntu-latest @@ -104,7 +104,7 @@ jobs: path: apps/${{ env.APP_NAME }} - name: Set up php ${{ matrix.php-versions }} - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ matrix.php-versions }} # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation diff --git a/.github/workflows/phpunit-mysql.yml b/.github/workflows/phpunit-mysql.yml index a7d98c9cf..c32f33e91 100644 --- a/.github/workflows/phpunit-mysql.yml +++ b/.github/workflows/phpunit-mysql.yml @@ -55,7 +55,7 @@ jobs: - name: Get version matrix if: steps.changes.outputs.src != 'false' id: versions - uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3 + uses: nextcloud-libraries/nextcloud-version-matrix@71959de73c244b11ecbf4503b87c41d65b0f64ae # v1.3.4 with: matrix: '{"mysql-versions": ["8.4"]}' @@ -102,7 +102,7 @@ jobs: path: apps/${{ env.APP_NAME }} - name: Set up php ${{ matrix.php-versions }} - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ matrix.php-versions }} # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation diff --git a/.github/workflows/phpunit-oci.yml b/.github/workflows/phpunit-oci.yml index f3b17ff8f..92672854e 100644 --- a/.github/workflows/phpunit-oci.yml +++ b/.github/workflows/phpunit-oci.yml @@ -56,7 +56,7 @@ jobs: - name: Get version matrix if: steps.changes.outputs.src != 'false' id: versions - uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3 + uses: nextcloud-libraries/nextcloud-version-matrix@71959de73c244b11ecbf4503b87c41d65b0f64ae # v1.3.4 phpunit-oci: runs-on: ubuntu-latest @@ -114,7 +114,7 @@ jobs: path: apps/${{ env.APP_NAME }} - name: Set up php ${{ matrix.php-versions }} - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ matrix.php-versions }} # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation diff --git a/.github/workflows/phpunit-pgsql.yml b/.github/workflows/phpunit-pgsql.yml index 0d63f7dad..f385461a4 100644 --- a/.github/workflows/phpunit-pgsql.yml +++ b/.github/workflows/phpunit-pgsql.yml @@ -56,7 +56,7 @@ jobs: - name: Get version matrix if: steps.changes.outputs.src != 'false' id: versions - uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3 + uses: nextcloud-libraries/nextcloud-version-matrix@71959de73c244b11ecbf4503b87c41d65b0f64ae # v1.3.4 phpunit-pgsql: runs-on: ubuntu-latest @@ -105,7 +105,7 @@ jobs: path: apps/${{ env.APP_NAME }} - name: Set up php ${{ matrix.php-versions }} - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ matrix.php-versions }} # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation diff --git a/.github/workflows/phpunit-sqlite.yml b/.github/workflows/phpunit-sqlite.yml index d6bcf8e7b..17db50751 100644 --- a/.github/workflows/phpunit-sqlite.yml +++ b/.github/workflows/phpunit-sqlite.yml @@ -56,7 +56,7 @@ jobs: - name: Get version matrix if: steps.changes.outputs.src != 'false' id: versions - uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3 + uses: nextcloud-libraries/nextcloud-version-matrix@71959de73c244b11ecbf4503b87c41d65b0f64ae # v1.3.4 phpunit-sqlite: runs-on: ubuntu-latest @@ -94,7 +94,7 @@ jobs: path: apps/${{ env.APP_NAME }} - name: Set up php ${{ matrix.php-versions }} - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ matrix.php-versions }} # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation diff --git a/.github/workflows/psalm.yml b/.github/workflows/psalm.yml index d6e2d52f3..e03c8c9e1 100644 --- a/.github/workflows/psalm.yml +++ b/.github/workflows/psalm.yml @@ -30,13 +30,13 @@ jobs: - name: Get php version id: versions - uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3 + uses: nextcloud-libraries/nextcloud-version-matrix@71959de73c244b11ecbf4503b87c41d65b0f64ae # v1.3.4 - name: Check enforcement of minimum PHP version ${{ steps.versions.outputs.php-min }} in psalm.xml run: grep 'phpVersion="${{ steps.versions.outputs.php-min }}' psalm.xml - name: Set up php${{ steps.versions.outputs.php-available }} - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: php-version: ${{ steps.versions.outputs.php-available }} extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite diff --git a/.github/workflows/sync-workflow-templates.yml b/.github/workflows/sync-workflow-templates.yml index 40d39e1fa..7b2a61ac8 100644 --- a/.github/workflows/sync-workflow-templates.yml +++ b/.github/workflows/sync-workflow-templates.yml @@ -12,7 +12,7 @@ name: Update workflows on: workflow_dispatch: schedule: - - cron: "5 2 * * 0" + - cron: "45 22 * * 6" permissions: contents: read @@ -47,7 +47,7 @@ jobs: with: persist-credentials: false path: source - repository: nextcloud/.github + repository: ${{ github.repository_owner }}/.github - name: Checkout app uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -56,7 +56,32 @@ jobs: path: target ref: ${{ matrix.branches }} + - name: Check for active merge freeze + id: freeze + env: + BRANCH_NAME: ${{ matrix.branches }} + run: | + if [[ ! -f target/.github/workflows/block-merge-freeze.yml ]]; then + echo 'No block-merge-freeze workflow, continuing' + exit 0 + fi + if [[ "$BRANCH_NAME" == 'main' || "$BRANCH_NAME" == 'master' ]]; then + SERVER_REF='master' + elif [[ "$BRANCH_NAME" =~ ^stable[0-9]+$ ]]; then + SERVER_REF="$BRANCH_NAME" + else + echo 'Not based on master/main/stable*, so skipping freeze check' + exit 0 + fi + curl -sf "https://raw.githubusercontent.com/nextcloud/server/$SERVER_REF/version.php" --output version.php + if grep 'OC_VersionString' version.php | grep -q -i -E '(\.0\.0 RC[3-9]|\.[1-9][0-9]* RC)'; then + echo "Merge freeze is active for $SERVER_REF, skipping" + echo 'active=true' >> $GITHUB_OUTPUT + fi + rm version.php + - name: Copy all workflow templates + if: steps.freeze.outputs.active != 'true' run: | echo 'SUMMARY<> $GITHUB_ENV draft_only=0 @@ -83,7 +108,7 @@ jobs: echo "ℹī¸ Locked version: $locked_version" echo "ℹī¸ Current version: $new_version" echo "🆙 Updating existing workflow: $filename" - echo "- 🆙 Updated [$filename](https://github.com/nextcloud/.github/commits/master/workflow-templates/$filename)" >> $GITHUB_ENV + echo "- 🆙 Updated [$filename](https://github.com/${GITHUB_REPOSITORY_OWNER}/.github/commits/HEAD/workflow-templates/$filename)" >> $GITHUB_ENV cp "$workflow" "$target_file" @@ -121,6 +146,7 @@ jobs: echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV - name: Create Pull Request + if: steps.freeze.outputs.active != 'true' uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: token: ${{ secrets.COMMAND_BOT_WORKFLOWS }} @@ -134,7 +160,7 @@ jobs: draft: ${{ env.DRAFT_ONLY == 1 }} add-paths: .github/workflows/*.yml,.github/actions-lock.txt body: | - Automated update of all workflow templates from [nextcloud/.github](https://github.com/nextcloud/.github) + Automated update of all workflow templates from [${{ github.repository_owner }}/.github](https://github.com/${{ github.repository_owner }}/.github) ${{ env.SUMMARY }} labels: | dependencies diff --git a/.github/workflows/update-nextcloud-ocp.yml b/.github/workflows/update-nextcloud-ocp.yml index 894bc13a7..e6e5aaf5e 100644 --- a/.github/workflows/update-nextcloud-ocp.yml +++ b/.github/workflows/update-nextcloud-ocp.yml @@ -11,7 +11,7 @@ name: Update nextcloud/ocp on: workflow_dispatch: schedule: - - cron: "5 2 * * 0" + - cron: "5 22 * * 6" permissions: contents: write @@ -49,11 +49,41 @@ jobs: submodules: true continue-on-error: true - - name: Set up php8.3 + - name: Check for active merge freeze + id: freeze if: steps.checkout.outcome == 'success' - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 + env: + BRANCH_NAME: ${{ matrix.branches }} + run: | + if [[ ! -f .github/workflows/block-merge-freeze.yml ]]; then + echo 'No block-merge-freeze workflow, continuing' + exit 0 + fi + if [[ "$BRANCH_NAME" == 'main' || "$BRANCH_NAME" == 'master' ]]; then + SERVER_REF='master' + elif [[ "$BRANCH_NAME" =~ ^stable[0-9]+$ ]]; then + SERVER_REF="$BRANCH_NAME" + else + echo 'Not based on master/main/stable*, so skipping freeze check' + exit 0 + fi + curl -sf "https://raw.githubusercontent.com/nextcloud/server/$SERVER_REF/version.php" --output version.php + if grep 'OC_VersionString' version.php | grep -q -i -E '(\.0\.0 RC[3-9]|\.[1-9][0-9]* RC)'; then + echo "Merge freeze is active for $SERVER_REF, skipping" + echo 'active=true' >> $GITHUB_OUTPUT + fi + rm version.php + + - name: Get php version + id: versions + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' + uses: nextcloud-libraries/nextcloud-version-matrix@71959de73c244b11ecbf4503b87c41d65b0f64ae # v1.3.4 + + - name: Set up php${{ steps.versions.outputs.php-min }} + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' + uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0 with: - php-version: 8.3 + php-version: ${{ steps.versions.outputs.php-min }} # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite coverage: none @@ -61,24 +91,26 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Read codeowners - if: steps.checkout.outcome == 'success' + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' id: codeowners run: | grep '/appinfo/info.xml' .github/CODEOWNERS | cut -f 2- -d ' ' | xargs | awk '{ print "codeowners="$0 }' >> $GITHUB_OUTPUT continue-on-error: true - name: Install composer dependencies - if: steps.checkout.outcome == 'success' + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0 - name: Check composer bin for nextcloud/ocp exists id: check_composer_bin + if: steps.freeze.outputs.active != 'true' uses: andstor/file-existence-action@558493d6c74bf472d87c84eab196434afc2fa029 # v3.1.0 with: files: vendor-bin/nextcloud-ocp/composer.json - name: Composer update nextcloud/ocp id: update_branch + if: steps.freeze.outputs.active != 'true' env: USE_COMPOSER_BIN: ${{ steps.check_composer_bin.outputs.files_exists }} BRANCH_NAME: ${{ matrix.branches }} @@ -98,7 +130,7 @@ jobs: - name: Raise on issue on failure uses: dacbd/create-issue-action@cdb57ab6ff8862aa09fee2be6ba77a59581921c2 # v2.0.0 - if: ${{ steps.checkout.outcome == 'success' && failure() && steps.update_branch.conclusion == 'failure' }} + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' && failure() && steps.update_branch.conclusion == 'failure' with: token: ${{ secrets.GITHUB_TOKEN }} title: 'Failed to update nextcloud/ocp package on branch ${{ matrix.branches }}' @@ -106,7 +138,7 @@ jobs: - name: Create Pull Request id: create-pull-request - if: steps.checkout.outcome == 'success' + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: token: ${{ secrets.COMMAND_BOT_PAT }} @@ -126,14 +158,14 @@ jobs: # Approve using the default GITHUB_TOKEN, as the PR itself was created # using COMMAND_BOT_PAT and GitHub does not allow an account to approve its own PR - name: GitHub actions bot approve - if: steps.create-pull-request.outputs.pull-request-operation != 'none' + if: steps.freeze.outputs.active != 'true' && steps.create-pull-request.outputs.pull-request-operation != 'none' run: gh pr review --approve "$PR_URL" env: PR_URL: ${{ steps.create-pull-request.outputs.pull-request-url }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Enable auto merge - if: steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE) + if: steps.freeze.outputs.active != 'true' && steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE) uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0 with: token: ${{ secrets.GITHUB_TOKEN }}