Skip auto prs when blocked anyway

workflow-templates/npm-audit-fix.yml

@@ -11,8 +11,8 @@ name: Npm audit fix and compile
 on:
   workflow_dispatch:
   schedule:
-    # At 2:30 on Sundays
-    - cron: '30 2 * * 0'
+    # At 22:30 on Saturdays
+    - cron: '30 22 * * 6'
 
 permissions:
   contents: write
@@ -46,24 +46,53 @@ jobs:
           ref: ${{ matrix.branches }}
         continue-on-error: true
 
+      - name: Check for active merge freeze
+        id: freeze
+        if: steps.checkout.outcome == 'success'
+        env:
+          BRANCH_NAME: ${{ matrix.branches }}
+        run: |
+          if [[ ! -f .github/workflows/block-merge-freeze.yml ]]; then
+            echo 'No block-merge-freeze workflow, continuing'
+            exit 0
+          fi
+          if [[ "$BRANCH_NAME" == 'main' || "$BRANCH_NAME" == 'master' ]]; then
+            SERVER_REF='master'
+          elif [[ "$BRANCH_NAME" =~ ^stable[0-9]+$ ]]; then
+            SERVER_REF="$BRANCH_NAME"
+          else
+            echo 'Not based on master/main/stable*, so skipping freeze check'
+            exit 0
+          fi
+          curl -sf "https://raw.githubusercontent.com/nextcloud/server/$SERVER_REF/version.php" --output version.php
+          if grep 'OC_VersionString' version.php | grep -q -i -E '(\.0\.0 RC[3-9]|\.[1-9][0-9]* RC)'; then
+            echo "Merge freeze is active for $SERVER_REF, skipping"
+            echo 'active=true' >> $GITHUB_OUTPUT
+          fi
+          rm version.php
+
       - name: Read package.json node and npm engines version
+        if: steps.freeze.outputs.active != 'true'
         uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
         id: versions
 
       - name: Set up node ${{ steps.versions.outputs.node-version }}
+        if: steps.freeze.outputs.active != 'true'
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ steps.versions.outputs.node-version }}
 
       - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
+        if: steps.freeze.outputs.active != 'true'
         run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
 
       - name: Fix npm audit
         id: npm-audit
+        if: steps.freeze.outputs.active != 'true'
         uses: nextcloud-libraries/npm-audit-action@1b1728b2b4a7a78d69de65608efcf4db0e3e42d0 # v0.2.0
 
       - name: Run npm ci and npm run build
-        if: steps.checkout.outcome == 'success'
+        if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success'
         env:
           CYPRESS_INSTALL_BINARY: 0
         run: |
@@ -72,7 +101,7 @@ jobs:
 
       - name: Create Pull Request
         id: create-pull-request
-        if: steps.checkout.outcome == 'success'
+        if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success'
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.COMMAND_BOT_PAT }}
@@ -90,14 +119,14 @@ jobs:
       # Approve using the default GITHUB_TOKEN, as the PR itself was created
       # using COMMAND_BOT_PAT and GitHub does not allow an account to approve its own PR
       - name: GitHub actions bot approve
-        if: steps.create-pull-request.outputs.pull-request-operation != 'none'
+        if: steps.freeze.outputs.active != 'true' && steps.create-pull-request.outputs.pull-request-operation != 'none'
         run: gh pr review --approve "$PR_URL"
         env:
           PR_URL: ${{ steps.create-pull-request.outputs.pull-request-url }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Enable auto merge
-        if: steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE)
+        if: steps.freeze.outputs.active != 'true' && steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE)
         uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

workflow-templates/sync-workflow-templates.yml

@@ -12,7 +12,7 @@ name: Update workflows
 on:
   workflow_dispatch:
   schedule:
-      - cron: "5 2 * * 0"
+      - cron: "45 22 * * 6"
 
 permissions:
   contents: read
@@ -56,7 +56,32 @@ jobs:
           path: target
           ref: ${{ matrix.branches }}
 
+      - name: Check for active merge freeze
+        id: freeze
+        env:
+          BRANCH_NAME: ${{ matrix.branches }}
+        run: |
+          if [[ ! -f target/.github/workflows/block-merge-freeze.yml ]]; then
+            echo 'No block-merge-freeze workflow, continuing'
+            exit 0
+          fi
+          if [[ "$BRANCH_NAME" == 'main' || "$BRANCH_NAME" == 'master' ]]; then
+            SERVER_REF='master'
+          elif [[ "$BRANCH_NAME" =~ ^stable[0-9]+$ ]]; then
+            SERVER_REF="$BRANCH_NAME"
+          else
+            echo 'Not based on master/main/stable*, so skipping freeze check'
+            exit 0
+          fi
+          curl -sf "https://raw.githubusercontent.com/nextcloud/server/$SERVER_REF/version.php" --output version.php
+          if grep 'OC_VersionString' version.php | grep -q -i -E '(\.0\.0 RC[3-9]|\.[1-9][0-9]* RC)'; then
+            echo "Merge freeze is active for $SERVER_REF, skipping"
+            echo 'active=true' >> $GITHUB_OUTPUT
+          fi
+          rm version.php
+
       - name: Copy all workflow templates
+        if: steps.freeze.outputs.active != 'true'
         run: |
           echo 'SUMMARY<<EOF' >> $GITHUB_ENV
           draft_only=0
@@ -121,6 +146,7 @@ jobs:
           echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV
 
       - name: Create Pull Request
+        if: steps.freeze.outputs.active != 'true'
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.COMMAND_BOT_WORKFLOWS }}

workflow-templates/update-nextcloud-ocp-matrix.yml

@@ -11,7 +11,7 @@ name: Update nextcloud/ocp
 on:
   workflow_dispatch:
   schedule:
-    - cron: '5 2 * * 0'
+    - cron: '5 22 * * 6'
 
 permissions:
   contents: write

workflow-templates/update-nextcloud-ocp.yml

@@ -11,7 +11,7 @@ name: Update nextcloud/ocp
 on:
   workflow_dispatch:
   schedule:
-    - cron: "5 2 * * 0"
+    - cron: "5 22 * * 6"
 
 permissions:
   contents: write
@@ -49,8 +49,33 @@ jobs:
           submodules: true
         continue-on-error: true
 
-      - name: Set up php8.3
+      - name: Check for active merge freeze
+        id: freeze
         if: steps.checkout.outcome == 'success'
+        env:
+          BRANCH_NAME: ${{ matrix.branches }}
+        run: |
+          if [[ ! -f .github/workflows/block-merge-freeze.yml ]]; then
+            echo 'No block-merge-freeze workflow, continuing'
+            exit 0
+          fi
+          if [[ "$BRANCH_NAME" == 'main' || "$BRANCH_NAME" == 'master' ]]; then
+            SERVER_REF='master'
+          elif [[ "$BRANCH_NAME" =~ ^stable[0-9]+$ ]]; then
+            SERVER_REF="$BRANCH_NAME"
+          else
+            echo 'Not based on master/main/stable*, so skipping freeze check'
+            exit 0
+          fi
+          curl -sf "https://raw.githubusercontent.com/nextcloud/server/$SERVER_REF/version.php" --output version.php
+          if grep 'OC_VersionString' version.php | grep -q -i -E '(\.0\.0 RC[3-9]|\.[1-9][0-9]* RC)'; then
+            echo "Merge freeze is active for $SERVER_REF, skipping"
+            echo 'active=true' >> $GITHUB_OUTPUT
+          fi
+          rm version.php
+
+      - name: Set up php8.3
+        if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success'
         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: 8.3
@@ -61,24 +86,26 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Read codeowners
-        if: steps.checkout.outcome == 'success'
+        if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success'
         id: codeowners
         run: |
           grep '/appinfo/info.xml' .github/CODEOWNERS | cut -f 2- -d ' ' | xargs | awk '{ print "codeowners="$0 }' >> $GITHUB_OUTPUT
         continue-on-error: true
 
       - name: Install composer dependencies
-        if: steps.checkout.outcome == 'success'
+        if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success'
         uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
 
       - name: Check composer bin for nextcloud/ocp exists
         id: check_composer_bin
+        if: steps.freeze.outputs.active != 'true'
         uses: andstor/file-existence-action@558493d6c74bf472d87c84eab196434afc2fa029 # v3.1.0
         with:
           files: vendor-bin/nextcloud-ocp/composer.json
 
       - name: Composer update nextcloud/ocp
         id: update_branch
+        if: steps.freeze.outputs.active != 'true'
         env:
           USE_COMPOSER_BIN: ${{ steps.check_composer_bin.outputs.files_exists }}
           BRANCH_NAME: ${{ matrix.branches }}
@@ -98,15 +125,15 @@ jobs:
 
       - name: Raise on issue on failure
         uses: dacbd/create-issue-action@cdb57ab6ff8862aa09fee2be6ba77a59581921c2 # v2.0.0
-        if: ${{ steps.checkout.outcome == 'success' && failure() && steps.update_branch.conclusion == 'failure' }}
+        if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' && failure() && steps.update_branch.conclusion == 'failure'
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           title: 'Failed to update nextcloud/ocp package on branch ${{ matrix.branches }}'
           body: 'Please check the output of the GitHub action and manually resolve the issues<br>${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}<br>${{ steps.codeowners.outputs.codeowners }}'
 
       - name: Create Pull Request
         id: create-pull-request
-        if: steps.checkout.outcome == 'success'
+        if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success'
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.COMMAND_BOT_PAT }}
@@ -126,14 +153,14 @@ jobs:
       # Approve using the default GITHUB_TOKEN, as the PR itself was created
       # using COMMAND_BOT_PAT and GitHub does not allow an account to approve its own PR
       - name: GitHub actions bot approve
-        if: steps.create-pull-request.outputs.pull-request-operation != 'none'
+        if: steps.freeze.outputs.active != 'true' && steps.create-pull-request.outputs.pull-request-operation != 'none'
         run: gh pr review --approve "$PR_URL"
         env:
           PR_URL: ${{ steps.create-pull-request.outputs.pull-request-url }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Enable auto merge
-        if: steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE)
+        if: steps.freeze.outputs.active != 'true' && steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE)
         uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}