From 7ca54e07e1ac73a411a368afd88a036c7235135e Mon Sep 17 00:00:00 2001 From: Andy Scherzinger Date: Tue, 27 Oct 2026 13:08:10 +0100 Subject: [PATCH] ci: sync workflows with .github Signed-off-by: Andy Scherzinger --- .github/workflows/ai-policy.yml | 3 + .github/workflows/command-compile.yml | 14 ++--- .github/workflows/lint-eslint.yml | 12 ++-- .github/workflows/lint-stylelint.yml | 12 ++-- .github/workflows/node-test.yml | 12 ++-- .github/workflows/npm-audit-fix.yml | 72 ++++++++++++++++++---- .github/workflows/npm-build.yml | 12 ++-- .github/workflows/playwright.yml | 16 ++--- .github/workflows/pr-feedback.yml | 4 +- .github/workflows/update-stable-titles.yml | 2 + 10 files changed, 106 insertions(+), 53 deletions(-) diff --git a/.github/workflows/ai-policy.yml b/.github/workflows/ai-policy.yml index 4b4653ee67acd..9b6d49435f142 100644 --- a/.github/workflows/ai-policy.yml +++ b/.github/workflows/ai-policy.yml @@ -140,6 +140,9 @@ jobs: - name: Label PR as AI assisted if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true' + # Fork-triggered runs only get a read-only token, so labelling fails with HTTP 403. + # The label is informational; the checks below must still decide the job result. + continue-on-error: true env: # Fall back to the default token when the PAT is unavailable # (e.g. Dependabot- or fork-triggered runs don't receive Actions secrets) diff --git a/.github/workflows/command-compile.yml b/.github/workflows/command-compile.yml index 3b33c04ada2db..8f5d5407f8da4 100644 --- a/.github/workflows/command-compile.yml +++ b/.github/workflows/command-compile.yml @@ -8,7 +8,7 @@ name: Compile Command on: - issue_comment: + issue_comment: # zizmor: ignore[dangerous-triggers] types: [created] permissions: @@ -116,20 +116,20 @@ jobs: git config --local user.name 'nextcloud-command' - name: Read package.json node and npm engines version - uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3 + uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0 id: package-engines-versions with: fallbackNode: '^24' fallbackNpm: '^11.3' - - name: Set up node ${{ steps.package-engines-versions.outputs.nodeVersion }} - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - name: Set up node ${{ steps.package-engines-versions.outputs.node-version }} + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: ${{ steps.package-engines-versions.outputs.nodeVersion }} + node-version: ${{ steps.package-engines-versions.outputs.node-version }} cache: npm - - name: Set up npm ${{ steps.package-engines-versions.outputs.npmVersion }} - run: npm i -g 'npm@${{ steps.package-engines-versions.outputs.npmVersion }}' + - name: Set up npm ${{ steps.package-engines-versions.outputs.package-manager-version }} + run: npm i -g 'npm@${{ steps.package-engines-versions.outputs.package-manager-version }}' - name: Rebase to ${{ needs.init.outputs.base_ref }} if: ${{ contains(needs.init.outputs.arg1, 'rebase') }} diff --git a/.github/workflows/lint-eslint.yml b/.github/workflows/lint-eslint.yml index 0603974617ef3..6cfbc5a355337 100644 --- a/.github/workflows/lint-eslint.yml +++ b/.github/workflows/lint-eslint.yml @@ -61,19 +61,19 @@ jobs: persist-credentials: false - name: Read package.json node and npm engines version - uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3 + uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0 id: versions with: fallbackNode: '^24' fallbackNpm: '^11.3' - - name: Set up node ${{ steps.versions.outputs.nodeVersion }} - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - name: Set up node ${{ steps.versions.outputs.node-version }} + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: ${{ steps.versions.outputs.nodeVersion }} + node-version: ${{ steps.versions.outputs.node-version }} - - name: Set up npm ${{ steps.versions.outputs.npmVersion }} - run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}' + - name: Set up npm ${{ steps.versions.outputs.package-manager-version }} + run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}' - name: Install dependencies env: diff --git a/.github/workflows/lint-stylelint.yml b/.github/workflows/lint-stylelint.yml index 9b654456a9c9c..2590b6778c688 100644 --- a/.github/workflows/lint-stylelint.yml +++ b/.github/workflows/lint-stylelint.yml @@ -58,19 +58,19 @@ jobs: persist-credentials: false - name: Read package.json node and npm engines version - uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3 + uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0 id: versions with: fallbackNode: '^24' fallbackNpm: '^11.3' - - name: Set up node ${{ steps.versions.outputs.nodeVersion }} - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - name: Set up node ${{ steps.versions.outputs.node-version }} + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: ${{ steps.versions.outputs.nodeVersion }} + node-version: ${{ steps.versions.outputs.node-version }} - - name: Set up npm ${{ steps.versions.outputs.npmVersion }} - run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}' + - name: Set up npm ${{ steps.versions.outputs.package-manager-version }} + run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}' - name: Install dependencies env: diff --git a/.github/workflows/node-test.yml b/.github/workflows/node-test.yml index c1b0cb42a8eb8..90ade8b74b313 100644 --- a/.github/workflows/node-test.yml +++ b/.github/workflows/node-test.yml @@ -63,19 +63,19 @@ jobs: persist-credentials: false - name: Read package.json node and npm engines version - uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3 + uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0 id: versions with: fallbackNode: '^24' fallbackNpm: '^11.3' - - name: Set up node ${{ steps.versions.outputs.nodeVersion }} - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - name: Set up node ${{ steps.versions.outputs.node-version }} + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: ${{ steps.versions.outputs.nodeVersion }} + node-version: ${{ steps.versions.outputs.node-version }} - - name: Set up npm ${{ steps.versions.outputs.npmVersion }} - run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}' + - name: Set up npm ${{ steps.versions.outputs.package-manager-version }} + run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}' - name: Install dependencies env: diff --git a/.github/workflows/npm-audit-fix.yml b/.github/workflows/npm-audit-fix.yml index b382c55a86158..ef5771bddc4dc 100644 --- a/.github/workflows/npm-audit-fix.yml +++ b/.github/workflows/npm-audit-fix.yml @@ -15,12 +15,17 @@ on: - cron: '30 2 * * 0' permissions: - contents: read + contents: write + pull-requests: write jobs: build: runs-on: ubuntu-latest + env: + # env variable for maintainers: 'false' disables auto-merge for these pull requests + AUTOMERGE: true + strategy: fail-fast: false matrix: @@ -41,27 +46,53 @@ jobs: ref: ${{ matrix.branches }} continue-on-error: true + - name: Check for active merge freeze + id: freeze + if: steps.checkout.outcome == 'success' + env: + BRANCH_NAME: ${{ matrix.branches }} + run: | + if [[ ! -f .github/workflows/block-merge-freeze.yml ]]; then + echo 'No block-merge-freeze workflow, continuing' + exit 0 + fi + if [[ "$BRANCH_NAME" == 'main' || "$BRANCH_NAME" == 'master' ]]; then + SERVER_REF='master' + elif [[ "$BRANCH_NAME" =~ ^stable[0-9]+$ ]]; then + SERVER_REF="$BRANCH_NAME" + else + echo 'Not based on master/main/stable*, so skipping freeze check' + exit 0 + fi + curl -sf "https://raw.githubusercontent.com/nextcloud/server/$SERVER_REF/version.php" --output version.php + if grep 'OC_VersionString' version.php | grep -q -i -E '(\.0\.0 RC[3-9]|\.[1-9][0-9]* RC)'; then + echo "Merge freeze is active for $SERVER_REF, skipping" + echo 'active=true' >> $GITHUB_OUTPUT + fi + rm version.php + - name: Read package.json node and npm engines version - uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3 + if: steps.freeze.outputs.active != 'true' + uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0 id: versions - with: - fallbackNode: '^24' - fallbackNpm: '^11.3' - - name: Set up node ${{ steps.versions.outputs.nodeVersion }} - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - name: Set up node ${{ steps.versions.outputs.node-version }} + if: steps.freeze.outputs.active != 'true' + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: ${{ steps.versions.outputs.nodeVersion }} + node-version: ${{ steps.versions.outputs.node-version }} - - name: Set up npm ${{ steps.versions.outputs.npmVersion }} - run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}' + - name: Set up npm ${{ steps.versions.outputs.package-manager-version }} + if: steps.freeze.outputs.active != 'true' + run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}' - name: Fix npm audit id: npm-audit + if: steps.freeze.outputs.active != 'true' uses: nextcloud-libraries/npm-audit-action@1b1728b2b4a7a78d69de65608efcf4db0e3e42d0 # v0.2.0 - name: Run npm ci and npm run build - if: steps.checkout.outcome == 'success' + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' env: CYPRESS_INSTALL_BINARY: 0 run: | @@ -69,7 +100,8 @@ jobs: npm run build --if-present - name: Create Pull Request - if: steps.checkout.outcome == 'success' + id: create-pull-request + if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success' uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: token: ${{ secrets.COMMAND_BOT_PAT }} @@ -83,3 +115,19 @@ jobs: labels: | dependencies 3. to review + + # Approve using the default GITHUB_TOKEN, as the PR itself was created + # using COMMAND_BOT_PAT and GitHub does not allow an account to approve its own PR + - name: GitHub actions bot approve + if: steps.freeze.outputs.active != 'true' && steps.create-pull-request.outputs.pull-request-operation != 'none' + run: gh pr review --approve "$PR_URL" + env: + PR_URL: ${{ steps.create-pull-request.outputs.pull-request-url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Enable auto merge + if: steps.freeze.outputs.active != 'true' && steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE) + uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0 + with: + token: ${{ secrets.GITHUB_TOKEN }} + pull-request-number: ${{ steps.create-pull-request.outputs.pull-request-number }} diff --git a/.github/workflows/npm-build.yml b/.github/workflows/npm-build.yml index de17307cc57e1..39eb05e73d4a1 100644 --- a/.github/workflows/npm-build.yml +++ b/.github/workflows/npm-build.yml @@ -58,19 +58,19 @@ jobs: persist-credentials: false - name: Read package.json node and npm engines version - uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3 + uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0 id: versions with: fallbackNode: '^24' fallbackNpm: '^11.3' - - name: Set up node ${{ steps.versions.outputs.nodeVersion }} - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - name: Set up node ${{ steps.versions.outputs.node-version }} + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: - node-version: ${{ steps.versions.outputs.nodeVersion }} + node-version: ${{ steps.versions.outputs.node-version }} - - name: Set up npm ${{ steps.versions.outputs.npmVersion }} - run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}' + - name: Set up npm ${{ steps.versions.outputs.package-manager-version }} + run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}' - name: Validate package-lock.json # See https://github.com/npm/cli/issues/4460 run: | diff --git a/.github/workflows/playwright.yml b/.github/workflows/playwright.yml index 65afbe86b1225..e18ef72ffb7cf 100644 --- a/.github/workflows/playwright.yml +++ b/.github/workflows/playwright.yml @@ -64,10 +64,10 @@ jobs: persist-credentials: false submodules: true # for 3rdparty - name: Read package.json - uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0 + uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0 id: versions - name: Set up node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ steps.versions.outputs.node-version }} - name: Set up npm @@ -111,11 +111,11 @@ jobs: submodules: true # for 3rdparty - name: Read package.json - uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0 + uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0 id: versions - name: Set up node - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ steps.versions.outputs.node-version }} @@ -146,7 +146,7 @@ jobs: - name: Upload blob report to GitHub Actions Artifacts if: ${{ !cancelled() }} - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: blob-report-${{ matrix.shardIndex }} path: blob-report @@ -280,7 +280,7 @@ jobs: with: persist-credentials: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 if: steps.cache.outputs.cache-hit != 'true' with: node-version: ${{ needs.playwright-tests.outputs.node-version }} @@ -294,7 +294,7 @@ jobs: run: npm ci - name: Download blob reports from GitHub Actions Artifacts - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: path: all-blob-reports pattern: blob-report-* @@ -304,7 +304,7 @@ jobs: run: npx playwright merge-reports --config tests/playwright/merge.config.ts --reporter html,github ./all-blob-reports - name: Upload HTML report - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: html-report--attempt-${{ github.run_attempt }} path: playwright-report diff --git a/.github/workflows/pr-feedback.yml b/.github/workflows/pr-feedback.yml index 4420bf6922498..e93d2be9b01db 100644 --- a/.github/workflows/pr-feedback.yml +++ b/.github/workflows/pr-feedback.yml @@ -36,7 +36,7 @@ jobs: blocklist=$(curl https://raw.githubusercontent.com/nextcloud/.github/master/non-community-usernames.txt | paste -s -d, -) echo "blocklist=$blocklist" >> "$GITHUB_OUTPUT" - - uses: nextcloud/pr-feedback-action@5227c55be184087d0aef6338bee210d8620b6297 # v1.0.1 + - uses: nextcloud-libraries/pr-feedback-action@4738cf661995d96df3512409ec17c900a4081d33 # v2.0.0 with: feedback-message: | Hello there, @@ -50,6 +50,6 @@ jobs: (If you believe you should not receive this message, you can add yourself to the [blocklist](https://github.com/nextcloud/.github/blob/master/non-community-usernames.txt).) days-before-feedback: 14 - start-date: '2025-06-12' + max-days-overdue: 7 exempt-authors: '${{ steps.blocklist.outputs.blocklist }},${{ steps.scrape.outputs.users }}' exempt-bots: true diff --git a/.github/workflows/update-stable-titles.yml b/.github/workflows/update-stable-titles.yml index 8fe443f027c7c..ca8be8bff6c98 100644 --- a/.github/workflows/update-stable-titles.yml +++ b/.github/workflows/update-stable-titles.yml @@ -24,6 +24,8 @@ jobs: run: sleep 15 - name: Get PR details and update title + # Renovate already have target branch in the title + if: github.event.pull_request.user.login != 'renovate[bot]' uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: github-token: ${{ secrets.GITHUB_TOKEN }}