diff --git a/consumers.json b/consumers.json index dd8aa2e..74c182a 100644 --- a/consumers.json +++ b/consumers.json @@ -1,20 +1,5 @@ { "consumers": [ - { - "repository": "LibreCodeCoop/extract", - "workflows": [ - "block-unconventional-commits.yml", - "lint-eslint.yml", - "lint-info-xml.yml", - "lint-php-cs.yml", - "lint-php.yml", - "lint-stylelint.yml", - "npm-build.yml", - "openapi.yml", - "psalm.yml", - "reuse.yml" - ] - }, { "repository": "LibreCodeCoop/profile_fields", "workflows": [ diff --git a/patches/nextcloud/lint-eslint-template.yml.patch b/patches/nextcloud/lint-eslint-template.yml.patch new file mode 100644 index 0000000..267ca2a --- /dev/null +++ b/patches/nextcloud/lint-eslint-template.yml.patch @@ -0,0 +1,31 @@ +--- upstream/vendor/nextcloud/lint-eslint.yml ++++ workflow-templates/lint-eslint.yml +@@ -1,9 +1,9 @@ + # This workflow is provided via the organization template repository + # +-# https://github.com/nextcloud/.github ++# https://github.com/LibreCodeCoop/.github + # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization + # + # SPDX-FileCopyrightText: 2021-2024 Nextcloud GmbH and Nextcloud contributors + # SPDX-License-Identifier: MIT + + name: Lint eslint +@@ -19,7 +19,7 @@ + + jobs: + changes: +- runs-on: ubuntu-latest-low ++ runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: read +@@ -87,7 +87,7 @@ + summary: + permissions: + contents: none +- runs-on: ubuntu-latest-low ++ runs-on: ubuntu-latest + needs: [changes, lint] + + if: always() diff --git a/patches/nextcloud/sync-workflow-templates.yml.patch b/patches/nextcloud/sync-workflow-templates.yml.patch new file mode 100644 index 0000000..683aec8 --- /dev/null +++ b/patches/nextcloud/sync-workflow-templates.yml.patch @@ -0,0 +1,70 @@ +--- upstream/vendor/nextcloud/sync-workflow-templates.yml ++++ workflow-templates/sync-workflow-templates.yml +@@ -1,9 +1,9 @@ + # This workflow is provided via the organization template repository + # +-# https://github.com/nextcloud/.github ++# https://github.com/LibreCodeCoop/.github + # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization + # + # SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors + # SPDX-License-Identifier: MIT + + # This workflow will update all workflow templates +@@ -42,12 +42,24 @@ + with: + require: admin + ++ - name: Create GitHub App token ++ id: app-token ++ uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4 ++ with: ++ app-id: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }} ++ private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }} ++ owner: LibreCodeCoop ++ repositories: ${{ github.event.repository.name }} ++ permission-contents: write ++ permission-pull-requests: write ++ permission-workflows: write ++ + - name: Checkout workflow repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + path: source +- repository: nextcloud/.github ++ repository: LibreCodeCoop/.github + + - name: Checkout app + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 +@@ -78,7 +90,7 @@ + echo "â„šī¸ Locked version: $locked_version" + echo "â„šī¸ Current version: $new_version" + echo "🆙 Updating existing workflow: $filename" +- echo "- 🆙 Updated [$filename](https://github.com/nextcloud/.github/commits/master/workflow-templates/$filename)" >> $GITHUB_ENV ++ echo "- 🆙 Updated [$filename](https://github.com/LibreCodeCoop/.github/commits/main/workflow-templates/$filename)" >> $GITHUB_ENV + + cp "$workflow" "$target_file" + +@@ -123,10 +135,10 @@ + - name: Create Pull Request + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 + with: +- token: ${{ secrets.COMMAND_BOT_WORKFLOWS }} ++ token: ${{ steps.app-token.outputs.token }} + commit-message: 'ci(actions): Update workflow templates from organization template repository' + committer: GitHub +- author: nextcloud-command ++ author: librecode-workflow-automation[bot] <331658022+librecode-workflow-automation[bot]@users.noreply.github.com> + path: target + signoff: true + branch: 'automated/noid/${{ matrix.branches }}-update-workflows' +@@ -134,7 +146,7 @@ + draft: ${{ env.DRAFT_ONLY == 1 }} + add-paths: .github/workflows/*.yml,.github/actions-lock.txt + body: | +- Automated update of all workflow templates from [nextcloud/.github](https://github.com/nextcloud/.github) ++ Automated update of all workflow templates from [LibreCodeCoop/.github](https://github.com/LibreCodeCoop/.github) + ${{ env.SUMMARY }} + labels: | + dependencies diff --git a/upstream/sources.json b/upstream/sources.json index 81fb92a..cd37015 100644 --- a/upstream/sources.json +++ b/upstream/sources.json @@ -116,6 +116,15 @@ "url": "https://raw.githubusercontent.com/nextcloud/.github/98dc00f32e5c4b85361a06a40c7f8d7d1c0a38f3/workflow-templates/reuse.yml", "sha256": "13133274d505be2d100b27637ccd893a24f9dea82cbf96483a1024138aacf5b3", "destination": "upstream/vendor/nextcloud/reuse.yml" + }, + { + "name": "nextcloud-sync-workflow-templates", + "repository": "nextcloud/.github", + "ref": "master", + "path": "workflow-templates/sync-workflow-templates.yml", + "url": "https://raw.githubusercontent.com/nextcloud/.github/e137952600ed786d2dfd1bf928fadf92d295483c/workflow-templates/sync-workflow-templates.yml", + "sha256": "b1a49a5dbc35ca40a1485bed5f84ef042c6c738f5c81cb229035f24fd6dc0cf0", + "destination": "upstream/vendor/nextcloud/sync-workflow-templates.yml" } ] } diff --git a/upstream/templates.json b/upstream/templates.json index f088114..893eb37 100644 --- a/upstream/templates.json +++ b/upstream/templates.json @@ -103,6 +103,22 @@ "patches/nextcloud/reuse.yml.patch" ], "destination": ".github/workflows/reuse.yml" + }, + { + "name": "nextcloud-lint-eslint-template", + "source": "upstream/vendor/nextcloud/lint-eslint.yml", + "patches": [ + "patches/nextcloud/lint-eslint-template.yml.patch" + ], + "destination": "workflow-templates/lint-eslint.yml" + }, + { + "name": "nextcloud-sync-workflow-templates", + "source": "upstream/vendor/nextcloud/sync-workflow-templates.yml", + "patches": [ + "patches/nextcloud/sync-workflow-templates.yml.patch" + ], + "destination": "workflow-templates/sync-workflow-templates.yml" } ] } diff --git a/upstream/vendor/nextcloud/sync-workflow-templates.yml b/upstream/vendor/nextcloud/sync-workflow-templates.yml new file mode 100644 index 0000000..40d39e1 --- /dev/null +++ b/upstream/vendor/nextcloud/sync-workflow-templates.yml @@ -0,0 +1,141 @@ +# This workflow is provided via the organization template repository +# +# https://github.com/nextcloud/.github +# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization +# +# SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors +# SPDX-License-Identifier: MIT + +# This workflow will update all workflow templates +# Additionally it will reapply `workflow.yml.patch` files after syncing and only then commit the result +name: Update workflows +on: + workflow_dispatch: + schedule: + - cron: "5 2 * * 0" + +permissions: + contents: read + +jobs: + dispatch: + runs-on: ubuntu-latest + + strategy: + fail-fast: false + matrix: + branches: + - ${{ github.event.repository.default_branch }} + - 'stable35' + - 'stable34' + - 'stable33' + + name: Update workflows in ${{ matrix.branches }} + + permissions: + contents: write + pull-requests: write + + steps: + - name: Check actor permission + uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0 + with: + require: admin + + - name: Checkout workflow repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + path: source + repository: nextcloud/.github + + - name: Checkout app + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + path: target + ref: ${{ matrix.branches }} + + - name: Copy all workflow templates + run: | + echo 'SUMMARY<> $GITHUB_ENV + draft_only=0 + for workflow in ./source/workflow-templates/*.yml; do + echo "❓ Looking for $workflow" + if [ -f "$workflow" ]; then + filename=$(basename "$workflow") + target_file="./target/.github/workflows/$filename" + + # Only copy if the file exists in the target repository + if [ -f "$target_file" ]; then + if [ -f "./target/.github/actions-lock.txt" ]; then + locked_version=$(grep " $filename" ./target/.github/actions-lock.txt | cat) + else + echo "# SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors" >> ./target/.github/actions-lock.txt + echo "# SPDX-License""-Identifier: MIT" >> ./target/.github/actions-lock.txt + locked_version="" + fi + locked_version=$(echo $locked_version | cut -f 1 -d " ") + new_version=$(md5sum $workflow | cut -f 1 -d " ") + + # Only update if the action changes + if [[ "$locked_version" != "$new_version" ]]; then + echo "â„šī¸ Locked version: $locked_version" + echo "â„šī¸ Current version: $new_version" + echo "🆙 Updating existing workflow: $filename" + echo "- 🆙 Updated [$filename](https://github.com/nextcloud/.github/commits/master/workflow-templates/$filename)" >> $GITHUB_ENV + + cp "$workflow" "$target_file" + + # Apply patch if one exists + if [ -f "$target_file.patch" ]; then + echo "🩹 Applying patch" + cd ./target + set +e + patch -p1 < ".github/workflows/$filename.patch" + patch_worked=$? + set -e + cd - + if [[ "$patch_worked" == "0" ]]; then + echo " - Patch applied" >> $GITHUB_ENV + else + echo " - [ ] ❌ Patch failed" >> $GITHUB_ENV + draft_only=1 + fi + fi + + if [[ "$locked_version" != "" ]]; then + sed -i "s/$locked_version $filename/$new_version $filename/" ./target/.github/actions-lock.txt + else + echo "$new_version $filename" >> ./target/.github/actions-lock.txt + fi + else + echo "✅ Skipping $filename: already up to date" + fi + else + echo "â­ī¸ Skipping $filename: does not exist in target repository" + fi + fi + done + echo 'EOF' >> $GITHUB_ENV + echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV + + - name: Create Pull Request + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 + with: + token: ${{ secrets.COMMAND_BOT_WORKFLOWS }} + commit-message: 'ci(actions): Update workflow templates from organization template repository' + committer: GitHub + author: nextcloud-command + path: target + signoff: true + branch: 'automated/noid/${{ matrix.branches }}-update-workflows' + title: '[${{ matrix.branches }}] ci(actions): Update workflow templates from organization template repository' + draft: ${{ env.DRAFT_ONLY == 1 }} + add-paths: .github/workflows/*.yml,.github/actions-lock.txt + body: | + Automated update of all workflow templates from [nextcloud/.github](https://github.com/nextcloud/.github) + ${{ env.SUMMARY }} + labels: | + dependencies + 3. to review diff --git a/workflow-catalog.json b/workflow-catalog.json index 706591e..43e1e01 100644 --- a/workflow-catalog.json +++ b/workflow-catalog.json @@ -11,6 +11,7 @@ "npm-build", "openapi", "psalm", - "reuse" + "reuse", + "sync-workflow-templates" ] } diff --git a/workflow-templates/lint-eslint.yml b/workflow-templates/lint-eslint.yml index 6bf3e9c..8614833 100644 --- a/workflow-templates/lint-eslint.yml +++ b/workflow-templates/lint-eslint.yml @@ -1,8 +1,10 @@ -# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors -# SPDX-License-Identifier: AGPL-3.0-or-later - -# This workflow is published through the LibreCode organization catalog. -# Implementation: LibreCodeCoop/github-workflows +# This workflow is provided via the organization template repository +# +# https://github.com/LibreCodeCoop/.github +# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization +# +# SPDX-FileCopyrightText: 2021-2024 Nextcloud GmbH and Nextcloud contributors +# SPDX-License-Identifier: MIT name: Lint eslint @@ -10,8 +12,89 @@ on: pull_request permissions: contents: read - pull-requests: read + +concurrency: + group: lint-eslint-${{ github.head_ref || github.run_id }} + cancel-in-progress: true jobs: - eslint: - uses: LibreCodeCoop/github-workflows/.github/workflows/lint-eslint.yml@bf6d298f17eacdada7d2f771cad8fe29a11ec09e + changes: + runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: read + + outputs: + src: ${{ steps.changes.outputs.src}} + + steps: + - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 + id: changes + continue-on-error: true + with: + filters: | + src: + - '.github/workflows/**' + - 'src/**' + - 'appinfo/info.xml' + - 'package.json' + - 'package-lock.json' + - 'tsconfig.json' + - '.eslintrc.*' + - '.eslintignore' + - '**.js' + - '**.ts' + - '**.vue' + + lint: + runs-on: ubuntu-latest + + needs: changes + if: needs.changes.outputs.src != 'false' + + name: NPM lint + + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Read package.json node and npm engines version + uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3 + id: versions + with: + fallbackNode: '^24' + fallbackNpm: '^11.3' + + - name: Set up node ${{ steps.versions.outputs.nodeVersion }} + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + with: + node-version: ${{ steps.versions.outputs.nodeVersion }} + + - name: Set up npm ${{ steps.versions.outputs.npmVersion }} + run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}' + + - name: Install dependencies + env: + CYPRESS_INSTALL_BINARY: 0 + PUPPETEER_SKIP_DOWNLOAD: true + run: npm ci + + - name: Lint + run: npm run lint + + summary: + permissions: + contents: none + runs-on: ubuntu-latest + needs: [changes, lint] + + if: always() + + # This is the summary, we just avoid to rename it so that branch protection rules still match + name: eslint + + steps: + - name: Summary status + run: if ${{ needs.changes.outputs.src != 'false' && needs.lint.result != 'success' }}; then exit 1; fi diff --git a/workflow-templates/sync-workflow-templates.properties.json b/workflow-templates/sync-workflow-templates.properties.json new file mode 100644 index 0000000..c394c30 --- /dev/null +++ b/workflow-templates/sync-workflow-templates.properties.json @@ -0,0 +1,11 @@ +{ + "name": "Auto workflows update", + "description": "Update local workflow copies from the LibreCode organization workflow catalog.", + "iconName": "octicon git-pull-request", + "categories": [ + "yml" + ], + "filePatterns": [ + ".github/workflows/*" + ] +} diff --git a/workflow-templates/sync-workflow-templates.properties.json.license b/workflow-templates/sync-workflow-templates.properties.json.license new file mode 100644 index 0000000..1ce4e0c --- /dev/null +++ b/workflow-templates/sync-workflow-templates.properties.json.license @@ -0,0 +1,2 @@ +SPDX-FileCopyrightText: 2026 LibreCode coop and contributors +SPDX-License-Identifier: AGPL-3.0-or-later diff --git a/workflow-templates/sync-workflow-templates.yml b/workflow-templates/sync-workflow-templates.yml new file mode 100644 index 0000000..2f7cc01 --- /dev/null +++ b/workflow-templates/sync-workflow-templates.yml @@ -0,0 +1,153 @@ +# This workflow is provided via the organization template repository +# +# https://github.com/LibreCodeCoop/.github +# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization +# +# SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors +# SPDX-License-Identifier: MIT + +# This workflow will update all workflow templates +# Additionally it will reapply `workflow.yml.patch` files after syncing and only then commit the result +name: Update workflows +on: + workflow_dispatch: + schedule: + - cron: "5 2 * * 0" + +permissions: + contents: read + +jobs: + dispatch: + runs-on: ubuntu-latest + + strategy: + fail-fast: false + matrix: + branches: + - ${{ github.event.repository.default_branch }} + - 'stable35' + - 'stable34' + - 'stable33' + + name: Update workflows in ${{ matrix.branches }} + + permissions: + contents: write + pull-requests: write + + steps: + - name: Check actor permission + uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0 + with: + require: admin + + - name: Create GitHub App token + id: app-token + uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4 + with: + app-id: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }} + private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }} + owner: LibreCodeCoop + repositories: ${{ github.event.repository.name }} + permission-contents: write + permission-pull-requests: write + permission-workflows: write + + - name: Checkout workflow repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + path: source + repository: LibreCodeCoop/.github + + - name: Checkout app + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + path: target + ref: ${{ matrix.branches }} + + - name: Copy all workflow templates + run: | + echo 'SUMMARY<> $GITHUB_ENV + draft_only=0 + for workflow in ./source/workflow-templates/*.yml; do + echo "❓ Looking for $workflow" + if [ -f "$workflow" ]; then + filename=$(basename "$workflow") + target_file="./target/.github/workflows/$filename" + + # Only copy if the file exists in the target repository + if [ -f "$target_file" ]; then + if [ -f "./target/.github/actions-lock.txt" ]; then + locked_version=$(grep " $filename" ./target/.github/actions-lock.txt | cat) + else + echo "# SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors" >> ./target/.github/actions-lock.txt + echo "# SPDX-License""-Identifier: MIT" >> ./target/.github/actions-lock.txt + locked_version="" + fi + locked_version=$(echo $locked_version | cut -f 1 -d " ") + new_version=$(md5sum $workflow | cut -f 1 -d " ") + + # Only update if the action changes + if [[ "$locked_version" != "$new_version" ]]; then + echo "â„šī¸ Locked version: $locked_version" + echo "â„šī¸ Current version: $new_version" + echo "🆙 Updating existing workflow: $filename" + echo "- 🆙 Updated [$filename](https://github.com/LibreCodeCoop/.github/commits/main/workflow-templates/$filename)" >> $GITHUB_ENV + + cp "$workflow" "$target_file" + + # Apply patch if one exists + if [ -f "$target_file.patch" ]; then + echo "🩹 Applying patch" + cd ./target + set +e + patch -p1 < ".github/workflows/$filename.patch" + patch_worked=$? + set -e + cd - + if [[ "$patch_worked" == "0" ]]; then + echo " - Patch applied" >> $GITHUB_ENV + else + echo " - [ ] ❌ Patch failed" >> $GITHUB_ENV + draft_only=1 + fi + fi + + if [[ "$locked_version" != "" ]]; then + sed -i "s/$locked_version $filename/$new_version $filename/" ./target/.github/actions-lock.txt + else + echo "$new_version $filename" >> ./target/.github/actions-lock.txt + fi + else + echo "✅ Skipping $filename: already up to date" + fi + else + echo "â­ī¸ Skipping $filename: does not exist in target repository" + fi + fi + done + echo 'EOF' >> $GITHUB_ENV + echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV + + - name: Create Pull Request + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 + with: + token: ${{ steps.app-token.outputs.token }} + commit-message: 'ci(actions): Update workflow templates from organization template repository' + committer: GitHub + author: librecode-workflow-automation[bot] <331658022+librecode-workflow-automation[bot]@users.noreply.github.com> + path: target + signoff: true + branch: 'automated/noid/${{ matrix.branches }}-update-workflows' + title: '[${{ matrix.branches }}] ci(actions): Update workflow templates from organization template repository' + draft: ${{ env.DRAFT_ONLY == 1 }} + add-paths: .github/workflows/*.yml,.github/actions-lock.txt + body: | + Automated update of all workflow templates from [LibreCodeCoop/.github](https://github.com/LibreCodeCoop/.github) + ${{ env.SUMMARY }} + labels: | + dependencies + 3. to review