feat: add explicit Nextcloud release apply workflow

VERSION

@@ -1 +1 @@
-0.2.0
+0.3.0

docs/workflow-family-decisions.md

@@ -25,7 +25,7 @@ consumer-specific or credential-sensitive.
 | Dependency approval / auto-merge | Keep local until policy-compatible | Governed by `docs/dependency-update-policy.md` |
 | npm audit remediation | Keep local | Credential and merge policy are repository-specific |
 | App Store build/publish | Organization template available | Cataloged; installation remains opt-in because credentials and release policy are consumer-owned |
-| Other release automation | Keep consumer-local unless generic | Requires an explicit credential and release contract before cataloging |
+| Release apply | `release-nextcloud-app.yml` organization template | Cataloged and opt-in; validates readiness, consumer credentials, then creates the GitHub Release that triggers App Store publication |
 
 ## Decision rule
 

workflow-catalog.json

@@ -12,6 +12,7 @@
     "npm-build",
     "openapi",
     "psalm",
+    "release-nextcloud-app",
     "reuse",
     "sync-workflow-templates"
   ]

workflow-templates/release-nextcloud-app.properties.json

@@ -0,0 +1,5 @@
+{
+  "name": "Create Nextcloud app release",
+  "description": "Validate release readiness and create an auditable GitHub Release that triggers the App Store publication workflow.",
+  "iconName": "octicon tag"
+}

workflow-templates/release-nextcloud-app.properties.json.license

@@ -0,0 +1,2 @@
+SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+SPDX-License-Identifier: AGPL-3.0-or-later

workflow-templates/release-nextcloud-app.yml

@@ -0,0 +1,95 @@
+# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+name: Create Nextcloud app release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Release version in MAJOR.MINOR.PATCH form
+        required: true
+        type: string
+      stable_branch:
+        description: Stable branch to release from
+        required: true
+        type: string
+      milestone:
+        description: Closed milestone that must have no open issues
+        required: false
+        default: ''
+        type: string
+      blocker_queries:
+        description: JSON array of GitHub issue search fragments that must return zero open items
+        required: false
+        default: '[]'
+        type: string
+
+permissions:
+  contents: write
+  issues: read
+  pull-requests: read
+
+concurrency:
+  group: release-${{ inputs.stable_branch }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    name: Create v${{ inputs.version }}
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    environment: release
+    timeout-minutes: 15
+
+    steps:
+      - name: Check actor permission
+        uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0
+        with:
+          require: write
+
+      - name: Checkout release branch
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.stable_branch }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Validate release plan
+        uses: LibreCodeCoop/github-workflows/actions/release-plan@94ad33acf3cdf261db5b90a2297f92325c48c5d2 # v0.2.0
+        with:
+          version: ${{ inputs.version }}
+          stable-branch: ${{ inputs.stable_branch }}
+          milestone: ${{ inputs.milestone }}
+          blocker-queries: ${{ inputs.blocker_queries }}
+          github-token: ${{ github.token }}
+
+      - name: Validate publication credentials
+        env:
+          APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
+          APPSTORE_TOKEN: ${{ secrets.APPSTORE_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ -z "$APP_PRIVATE_KEY" ]; then
+            echo "::error::APP_PRIVATE_KEY is not configured."
+            exit 1
+          fi
+          if [ -z "$APPSTORE_TOKEN" ]; then
+            echo "::error::APPSTORE_TOKEN is not configured."
+            exit 1
+          fi
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_VERSION: ${{ inputs.version }}
+          STABLE_BRANCH: ${{ inputs.stable_branch }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          gh release create "v$RELEASE_VERSION" \
+            --repo "$GITHUB_REPOSITORY" \
+            --target "$STABLE_BRANCH" \
+            --title "v$RELEASE_VERSION" \
+            --generate-notes