From 7a0c12cc4544cce1f31f5a03a07dad941785a07e Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Sun, 11 Oct 2026 13:03:02 +0200 Subject: [PATCH 1/2] fix(automations): Don't send automated PRs when blocked by freeze anyway Assisted-by: ClaudeCode:claude-opus-5-5 Signed-off-by: Joas Schilling --- workflow-templates/npm-audit-fix.yml | 37 +++++++++++++++-- .../sync-workflow-templates.yml | 26 ++++++++++++ workflow-templates/update-nextcloud-ocp.yml | 41 +++++++++++++++---- 3 files changed, 93 insertions(+), 11 deletions(-) diff --git a/workflow-templates/npm-audit-fix.yml b/workflow-templates/npm-audit-fix.yml index 338e5f5b..7e03d519 100644 --- a/workflow-templates/npm-audit-fix.yml +++ b/workflow-templates/npm-audit-fix.yml @@ -46,24 +46,53 @@ jobs: ref: ${{ matrix.branches }} continue-on-error: true + - name: Check for active merge freeze + id: freeze + if: steps.checkout.outcome == 'success' + env: + BRANCH_NAME: ${{ matrix.branches }} + run: | + if [[ ! -f .github/workflows/block-merge-freeze.yml ]]; then + echo 'No block-merge-freeze workflow, continuing' + exit 0 + fi + if [[ "$BRANCH_NAME" == 'main' || "$BRANCH_NAME" == 'master' ]]; then + SERVER_REF='master' + elif [[ "$BRANCH_NAME" =~ ^stable[0-9]+$ ]]; then + SERVER_REF="$BRANCH_NAME" + else + echo 'Not based on master/main/stable*, so skipping freeze check' + exit 0 + fi + curl -sf "https://raw.githubusercontent.com/nextcloud/server/$SERVER_REF/version.php" --output version.php + if grep 'OC_VersionString' version.php | grep -q -i -E '(\.0\.0 RC[3-9]|\.[1-9][0-9]* RC)'; then + echo "Merge freeze is active for $SERVER_REF, skipping" + echo 'active=true' >> $GITHUB_OUTPUT + fi + rm version.php + - name: Read package.json node and npm engines version + if: steps.freeze.outputs.active != 'true' uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0 id: versions - name: Set up node ${{ steps.versions.outputs.node-version }} + if: steps.freeze.outputs.active != 'true' uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ steps.versions.outputs.node-version }} - name: Set up npm ${{ steps.versions.outputs.package-manager-version }} + if: steps.freeze.outputs.active != 'true' run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}' - name: Fix npm audit id: npm-audit + if: steps.freeze.outputs.active != 'true' uses: nextcloud-libraries/npm-audit-action@1b1728b2b4a7a78d69de65608efcf4db0e3e42d0 # v0.2.0 - name: Run npm ci and npm run build - if: steps.checkout.outcome == 'success' + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' env: CYPRESS_INSTALL_BINARY: 0 run: | @@ -72,7 +101,7 @@ jobs: - name: Create Pull Request id: create-pull-request - if: steps.checkout.outcome == 'success' + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: token: ${{ secrets.COMMAND_BOT_PAT }} @@ -90,14 +119,14 @@ jobs: # Approve using the default GITHUB_TOKEN, as the PR itself was created # using COMMAND_BOT_PAT and GitHub does not allow an account to approve its own PR - name: GitHub actions bot approve - if: steps.create-pull-request.outputs.pull-request-operation != 'none' + if: steps.freeze.outputs.active != 'true' && steps.create-pull-request.outputs.pull-request-operation != 'none' run: gh pr review --approve "$PR_URL" env: PR_URL: ${{ steps.create-pull-request.outputs.pull-request-url }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Enable auto merge - if: steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE) + if: steps.freeze.outputs.active != 'true' && steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE) uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0 with: token: ${{ secrets.GITHUB_TOKEN }} diff --git a/workflow-templates/sync-workflow-templates.yml b/workflow-templates/sync-workflow-templates.yml index 40d39e1f..38031f6a 100644 --- a/workflow-templates/sync-workflow-templates.yml +++ b/workflow-templates/sync-workflow-templates.yml @@ -56,7 +56,32 @@ jobs: path: target ref: ${{ matrix.branches }} + - name: Check for active merge freeze + id: freeze + env: + BRANCH_NAME: ${{ matrix.branches }} + run: | + if [[ ! -f target/.github/workflows/block-merge-freeze.yml ]]; then + echo 'No block-merge-freeze workflow, continuing' + exit 0 + fi + if [[ "$BRANCH_NAME" == 'main' || "$BRANCH_NAME" == 'master' ]]; then + SERVER_REF='master' + elif [[ "$BRANCH_NAME" =~ ^stable[0-9]+$ ]]; then + SERVER_REF="$BRANCH_NAME" + else + echo 'Not based on master/main/stable*, so skipping freeze check' + exit 0 + fi + curl -sf "https://raw.githubusercontent.com/nextcloud/server/$SERVER_REF/version.php" --output version.php + if grep 'OC_VersionString' version.php | grep -q -i -E '(\.0\.0 RC[3-9]|\.[1-9][0-9]* RC)'; then + echo "Merge freeze is active for $SERVER_REF, skipping" + echo 'active=true' >> $GITHUB_OUTPUT + fi + rm version.php + - name: Copy all workflow templates + if: steps.freeze.outputs.active != 'true' run: | echo 'SUMMARY<> $GITHUB_ENV draft_only=0 @@ -121,6 +146,7 @@ jobs: echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV - name: Create Pull Request + if: steps.freeze.outputs.active != 'true' uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: token: ${{ secrets.COMMAND_BOT_WORKFLOWS }} diff --git a/workflow-templates/update-nextcloud-ocp.yml b/workflow-templates/update-nextcloud-ocp.yml index 894bc13a..32117fc5 100644 --- a/workflow-templates/update-nextcloud-ocp.yml +++ b/workflow-templates/update-nextcloud-ocp.yml @@ -49,8 +49,33 @@ jobs: submodules: true continue-on-error: true - - name: Set up php8.3 + - name: Check for active merge freeze + id: freeze if: steps.checkout.outcome == 'success' + env: + BRANCH_NAME: ${{ matrix.branches }} + run: | + if [[ ! -f .github/workflows/block-merge-freeze.yml ]]; then + echo 'No block-merge-freeze workflow, continuing' + exit 0 + fi + if [[ "$BRANCH_NAME" == 'main' || "$BRANCH_NAME" == 'master' ]]; then + SERVER_REF='master' + elif [[ "$BRANCH_NAME" =~ ^stable[0-9]+$ ]]; then + SERVER_REF="$BRANCH_NAME" + else + echo 'Not based on master/main/stable*, so skipping freeze check' + exit 0 + fi + curl -sf "https://raw.githubusercontent.com/nextcloud/server/$SERVER_REF/version.php" --output version.php + if grep 'OC_VersionString' version.php | grep -q -i -E '(\.0\.0 RC[3-9]|\.[1-9][0-9]* RC)'; then + echo "Merge freeze is active for $SERVER_REF, skipping" + echo 'active=true' >> $GITHUB_OUTPUT + fi + rm version.php + + - name: Set up php8.3 + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: 8.3 @@ -61,24 +86,26 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Read codeowners - if: steps.checkout.outcome == 'success' + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' id: codeowners run: | grep '/appinfo/info.xml' .github/CODEOWNERS | cut -f 2- -d ' ' | xargs | awk '{ print "codeowners="$0 }' >> $GITHUB_OUTPUT continue-on-error: true - name: Install composer dependencies - if: steps.checkout.outcome == 'success' + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0 - name: Check composer bin for nextcloud/ocp exists id: check_composer_bin + if: steps.freeze.outputs.active != 'true' uses: andstor/file-existence-action@558493d6c74bf472d87c84eab196434afc2fa029 # v3.1.0 with: files: vendor-bin/nextcloud-ocp/composer.json - name: Composer update nextcloud/ocp id: update_branch + if: steps.freeze.outputs.active != 'true' env: USE_COMPOSER_BIN: ${{ steps.check_composer_bin.outputs.files_exists }} BRANCH_NAME: ${{ matrix.branches }} @@ -98,7 +125,7 @@ jobs: - name: Raise on issue on failure uses: dacbd/create-issue-action@cdb57ab6ff8862aa09fee2be6ba77a59581921c2 # v2.0.0 - if: ${{ steps.checkout.outcome == 'success' && failure() && steps.update_branch.conclusion == 'failure' }} + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' && failure() && steps.update_branch.conclusion == 'failure' with: token: ${{ secrets.GITHUB_TOKEN }} title: 'Failed to update nextcloud/ocp package on branch ${{ matrix.branches }}' @@ -106,7 +133,7 @@ jobs: - name: Create Pull Request id: create-pull-request - if: steps.checkout.outcome == 'success' + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: token: ${{ secrets.COMMAND_BOT_PAT }} @@ -126,14 +153,14 @@ jobs: # Approve using the default GITHUB_TOKEN, as the PR itself was created # using COMMAND_BOT_PAT and GitHub does not allow an account to approve its own PR - name: GitHub actions bot approve - if: steps.create-pull-request.outputs.pull-request-operation != 'none' + if: steps.freeze.outputs.active != 'true' && steps.create-pull-request.outputs.pull-request-operation != 'none' run: gh pr review --approve "$PR_URL" env: PR_URL: ${{ steps.create-pull-request.outputs.pull-request-url }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Enable auto merge - if: steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE) + if: steps.freeze.outputs.active != 'true' && steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE) uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0 with: token: ${{ secrets.GITHUB_TOKEN }} From 593089b25a456dc70dc66eb09efb35de69a5f621 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Sun, 11 Oct 2026 13:06:50 +0200 Subject: [PATCH 2/2] fix(automations): Adjust times to better account for current GitHub delay Signed-off-by: Joas Schilling --- workflow-templates/npm-audit-fix.yml | 4 ++-- workflow-templates/sync-workflow-templates.yml | 2 +- workflow-templates/update-nextcloud-ocp-matrix.yml | 2 +- workflow-templates/update-nextcloud-ocp.yml | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/workflow-templates/npm-audit-fix.yml b/workflow-templates/npm-audit-fix.yml index 7e03d519..3f3919bb 100644 --- a/workflow-templates/npm-audit-fix.yml +++ b/workflow-templates/npm-audit-fix.yml @@ -11,8 +11,8 @@ name: Npm audit fix and compile on: workflow_dispatch: schedule: - # At 2:30 on Sundays - - cron: '30 2 * * 0' + # At 22:30 on Saturdays + - cron: '30 22 * * 6' permissions: contents: write diff --git a/workflow-templates/sync-workflow-templates.yml b/workflow-templates/sync-workflow-templates.yml index 38031f6a..5d84aec2 100644 --- a/workflow-templates/sync-workflow-templates.yml +++ b/workflow-templates/sync-workflow-templates.yml @@ -12,7 +12,7 @@ name: Update workflows on: workflow_dispatch: schedule: - - cron: "5 2 * * 0" + - cron: "45 22 * * 6" permissions: contents: read diff --git a/workflow-templates/update-nextcloud-ocp-matrix.yml b/workflow-templates/update-nextcloud-ocp-matrix.yml index cbb7005a..39dc39a8 100644 --- a/workflow-templates/update-nextcloud-ocp-matrix.yml +++ b/workflow-templates/update-nextcloud-ocp-matrix.yml @@ -11,7 +11,7 @@ name: Update nextcloud/ocp on: workflow_dispatch: schedule: - - cron: '5 2 * * 0' + - cron: '5 22 * * 6' permissions: contents: write diff --git a/workflow-templates/update-nextcloud-ocp.yml b/workflow-templates/update-nextcloud-ocp.yml index 32117fc5..be5a1c4d 100644 --- a/workflow-templates/update-nextcloud-ocp.yml +++ b/workflow-templates/update-nextcloud-ocp.yml @@ -11,7 +11,7 @@ name: Update nextcloud/ocp on: workflow_dispatch: schedule: - - cron: "5 2 * * 0" + - cron: "5 22 * * 6" permissions: contents: write