diff --git a/.github/actions-lock.txt b/.github/actions-lock.txt
index 940e02b9e82..b74ad661822 100644
--- a/.github/actions-lock.txt
+++ b/.github/actions-lock.txt
@@ -21,12 +21,12 @@ ba5a538fea1a9e53dfcbeb53b83ea6fa phpunit-sqlite.yml
aaa395a26591445ccf4c8196d7f01ee7 pr-feedback.yml
4f1080b33778a956a08efc7a41a11994 psalm.yml
2dbec18233063b42f4d8e03bbb43671c reuse.yml
-a3440826636c0fd7c2d20b1de50363da update-nextcloud-ocp-approve-merge.yml
-1919e2ff468e875aeeae5fd088d4ce1f update-nextcloud-ocp.yml
+abcb8206c3f6c5a9dc86cccf57846bfc update-nextcloud-ocp-approve-merge.yml
+f951ce2c95c9fcf7f4122b6f4f44618d update-nextcloud-ocp.yml
22604c31b526de270a080eb19967a638 update-stable-titles.yml
c5147997c7fb8ecbcd23c69705bddc86 lint-typescript.yml
-b47a9fe981a7435caea92db33f5ad121 sync-workflow-templates.yml
+511439ba27869e0324f283142cc8b3df sync-workflow-templates.yml
e456e5920f7020b8fef59329ab6ce54e ai-policy.yml
ab958fa2b07234fceab6b6d836fb7f19 npm-build.yml
-0dc931ec237a235370e224282608b20e npm-audit-fix.yml
+ffbfc28e30ea82e6334314aa8f703b67 npm-audit-fix.yml
c2fc57f15bc64e5066b79a398021ca1a rector-apply.yml
diff --git a/.github/workflows/npm-audit-fix.yml b/.github/workflows/npm-audit-fix.yml
index fd84e64a3e2..b9403d59118 100644
--- a/.github/workflows/npm-audit-fix.yml
+++ b/.github/workflows/npm-audit-fix.yml
@@ -15,12 +15,17 @@ on:
- cron: '30 2 * * 0'
permissions:
- contents: read
+ contents: write
+ pull-requests: write
jobs:
build:
runs-on: ubuntu-latest
+ env:
+ # env variable for maintainers: 'false' disables auto-merge for these pull requests
+ AUTOMERGE: true
+
strategy:
fail-fast: false
matrix:
@@ -29,7 +34,6 @@ jobs:
- 'stable35'
- 'stable34'
- 'stable33'
- - 'stable32'
name: npm-audit-fix-${{ matrix.branches }}
@@ -70,6 +74,7 @@ jobs:
npm run build --if-present
- name: Create Pull Request
+ id: create-pull-request
if: steps.checkout.outcome == 'success'
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
with:
@@ -84,3 +89,19 @@ jobs:
labels: |
dependencies
3. to review
+
+ # Approve using the default GITHUB_TOKEN, as the PR itself was created
+ # using COMMAND_BOT_PAT and GitHub does not allow an account to approve its own PR
+ - name: GitHub actions bot approve
+ if: steps.create-pull-request.outputs.pull-request-operation != 'none'
+ run: gh pr review --approve "$PR_URL"
+ env:
+ PR_URL: ${{ steps.create-pull-request.outputs.pull-request-url }}
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+ - name: Enable auto merge
+ if: steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE)
+ uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0
+ with:
+ token: ${{ secrets.GITHUB_TOKEN }}
+ pull-request-number: ${{ steps.create-pull-request.outputs.pull-request-number }}
diff --git a/.github/workflows/sync-workflow-templates.yml b/.github/workflows/sync-workflow-templates.yml
index 6a48b59761d..2642cebd775 100644
--- a/.github/workflows/sync-workflow-templates.yml
+++ b/.github/workflows/sync-workflow-templates.yml
@@ -29,7 +29,6 @@ jobs:
- 'stable35'
- 'stable34'
- 'stable33'
- - 'stable32'
name: Update workflows in ${{ matrix.branches }}
diff --git a/.github/workflows/update-nextcloud-ocp-approve-merge.yml b/.github/workflows/update-nextcloud-ocp-approve-merge.yml
index 88c54da0ab3..4d9f82a2b0e 100644
--- a/.github/workflows/update-nextcloud-ocp-approve-merge.yml
+++ b/.github/workflows/update-nextcloud-ocp-approve-merge.yml
@@ -6,17 +6,14 @@
# SPDX-FileCopyrightText: 2023-2024 Nextcloud GmbH and Nextcloud contributors
# SPDX-License-Identifier: MIT
-name: Auto approve nextcloud/ocp
+# TODO: Remove this after a grace period of 6 months to give everyone the chance to remove the workflow
+# TODO: To be removed mid 2027.
+name: No-op please remove this workflow
-on:
- pull_request_target: # zizmor: ignore[dangerous-triggers]
- branches:
- - main
- - master
- - stable*
+on: pull_request
permissions:
- contents: read
+ contents: none
concurrency:
group: update-nextcloud-ocp-approve-merge-${{ github.head_ref || github.run_id }}
@@ -24,36 +21,12 @@ concurrency:
jobs:
auto-approve-merge:
- if: github.actor == 'nextcloud-command'
runs-on: ubuntu-latest-low
- permissions:
- # for auto-approve-action to approve PRs
- pull-requests: write
- # for alexwilson/enable-github-automerge-action to approve PRs
- contents: write
+ if: always()
- steps:
- - name: Disabled on forks
- if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
- run: |
- echo 'Can not approve PRs from forks'
- exit 1
-
- - uses: mdecoleman/pr-branch-name@55795d86b4566d300d237883103f052125cc7508 # v3.0.0
- id: branchname
- with:
- repo-token: ${{ secrets.GITHUB_TOKEN }}
+ # This is the summary, we just avoid to rename it so that branch protection rules still match
+ name: auto-approve-merge
- - name: GitHub actions bot approve
- if: startsWith(steps.branchname.outputs.branch, 'automated/noid/') && endsWith(steps.branchname.outputs.branch, 'update-nextcloud-ocp')
- run: gh pr review --approve "$PR_URL"
- env:
- PR_URL: ${{ github.event.pull_request.html_url }}
- GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
- # Enable GitHub auto merge
- - name: Auto merge
- uses: alexwilson/enable-github-automerge-action@2c32e18a76e0726ffe7a573bfff2d42a20885126 # 3.0.0
- if: startsWith(steps.branchname.outputs.branch, 'automated/noid/') && endsWith(steps.branchname.outputs.branch, 'update-nextcloud-ocp')
- with:
- github-token: ${{ secrets.GITHUB_TOKEN }}
+ steps:
+ - name: No-op please remove this workflow
+ run: echo "Approve and auto-merge has been folded into update-nextcloud-ocp.yml / update-nextcloud-ocp-matrix.yml, please remove this file"; exit 1;
diff --git a/.github/workflows/update-nextcloud-ocp.yml b/.github/workflows/update-nextcloud-ocp.yml
index 2189d896d26..bc3b4241e8a 100644
--- a/.github/workflows/update-nextcloud-ocp.yml
+++ b/.github/workflows/update-nextcloud-ocp.yml
@@ -14,8 +14,9 @@ on:
- cron: "5 2 * * 0"
permissions:
- contents: read
+ contents: write
issues: write
+ pull-requests: write
jobs:
update-nextcloud-ocp:
@@ -24,6 +25,10 @@ jobs:
# Only allowed to be run on nextcloud repositories
if: ${{ github.repository_owner == 'nextcloud' }}
+ env:
+ # env variable for maintainers: 'false' disables auto-merge for these pull requests
+ AUTOMERGE: true
+
strategy:
fail-fast: false
matrix:
@@ -32,7 +37,6 @@ jobs:
- 'stable35'
- 'stable34'
- 'stable33'
- - 'stable32'
name: update-nextcloud-ocp-${{ matrix.branches }}
@@ -101,6 +105,7 @@ jobs:
body: 'Please check the output of the GitHub action and manually resolve the issues
${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
${{ steps.codeowners.outputs.codeowners }}'
- name: Create Pull Request
+ id: create-pull-request
if: steps.checkout.outcome == 'success'
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
with:
@@ -111,7 +116,7 @@ jobs:
signoff: true
branch: 'automated/noid/${{ matrix.branches }}-update-nextcloud-ocp'
title: '[${{ matrix.branches }}] Update nextcloud/ocp dependency'
- add-path: |
+ add-paths: |
composer.json
composer.lock
vendor-bin/nextcloud-ocp/composer.json
@@ -120,3 +125,20 @@ jobs:
Auto-generated update of [nextcloud/ocp](https://github.com/nextcloud-deps/ocp/) dependency
labels: |
dependencies
+ 3. to review
+
+ # Approve using the default GITHUB_TOKEN, as the PR itself was created
+ # using COMMAND_BOT_PAT and GitHub does not allow an account to approve its own PR
+ - name: GitHub actions bot approve
+ if: steps.create-pull-request.outputs.pull-request-operation != 'none'
+ run: gh pr review --approve "$PR_URL"
+ env:
+ PR_URL: ${{ steps.create-pull-request.outputs.pull-request-url }}
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+ - name: Enable auto merge
+ if: steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE)
+ uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0
+ with:
+ token: ${{ secrets.GITHUB_TOKEN }}
+ pull-request-number: ${{ steps.create-pull-request.outputs.pull-request-number }}