ci: remove Node 20 actor permission dependency

patches/nextcloud/sync-workflow-templates.yml.patch

@@ -3,20 +3,20 @@
 @@ -1,13 +1,16 @@
  # This workflow is provided via the organization template repository
  #
--# https://github.com/nextcloud/.github
 +# https://github.com/LibreCodeCoop/.github
+-# https://github.com/nextcloud/.github
  # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
  #
  # SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
  # SPDX-License-Identifier: MIT
 
--# This workflow will update all workflow templates
--# Additionally it will reapply `workflow.yml.patch` files after syncing and only then commit the result
 +# This workflow will update all workflow templates.
 +# Additionally it will reapply workflow.yml.patch files after syncing and only then commit the result.
 +#
 +# Authentication is selected explicitly with vars.WORKFLOW_SYNC_AUTH_MODE.
 +# See docs/cross-repository-automation.md for modes, credentials and GITHUB_TOKEN limitations.
+-# This workflow will update all workflow templates
+-# Additionally it will reapply `workflow.yml.patch` files after syncing and only then commit the result
  name: Update workflows
  on:
    workflow_dispatch:
@@ -30,10 +30,22 @@
 
      name: Update workflows in ${{ matrix.branches }}
 
-@@ -42,12 +42,111 @@
-         with:
-           require: admin
+@@ -38,16 +38,123 @@
 
+     steps:
+       - name: Check actor permission
++        if: ${{ github.event_name == 'workflow_dispatch' }}
++        shell: bash
++        env:
++          GH_TOKEN: ${{ github.token }}
++        run: |
++          set -euo pipefail
++          permission="$(gh api "repos/${GITHUB_REPOSITORY}/collaborators/${GITHUB_ACTOR}/permission" --jq '.permission')"
++          [[ "${permission}" == "admin" ]] || {
++            echo "::error::Manual workflow runs require repository admin permission; ${GITHUB_ACTOR} has ${permission}"
++            exit 1
++          }
++
 +      - name: Validate workflow sync authentication
 +        shell: bash
 +        env:
@@ -90,7 +102,8 @@
 +        if: ${{ vars.WORKFLOW_SYNC_AUTH_MODE == 'github-app' }}
 +        id: consumer-app-token
 +        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-+        with:
+-        uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0
+         with:
 +          app-id: ${{ vars.WORKFLOW_SYNC_APP_ID }}
 +          private-key: ${{ secrets.WORKFLOW_SYNC_APP_PRIVATE_KEY }}
 +          owner: ${{ github.repository_owner }}
@@ -126,27 +139,35 @@
 +
 +          echo "::add-mask::${token}"
 +          echo "token=${token}" >> "${GITHUB_OUTPUT}"
-+
+-          require: admin
+
        - name: Checkout workflow repository
          uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
          with:
            persist-credentials: false
            path: source
--          repository: nextcloud/.github
 +          repository: LibreCodeCoop/.github
 +
 +      - name: Record workflow catalog revision
 +        id: catalog-revision
 +        working-directory: source
 +        shell: bash
 +        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+-          repository: nextcloud/.github
 
        - name: Checkout app
          uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-@@ -56,86 +155,31 @@
+@@ -56,86 +163,31 @@
            path: target
            ref: ${{ matrix.branches }}
 
++      - name: Synchronize workflow templates
++        id: sync
++        uses: ./source/actions/sync-workflows
++        with:
++          source: source/workflow-templates
++          target: target
++          catalog-commit: ${{ steps.catalog-revision.outputs.sha }}
 -      - name: Copy all workflow templates
 -        run: |
 -          echo 'SUMMARY<<EOF' >> $GITHUB_ENV
@@ -156,7 +177,7 @@
 -            if [ -f "$workflow" ]; then
 -              filename=$(basename "$workflow")
 -              target_file="./target/.github/workflows/$filename"
--
+ 
 -              # Only copy if the file exists in the target repository
 -              if [ -f "$target_file" ]; then
 -                if [ -f "./target/.github/actions-lock.txt" ]; then
@@ -210,36 +231,29 @@
 -          done
 -          echo 'EOF' >> $GITHUB_ENV
 -          echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV
-+      - name: Synchronize workflow templates
-+        id: sync
-+        uses: ./source/actions/sync-workflows
-+        with:
-+          source: source/workflow-templates
-+          target: target
-+          catalog-commit: ${{ steps.catalog-revision.outputs.sha }}
-
+-
        - name: Create Pull Request
 +        if: ${{ steps.sync.outputs.changed == 'true' }}
          uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
          with:
--          token: ${{ secrets.COMMAND_BOT_WORKFLOWS }}
 +          token: ${{ steps.auth-token.outputs.token }}
+-          token: ${{ secrets.COMMAND_BOT_WORKFLOWS }}
            commit-message: 'ci(actions): Update workflow templates from organization template repository'
            committer: GitHub <noreply@github.com>
--          author: nextcloud-command <nextcloud-command@users.noreply.github.com>
 +          author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
+-          author: nextcloud-command <nextcloud-command@users.noreply.github.com>
            path: target
            signoff: true
            branch: 'automated/noid/${{ matrix.branches }}-update-workflows'
            title: '[${{ matrix.branches }}] ci(actions): Update workflow templates from organization template repository'
--          draft: ${{ env.DRAFT_ONLY == 1 }}
 +          draft: ${{ steps.sync.outputs.patch_failed == 'true' }}
+-          draft: ${{ env.DRAFT_ONLY == 1 }}
            add-paths: .github/workflows/*.yml,.github/actions-lock.txt
            body: |
--            Automated update of all workflow templates from [nextcloud/.github](https://github.com/nextcloud/.github)
--            ${{ env.SUMMARY }}
 +            Automated update of workflow templates from [LibreCodeCoop/.github](https://github.com/LibreCodeCoop/.github)
 +            ${{ steps.sync.outputs.summary }}
+-            Automated update of all workflow templates from [nextcloud/.github](https://github.com/nextcloud/.github)
+-            ${{ env.SUMMARY }}
            labels: |
              dependencies
              3. to review

workflow-templates/sync-workflow-templates.yml

@@ -38,9 +38,17 @@ jobs:
 
     steps:
       - name: Check actor permission
-        uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0
-        with:
-          require: admin
+        if: ${{ github.event_name == 'workflow_dispatch' }}
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          permission="$(gh api "repos/${GITHUB_REPOSITORY}/collaborators/${GITHUB_ACTOR}/permission" --jq '.permission')"
+          [[ "${permission}" == "admin" ]] || {
+            echo "::error::Manual workflow runs require repository admin permission; ${GITHUB_ACTOR} has ${permission}"
+            exit 1
+          }
 
       - name: Validate workflow sync authentication
         shell: bash