[stable34] chore: complete release artifact and publication contract

.github/workflows/release-metadata.yml

@@ -37,7 +37,7 @@ jobs:
 
       - id: release
         name: Validate release consumer
-        uses: LibreCodeCoop/github-workflows/actions/validate-release-consumer@b0f1a51911ed5424a0dfa1ff0cb732cbd57c3d4c
+        uses: LibreCodeCoop/github-workflows/actions/validate-release-consumer@83fdddeb3efe9b9e464e1f5c2e2772322af94fc8
 
       - name: Verify packaging changelog mapping
         env:

.nextcloud-release.yml

@@ -39,3 +39,40 @@ package:
     - make
     - appstore
     - verify-appstore-package
+  required_paths:
+    - appinfo
+    - composer
+    - css
+    - img
+    - js
+    - l10n
+    - lib
+    - templates
+    - vendor
+    - 3rdparty
+    - openapi.json
+    - openapi-administration.json
+    - openapi-full.json
+    - tests/php/fixtures/pdfs/small_valid.pdf
+  forbidden_paths:
+    - .git
+    - .github
+    - .devcontainer
+    - .patches
+    - build
+    - docs
+    - node_modules
+    - playwright
+    - src
+    - vendor-bin
+    - img/screenshot
+    - 3rdparty/.git
+    - 3rdparty/.github
+    - 3rdparty/vendor
+    - 3rdparty/vendor-bin
+    - 3rdparty/scoper.inc.php
+
+publication:
+  publisher_workflow: appstore-build-publish.yml
+  asset_name: '{app}-{tag}.tar.gz'
+  appstore_api: https://apps.nextcloud.com/api/v1/apps.json