From 4fa50e9e334017c0521f88cdb093dec23d4869b5 Mon Sep 17 00:00:00 2001
From: github-workflows bot <noreply@github.com>
Date: Mon, 21 Sep 2026 00:36:05 +0000
Subject: [PATCH] chore: sync LibreCode workflow catalog

Signed-off-by: GitHub <noreply@github.com>
---
 .../release-nextcloud-app.properties.json     |  5 +
 workflow-templates/release-nextcloud-app.yml  | 95 +++++++++++++++++++
 2 files changed, 100 insertions(+)
 create mode 100644 workflow-templates/release-nextcloud-app.properties.json
 create mode 100644 workflow-templates/release-nextcloud-app.yml

diff --git a/workflow-templates/release-nextcloud-app.properties.json b/workflow-templates/release-nextcloud-app.properties.json
new file mode 100644
index 0000000..d4e8859
--- /dev/null
+++ b/workflow-templates/release-nextcloud-app.properties.json
@@ -0,0 +1,5 @@
+{
+  "name": "Create Nextcloud app release",
+  "description": "Validate release readiness and create an auditable GitHub Release that triggers the App Store publication workflow.",
+  "iconName": "octicon tag"
+}
diff --git a/workflow-templates/release-nextcloud-app.yml b/workflow-templates/release-nextcloud-app.yml
new file mode 100644
index 0000000..3bb9a7a
--- /dev/null
+++ b/workflow-templates/release-nextcloud-app.yml
@@ -0,0 +1,95 @@
+# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+name: Create Nextcloud app release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Release version in MAJOR.MINOR.PATCH form
+        required: true
+        type: string
+      stable_branch:
+        description: Stable branch to release from
+        required: true
+        type: string
+      milestone:
+        description: Closed milestone that must have no open issues
+        required: false
+        default: ''
+        type: string
+      blocker_queries:
+        description: JSON array of GitHub issue search fragments that must return zero open items
+        required: false
+        default: '[]'
+        type: string
+
+permissions:
+  contents: write
+  issues: read
+  pull-requests: read
+
+concurrency:
+  group: release-${{ inputs.stable_branch }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: Create v${{ inputs.version }}
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    environment: release
+    timeout-minutes: 15
+
+    steps:
+      - name: Check actor permission
+        uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0
+        with:
+          require: write
+
+      - name: Checkout release branch
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.stable_branch }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Validate release plan
+        uses: LibreCodeCoop/github-workflows/actions/release-plan@94ad33acf3cdf261db5b90a2297f92325c48c5d2 # v0.2.0
+        with:
+          version: ${{ inputs.version }}
+          stable-branch: ${{ inputs.stable_branch }}
+          milestone: ${{ inputs.milestone }}
+          blocker-queries: ${{ inputs.blocker_queries }}
+          github-token: ${{ github.token }}
+
+      - name: Validate publication credentials
+        env:
+          APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
+          APPSTORE_TOKEN: ${{ secrets.APPSTORE_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ -z "$APP_PRIVATE_KEY" ]; then
+            echo "::error::APP_PRIVATE_KEY is not configured."
+            exit 1
+          fi
+          if [ -z "$APPSTORE_TOKEN" ]; then
+            echo "::error::APPSTORE_TOKEN is not configured."
+            exit 1
+          fi
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_VERSION: ${{ inputs.version }}
+          STABLE_BRANCH: ${{ inputs.stable_branch }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          gh release create "v$RELEASE_VERSION" \
+            --repo "$GITHUB_REPOSITORY" \
+            --target "$STABLE_BRANCH" \
+            --title "v$RELEASE_VERSION" \
+            --generate-notes