From 1cec09b00de703daaedf6b5e5c423c9a979f2c29 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <vitor@php.rio>
Date: Sun, 20 Sep 2026 15:43:28 -0300
Subject: [PATCH 01/17] ci: restore materialized workflow synchronization

Signed-off-by: Vitor Mattos <vitor@php.rio>
---
 consumers.json                                |  15 --
 .../nextcloud/lint-eslint-template.yml.patch  |  62 +++++
 .../sync-workflow-templates.yml.patch         | 239 ++++++++++++++++++
 upstream/sources.json                         |   9 +
 upstream/templates.json                       |  16 ++
 .../nextcloud/sync-workflow-templates.yml     | 141 +++++++++++
 workflow-catalog.json                         |   3 +-
 workflow-templates/lint-eslint.yml            | 104 +++++++-
 .../sync-workflow-templates.properties.json   |  11 +
 ...workflow-templates.properties.json.license |   2 +
 .../sync-workflow-templates.yml               | 153 +++++++++++
 11 files changed, 732 insertions(+), 23 deletions(-)
 create mode 100644 patches/nextcloud/lint-eslint-template.yml.patch
 create mode 100644 patches/nextcloud/sync-workflow-templates.yml.patch
 create mode 100644 upstream/vendor/nextcloud/sync-workflow-templates.yml
 create mode 100644 workflow-templates/sync-workflow-templates.properties.json
 create mode 100644 workflow-templates/sync-workflow-templates.properties.json.license
 create mode 100644 workflow-templates/sync-workflow-templates.yml

diff --git a/consumers.json b/consumers.json
index dd8aa2e..74c182a 100644
--- a/consumers.json
+++ b/consumers.json
@@ -1,20 +1,5 @@
 {
   "consumers": [
-    {
-      "repository": "LibreCodeCoop/extract",
-      "workflows": [
-        "block-unconventional-commits.yml",
-        "lint-eslint.yml",
-        "lint-info-xml.yml",
-        "lint-php-cs.yml",
-        "lint-php.yml",
-        "lint-stylelint.yml",
-        "npm-build.yml",
-        "openapi.yml",
-        "psalm.yml",
-        "reuse.yml"
-      ]
-    },
     {
       "repository": "LibreCodeCoop/profile_fields",
       "workflows": [
diff --git a/patches/nextcloud/lint-eslint-template.yml.patch b/patches/nextcloud/lint-eslint-template.yml.patch
new file mode 100644
index 0000000..e474c84
--- /dev/null
+++ b/patches/nextcloud/lint-eslint-template.yml.patch
@@ -0,0 +1,62 @@
+--- upstream/vendor/nextcloud/lint-eslint.yml
++++ workflow-templates/lint-eslint.yml
+@@ -1,9 +1,10 @@
+ # This workflow is provided via the organization template repository
+ #
+-# https://github.com/nextcloud/.github
++# https://github.com/LibreCodeCoop/.github
+ # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
+ #
+ # SPDX-FileCopyrightText: 2021-2024 Nextcloud GmbH and Nextcloud contributors
++# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ # SPDX-License-Identifier: MIT
+ 
+ name: Lint eslint
+@@ -19,13 +20,13 @@
+ 
+ jobs:
+   changes:
+-    runs-on: ubuntu-latest-low
++    runs-on: ubuntu-latest
+     permissions:
+       contents: read
+       pull-requests: read
+ 
+     outputs:
+-      src: ${{ steps.changes.outputs.src}}
++      src: ${{ steps.changes.outputs.src }}
+ 
+     steps:
+       - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+@@ -72,8 +73,8 @@
+         with:
+           node-version: ${{ steps.versions.outputs.nodeVersion }}
+ 
+-      - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
+-        run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
++      - name: Show npm version
++        run: npm --version
+ 
+       - name: Install dependencies
+         env:
+@@ -87,7 +88,7 @@
+   summary:
+     permissions:
+       contents: none
+-    runs-on: ubuntu-latest-low
++    runs-on: ubuntu-latest
+     needs: [changes, lint]
+ 
+     if: always()
+@@ -97,4 +98,10 @@
+ 
+     steps:
+       - name: Summary status
+-        run: if ${{ needs.changes.outputs.src != 'false' && needs.lint.result != 'success' }}; then exit 1; fi
++        env:
++          CHANGED: ${{ needs.changes.outputs.src }}
++          LINT_RESULT: ${{ needs.lint.result }}
++        run: |
++          if [ "$CHANGED" != "false" ] && [ "$LINT_RESULT" != "success" ]; then
++            exit 1
++          fi
diff --git a/patches/nextcloud/sync-workflow-templates.yml.patch b/patches/nextcloud/sync-workflow-templates.yml.patch
new file mode 100644
index 0000000..41ef581
--- /dev/null
+++ b/patches/nextcloud/sync-workflow-templates.yml.patch
@@ -0,0 +1,239 @@
+--- upstream/vendor/nextcloud/sync-workflow-templates.yml
++++ workflow-templates/sync-workflow-templates.yml
+@@ -1,18 +1,19 @@
+ # This workflow is provided via the organization template repository
+ #
+-# https://github.com/nextcloud/.github
++# https://github.com/LibreCodeCoop/.github
+ # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
+ #
+ # SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
++# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+ # SPDX-License-Identifier: MIT
+ 
+-# This workflow will update all workflow templates
+-# Additionally it will reapply `workflow.yml.patch` files after syncing and only then commit the result
++# This workflow updates local workflow copies from the LibreCode organization catalog.
++# Local `workflow.yml.patch` files are reapplied after syncing and before the pull request is created.
+ name: Update workflows
+ on:
+   workflow_dispatch:
+   schedule:
+-      - cron: "5 2 * * 0"
++    - cron: "5 2 * * 0"
+ 
+ permissions:
+   contents: read
+@@ -20,122 +21,133 @@
+ jobs:
+   dispatch:
+     runs-on: ubuntu-latest
+-
+-    strategy:
+-      fail-fast: false
+-      matrix:
+-        branches:
+-          - ${{ github.event.repository.default_branch }}
+-          - 'stable35'
+-          - 'stable34'
+-          - 'stable33'
+-
+-    name: Update workflows in ${{ matrix.branches }}
+-
++    name: Update workflows in ${{ github.event.repository.default_branch }}
+     permissions:
+       contents: write
+       pull-requests: write
+ 
+     steps:
+       - name: Check actor permission
++        if: github.event_name == 'workflow_dispatch'
+         uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0
+         with:
+           require: admin
+ 
++      - name: Validate GitHub App configuration
++        env:
++          WORKFLOW_APP_ID: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
++          WORKFLOW_APP_PRIVATE_KEY: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
++        run: |
++          if [ -z "$WORKFLOW_APP_ID" ]; then
++            echo "::error::LIBRECODE_WORKFLOW_APP_ID is not configured."
++            exit 1
++          fi
++          if [ -z "$WORKFLOW_APP_PRIVATE_KEY" ]; then
++            echo "::error::LIBRECODE_WORKFLOW_APP_PRIVATE_KEY is not configured."
++            exit 1
++          fi
++
++      - name: Create GitHub App token
++        id: app-token
++        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
++        with:
++          app-id: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
++          private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
++          owner: LibreCodeCoop
++          repositories: ${{ github.event.repository.name }}
++          permission-contents: write
++          permission-pull-requests: write
++          permission-workflows: write
++
+       - name: Checkout workflow repository
+         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+         with:
+           persist-credentials: false
+           path: source
+-          repository: nextcloud/.github
++          repository: LibreCodeCoop/.github
+ 
+       - name: Checkout app
+         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+         with:
+           persist-credentials: false
+           path: target
+-          ref: ${{ matrix.branches }}
++          ref: ${{ github.event.repository.default_branch }}
+ 
+       - name: Copy all workflow templates
+         run: |
+-          echo 'SUMMARY<<EOF' >> $GITHUB_ENV
++          echo 'SUMMARY<<EOF' >> "$GITHUB_ENV"
+           draft_only=0
++          lock_file="./target/.github/actions-lock.txt"
++          if [ ! -f "$lock_file" ]; then
++            printf '%s\n' \
++              '# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors' \
++              '# SPDX-License''-Identifier: MIT' \
++              > "$lock_file"
++          fi
++
+           for workflow in ./source/workflow-templates/*.yml; do
+-            echo "❓ Looking for $workflow"
+-            if [ -f "$workflow" ]; then
+-              filename=$(basename "$workflow")
+-              target_file="./target/.github/workflows/$filename"
+-
+-              # Only copy if the file exists in the target repository
+-              if [ -f "$target_file" ]; then
+-                if [ -f "./target/.github/actions-lock.txt" ]; then
+-                  locked_version=$(grep " $filename" ./target/.github/actions-lock.txt | cat)
+-                else
+-                  echo "# SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors" >> ./target/.github/actions-lock.txt
+-                  echo "# SPDX-License""-Identifier: MIT" >> ./target/.github/actions-lock.txt
+-                  locked_version=""
+-                fi
+-                locked_version=$(echo $locked_version | cut -f 1 -d " ")
+-                new_version=$(md5sum $workflow | cut -f 1 -d " ")
+-
+-                # Only update if the action changes
+-                if [[ "$locked_version" != "$new_version" ]]; then
+-                  echo "ℹ️ Locked version: $locked_version"
+-                  echo "ℹ️ Current version: $new_version"
+-                  echo "🆙 Updating existing workflow: $filename"
+-                  echo "- 🆙 Updated [$filename](https://github.com/nextcloud/.github/commits/master/workflow-templates/$filename)" >> $GITHUB_ENV
+-
+-                  cp "$workflow" "$target_file"
+-
+-                  # Apply patch if one exists
+-                  if [ -f "$target_file.patch" ]; then
+-                    echo "🩹 Applying patch"
+-                    cd ./target
+-                    set +e
+-                    patch -p1 < ".github/workflows/$filename.patch"
+-                    patch_worked=$?
+-                    set -e
+-                    cd -
+-                    if [[ "$patch_worked" == "0" ]]; then
+-                      echo "  - Patch applied" >> $GITHUB_ENV
+-                    else
+-                      echo "  - [ ] ❌ Patch failed" >> $GITHUB_ENV
+-                      draft_only=1
+-                    fi
+-                  fi
+-
+-                  if [[ "$locked_version" != "" ]]; then
+-                    sed -i "s/$locked_version $filename/$new_version $filename/" ./target/.github/actions-lock.txt
+-                  else
+-                    echo "$new_version $filename" >> ./target/.github/actions-lock.txt
+-                  fi
+-                else
+-                  echo "✅ Skipping $filename: already up to date"
+-                fi
++            filename=$(basename "$workflow")
++            target_file="./target/.github/workflows/$filename"
++
++            if [ ! -f "$target_file" ]; then
++              echo "Skipping $filename: does not exist in target repository"
++              continue
++            fi
++
++            locked_version=$(grep " $filename$" "$lock_file" | cut -f 1 -d ' ' || true)
++            new_version=$(sha256sum "$workflow" | cut -f 1 -d ' ')
++
++            if [ "$locked_version" = "$new_version" ]; then
++              echo "Skipping $filename: already up to date"
++              continue
++            fi
++
++            echo "Updating existing workflow: $filename"
++            echo "- Updated [$filename](https://github.com/LibreCodeCoop/.github/commits/main/workflow-templates/$filename)" >> "$GITHUB_ENV"
++            cp "$workflow" "$target_file"
++
++            if [ -f "$target_file.patch" ]; then
++              echo "Applying local patch for $filename"
++              set +e
++              (
++                cd ./target
++                patch -p1 < ".github/workflows/$filename.patch"
++              )
++              patch_worked=$?
++              set -e
++              if [ "$patch_worked" -eq 0 ]; then
++                echo "  - Patch applied" >> "$GITHUB_ENV"
+               else
+-                echo "⏭️ Skipping $filename: does not exist in target repository"
++                echo "  - [ ] Patch failed" >> "$GITHUB_ENV"
++                draft_only=1
+               fi
+             fi
++
++            if grep -q " $filename$" "$lock_file"; then
++              sed -i "s/^[^ ]* $filename$/$new_version $filename/" "$lock_file"
++            else
++              echo "$new_version $filename" >> "$lock_file"
++            fi
+           done
+-          echo 'EOF' >> $GITHUB_ENV
+-          echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV
++          echo 'EOF' >> "$GITHUB_ENV"
++          echo "DRAFT_ONLY=${draft_only}" >> "$GITHUB_ENV"
+ 
+       - name: Create Pull Request
+         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+         with:
+-          token: ${{ secrets.COMMAND_BOT_WORKFLOWS }}
+-          commit-message: 'ci(actions): Update workflow templates from organization template repository'
++          token: ${{ steps.app-token.outputs.token }}
++          commit-message: 'ci(actions): update workflow templates from LibreCode catalog'
+           committer: GitHub <noreply@github.com>
+-          author: nextcloud-command <nextcloud-command@users.noreply.github.com>
++          author: librecode-workflow-automation[bot] <noreply@github.com>
+           path: target
+           signoff: true
+-          branch: 'automated/noid/${{ matrix.branches }}-update-workflows'
+-          title: '[${{ matrix.branches }}] ci(actions): Update workflow templates from organization template repository'
++          branch: 'automated/update-workflows'
++          delete-branch: true
++          title: 'ci(actions): update workflow templates from LibreCode catalog'
+           draft: ${{ env.DRAFT_ONLY == 1 }}
+-          add-paths: .github/workflows/*.yml,.github/actions-lock.txt
++          add-paths: |
++            .github/workflows/*.yml
++            .github/actions-lock.txt
+           body: |
+-            Automated update of all workflow templates from [nextcloud/.github](https://github.com/nextcloud/.github)
++            Automated update of workflow templates from [LibreCodeCoop/.github](https://github.com/LibreCodeCoop/.github).
+             ${{ env.SUMMARY }}
+-          labels: |
+-            dependencies
+-            3. to review
diff --git a/upstream/sources.json b/upstream/sources.json
index 81fb92a..cd37015 100644
--- a/upstream/sources.json
+++ b/upstream/sources.json
@@ -116,6 +116,15 @@
       "url": "https://raw.githubusercontent.com/nextcloud/.github/98dc00f32e5c4b85361a06a40c7f8d7d1c0a38f3/workflow-templates/reuse.yml",
       "sha256": "13133274d505be2d100b27637ccd893a24f9dea82cbf96483a1024138aacf5b3",
       "destination": "upstream/vendor/nextcloud/reuse.yml"
+    },
+    {
+      "name": "nextcloud-sync-workflow-templates",
+      "repository": "nextcloud/.github",
+      "ref": "master",
+      "path": "workflow-templates/sync-workflow-templates.yml",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/e137952600ed786d2dfd1bf928fadf92d295483c/workflow-templates/sync-workflow-templates.yml",
+      "sha256": "b1a49a5dbc35ca40a1485bed5f84ef042c6c738f5c81cb229035f24fd6dc0cf0",
+      "destination": "upstream/vendor/nextcloud/sync-workflow-templates.yml"
     }
   ]
 }
diff --git a/upstream/templates.json b/upstream/templates.json
index f088114..893eb37 100644
--- a/upstream/templates.json
+++ b/upstream/templates.json
@@ -103,6 +103,22 @@
         "patches/nextcloud/reuse.yml.patch"
       ],
       "destination": ".github/workflows/reuse.yml"
+    },
+    {
+      "name": "nextcloud-lint-eslint-template",
+      "source": "upstream/vendor/nextcloud/lint-eslint.yml",
+      "patches": [
+        "patches/nextcloud/lint-eslint-template.yml.patch"
+      ],
+      "destination": "workflow-templates/lint-eslint.yml"
+    },
+    {
+      "name": "nextcloud-sync-workflow-templates",
+      "source": "upstream/vendor/nextcloud/sync-workflow-templates.yml",
+      "patches": [
+        "patches/nextcloud/sync-workflow-templates.yml.patch"
+      ],
+      "destination": "workflow-templates/sync-workflow-templates.yml"
     }
   ]
 }
diff --git a/upstream/vendor/nextcloud/sync-workflow-templates.yml b/upstream/vendor/nextcloud/sync-workflow-templates.yml
new file mode 100644
index 0000000..40d39e1
--- /dev/null
+++ b/upstream/vendor/nextcloud/sync-workflow-templates.yml
@@ -0,0 +1,141 @@
+# This workflow is provided via the organization template repository
+#
+# https://github.com/nextcloud/.github
+# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
+#
+# SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: MIT
+
+# This workflow will update all workflow templates
+# Additionally it will reapply `workflow.yml.patch` files after syncing and only then commit the result
+name: Update workflows
+on:
+  workflow_dispatch:
+  schedule:
+      - cron: "5 2 * * 0"
+
+permissions:
+  contents: read
+
+jobs:
+  dispatch:
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        branches:
+          - ${{ github.event.repository.default_branch }}
+          - 'stable35'
+          - 'stable34'
+          - 'stable33'
+
+    name: Update workflows in ${{ matrix.branches }}
+
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - name: Check actor permission
+        uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0
+        with:
+          require: admin
+
+      - name: Checkout workflow repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          path: source
+          repository: nextcloud/.github
+
+      - name: Checkout app
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          path: target
+          ref: ${{ matrix.branches }}
+
+      - name: Copy all workflow templates
+        run: |
+          echo 'SUMMARY<<EOF' >> $GITHUB_ENV
+          draft_only=0
+          for workflow in ./source/workflow-templates/*.yml; do
+            echo "❓ Looking for $workflow"
+            if [ -f "$workflow" ]; then
+              filename=$(basename "$workflow")
+              target_file="./target/.github/workflows/$filename"
+
+              # Only copy if the file exists in the target repository
+              if [ -f "$target_file" ]; then
+                if [ -f "./target/.github/actions-lock.txt" ]; then
+                  locked_version=$(grep " $filename" ./target/.github/actions-lock.txt | cat)
+                else
+                  echo "# SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors" >> ./target/.github/actions-lock.txt
+                  echo "# SPDX-License""-Identifier: MIT" >> ./target/.github/actions-lock.txt
+                  locked_version=""
+                fi
+                locked_version=$(echo $locked_version | cut -f 1 -d " ")
+                new_version=$(md5sum $workflow | cut -f 1 -d " ")
+
+                # Only update if the action changes
+                if [[ "$locked_version" != "$new_version" ]]; then
+                  echo "ℹ️ Locked version: $locked_version"
+                  echo "ℹ️ Current version: $new_version"
+                  echo "🆙 Updating existing workflow: $filename"
+                  echo "- 🆙 Updated [$filename](https://github.com/nextcloud/.github/commits/master/workflow-templates/$filename)" >> $GITHUB_ENV
+
+                  cp "$workflow" "$target_file"
+
+                  # Apply patch if one exists
+                  if [ -f "$target_file.patch" ]; then
+                    echo "🩹 Applying patch"
+                    cd ./target
+                    set +e
+                    patch -p1 < ".github/workflows/$filename.patch"
+                    patch_worked=$?
+                    set -e
+                    cd -
+                    if [[ "$patch_worked" == "0" ]]; then
+                      echo "  - Patch applied" >> $GITHUB_ENV
+                    else
+                      echo "  - [ ] ❌ Patch failed" >> $GITHUB_ENV
+                      draft_only=1
+                    fi
+                  fi
+
+                  if [[ "$locked_version" != "" ]]; then
+                    sed -i "s/$locked_version $filename/$new_version $filename/" ./target/.github/actions-lock.txt
+                  else
+                    echo "$new_version $filename" >> ./target/.github/actions-lock.txt
+                  fi
+                else
+                  echo "✅ Skipping $filename: already up to date"
+                fi
+              else
+                echo "⏭️ Skipping $filename: does not exist in target repository"
+              fi
+            fi
+          done
+          echo 'EOF' >> $GITHUB_ENV
+          echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ secrets.COMMAND_BOT_WORKFLOWS }}
+          commit-message: 'ci(actions): Update workflow templates from organization template repository'
+          committer: GitHub <noreply@github.com>
+          author: nextcloud-command <nextcloud-command@users.noreply.github.com>
+          path: target
+          signoff: true
+          branch: 'automated/noid/${{ matrix.branches }}-update-workflows'
+          title: '[${{ matrix.branches }}] ci(actions): Update workflow templates from organization template repository'
+          draft: ${{ env.DRAFT_ONLY == 1 }}
+          add-paths: .github/workflows/*.yml,.github/actions-lock.txt
+          body: |
+            Automated update of all workflow templates from [nextcloud/.github](https://github.com/nextcloud/.github)
+            ${{ env.SUMMARY }}
+          labels: |
+            dependencies
+            3. to review
diff --git a/workflow-catalog.json b/workflow-catalog.json
index 706591e..43e1e01 100644
--- a/workflow-catalog.json
+++ b/workflow-catalog.json
@@ -11,6 +11,7 @@
     "npm-build",
     "openapi",
     "psalm",
-    "reuse"
+    "reuse",
+    "sync-workflow-templates"
   ]
 }
diff --git a/workflow-templates/lint-eslint.yml b/workflow-templates/lint-eslint.yml
index 6bf3e9c..94593bc 100644
--- a/workflow-templates/lint-eslint.yml
+++ b/workflow-templates/lint-eslint.yml
@@ -1,8 +1,11 @@
+# This workflow is provided via the organization template repository
+#
+# https://github.com/LibreCodeCoop/.github
+# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
+#
+# SPDX-FileCopyrightText: 2021-2024 Nextcloud GmbH and Nextcloud contributors
 # SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-# This workflow is published through the LibreCode organization catalog.
-# Implementation: LibreCodeCoop/github-workflows
+# SPDX-License-Identifier: MIT
 
 name: Lint eslint
 
@@ -10,8 +13,95 @@ on: pull_request
 
 permissions:
   contents: read
-  pull-requests: read
+
+concurrency:
+  group: lint-eslint-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
 
 jobs:
-  eslint:
-    uses: LibreCodeCoop/github-workflows/.github/workflows/lint-eslint.yml@bf6d298f17eacdada7d2f771cad8fe29a11ec09e
+  changes:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+
+    outputs:
+      src: ${{ steps.changes.outputs.src }}
+
+    steps:
+      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        id: changes
+        continue-on-error: true
+        with:
+          filters: |
+            src:
+              - '.github/workflows/**'
+              - 'src/**'
+              - 'appinfo/info.xml'
+              - 'package.json'
+              - 'package-lock.json'
+              - 'tsconfig.json'
+              - '.eslintrc.*'
+              - '.eslintignore'
+              - '**.js'
+              - '**.ts'
+              - '**.vue'
+
+  lint:
+    runs-on: ubuntu-latest
+
+    needs: changes
+    if: needs.changes.outputs.src != 'false'
+
+    name: NPM lint
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Read package.json node and npm engines version
+        uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+        id: versions
+        with:
+          fallbackNode: '^24'
+          fallbackNpm: '^11.3'
+
+      - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ steps.versions.outputs.nodeVersion }}
+
+      - name: Show npm version
+        run: npm --version
+
+      - name: Install dependencies
+        env:
+          CYPRESS_INSTALL_BINARY: 0
+          PUPPETEER_SKIP_DOWNLOAD: true
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+  summary:
+    permissions:
+      contents: none
+    runs-on: ubuntu-latest
+    needs: [changes, lint]
+
+    if: always()
+
+    # This is the summary, we just avoid to rename it so that branch protection rules still match
+    name: eslint
+
+    steps:
+      - name: Summary status
+        env:
+          CHANGED: ${{ needs.changes.outputs.src }}
+          LINT_RESULT: ${{ needs.lint.result }}
+        run: |
+          if [ "$CHANGED" != "false" ] && [ "$LINT_RESULT" != "success" ]; then
+            exit 1
+          fi
diff --git a/workflow-templates/sync-workflow-templates.properties.json b/workflow-templates/sync-workflow-templates.properties.json
new file mode 100644
index 0000000..c394c30
--- /dev/null
+++ b/workflow-templates/sync-workflow-templates.properties.json
@@ -0,0 +1,11 @@
+{
+  "name": "Auto workflows update",
+  "description": "Update local workflow copies from the LibreCode organization workflow catalog.",
+  "iconName": "octicon git-pull-request",
+  "categories": [
+    "yml"
+  ],
+  "filePatterns": [
+    ".github/workflows/*"
+  ]
+}
diff --git a/workflow-templates/sync-workflow-templates.properties.json.license b/workflow-templates/sync-workflow-templates.properties.json.license
new file mode 100644
index 0000000..1ce4e0c
--- /dev/null
+++ b/workflow-templates/sync-workflow-templates.properties.json.license
@@ -0,0 +1,2 @@
+SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+SPDX-License-Identifier: AGPL-3.0-or-later
diff --git a/workflow-templates/sync-workflow-templates.yml b/workflow-templates/sync-workflow-templates.yml
new file mode 100644
index 0000000..65fe643
--- /dev/null
+++ b/workflow-templates/sync-workflow-templates.yml
@@ -0,0 +1,153 @@
+# This workflow is provided via the organization template repository
+#
+# https://github.com/LibreCodeCoop/.github
+# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
+#
+# SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
+# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+# SPDX-License-Identifier: MIT
+
+# This workflow updates local workflow copies from the LibreCode organization catalog.
+# Local `workflow.yml.patch` files are reapplied after syncing and before the pull request is created.
+name: Update workflows
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "5 2 * * 0"
+
+permissions:
+  contents: read
+
+jobs:
+  dispatch:
+    runs-on: ubuntu-latest
+    name: Update workflows in ${{ github.event.repository.default_branch }}
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - name: Check actor permission
+        if: github.event_name == 'workflow_dispatch'
+        uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0
+        with:
+          require: admin
+
+      - name: Validate GitHub App configuration
+        env:
+          WORKFLOW_APP_ID: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
+          WORKFLOW_APP_PRIVATE_KEY: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
+        run: |
+          if [ -z "$WORKFLOW_APP_ID" ]; then
+            echo "::error::LIBRECODE_WORKFLOW_APP_ID is not configured."
+            exit 1
+          fi
+          if [ -z "$WORKFLOW_APP_PRIVATE_KEY" ]; then
+            echo "::error::LIBRECODE_WORKFLOW_APP_PRIVATE_KEY is not configured."
+            exit 1
+          fi
+
+      - name: Create GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+        with:
+          app-id: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
+          private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
+          owner: LibreCodeCoop
+          repositories: ${{ github.event.repository.name }}
+          permission-contents: write
+          permission-pull-requests: write
+          permission-workflows: write
+
+      - name: Checkout workflow repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          path: source
+          repository: LibreCodeCoop/.github
+
+      - name: Checkout app
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          path: target
+          ref: ${{ github.event.repository.default_branch }}
+
+      - name: Copy all workflow templates
+        run: |
+          echo 'SUMMARY<<EOF' >> "$GITHUB_ENV"
+          draft_only=0
+          lock_file="./target/.github/actions-lock.txt"
+          if [ ! -f "$lock_file" ]; then
+            printf '%s\n' \
+              '# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors' \
+              '# SPDX-License''-Identifier: MIT' \
+              > "$lock_file"
+          fi
+
+          for workflow in ./source/workflow-templates/*.yml; do
+            filename=$(basename "$workflow")
+            target_file="./target/.github/workflows/$filename"
+
+            if [ ! -f "$target_file" ]; then
+              echo "Skipping $filename: does not exist in target repository"
+              continue
+            fi
+
+            locked_version=$(grep " $filename$" "$lock_file" | cut -f 1 -d ' ' || true)
+            new_version=$(sha256sum "$workflow" | cut -f 1 -d ' ')
+
+            if [ "$locked_version" = "$new_version" ]; then
+              echo "Skipping $filename: already up to date"
+              continue
+            fi
+
+            echo "Updating existing workflow: $filename"
+            echo "- Updated [$filename](https://github.com/LibreCodeCoop/.github/commits/main/workflow-templates/$filename)" >> "$GITHUB_ENV"
+            cp "$workflow" "$target_file"
+
+            if [ -f "$target_file.patch" ]; then
+              echo "Applying local patch for $filename"
+              set +e
+              (
+                cd ./target
+                patch -p1 < ".github/workflows/$filename.patch"
+              )
+              patch_worked=$?
+              set -e
+              if [ "$patch_worked" -eq 0 ]; then
+                echo "  - Patch applied" >> "$GITHUB_ENV"
+              else
+                echo "  - [ ] Patch failed" >> "$GITHUB_ENV"
+                draft_only=1
+              fi
+            fi
+
+            if grep -q " $filename$" "$lock_file"; then
+              sed -i "s/^[^ ]* $filename$/$new_version $filename/" "$lock_file"
+            else
+              echo "$new_version $filename" >> "$lock_file"
+            fi
+          done
+          echo 'EOF' >> "$GITHUB_ENV"
+          echo "DRAFT_ONLY=${draft_only}" >> "$GITHUB_ENV"
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          commit-message: 'ci(actions): update workflow templates from LibreCode catalog'
+          committer: GitHub <noreply@github.com>
+          author: librecode-workflow-automation[bot] <noreply@github.com>
+          path: target
+          signoff: true
+          branch: 'automated/update-workflows'
+          delete-branch: true
+          title: 'ci(actions): update workflow templates from LibreCode catalog'
+          draft: ${{ env.DRAFT_ONLY == 1 }}
+          add-paths: |
+            .github/workflows/*.yml
+            .github/actions-lock.txt
+          body: |
+            Automated update of workflow templates from [LibreCodeCoop/.github](https://github.com/LibreCodeCoop/.github).
+            ${{ env.SUMMARY }}

From 46b2a8bc74bac57ba2798d404460130774f72e7a Mon Sep 17 00:00:00 2001
From: Vitor Mattos <vitor@php.rio>
Date: Sun, 20 Sep 2026 15:50:32 -0300
Subject: [PATCH 02/17] fix: keep workflow sync patch close to upstream

Signed-off-by: Vitor Mattos <vitor@php.rio>
---
 .../sync-workflow-templates.yml               | 156 +++++++++---------
 1 file changed, 78 insertions(+), 78 deletions(-)

diff --git a/workflow-templates/sync-workflow-templates.yml b/workflow-templates/sync-workflow-templates.yml
index 65fe643..278d72a 100644
--- a/workflow-templates/sync-workflow-templates.yml
+++ b/workflow-templates/sync-workflow-templates.yml
@@ -7,13 +7,13 @@
 # SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
 # SPDX-License-Identifier: MIT
 
-# This workflow updates local workflow copies from the LibreCode organization catalog.
-# Local `workflow.yml.patch` files are reapplied after syncing and before the pull request is created.
+# This workflow will update all workflow templates
+# Additionally it will reapply `workflow.yml.patch` files after syncing and only then commit the result
 name: Update workflows
 on:
   workflow_dispatch:
   schedule:
-    - cron: "5 2 * * 0"
+      - cron: "5 2 * * 0"
 
 permissions:
   contents: read
@@ -21,32 +21,27 @@ permissions:
 jobs:
   dispatch:
     runs-on: ubuntu-latest
-    name: Update workflows in ${{ github.event.repository.default_branch }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        branches:
+          - ${{ github.event.repository.default_branch }}
+          - 'stable32'
+          - 'stable31'
+
+    name: Update workflows in ${{ matrix.branches }}
+
     permissions:
       contents: write
       pull-requests: write
 
     steps:
       - name: Check actor permission
-        if: github.event_name == 'workflow_dispatch'
         uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0
         with:
           require: admin
 
-      - name: Validate GitHub App configuration
-        env:
-          WORKFLOW_APP_ID: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
-          WORKFLOW_APP_PRIVATE_KEY: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
-        run: |
-          if [ -z "$WORKFLOW_APP_ID" ]; then
-            echo "::error::LIBRECODE_WORKFLOW_APP_ID is not configured."
-            exit 1
-          fi
-          if [ -z "$WORKFLOW_APP_PRIVATE_KEY" ]; then
-            echo "::error::LIBRECODE_WORKFLOW_APP_PRIVATE_KEY is not configured."
-            exit 1
-          fi
-
       - name: Create GitHub App token
         id: app-token
         uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
@@ -71,83 +66,88 @@ jobs:
         with:
           persist-credentials: false
           path: target
-          ref: ${{ github.event.repository.default_branch }}
+          ref: ${{ matrix.branches }}
 
       - name: Copy all workflow templates
         run: |
-          echo 'SUMMARY<<EOF' >> "$GITHUB_ENV"
+          echo 'SUMMARY<<EOF' >> $GITHUB_ENV
           draft_only=0
-          lock_file="./target/.github/actions-lock.txt"
-          if [ ! -f "$lock_file" ]; then
-            printf '%s\n' \
-              '# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors' \
-              '# SPDX-License''-Identifier: MIT' \
-              > "$lock_file"
-          fi
-
           for workflow in ./source/workflow-templates/*.yml; do
-            filename=$(basename "$workflow")
-            target_file="./target/.github/workflows/$filename"
-
-            if [ ! -f "$target_file" ]; then
-              echo "Skipping $filename: does not exist in target repository"
-              continue
-            fi
-
-            locked_version=$(grep " $filename$" "$lock_file" | cut -f 1 -d ' ' || true)
-            new_version=$(sha256sum "$workflow" | cut -f 1 -d ' ')
-
-            if [ "$locked_version" = "$new_version" ]; then
-              echo "Skipping $filename: already up to date"
-              continue
-            fi
-
-            echo "Updating existing workflow: $filename"
-            echo "- Updated [$filename](https://github.com/LibreCodeCoop/.github/commits/main/workflow-templates/$filename)" >> "$GITHUB_ENV"
-            cp "$workflow" "$target_file"
-
-            if [ -f "$target_file.patch" ]; then
-              echo "Applying local patch for $filename"
-              set +e
-              (
-                cd ./target
-                patch -p1 < ".github/workflows/$filename.patch"
-              )
-              patch_worked=$?
-              set -e
-              if [ "$patch_worked" -eq 0 ]; then
-                echo "  - Patch applied" >> "$GITHUB_ENV"
+            echo "❓ Looking for $workflow"
+            if [ -f "$workflow" ]; then
+              filename=$(basename "$workflow")
+              target_file="./target/.github/workflows/$filename"
+
+              # Only copy if the file exists in the target repository
+              if [ -f "$target_file" ]; then
+                if [ -f "./target/.github/actions-lock.txt" ]; then
+                  locked_version=$(grep " $filename" ./target/.github/actions-lock.txt | cat)
+                else
+                  echo "# SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors" >> ./target/.github/actions-lock.txt
+                  echo "# SPDX-License""-Identifier: MIT" >> ./target/.github/actions-lock.txt
+                  locked_version=""
+                fi
+                locked_version=$(echo $locked_version | cut -f 1 -d " ")
+                new_version=$(md5sum $workflow | cut -f 1 -d " ")
+
+                # Only update if the action changes
+                if [[ "$locked_version" != "$new_version" ]]; then
+                  echo "ℹ️ Locked version: $locked_version"
+                  echo "ℹ️ Current version: $new_version"
+                  echo "🆙 Updating existing workflow: $filename"
+                  echo "- 🆙 Updated [$filename](https://github.com/nextcloud/.github/commits/master/workflow-templates/$filename)" >> $GITHUB_ENV
+
+                  cp "$workflow" "$target_file"
+
+                  # Apply patch if one exists
+                  if [ -f "$target_file.patch" ]; then
+                    echo "🩹 Applying patch"
+                    cd ./target
+                    set +e
+                    patch -p1 < ".github/workflows/$filename.patch"
+                    patch_worked=$?
+                    set -e
+                    cd -
+                    if [[ "$patch_worked" == "0" ]]; then
+                      echo "  - Patch applied" >> $GITHUB_ENV
+                    else
+                      echo "  - [ ] ❌ Patch failed" >> $GITHUB_ENV
+                      draft_only=1
+                    fi
+                  fi
+
+                  if [[ "$locked_version" != "" ]]; then
+                    sed -i "s/$locked_version $filename/$new_version $filename/" ./target/.github/actions-lock.txt
+                  else
+                    echo "$new_version $filename" >> ./target/.github/actions-lock.txt
+                  fi
+                else
+                  echo "✅ Skipping $filename: already up to date"
+                fi
               else
-                echo "  - [ ] Patch failed" >> "$GITHUB_ENV"
-                draft_only=1
+                echo "⏭️ Skipping $filename: does not exist in target repository"
               fi
             fi
-
-            if grep -q " $filename$" "$lock_file"; then
-              sed -i "s/^[^ ]* $filename$/$new_version $filename/" "$lock_file"
-            else
-              echo "$new_version $filename" >> "$lock_file"
-            fi
           done
-          echo 'EOF' >> "$GITHUB_ENV"
-          echo "DRAFT_ONLY=${draft_only}" >> "$GITHUB_ENV"
+          echo 'EOF' >> $GITHUB_ENV
+          echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV
 
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ steps.app-token.outputs.token }}
-          commit-message: 'ci(actions): update workflow templates from LibreCode catalog'
+          commit-message: 'ci(actions): Update workflow templates from organization template repository'
           committer: GitHub <noreply@github.com>
           author: librecode-workflow-automation[bot] <noreply@github.com>
           path: target
           signoff: true
-          branch: 'automated/update-workflows'
-          delete-branch: true
-          title: 'ci(actions): update workflow templates from LibreCode catalog'
+          branch: 'automated/noid/${{ matrix.branches }}-update-workflows'
+          title: '[${{ matrix.branches }}] ci(actions): Update workflow templates from organization template repository'
           draft: ${{ env.DRAFT_ONLY == 1 }}
-          add-paths: |
-            .github/workflows/*.yml
-            .github/actions-lock.txt
+          add-paths: .github/workflows/*.yml,.github/actions-lock.txt
           body: |
-            Automated update of workflow templates from [LibreCodeCoop/.github](https://github.com/LibreCodeCoop/.github).
+            Automated update of all workflow templates from [LibreCodeCoop/.github](https://github.com/LibreCodeCoop/.github)
             ${{ env.SUMMARY }}
+          labels: |
+            dependencies
+            3. to review

From c6e86a74d029ef42a68ab79760bb1947c59f4105 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <vitor@php.rio>
Date: Sun, 20 Sep 2026 16:10:46 -0300
Subject: [PATCH 03/17] fix: minimize workflow sync patch

Signed-off-by: Vitor Mattos <vitor@php.rio>
---
 .../sync-workflow-templates.yml.patch         | 203 ++----------------
 1 file changed, 19 insertions(+), 184 deletions(-)

diff --git a/patches/nextcloud/sync-workflow-templates.yml.patch b/patches/nextcloud/sync-workflow-templates.yml.patch
index 41ef581..8a4fe61 100644
--- a/patches/nextcloud/sync-workflow-templates.yml.patch
+++ b/patches/nextcloud/sync-workflow-templates.yml.patch
@@ -1,6 +1,6 @@
 --- upstream/vendor/nextcloud/sync-workflow-templates.yml
 +++ workflow-templates/sync-workflow-templates.yml
-@@ -1,18 +1,19 @@
+@@ -1,9 +1,10 @@
  # This workflow is provided via the organization template repository
  #
 -# https://github.com/nextcloud/.github
@@ -11,61 +11,23 @@
 +# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
  # SPDX-License-Identifier: MIT
  
--# This workflow will update all workflow templates
--# Additionally it will reapply `workflow.yml.patch` files after syncing and only then commit the result
-+# This workflow updates local workflow copies from the LibreCode organization catalog.
-+# Local `workflow.yml.patch` files are reapplied after syncing and before the pull request is created.
- name: Update workflows
- on:
-   workflow_dispatch:
-   schedule:
--      - cron: "5 2 * * 0"
-+    - cron: "5 2 * * 0"
- 
- permissions:
-   contents: read
-@@ -20,122 +21,133 @@
- jobs:
-   dispatch:
-     runs-on: ubuntu-latest
--
--    strategy:
--      fail-fast: false
--      matrix:
--        branches:
--          - ${{ github.event.repository.default_branch }}
+ # This workflow will update all workflow templates
+@@ -26,9 +27,8 @@
+       matrix:
+         branches:
+           - ${{ github.event.repository.default_branch }}
 -          - 'stable35'
 -          - 'stable34'
 -          - 'stable33'
--
--    name: Update workflows in ${{ matrix.branches }}
--
-+    name: Update workflows in ${{ github.event.repository.default_branch }}
-     permissions:
-       contents: write
-       pull-requests: write
++          - 'stable32'
++          - 'stable31'
+ 
+     name: Update workflows in ${{ matrix.branches }}
  
-     steps:
-       - name: Check actor permission
-+        if: github.event_name == 'workflow_dispatch'
-         uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0
+@@ -42,12 +42,24 @@
          with:
            require: admin
  
-+      - name: Validate GitHub App configuration
-+        env:
-+          WORKFLOW_APP_ID: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }}
-+          WORKFLOW_APP_PRIVATE_KEY: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
-+        run: |
-+          if [ -z "$WORKFLOW_APP_ID" ]; then
-+            echo "::error::LIBRECODE_WORKFLOW_APP_ID is not configured."
-+            exit 1
-+          fi
-+          if [ -z "$WORKFLOW_APP_PRIVATE_KEY" ]; then
-+            echo "::error::LIBRECODE_WORKFLOW_APP_PRIVATE_KEY is not configured."
-+            exit 1
-+          fi
-+
 +      - name: Create GitHub App token
 +        id: app-token
 +        uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
@@ -88,152 +50,25 @@
  
        - name: Checkout app
          uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-         with:
-           persist-credentials: false
-           path: target
--          ref: ${{ matrix.branches }}
-+          ref: ${{ github.event.repository.default_branch }}
- 
-       - name: Copy all workflow templates
-         run: |
--          echo 'SUMMARY<<EOF' >> $GITHUB_ENV
-+          echo 'SUMMARY<<EOF' >> "$GITHUB_ENV"
-           draft_only=0
-+          lock_file="./target/.github/actions-lock.txt"
-+          if [ ! -f "$lock_file" ]; then
-+            printf '%s\n' \
-+              '# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors' \
-+              '# SPDX-License''-Identifier: MIT' \
-+              > "$lock_file"
-+          fi
-+
-           for workflow in ./source/workflow-templates/*.yml; do
--            echo "❓ Looking for $workflow"
--            if [ -f "$workflow" ]; then
--              filename=$(basename "$workflow")
--              target_file="./target/.github/workflows/$filename"
--
--              # Only copy if the file exists in the target repository
--              if [ -f "$target_file" ]; then
--                if [ -f "./target/.github/actions-lock.txt" ]; then
--                  locked_version=$(grep " $filename" ./target/.github/actions-lock.txt | cat)
--                else
--                  echo "# SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors" >> ./target/.github/actions-lock.txt
--                  echo "# SPDX-License""-Identifier: MIT" >> ./target/.github/actions-lock.txt
--                  locked_version=""
--                fi
--                locked_version=$(echo $locked_version | cut -f 1 -d " ")
--                new_version=$(md5sum $workflow | cut -f 1 -d " ")
--
--                # Only update if the action changes
--                if [[ "$locked_version" != "$new_version" ]]; then
--                  echo "ℹ️ Locked version: $locked_version"
--                  echo "ℹ️ Current version: $new_version"
--                  echo "🆙 Updating existing workflow: $filename"
--                  echo "- 🆙 Updated [$filename](https://github.com/nextcloud/.github/commits/master/workflow-templates/$filename)" >> $GITHUB_ENV
--
--                  cp "$workflow" "$target_file"
--
--                  # Apply patch if one exists
--                  if [ -f "$target_file.patch" ]; then
--                    echo "🩹 Applying patch"
--                    cd ./target
--                    set +e
--                    patch -p1 < ".github/workflows/$filename.patch"
--                    patch_worked=$?
--                    set -e
--                    cd -
--                    if [[ "$patch_worked" == "0" ]]; then
--                      echo "  - Patch applied" >> $GITHUB_ENV
--                    else
--                      echo "  - [ ] ❌ Patch failed" >> $GITHUB_ENV
--                      draft_only=1
--                    fi
--                  fi
--
--                  if [[ "$locked_version" != "" ]]; then
--                    sed -i "s/$locked_version $filename/$new_version $filename/" ./target/.github/actions-lock.txt
--                  else
--                    echo "$new_version $filename" >> ./target/.github/actions-lock.txt
--                  fi
--                else
--                  echo "✅ Skipping $filename: already up to date"
--                fi
-+            filename=$(basename "$workflow")
-+            target_file="./target/.github/workflows/$filename"
-+
-+            if [ ! -f "$target_file" ]; then
-+              echo "Skipping $filename: does not exist in target repository"
-+              continue
-+            fi
-+
-+            locked_version=$(grep " $filename$" "$lock_file" | cut -f 1 -d ' ' || true)
-+            new_version=$(sha256sum "$workflow" | cut -f 1 -d ' ')
-+
-+            if [ "$locked_version" = "$new_version" ]; then
-+              echo "Skipping $filename: already up to date"
-+              continue
-+            fi
-+
-+            echo "Updating existing workflow: $filename"
-+            echo "- Updated [$filename](https://github.com/LibreCodeCoop/.github/commits/main/workflow-templates/$filename)" >> "$GITHUB_ENV"
-+            cp "$workflow" "$target_file"
-+
-+            if [ -f "$target_file.patch" ]; then
-+              echo "Applying local patch for $filename"
-+              set +e
-+              (
-+                cd ./target
-+                patch -p1 < ".github/workflows/$filename.patch"
-+              )
-+              patch_worked=$?
-+              set -e
-+              if [ "$patch_worked" -eq 0 ]; then
-+                echo "  - Patch applied" >> "$GITHUB_ENV"
-               else
--                echo "⏭️ Skipping $filename: does not exist in target repository"
-+                echo "  - [ ] Patch failed" >> "$GITHUB_ENV"
-+                draft_only=1
-               fi
-             fi
-+
-+            if grep -q " $filename$" "$lock_file"; then
-+              sed -i "s/^[^ ]* $filename$/$new_version $filename/" "$lock_file"
-+            else
-+              echo "$new_version $filename" >> "$lock_file"
-+            fi
-           done
--          echo 'EOF' >> $GITHUB_ENV
--          echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV
-+          echo 'EOF' >> "$GITHUB_ENV"
-+          echo "DRAFT_ONLY=${draft_only}" >> "$GITHUB_ENV"
- 
+@@ -123,10 +135,10 @@
        - name: Create Pull Request
          uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
          with:
 -          token: ${{ secrets.COMMAND_BOT_WORKFLOWS }}
--          commit-message: 'ci(actions): Update workflow templates from organization template repository'
 +          token: ${{ steps.app-token.outputs.token }}
-+          commit-message: 'ci(actions): update workflow templates from LibreCode catalog'
+           commit-message: 'ci(actions): Update workflow templates from organization template repository'
            committer: GitHub <noreply@github.com>
 -          author: nextcloud-command <nextcloud-command@users.noreply.github.com>
 +          author: librecode-workflow-automation[bot] <noreply@github.com>
            path: target
            signoff: true
--          branch: 'automated/noid/${{ matrix.branches }}-update-workflows'
--          title: '[${{ matrix.branches }}] ci(actions): Update workflow templates from organization template repository'
-+          branch: 'automated/update-workflows'
-+          delete-branch: true
-+          title: 'ci(actions): update workflow templates from LibreCode catalog'
+           branch: 'automated/noid/${{ matrix.branches }}-update-workflows'
+@@ -134,7 +146,7 @@
            draft: ${{ env.DRAFT_ONLY == 1 }}
--          add-paths: .github/workflows/*.yml,.github/actions-lock.txt
-+          add-paths: |
-+            .github/workflows/*.yml
-+            .github/actions-lock.txt
+           add-paths: .github/workflows/*.yml,.github/actions-lock.txt
            body: |
 -            Automated update of all workflow templates from [nextcloud/.github](https://github.com/nextcloud/.github)
-+            Automated update of workflow templates from [LibreCodeCoop/.github](https://github.com/LibreCodeCoop/.github).
++            Automated update of all workflow templates from [LibreCodeCoop/.github](https://github.com/LibreCodeCoop/.github)
              ${{ env.SUMMARY }}
--          labels: |
--            dependencies
--            3. to review
+           labels: |
+             dependencies

From a2e0770cca664734d0e698ef1505956f11a792ea Mon Sep 17 00:00:00 2001
From: Vitor Mattos <vitor@php.rio>
Date: Sun, 20 Sep 2026 16:15:27 -0300
Subject: [PATCH 04/17] fix: keep ESLint template close to upstream

Signed-off-by: Vitor Mattos <vitor@php.rio>
---
 workflow-templates/lint-eslint.yml | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/workflow-templates/lint-eslint.yml b/workflow-templates/lint-eslint.yml
index 94593bc..26edb88 100644
--- a/workflow-templates/lint-eslint.yml
+++ b/workflow-templates/lint-eslint.yml
@@ -26,7 +26,7 @@ jobs:
       pull-requests: read
 
     outputs:
-      src: ${{ steps.changes.outputs.src }}
+      src: ${{ steps.changes.outputs.src}}
 
     steps:
       - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
@@ -73,8 +73,8 @@ jobs:
         with:
           node-version: ${{ steps.versions.outputs.nodeVersion }}
 
-      - name: Show npm version
-        run: npm --version
+      - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
+        run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
 
       - name: Install dependencies
         env:
@@ -98,10 +98,4 @@ jobs:
 
     steps:
       - name: Summary status
-        env:
-          CHANGED: ${{ needs.changes.outputs.src }}
-          LINT_RESULT: ${{ needs.lint.result }}
-        run: |
-          if [ "$CHANGED" != "false" ] && [ "$LINT_RESULT" != "success" ]; then
-            exit 1
-          fi
+        run: if ${{ needs.changes.outputs.src != 'false' && needs.lint.result != 'success' }}; then exit 1; fi

From ccbad426ca060f5153e740b6a43dc0400cd3b347 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <vitor@php.rio>
Date: Sun, 20 Sep 2026 16:15:29 -0300
Subject: [PATCH 05/17] fix: minimize ESLint template patch

Signed-off-by: Vitor Mattos <vitor@php.rio>
---
 .../nextcloud/lint-eslint-template.yml.patch  | 32 +------------------
 1 file changed, 1 insertion(+), 31 deletions(-)

diff --git a/patches/nextcloud/lint-eslint-template.yml.patch b/patches/nextcloud/lint-eslint-template.yml.patch
index e474c84..d4fce12 100644
--- a/patches/nextcloud/lint-eslint-template.yml.patch
+++ b/patches/nextcloud/lint-eslint-template.yml.patch
@@ -12,7 +12,7 @@
  # SPDX-License-Identifier: MIT
  
  name: Lint eslint
-@@ -19,13 +20,13 @@
+@@ -19,7 +20,7 @@
  
  jobs:
    changes:
@@ -21,24 +21,6 @@
      permissions:
        contents: read
        pull-requests: read
- 
-     outputs:
--      src: ${{ steps.changes.outputs.src}}
-+      src: ${{ steps.changes.outputs.src }}
- 
-     steps:
-       - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
-@@ -72,8 +73,8 @@
-         with:
-           node-version: ${{ steps.versions.outputs.nodeVersion }}
- 
--      - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
--        run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
-+      - name: Show npm version
-+        run: npm --version
- 
-       - name: Install dependencies
-         env:
 @@ -87,7 +88,7 @@
    summary:
      permissions:
@@ -48,15 +30,3 @@
      needs: [changes, lint]
  
      if: always()
-@@ -97,4 +98,10 @@
- 
-     steps:
-       - name: Summary status
--        run: if ${{ needs.changes.outputs.src != 'false' && needs.lint.result != 'success' }}; then exit 1; fi
-+        env:
-+          CHANGED: ${{ needs.changes.outputs.src }}
-+          LINT_RESULT: ${{ needs.lint.result }}
-+        run: |
-+          if [ "$CHANGED" != "false" ] && [ "$LINT_RESULT" != "success" ]; then
-+            exit 1
-+          fi

From 09e4a000891f7f9491cf11a14adf2ddddd6dd547 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <vitor@php.rio>
Date: Sun, 20 Sep 2026 16:15:56 -0300
Subject: [PATCH 06/17] fix: keep sync workflow organization-generic

Signed-off-by: Vitor Mattos <vitor@php.rio>
---
 workflow-templates/sync-workflow-templates.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/workflow-templates/sync-workflow-templates.yml b/workflow-templates/sync-workflow-templates.yml
index 278d72a..5f88d29 100644
--- a/workflow-templates/sync-workflow-templates.yml
+++ b/workflow-templates/sync-workflow-templates.yml
@@ -27,8 +27,9 @@ jobs:
       matrix:
         branches:
           - ${{ github.event.repository.default_branch }}
-          - 'stable32'
-          - 'stable31'
+          - 'stable35'
+          - 'stable34'
+          - 'stable33'
 
     name: Update workflows in ${{ matrix.branches }}
 
@@ -95,7 +96,7 @@ jobs:
                   echo "ℹ️ Locked version: $locked_version"
                   echo "ℹ️ Current version: $new_version"
                   echo "🆙 Updating existing workflow: $filename"
-                  echo "- 🆙 Updated [$filename](https://github.com/nextcloud/.github/commits/master/workflow-templates/$filename)" >> $GITHUB_ENV
+                  echo "- 🆙 Updated [$filename](https://github.com/LibreCodeCoop/.github/commits/main/workflow-templates/$filename)" >> $GITHUB_ENV
 
                   cp "$workflow" "$target_file"
 

From 4ce1c4daa5bab217938625d38d79c2e109dc4492 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <vitor@php.rio>
Date: Sun, 20 Sep 2026 16:15:58 -0300
Subject: [PATCH 07/17] fix: limit sync patch to LibreCode integration

Signed-off-by: Vitor Mattos <vitor@php.rio>
---
 .../sync-workflow-templates.yml.patch         | 27 +++++++++----------
 1 file changed, 12 insertions(+), 15 deletions(-)

diff --git a/patches/nextcloud/sync-workflow-templates.yml.patch b/patches/nextcloud/sync-workflow-templates.yml.patch
index 8a4fe61..97ec26e 100644
--- a/patches/nextcloud/sync-workflow-templates.yml.patch
+++ b/patches/nextcloud/sync-workflow-templates.yml.patch
@@ -12,19 +12,7 @@
  # SPDX-License-Identifier: MIT
  
  # This workflow will update all workflow templates
-@@ -26,9 +27,8 @@
-       matrix:
-         branches:
-           - ${{ github.event.repository.default_branch }}
--          - 'stable35'
--          - 'stable34'
--          - 'stable33'
-+          - 'stable32'
-+          - 'stable31'
- 
-     name: Update workflows in ${{ matrix.branches }}
- 
-@@ -42,12 +42,24 @@
+@@ -42,12 +43,24 @@
          with:
            require: admin
  
@@ -50,7 +38,16 @@
  
        - name: Checkout app
          uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-@@ -123,10 +135,10 @@
+@@ -78,7 +91,7 @@
+                   echo "ℹ️ Locked version: $locked_version"
+                   echo "ℹ️ Current version: $new_version"
+                   echo "🆙 Updating existing workflow: $filename"
+-                  echo "- 🆙 Updated [$filename](https://github.com/nextcloud/.github/commits/master/workflow-templates/$filename)" >> $GITHUB_ENV
++                  echo "- 🆙 Updated [$filename](https://github.com/LibreCodeCoop/.github/commits/main/workflow-templates/$filename)" >> $GITHUB_ENV
+ 
+                   cp "$workflow" "$target_file"
+ 
+@@ -123,10 +136,10 @@
        - name: Create Pull Request
          uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
          with:
@@ -63,7 +60,7 @@
            path: target
            signoff: true
            branch: 'automated/noid/${{ matrix.branches }}-update-workflows'
-@@ -134,7 +146,7 @@
+@@ -134,7 +147,7 @@
            draft: ${{ env.DRAFT_ONLY == 1 }}
            add-paths: .github/workflows/*.yml,.github/actions-lock.txt
            body: |

From 60da23e481b3e7e516a096c9c1832fd9224b8034 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <vitor@php.rio>
Date: Sun, 20 Sep 2026 16:22:50 -0300
Subject: [PATCH 08/17] fix: preserve upstream SPDX copyright

Signed-off-by: Vitor Mattos <vitor@php.rio>
---
 workflow-templates/lint-eslint.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/workflow-templates/lint-eslint.yml b/workflow-templates/lint-eslint.yml
index 26edb88..8614833 100644
--- a/workflow-templates/lint-eslint.yml
+++ b/workflow-templates/lint-eslint.yml
@@ -4,7 +4,6 @@
 # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
 #
 # SPDX-FileCopyrightText: 2021-2024 Nextcloud GmbH and Nextcloud contributors
-# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
 # SPDX-License-Identifier: MIT
 
 name: Lint eslint

From 7019b970b22a5eb933f74cd5b8ad0d586dc9f52e Mon Sep 17 00:00:00 2001
From: Vitor Mattos <vitor@php.rio>
Date: Sun, 20 Sep 2026 16:22:52 -0300
Subject: [PATCH 09/17] fix: preserve upstream SPDX copyright

Signed-off-by: Vitor Mattos <vitor@php.rio>
---
 workflow-templates/sync-workflow-templates.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/workflow-templates/sync-workflow-templates.yml b/workflow-templates/sync-workflow-templates.yml
index 5f88d29..795fa4e 100644
--- a/workflow-templates/sync-workflow-templates.yml
+++ b/workflow-templates/sync-workflow-templates.yml
@@ -4,7 +4,6 @@
 # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
 #
 # SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
-# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
 # SPDX-License-Identifier: MIT
 
 # This workflow will update all workflow templates

From 00642f7484832e7104107ecf5c86512bffe21a24 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <vitor@php.rio>
Date: Sun, 20 Sep 2026 16:22:54 -0300
Subject: [PATCH 10/17] fix: preserve upstream SPDX copyright

Signed-off-by: Vitor Mattos <vitor@php.rio>

From a8edb21b6735b3401a84b8264cad40f6f7029c72 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <vitor@php.rio>
Date: Sun, 20 Sep 2026 16:22:57 -0300
Subject: [PATCH 11/17] fix: preserve upstream SPDX copyright

Signed-off-by: Vitor Mattos <vitor@php.rio>

From 104d0edc23e5fb3540f9dacad46573d251421cf5 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <vitor@php.rio>
Date: Sun, 20 Sep 2026 16:28:40 -0300
Subject: [PATCH 12/17] fix: use canonical GitHub App bot identity

Signed-off-by: Vitor Mattos <vitor@php.rio>
---
 workflow-templates/sync-workflow-templates.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/workflow-templates/sync-workflow-templates.yml b/workflow-templates/sync-workflow-templates.yml
index 795fa4e..2f7cc01 100644
--- a/workflow-templates/sync-workflow-templates.yml
+++ b/workflow-templates/sync-workflow-templates.yml
@@ -138,7 +138,7 @@ jobs:
           token: ${{ steps.app-token.outputs.token }}
           commit-message: 'ci(actions): Update workflow templates from organization template repository'
           committer: GitHub <noreply@github.com>
-          author: librecode-workflow-automation[bot] <noreply@github.com>
+          author: librecode-workflow-automation[bot] <331658022+librecode-workflow-automation[bot]@users.noreply.github.com>
           path: target
           signoff: true
           branch: 'automated/noid/${{ matrix.branches }}-update-workflows'

From 1156100dd99eef7c655d9d586326a3b44f3579f8 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <vitor@php.rio>
Date: Sun, 20 Sep 2026 16:28:43 -0300
Subject: [PATCH 13/17] fix: use canonical GitHub App bot identity

Signed-off-by: Vitor Mattos <vitor@php.rio>
---
 patches/nextcloud/sync-workflow-templates.yml.patch | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/patches/nextcloud/sync-workflow-templates.yml.patch b/patches/nextcloud/sync-workflow-templates.yml.patch
index 97ec26e..a59104f 100644
--- a/patches/nextcloud/sync-workflow-templates.yml.patch
+++ b/patches/nextcloud/sync-workflow-templates.yml.patch
@@ -56,7 +56,7 @@
            commit-message: 'ci(actions): Update workflow templates from organization template repository'
            committer: GitHub <noreply@github.com>
 -          author: nextcloud-command <nextcloud-command@users.noreply.github.com>
-+          author: librecode-workflow-automation[bot] <noreply@github.com>
++          author: librecode-workflow-automation[bot] <331658022+librecode-workflow-automation[bot]@users.noreply.github.com>
            path: target
            signoff: true
            branch: 'automated/noid/${{ matrix.branches }}-update-workflows'

From f63436536007eea6e30e783d1bd32c93c12cd383 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <vitor@php.rio>
Date: Sun, 20 Sep 2026 16:31:18 -0300
Subject: [PATCH 14/17] fix: align rendered templates with minimal SPDX patch

Signed-off-by: Vitor Mattos <vitor@php.rio>
---
 patches/nextcloud/lint-eslint-template.yml.patch | 1 -
 1 file changed, 1 deletion(-)

diff --git a/patches/nextcloud/lint-eslint-template.yml.patch b/patches/nextcloud/lint-eslint-template.yml.patch
index d4fce12..637662c 100644
--- a/patches/nextcloud/lint-eslint-template.yml.patch
+++ b/patches/nextcloud/lint-eslint-template.yml.patch
@@ -8,7 +8,6 @@
  # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
  #
  # SPDX-FileCopyrightText: 2021-2024 Nextcloud GmbH and Nextcloud contributors
-+# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
  # SPDX-License-Identifier: MIT
  
  name: Lint eslint

From 1467bd1a8889a19868f8a6a67ccbd233a06c7fbe Mon Sep 17 00:00:00 2001
From: Vitor Mattos <vitor@php.rio>
Date: Sun, 20 Sep 2026 16:31:21 -0300
Subject: [PATCH 15/17] fix: align rendered templates with minimal SPDX patch

Signed-off-by: Vitor Mattos <vitor@php.rio>
---
 patches/nextcloud/sync-workflow-templates.yml.patch | 1 -
 1 file changed, 1 deletion(-)

diff --git a/patches/nextcloud/sync-workflow-templates.yml.patch b/patches/nextcloud/sync-workflow-templates.yml.patch
index a59104f..7161c8e 100644
--- a/patches/nextcloud/sync-workflow-templates.yml.patch
+++ b/patches/nextcloud/sync-workflow-templates.yml.patch
@@ -8,7 +8,6 @@
  # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
  #
  # SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
-+# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
  # SPDX-License-Identifier: MIT
  
  # This workflow will update all workflow templates

From f5b7b38e746632db8c7da0e13cc30633f72ea7d4 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <vitor@php.rio>
Date: Sun, 20 Sep 2026 16:45:05 -0300
Subject: [PATCH 16/17] fix: correct patch hunk offsets

Signed-off-by: Vitor Mattos <vitor@php.rio>
---
 patches/nextcloud/lint-eslint-template.yml.patch | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/patches/nextcloud/lint-eslint-template.yml.patch b/patches/nextcloud/lint-eslint-template.yml.patch
index 637662c..267ca2a 100644
--- a/patches/nextcloud/lint-eslint-template.yml.patch
+++ b/patches/nextcloud/lint-eslint-template.yml.patch
@@ -1,6 +1,6 @@
 --- upstream/vendor/nextcloud/lint-eslint.yml
 +++ workflow-templates/lint-eslint.yml
-@@ -1,9 +1,10 @@
+@@ -1,9 +1,9 @@
  # This workflow is provided via the organization template repository
  #
 -# https://github.com/nextcloud/.github
@@ -11,7 +11,7 @@
  # SPDX-License-Identifier: MIT
  
  name: Lint eslint
-@@ -19,7 +20,7 @@
+@@ -19,7 +19,7 @@
  
  jobs:
    changes:
@@ -20,7 +20,7 @@
      permissions:
        contents: read
        pull-requests: read
-@@ -87,7 +88,7 @@
+@@ -87,7 +87,7 @@
    summary:
      permissions:
        contents: none

From 41b8c3bbbec2cb42215bd9e5b6fc35ec5f04c1df Mon Sep 17 00:00:00 2001
From: Vitor Mattos <vitor@php.rio>
Date: Sun, 20 Sep 2026 16:45:07 -0300
Subject: [PATCH 17/17] fix: correct patch hunk offsets

Signed-off-by: Vitor Mattos <vitor@php.rio>
---
 patches/nextcloud/sync-workflow-templates.yml.patch | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/patches/nextcloud/sync-workflow-templates.yml.patch b/patches/nextcloud/sync-workflow-templates.yml.patch
index 7161c8e..683aec8 100644
--- a/patches/nextcloud/sync-workflow-templates.yml.patch
+++ b/patches/nextcloud/sync-workflow-templates.yml.patch
@@ -1,6 +1,6 @@
 --- upstream/vendor/nextcloud/sync-workflow-templates.yml
 +++ workflow-templates/sync-workflow-templates.yml
-@@ -1,9 +1,10 @@
+@@ -1,9 +1,9 @@
  # This workflow is provided via the organization template repository
  #
 -# https://github.com/nextcloud/.github
@@ -11,7 +11,7 @@
  # SPDX-License-Identifier: MIT
  
  # This workflow will update all workflow templates
-@@ -42,12 +43,24 @@
+@@ -42,12 +42,24 @@
          with:
            require: admin
  
@@ -37,7 +37,7 @@
  
        - name: Checkout app
          uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-@@ -78,7 +91,7 @@
+@@ -78,7 +90,7 @@
                    echo "ℹ️ Locked version: $locked_version"
                    echo "ℹ️ Current version: $new_version"
                    echo "🆙 Updating existing workflow: $filename"
@@ -46,7 +46,7 @@
  
                    cp "$workflow" "$target_file"
  
-@@ -123,10 +136,10 @@
+@@ -123,10 +135,10 @@
        - name: Create Pull Request
          uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
          with:
@@ -59,7 +59,7 @@
            path: target
            signoff: true
            branch: 'automated/noid/${{ matrix.branches }}-update-workflows'
-@@ -134,7 +147,7 @@
+@@ -134,7 +146,7 @@
            draft: ${{ env.DRAFT_ONLY == 1 }}
            add-paths: .github/workflows/*.yml,.github/actions-lock.txt
            body: |