From 0f01e4466028d2e921c15852918242a76be24dc2 Mon Sep 17 00:00:00 2001 From: nextcloud-command Date: Sun, 20 Sep 2026 07:48:11 +0000 Subject: [PATCH] ci(actions): Update workflow templates from organization template repository Signed-off-by: GitHub --- .github/actions-lock.txt | 8 +-- .github/workflows/npm-audit-fix.yml | 25 +++++++++- .github/workflows/sync-workflow-templates.yml | 1 - .../update-nextcloud-ocp-approve-merge.yml | 49 +++++-------------- .github/workflows/update-nextcloud-ocp.yml | 28 +++++++++-- 5 files changed, 63 insertions(+), 48 deletions(-) diff --git a/.github/actions-lock.txt b/.github/actions-lock.txt index 940e02b9e82..b74ad661822 100644 --- a/.github/actions-lock.txt +++ b/.github/actions-lock.txt @@ -21,12 +21,12 @@ ba5a538fea1a9e53dfcbeb53b83ea6fa phpunit-sqlite.yml aaa395a26591445ccf4c8196d7f01ee7 pr-feedback.yml 4f1080b33778a956a08efc7a41a11994 psalm.yml 2dbec18233063b42f4d8e03bbb43671c reuse.yml -a3440826636c0fd7c2d20b1de50363da update-nextcloud-ocp-approve-merge.yml -1919e2ff468e875aeeae5fd088d4ce1f update-nextcloud-ocp.yml +abcb8206c3f6c5a9dc86cccf57846bfc update-nextcloud-ocp-approve-merge.yml +f951ce2c95c9fcf7f4122b6f4f44618d update-nextcloud-ocp.yml 22604c31b526de270a080eb19967a638 update-stable-titles.yml c5147997c7fb8ecbcd23c69705bddc86 lint-typescript.yml -b47a9fe981a7435caea92db33f5ad121 sync-workflow-templates.yml +511439ba27869e0324f283142cc8b3df sync-workflow-templates.yml e456e5920f7020b8fef59329ab6ce54e ai-policy.yml ab958fa2b07234fceab6b6d836fb7f19 npm-build.yml -0dc931ec237a235370e224282608b20e npm-audit-fix.yml +ffbfc28e30ea82e6334314aa8f703b67 npm-audit-fix.yml c2fc57f15bc64e5066b79a398021ca1a rector-apply.yml diff --git a/.github/workflows/npm-audit-fix.yml b/.github/workflows/npm-audit-fix.yml index fd84e64a3e2..b9403d59118 100644 --- a/.github/workflows/npm-audit-fix.yml +++ b/.github/workflows/npm-audit-fix.yml @@ -15,12 +15,17 @@ on: - cron: '30 2 * * 0' permissions: - contents: read + contents: write + pull-requests: write jobs: build: runs-on: ubuntu-latest + env: + # env variable for maintainers: 'false' disables auto-merge for these pull requests + AUTOMERGE: true + strategy: fail-fast: false matrix: @@ -29,7 +34,6 @@ jobs: - 'stable35' - 'stable34' - 'stable33' - - 'stable32' name: npm-audit-fix-${{ matrix.branches }} @@ -70,6 +74,7 @@ jobs: npm run build --if-present - name: Create Pull Request + id: create-pull-request if: steps.checkout.outcome == 'success' uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: @@ -84,3 +89,19 @@ jobs: labels: | dependencies 3. to review + + # Approve using the default GITHUB_TOKEN, as the PR itself was created + # using COMMAND_BOT_PAT and GitHub does not allow an account to approve its own PR + - name: GitHub actions bot approve + if: steps.create-pull-request.outputs.pull-request-operation != 'none' + run: gh pr review --approve "$PR_URL" + env: + PR_URL: ${{ steps.create-pull-request.outputs.pull-request-url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Enable auto merge + if: steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE) + uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0 + with: + token: ${{ secrets.GITHUB_TOKEN }} + pull-request-number: ${{ steps.create-pull-request.outputs.pull-request-number }} diff --git a/.github/workflows/sync-workflow-templates.yml b/.github/workflows/sync-workflow-templates.yml index 6a48b59761d..2642cebd775 100644 --- a/.github/workflows/sync-workflow-templates.yml +++ b/.github/workflows/sync-workflow-templates.yml @@ -29,7 +29,6 @@ jobs: - 'stable35' - 'stable34' - 'stable33' - - 'stable32' name: Update workflows in ${{ matrix.branches }} diff --git a/.github/workflows/update-nextcloud-ocp-approve-merge.yml b/.github/workflows/update-nextcloud-ocp-approve-merge.yml index 88c54da0ab3..4d9f82a2b0e 100644 --- a/.github/workflows/update-nextcloud-ocp-approve-merge.yml +++ b/.github/workflows/update-nextcloud-ocp-approve-merge.yml @@ -6,17 +6,14 @@ # SPDX-FileCopyrightText: 2023-2024 Nextcloud GmbH and Nextcloud contributors # SPDX-License-Identifier: MIT -name: Auto approve nextcloud/ocp +# TODO: Remove this after a grace period of 6 months to give everyone the chance to remove the workflow +# TODO: To be removed mid 2027. +name: No-op please remove this workflow -on: - pull_request_target: # zizmor: ignore[dangerous-triggers] - branches: - - main - - master - - stable* +on: pull_request permissions: - contents: read + contents: none concurrency: group: update-nextcloud-ocp-approve-merge-${{ github.head_ref || github.run_id }} @@ -24,36 +21,12 @@ concurrency: jobs: auto-approve-merge: - if: github.actor == 'nextcloud-command' runs-on: ubuntu-latest-low - permissions: - # for auto-approve-action to approve PRs - pull-requests: write - # for alexwilson/enable-github-automerge-action to approve PRs - contents: write + if: always() - steps: - - name: Disabled on forks - if: ${{ github.event.pull_request.head.repo.full_name != github.repository }} - run: | - echo 'Can not approve PRs from forks' - exit 1 - - - uses: mdecoleman/pr-branch-name@55795d86b4566d300d237883103f052125cc7508 # v3.0.0 - id: branchname - with: - repo-token: ${{ secrets.GITHUB_TOKEN }} + # This is the summary, we just avoid to rename it so that branch protection rules still match + name: auto-approve-merge - - name: GitHub actions bot approve - if: startsWith(steps.branchname.outputs.branch, 'automated/noid/') && endsWith(steps.branchname.outputs.branch, 'update-nextcloud-ocp') - run: gh pr review --approve "$PR_URL" - env: - PR_URL: ${{ github.event.pull_request.html_url }} - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - # Enable GitHub auto merge - - name: Auto merge - uses: alexwilson/enable-github-automerge-action@2c32e18a76e0726ffe7a573bfff2d42a20885126 # 3.0.0 - if: startsWith(steps.branchname.outputs.branch, 'automated/noid/') && endsWith(steps.branchname.outputs.branch, 'update-nextcloud-ocp') - with: - github-token: ${{ secrets.GITHUB_TOKEN }} + steps: + - name: No-op please remove this workflow + run: echo "Approve and auto-merge has been folded into update-nextcloud-ocp.yml / update-nextcloud-ocp-matrix.yml, please remove this file"; exit 1; diff --git a/.github/workflows/update-nextcloud-ocp.yml b/.github/workflows/update-nextcloud-ocp.yml index 2189d896d26..bc3b4241e8a 100644 --- a/.github/workflows/update-nextcloud-ocp.yml +++ b/.github/workflows/update-nextcloud-ocp.yml @@ -14,8 +14,9 @@ on: - cron: "5 2 * * 0" permissions: - contents: read + contents: write issues: write + pull-requests: write jobs: update-nextcloud-ocp: @@ -24,6 +25,10 @@ jobs: # Only allowed to be run on nextcloud repositories if: ${{ github.repository_owner == 'nextcloud' }} + env: + # env variable for maintainers: 'false' disables auto-merge for these pull requests + AUTOMERGE: true + strategy: fail-fast: false matrix: @@ -32,7 +37,6 @@ jobs: - 'stable35' - 'stable34' - 'stable33' - - 'stable32' name: update-nextcloud-ocp-${{ matrix.branches }} @@ -101,6 +105,7 @@ jobs: body: 'Please check the output of the GitHub action and manually resolve the issues
${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
${{ steps.codeowners.outputs.codeowners }}' - name: Create Pull Request + id: create-pull-request if: steps.checkout.outcome == 'success' uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: @@ -111,7 +116,7 @@ jobs: signoff: true branch: 'automated/noid/${{ matrix.branches }}-update-nextcloud-ocp' title: '[${{ matrix.branches }}] Update nextcloud/ocp dependency' - add-path: | + add-paths: | composer.json composer.lock vendor-bin/nextcloud-ocp/composer.json @@ -120,3 +125,20 @@ jobs: Auto-generated update of [nextcloud/ocp](https://github.com/nextcloud-deps/ocp/) dependency labels: | dependencies + 3. to review + + # Approve using the default GITHUB_TOKEN, as the PR itself was created + # using COMMAND_BOT_PAT and GitHub does not allow an account to approve its own PR + - name: GitHub actions bot approve + if: steps.create-pull-request.outputs.pull-request-operation != 'none' + run: gh pr review --approve "$PR_URL" + env: + PR_URL: ${{ steps.create-pull-request.outputs.pull-request-url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Enable auto merge + if: steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE) + uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0 + with: + token: ${{ secrets.GITHUB_TOKEN }} + pull-request-number: ${{ steps.create-pull-request.outputs.pull-request-number }}