[stable35] ci(actions): Update workflow templates from organization template repository

.github/actions-lock.txt

@@ -21,12 +21,12 @@ ba5a538fea1a9e53dfcbeb53b83ea6fa phpunit-sqlite.yml
 aaa395a26591445ccf4c8196d7f01ee7 pr-feedback.yml
 4f1080b33778a956a08efc7a41a11994 psalm.yml
 2dbec18233063b42f4d8e03bbb43671c reuse.yml
-a3440826636c0fd7c2d20b1de50363da update-nextcloud-ocp-approve-merge.yml
-1919e2ff468e875aeeae5fd088d4ce1f update-nextcloud-ocp.yml
+abcb8206c3f6c5a9dc86cccf57846bfc update-nextcloud-ocp-approve-merge.yml
+f951ce2c95c9fcf7f4122b6f4f44618d update-nextcloud-ocp.yml
 22604c31b526de270a080eb19967a638 update-stable-titles.yml
 c5147997c7fb8ecbcd23c69705bddc86 lint-typescript.yml
-b47a9fe981a7435caea92db33f5ad121 sync-workflow-templates.yml
+511439ba27869e0324f283142cc8b3df sync-workflow-templates.yml
 e456e5920f7020b8fef59329ab6ce54e ai-policy.yml
 ab958fa2b07234fceab6b6d836fb7f19 npm-build.yml
-0dc931ec237a235370e224282608b20e npm-audit-fix.yml
+ffbfc28e30ea82e6334314aa8f703b67 npm-audit-fix.yml
 c2fc57f15bc64e5066b79a398021ca1a rector-apply.yml

.github/workflows/npm-audit-fix.yml

@@ -15,12 +15,17 @@ on:
     - cron: '30 2 * * 0'
 
 permissions:
-  contents: read
+  contents: write
+  pull-requests: write
 
 jobs:
   build:
     runs-on: ubuntu-latest
 
+    env:
+      # env variable for maintainers: 'false' disables auto-merge for these pull requests
+      AUTOMERGE: true
+
     strategy:
       fail-fast: false
       matrix:
@@ -29,7 +34,6 @@ jobs:
           - 'stable35'
           - 'stable34'
           - 'stable33'
-          - 'stable32'
 
     name: npm-audit-fix-${{ matrix.branches }}
 
@@ -70,6 +74,7 @@ jobs:
           npm run build --if-present
 
       - name: Create Pull Request
+        id: create-pull-request
         if: steps.checkout.outcome == 'success'
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
@@ -84,3 +89,19 @@ jobs:
           labels: |
             dependencies
             3. to review
+
+      # Approve using the default GITHUB_TOKEN, as the PR itself was created
+      # using COMMAND_BOT_PAT and GitHub does not allow an account to approve its own PR
+      - name: GitHub actions bot approve
+        if: steps.create-pull-request.outputs.pull-request-operation != 'none'
+        run: gh pr review --approve "$PR_URL"
+        env:
+          PR_URL: ${{ steps.create-pull-request.outputs.pull-request-url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Enable auto merge
+        if: steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE)
+        uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          pull-request-number: ${{ steps.create-pull-request.outputs.pull-request-number }}

.github/workflows/sync-workflow-templates.yml

@@ -29,7 +29,6 @@ jobs:
           - 'stable35'
           - 'stable34'
           - 'stable33'
-          - 'stable32'
 
     name: Update workflows in ${{ matrix.branches }}
 

.github/workflows/update-nextcloud-ocp-approve-merge.yml

@@ -6,54 +6,27 @@
 # SPDX-FileCopyrightText: 2023-2024 Nextcloud GmbH and Nextcloud contributors
 # SPDX-License-Identifier: MIT
 
-name: Auto approve nextcloud/ocp
+# TODO: Remove this after a grace period of 6 months to give everyone the chance to remove the workflow
+# TODO: To be removed mid 2027.
+name: No-op please remove this workflow
 
-on:
-  pull_request_target:  # zizmor: ignore[dangerous-triggers]
-    branches:
-      - main
-      - master
-      - stable*
+on: pull_request
 
 permissions:
-  contents: read
+  contents: none
 
 concurrency:
   group: update-nextcloud-ocp-approve-merge-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
   auto-approve-merge:
-    if: github.actor == 'nextcloud-command'
     runs-on: ubuntu-latest-low
-    permissions:
-      # for auto-approve-action to approve PRs
-      pull-requests: write
-      # for alexwilson/enable-github-automerge-action to approve PRs
-      contents: write
+    if: always()
 
-    steps:
-      - name: Disabled on forks
-        if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
-        run: |
-          echo 'Can not approve PRs from forks'
-          exit 1
-
-      - uses: mdecoleman/pr-branch-name@55795d86b4566d300d237883103f052125cc7508 # v3.0.0
-        id: branchname
-        with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
+    # This is the summary, we just avoid to rename it so that branch protection rules still match
+    name: auto-approve-merge
 
-      - name: GitHub actions bot approve
-        if: startsWith(steps.branchname.outputs.branch, 'automated/noid/') && endsWith(steps.branchname.outputs.branch, 'update-nextcloud-ocp')
-        run: gh pr review --approve "$PR_URL"
-        env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      # Enable GitHub auto merge
-      - name: Auto merge
-        uses: alexwilson/enable-github-automerge-action@2c32e18a76e0726ffe7a573bfff2d42a20885126 # 3.0.0
-        if: startsWith(steps.branchname.outputs.branch, 'automated/noid/') && endsWith(steps.branchname.outputs.branch, 'update-nextcloud-ocp')
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: No-op please remove this workflow
+        run: echo "Approve and auto-merge has been folded into update-nextcloud-ocp.yml / update-nextcloud-ocp-matrix.yml, please remove this file"; exit 1;

.github/workflows/update-nextcloud-ocp.yml

@@ -14,8 +14,9 @@ on:
     - cron: "5 2 * * 0"
 
 permissions:
-  contents: read
+  contents: write
   issues: write
+  pull-requests: write
 
 jobs:
   update-nextcloud-ocp:
@@ -24,6 +25,10 @@ jobs:
     # Only allowed to be run on nextcloud repositories
     if: ${{ github.repository_owner == 'nextcloud' }}
 
+    env:
+      # env variable for maintainers: 'false' disables auto-merge for these pull requests
+      AUTOMERGE: true
+
     strategy:
       fail-fast: false
       matrix:
@@ -32,7 +37,6 @@ jobs:
           - 'stable35'
           - 'stable34'
           - 'stable33'
-          - 'stable32'
 
     name: update-nextcloud-ocp-${{ matrix.branches }}
 
@@ -101,6 +105,7 @@ jobs:
           body: 'Please check the output of the GitHub action and manually resolve the issues<br>${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}<br>${{ steps.codeowners.outputs.codeowners }}'
 
       - name: Create Pull Request
+        id: create-pull-request
         if: steps.checkout.outcome == 'success'
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
@@ -111,7 +116,7 @@ jobs:
           signoff: true
           branch: 'automated/noid/${{ matrix.branches }}-update-nextcloud-ocp'
           title: '[${{ matrix.branches }}] Update nextcloud/ocp dependency'
-          add-path: |
+          add-paths: |
             composer.json
             composer.lock
             vendor-bin/nextcloud-ocp/composer.json
@@ -120,3 +125,20 @@ jobs:
             Auto-generated update of [nextcloud/ocp](https://github.com/nextcloud-deps/ocp/) dependency
           labels: |
             dependencies
+            3. to review
+
+      # Approve using the default GITHUB_TOKEN, as the PR itself was created
+      # using COMMAND_BOT_PAT and GitHub does not allow an account to approve its own PR
+      - name: GitHub actions bot approve
+        if: steps.create-pull-request.outputs.pull-request-operation != 'none'
+        run: gh pr review --approve "$PR_URL"
+        env:
+          PR_URL: ${{ steps.create-pull-request.outputs.pull-request-url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Enable auto merge
+        if: steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE)
+        uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          pull-request-number: ${{ steps.create-pull-request.outputs.pull-request-number }}