Design versioned workflow templates based on Nextcloud upstream

[vitormattos]

Goal

Create a separate reusable workflow product for GitHub automation that does not belong in the ruleset reconciler.

Architecture decision

The implementation should live in a dedicated repository, proposed as:

LibreCodeCoop/github-workflows

github-governance remains responsible only for repository governance/ruleset reconciliation. Workflow templates and application release automation have independent consumers, permissions, versioning and release cycles and must not be added to that engine.

Initial repository responsibilities

The new repository should own:

• reusable GitHub workflows;
• reproducible imports/adaptations from upstream projects such as Nextcloud;
• reviewable downstream patches;
• tests for generated workflow output;
• versioned releases consumed through immutable SHA pins;
• Dependabot for GitHub Actions;
• SPDX/REUSE compliance;
• actionlint and zizmor.

Upstream template model

Imported templates must be reproducible:

1. declare the upstream repository and immutable upstream commit;
2. record the source file and expected hash;
3. copy/import the upstream workflow deterministically;
4. apply LibreCode-maintained patches explicitly;
5. verify the generated result in CI;
6. fail when an upstream refresh no longer applies cleanly.

Generated templates must not be edited manually.

First implementation

Bootstrap the repository with:

• a short business-oriented README;
• docs/architecture.md;
• upstream/ metadata;
• patches/;
• templates/;
• a deterministic sync/check script;
• tests;
• REUSE, actionlint and zizmor workflows;
• Dependabot.

Only after that foundation is merged should the first Nextcloud workflows be imported.

Acceptance criteria

• workflow-template code is outside github-governance;
• upstream inputs are immutable and verifiable;
• downstream differences are reviewable patches;
• regeneration is deterministic;
• CI detects upstream/hash/patch drift;
• releases are versioned;
• consumers pin full SHAs with release-version comments.

[vitormattos]

Implementation has started in the new repository:

https://github.com/LibreCodeCoop/github-workflows

The initial bootstrap now includes:

• business/adoption-oriented README;
• architecture and upstream workflow documentation;
• immutable upstream source manifest with SHA-256 verification;
• deterministic sync/check tooling;
• unit tests;
• Dependabot for GitHub Actions;
• actionlint;
• zizmor;
• REUSE workflow;
• security policy.

The first real upstream workflow import should be implemented in that repository through a pull request, with explicit source commit/hash and downstream patch behavior covered by tests.