diff --git a/.github/actions-lock.txt b/.github/actions-lock.txt index 5e4af66..26f6c85 100644 --- a/.github/actions-lock.txt +++ b/.github/actions-lock.txt @@ -1,16 +1,16 @@ # SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors # SPDX-License-Identifier: MIT 9f2b534bea27e8ec2dda7c1d772a664b block-merge-eol.yml -25fc4c7e69e778e20bdc9eb0cc96367e block-merge-freeze.yml -7dd8d21d9dd013196cd4bdbf7c24db6f dependabot-approve-merge.yml -80a58e5584612def0e751fcfb7669814 lint-info-xml.yml -ccd8a55c60e35b84becb0f7005ce1286 lint-php-cs.yml -5dcc3187a9460cb62a455235cbdb3562 lint-php.yml -182cc739d33a2441d3a9278a9bff55b4 phpunit-sqlite.yml -3c4a096b3b7dbaef0f8e5190ffe13518 pr-feedback.yml -2070d9569f327e758b9ce2b924c28fef psalm.yml -7db5b820f3750eebe988005a0bb2febd reuse.yml -a064cb13abb8fa131c50af7f826f0331 sync-workflow-templates.yml -800d5b188aa885626cf4169fa2dfea9e update-nextcloud-ocp-approve-merge.yml -595e7ba6f8f494268c3309ab7e3825f2 update-nextcloud-ocp.yml +acad44f3e99b665897766ce90374dd03 block-merge-freeze.yml +e6351c608939c31ae1e32923aa82aa10 dependabot-approve-merge.yml +43fd0c5fb704cabc5f11cdfaf513236d lint-info-xml.yml +79006ab196f5664fc444e63645cfd8a7 lint-php-cs.yml +300be6a756abda800e40850918f2d964 lint-php.yml +ba5a538fea1a9e53dfcbeb53b83ea6fa phpunit-sqlite.yml +aaa395a26591445ccf4c8196d7f01ee7 pr-feedback.yml +4f1080b33778a956a08efc7a41a11994 psalm.yml +2dbec18233063b42f4d8e03bbb43671c reuse.yml +511439ba27869e0324f283142cc8b3df sync-workflow-templates.yml +abcb8206c3f6c5a9dc86cccf57846bfc update-nextcloud-ocp-approve-merge.yml +f951ce2c95c9fcf7f4122b6f4f44618d update-nextcloud-ocp.yml 22604c31b526de270a080eb19967a638 update-stable-titles.yml diff --git a/.github/workflows/block-merge-freeze.yml b/.github/workflows/block-merge-freeze.yml index 3a9d5cc..e665256 100644 --- a/.github/workflows/block-merge-freeze.yml +++ b/.github/workflows/block-merge-freeze.yml @@ -54,4 +54,4 @@ jobs: - name: Run check if: ${{ env.server_ref != '' }} - run: cat version.php | grep 'OC_VersionString' | grep -i -v 'RC' + run: cat version.php | grep 'OC_VersionString' | grep -i -v -E '(\.0\.0 RC[3-9]|\.[1-9][0-9]* RC)' diff --git a/.github/workflows/dependabot-approve-merge.yml b/.github/workflows/dependabot-approve-merge.yml index 71261f4..76340ac 100644 --- a/.github/workflows/dependabot-approve-merge.yml +++ b/.github/workflows/dependabot-approve-merge.yml @@ -26,8 +26,15 @@ jobs: auto-approve-merge: if: github.event.pull_request.user.login == 'dependabot[bot]' runs-on: ubuntu-latest-low + env: + # env variable for maintainers: 'true' allows to auto-merge 1.0.2 -> 2.0.0 + ALLOW_MAJOR: false + # env variable for maintainers: 'true' allows to auto-merge 1.0.2 -> 1.1.0 + ALLOW_MINOR: true + # env variable for maintainers: RegExp string to ignore some dependencies from auto-approve and auto-merge + IGNORE_PATTERN: '' permissions: - # for hmarr/auto-approve-action to approve PRs + # for auto-approve step to work pull-requests: write # for alexwilson/enable-github-automerge-action to approve PRs contents: write @@ -44,15 +51,51 @@ jobs: with: repo-token: ${{ secrets.GITHUB_TOKEN }} - # GitHub actions bot approve - - uses: hmarr/auto-approve-action@f0939ea97e9205ef24d872e76833fa908a770363 # v4.0.0 + - name: Dependabot metadata + id: metadata if: startsWith(steps.branchname.outputs.branch, 'dependabot/') + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 with: github-token: ${{ secrets.GITHUB_TOKEN }} + - name: Check for ignored dependencies in the PR + id: validate + if: startsWith(steps.branchname.outputs.branch, 'dependabot/') + env: + IGNORE_PATTERN: ${{ env.IGNORE_PATTERN }} + DEPENDENCY_NAMES: ${{ steps.metadata.outputs.dependency-names }} + run: | + if [[ -z ${IGNORE_PATTERN} ]]; then + echo "ignore=false" >> "$GITHUB_OUTPUT" + elif [[ -z ${DEPENDENCY_NAMES} ]]; then + echo "ignore=false" >> "$GITHUB_OUTPUT" + elif [[ ${DEPENDENCY_NAMES} =~ ${IGNORE_PATTERN} ]]; then + echo "ignore=true" >> "$GITHUB_OUTPUT" + fi + + - name: GitHub actions bot approve + id: auto_approve + if: ${{ + startsWith(steps.branchname.outputs.branch, 'dependabot/') + && steps.validate.outputs.ignore != 'true' + }} + run: gh pr review --approve "$PR_URL" + env: + PR_URL: ${{ github.event.pull_request.html_url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # Enable GitHub auto merge - name: Auto merge - uses: alexwilson/enable-github-automerge-action@56e3117d1ae1540309dc8f7a9f2825bc3c5f06ff # v2.0.0 - if: startsWith(steps.branchname.outputs.branch, 'dependabot/') && (github.event.pull_request.action == 'opened' || github.event.pull_request.action == 'reopened') + uses: alexwilson/enable-github-automerge-action@2c32e18a76e0726ffe7a573bfff2d42a20885126 # 3.0.0 + if: ${{ + startsWith(steps.branchname.outputs.branch, 'dependabot/') + && steps.auto_approve.conclusion == 'success' + && (github.event.action == 'opened' || github.event.action == 'reopened') + && ( + steps.metadata.outputs.update-type == 'version-update:semver-patch' + || (fromJSON(env.ALLOW_MINOR) && steps.metadata.outputs.update-type == 'version-update:semver-minor') + || (fromJSON(env.ALLOW_MAJOR) && steps.metadata.outputs.update-type == 'version-update:semver-major') + ) + }} with: github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/lint-info-xml.yml b/.github/workflows/lint-info-xml.yml index d0c84cc..8e6968c 100644 --- a/.github/workflows/lint-info-xml.yml +++ b/.github/workflows/lint-info-xml.yml @@ -24,9 +24,11 @@ jobs: name: info.xml lint steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false + sparse-checkout: | + appinfo/ - name: Download schema run: wget https://raw.githubusercontent.com/nextcloud/appstore/master/nextcloudappstore/api/v1/release/info.xsd diff --git a/.github/workflows/lint-php-cs.yml b/.github/workflows/lint-php-cs.yml index da40208..06d0842 100644 --- a/.github/workflows/lint-php-cs.yml +++ b/.github/workflows/lint-php-cs.yml @@ -25,16 +25,16 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Get php version id: versions - uses: icewind1991/nextcloud-version-matrix@8a7bac6300b2f0f3100088b297995a229558ddba # v1.3.2 + uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3 - name: Set up php${{ steps.versions.outputs.php-min }} - uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2.37.0 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: ${{ steps.versions.outputs.php-min }} extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite @@ -43,10 +43,12 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - name: Install dependencies + - name: Remove nextcloud/ocp run: | composer remove nextcloud/ocp --dev --no-scripts - composer i + + - name: Install composer dependencies + uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0 - name: Lint run: composer run cs:check || ( echo 'Please run `composer run cs:fix` to format your code' && exit 1 ) diff --git a/.github/workflows/lint-php.yml b/.github/workflows/lint-php.yml index d1eafea..e4c6e9b 100644 --- a/.github/workflows/lint-php.yml +++ b/.github/workflows/lint-php.yml @@ -25,16 +25,16 @@ jobs: php-max: ${{ steps.versions.outputs.php-max }} steps: - name: Checkout app - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Get version matrix id: versions - uses: icewind1991/nextcloud-version-matrix@8a7bac6300b2f0f3100088b297995a229558ddba # v1.3.2 + uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3 php-lint: - runs-on: ubuntu-latest + runs-on: ubuntu-latest-low needs: matrix strategy: matrix: @@ -44,12 +44,12 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up php ${{ matrix.php-versions }} - uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2.37.0 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: ${{ matrix.php-versions }} extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite diff --git a/.github/workflows/phpunit-sqlite.yml b/.github/workflows/phpunit-sqlite.yml index e2e299a..d6bcf8e 100644 --- a/.github/workflows/phpunit-sqlite.yml +++ b/.github/workflows/phpunit-sqlite.yml @@ -18,32 +18,19 @@ concurrency: cancel-in-progress: true jobs: - matrix: - runs-on: ubuntu-latest-low - outputs: - php-version: ${{ steps.versions.outputs.php-available-list }} - server-max: ${{ steps.versions.outputs.branches-max-list }} - steps: - - name: Checkout app - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - persist-credentials: false - - - name: Get version matrix - id: versions - uses: icewind1991/nextcloud-version-matrix@8a7bac6300b2f0f3100088b297995a229558ddba # v1.3.2 - - changes: + changes-and-matrix: runs-on: ubuntu-latest-low permissions: contents: read pull-requests: read outputs: - src: ${{ steps.changes.outputs.src}} + src: ${{ steps.changes.outputs.src }} + php-version: ${{ steps.versions.outputs.php-available-list }} + server-max: ${{ steps.versions.outputs.branches-max-list }} steps: - - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 + - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 id: changes continue-on-error: true with: @@ -60,16 +47,28 @@ jobs: - 'composer.json' - 'composer.lock' + - name: Checkout app + if: steps.changes.outputs.src != 'false' + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Get version matrix + if: steps.changes.outputs.src != 'false' + id: versions + uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3 + phpunit-sqlite: runs-on: ubuntu-latest - needs: [changes, matrix] - if: needs.changes.outputs.src != 'false' + needs: changes-and-matrix + if: needs.changes-and-matrix.outputs.src != 'false' strategy: + fail-fast: false matrix: - php-versions: ${{ fromJson(needs.matrix.outputs.php-version) }} - server-versions: ${{ fromJson(needs.matrix.outputs.server-max) }} + php-versions: ${{ fromJson(needs.changes-and-matrix.outputs.php-version) }} + server-versions: ${{ fromJson(needs.changes-and-matrix.outputs.server-max) }} name: SQLite PHP ${{ matrix.php-versions }} Nextcloud ${{ matrix.server-versions }} @@ -81,7 +80,7 @@ jobs: echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV - name: Checkout server - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false submodules: true @@ -89,13 +88,13 @@ jobs: ref: ${{ matrix.server-versions }} - name: Checkout app - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false path: apps/${{ env.APP_NAME }} - name: Set up php ${{ matrix.php-versions }} - uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2.37.0 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: ${{ matrix.php-versions }} # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation @@ -113,13 +112,17 @@ jobs: with: files: apps/${{ env.APP_NAME }}/composer.json - - name: Set up dependencies + - name: Remove nextcloud/ocp # Only run if phpunit config file exists if: steps.check_composer.outputs.files_exists == 'true' working-directory: apps/${{ env.APP_NAME }} run: | composer remove nextcloud/ocp --dev --no-scripts - composer i + + - name: Install composer dependencies + uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0 + with: + working-directory: apps/${{ env.APP_NAME }} - name: Set up Nextcloud env: @@ -176,7 +179,7 @@ jobs: permissions: contents: none runs-on: ubuntu-latest-low - needs: [changes, phpunit-sqlite] + needs: [changes-and-matrix, phpunit-sqlite] if: always() @@ -184,4 +187,4 @@ jobs: steps: - name: Summary status - run: if ${{ needs.changes.outputs.src != 'false' && needs.phpunit-sqlite.result != 'success' }}; then exit 1; fi + run: if ${{ needs.changes-and-matrix.outputs.src != 'false' && needs.phpunit-sqlite.result != 'success' }}; then exit 1; fi diff --git a/.github/workflows/pr-feedback.yml b/.github/workflows/pr-feedback.yml index f4c0477..1bd9c59 100644 --- a/.github/workflows/pr-feedback.yml +++ b/.github/workflows/pr-feedback.yml @@ -36,7 +36,7 @@ jobs: blocklist=$(curl https://raw.githubusercontent.com/nextcloud/.github/master/non-community-usernames.txt | paste -s -d, -) echo "blocklist=$blocklist" >> "$GITHUB_OUTPUT" - - uses: nextcloud/pr-feedback-action@f0cab224dea8e1f282f9451de322f323c78fc7a5 # main + - uses: nextcloud-libraries/pr-feedback-action@5227c55be184087d0aef6338bee210d8620b6297 # v1.0.1 with: feedback-message: | Hello there, diff --git a/.github/workflows/psalm.yml b/.github/workflows/psalm.yml index d69fd28..d6e2d52 100644 --- a/.github/workflows/psalm.yml +++ b/.github/workflows/psalm.yml @@ -24,19 +24,19 @@ jobs: name: static-psalm-analysis steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Get php version id: versions - uses: icewind1991/nextcloud-version-matrix@8a7bac6300b2f0f3100088b297995a229558ddba # v1.3.2 + uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3 - name: Check enforcement of minimum PHP version ${{ steps.versions.outputs.php-min }} in psalm.xml run: grep 'phpVersion="${{ steps.versions.outputs.php-min }}' psalm.xml - name: Set up php${{ steps.versions.outputs.php-available }} - uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2.37.0 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: ${{ steps.versions.outputs.php-available }} extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite @@ -47,15 +47,14 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - name: Install dependencies + - name: Remove nextcloud/ocp run: | composer remove nextcloud/ocp --dev --no-scripts - composer i - - name: Check for vulnerable PHP dependencies - run: composer require --dev roave/security-advisories:dev-latest + - name: Install composer dependencies + uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0 - - name: Install nextcloud/ocp + - name: Install nextcloud/ocp:dev-${{ steps.versions.outputs.branches-max }} run: composer require --dev nextcloud/ocp:dev-${{ steps.versions.outputs.branches-max }} --ignore-platform-reqs --with-dependencies - name: Run coding standards check diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml index 3f485f8..67fdafc 100644 --- a/.github/workflows/reuse.yml +++ b/.github/workflows/reuse.yml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest-low steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false diff --git a/.github/workflows/sync-workflow-templates.yml b/.github/workflows/sync-workflow-templates.yml index c80d194..40d39e1 100644 --- a/.github/workflows/sync-workflow-templates.yml +++ b/.github/workflows/sync-workflow-templates.yml @@ -26,8 +26,9 @@ jobs: matrix: branches: - ${{ github.event.repository.default_branch }} + - 'stable35' + - 'stable34' - 'stable33' - - 'stable32' name: Update workflows in ${{ matrix.branches }} @@ -42,14 +43,14 @@ jobs: require: admin - name: Checkout workflow repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false path: source repository: nextcloud/.github - name: Checkout app - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false path: target @@ -122,7 +123,7 @@ jobs: - name: Create Pull Request uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: - token: ${{ secrets.COMMAND_BOT_WORKFLOWS }} # zizmor: ignore[secrets-outside-env] + token: ${{ secrets.COMMAND_BOT_WORKFLOWS }} commit-message: 'ci(actions): Update workflow templates from organization template repository' committer: GitHub author: nextcloud-command diff --git a/.github/workflows/update-nextcloud-ocp-approve-merge.yml b/.github/workflows/update-nextcloud-ocp-approve-merge.yml index dfe0ef4..4d9f82a 100644 --- a/.github/workflows/update-nextcloud-ocp-approve-merge.yml +++ b/.github/workflows/update-nextcloud-ocp-approve-merge.yml @@ -6,17 +6,14 @@ # SPDX-FileCopyrightText: 2023-2024 Nextcloud GmbH and Nextcloud contributors # SPDX-License-Identifier: MIT -name: Auto approve nextcloud/ocp +# TODO: Remove this after a grace period of 6 months to give everyone the chance to remove the workflow +# TODO: To be removed mid 2027. +name: No-op please remove this workflow -on: - pull_request_target: # zizmor: ignore[dangerous-triggers] - branches: - - main - - master - - stable* +on: pull_request permissions: - contents: read + contents: none concurrency: group: update-nextcloud-ocp-approve-merge-${{ github.head_ref || github.run_id }} @@ -24,35 +21,12 @@ concurrency: jobs: auto-approve-merge: - if: github.actor == 'nextcloud-command' runs-on: ubuntu-latest-low - permissions: - # for hmarr/auto-approve-action to approve PRs - pull-requests: write - # for alexwilson/enable-github-automerge-action to approve PRs - contents: write + if: always() - steps: - - name: Disabled on forks - if: ${{ github.event.pull_request.head.repo.full_name != github.repository }} - run: | - echo 'Can not approve PRs from forks' - exit 1 - - - uses: mdecoleman/pr-branch-name@55795d86b4566d300d237883103f052125cc7508 # v3.0.0 - id: branchname - with: - repo-token: ${{ secrets.GITHUB_TOKEN }} + # This is the summary, we just avoid to rename it so that branch protection rules still match + name: auto-approve-merge - # GitHub actions bot approve - - uses: hmarr/auto-approve-action@b40d6c9ed2fa10c9a2749eca7eb004418a705501 # v2 - if: startsWith(steps.branchname.outputs.branch, 'automated/noid/') && endsWith(steps.branchname.outputs.branch, 'update-nextcloud-ocp') - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - - # Enable GitHub auto merge - - name: Auto merge - uses: alexwilson/enable-github-automerge-action@56e3117d1ae1540309dc8f7a9f2825bc3c5f06ff # v2.0.0 - if: startsWith(steps.branchname.outputs.branch, 'automated/noid/') && endsWith(steps.branchname.outputs.branch, 'update-nextcloud-ocp') - with: - github-token: ${{ secrets.GITHUB_TOKEN }} + steps: + - name: No-op please remove this workflow + run: echo "Approve and auto-merge has been folded into update-nextcloud-ocp.yml / update-nextcloud-ocp-matrix.yml, please remove this file"; exit 1; diff --git a/.github/workflows/update-nextcloud-ocp.yml b/.github/workflows/update-nextcloud-ocp.yml index a3c0f23..bc3b424 100644 --- a/.github/workflows/update-nextcloud-ocp.yml +++ b/.github/workflows/update-nextcloud-ocp.yml @@ -14,37 +14,46 @@ on: - cron: "5 2 * * 0" permissions: - contents: read + contents: write issues: write + pull-requests: write jobs: update-nextcloud-ocp: runs-on: ubuntu-latest + # Only allowed to be run on nextcloud repositories + if: ${{ github.repository_owner == 'nextcloud' }} + + env: + # env variable for maintainers: 'false' disables auto-merge for these pull requests + AUTOMERGE: true + strategy: fail-fast: false matrix: branches: - ${{ github.event.repository.default_branch }} + - 'stable35' + - 'stable34' - 'stable33' - - 'stable32' name: update-nextcloud-ocp-${{ matrix.branches }} steps: - id: checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false ref: ${{ matrix.branches }} submodules: true continue-on-error: true - - name: Set up php8.2 + - name: Set up php8.3 if: steps.checkout.outcome == 'success' - uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2.37.0 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: - php-version: 8.2 + php-version: 8.3 # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite coverage: none @@ -58,9 +67,9 @@ jobs: grep '/appinfo/info.xml' .github/CODEOWNERS | cut -f 2- -d ' ' | xargs | awk '{ print "codeowners="$0 }' >> $GITHUB_OUTPUT continue-on-error: true - - name: Composer install + - name: Install composer dependencies if: steps.checkout.outcome == 'success' - run: composer install + uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0 - name: Check composer bin for nextcloud/ocp exists id: check_composer_bin @@ -96,17 +105,18 @@ jobs: body: 'Please check the output of the GitHub action and manually resolve the issues
${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
${{ steps.codeowners.outputs.codeowners }}' - name: Create Pull Request + id: create-pull-request if: steps.checkout.outcome == 'success' uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: - token: ${{ secrets.COMMAND_BOT_PAT }} # zizmor: ignore[secrets-outside-env] + token: ${{ secrets.COMMAND_BOT_PAT }} commit-message: 'chore(dev-deps): Bump nextcloud/ocp package' committer: GitHub author: nextcloud-command signoff: true branch: 'automated/noid/${{ matrix.branches }}-update-nextcloud-ocp' title: '[${{ matrix.branches }}] Update nextcloud/ocp dependency' - add-path: | + add-paths: | composer.json composer.lock vendor-bin/nextcloud-ocp/composer.json @@ -116,3 +126,19 @@ jobs: labels: | dependencies 3. to review + + # Approve using the default GITHUB_TOKEN, as the PR itself was created + # using COMMAND_BOT_PAT and GitHub does not allow an account to approve its own PR + - name: GitHub actions bot approve + if: steps.create-pull-request.outputs.pull-request-operation != 'none' + run: gh pr review --approve "$PR_URL" + env: + PR_URL: ${{ steps.create-pull-request.outputs.pull-request-url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Enable auto merge + if: steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE) + uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0 + with: + token: ${{ secrets.GITHUB_TOKEN }} + pull-request-number: ${{ steps.create-pull-request.outputs.pull-request-number }}