chore: Merge nextcloud/.github

.github/workflows/ai-policy.yml

@@ -32,7 +32,9 @@ jobs:
       - name: Collect PR commit messages
         id: collect
         env:
-          GH_TOKEN: ${{ github.token }}
+          # Fall back to the default token when the PAT is unavailable
+          # (e.g. Dependabot- or fork-triggered runs don't receive Actions secrets)
+          GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT || github.token }}
           COMMITS_URL: ${{ github.event.pull_request.commits_url }}
         run: |
           set -euo pipefail
@@ -125,7 +127,9 @@ jobs:
       - name: Create 'AI assisted' label if absent
         if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true'
         env:
-          GH_TOKEN: ${{ github.token }}
+          # Fall back to the default token when the PAT is unavailable
+          # (e.g. Dependabot- or fork-triggered runs don't receive Actions secrets)
+          GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT || github.token }}
         run: |
           gh api "repos/${{ github.repository }}/labels" \
             --method POST \
@@ -137,11 +141,13 @@ jobs:
       - name: Label PR as AI assisted
         if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true'
         env:
-          GH_TOKEN: ${{ github.token }}
+          # Fall back to the default token when the PAT is unavailable
+          # (e.g. Dependabot- or fork-triggered runs don't receive Actions secrets)
+          GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT || github.token }}
         run: |
-          gh pr edit "${{ github.event.pull_request.number }}" \
-            --repo "${{ github.repository }}" \
-            --add-label "AI assisted"
+          gh api "repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels" \
+            --method POST \
+            -f "labels[]=AI assisted"
           echo "Added 'AI assisted' label to PR #${{ github.event.pull_request.number }}"
 
       - name: Fail on coding-agent Signed-off-by

.github/workflows/dispatch-workflow-repo.yml

@@ -69,7 +69,7 @@ jobs:
             if [ -f "$workflow" ]; then
               filename=$(basename "$workflow")
               target_file="./target/.github/workflows/$filename"
-              
+
               # Only copy if the file exists in the target repository
               if [ -f "$target_file" ]; then
                 echo "Updating existing workflow: $filename"

.github/workflows/lint-yaml.yml

@@ -33,15 +33,15 @@ jobs:
             line-length: warning
 
       - name: Run zizmor 🌈 on actions
-        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
         with:
           inputs: '.github/workflows/*.yml'
           advanced-security: false
           annotations: true
           min-severity: 'medium'
 
       - name: Run zizmor 🌈 on workflow-templates
-        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
         with:
           inputs: 'workflow-templates/*.yml'
           advanced-security: false

README.md

@@ -5,23 +5,41 @@ SPDX-License-Identifier: MIT
 
 # This repository contains Nextcloud's workflow templates for libraries
 
-## Setup a new template on your repository
+## Set up a new template on your repository
 
 When creating a new workflow on your repository, you will see templates originating from here.
 
-## Auto-update repositories
-For each template, you can propagate them on all the repos that use it.
+## Auto-update in a repository
 
-1. Go into https://github.com/nextcloud-libraries/.github/actions/workflows/dispatch-workflow.yml
-2. Enter the name of the workflow you want to dispatch
-3. Enter the page you want to execute (100 are done per page, so check the [number of repositories](https://github.com/orgs/nextcloud-libraries/repositories))
-4. Wait for the actions to finish and see the checkout the pull requests
+There is a GitHub action for that as well. Simply install
+https://github.com/nextcloud/.github/blob/master/workflow-templates/sync-workflow-templates.yml
+into your repository and a cron job will update the workflows from the template every sunday morning.
 
-## Update workflows with a script
+> [!IMPORTANT]
+> GitHub does not allow pull request that touch workflows to be auto-approved and auto-merged to improve security.
+> But it's at least much easier to be aware of the updates and you just need to approve and merge the PRs.
+
+> [!WARNING]
+> Do not forget to check the diff for conflicts and missing patches before approving, especially when updating the workflows on stable branches!
+
+## Patching workflows
+
+It's also possible to customise workflows by putting a `workflow.yml.patch` file right next to it.
+The patch files should be one per workflow and made from the repository root:
+
+Example:
+1. Modify `.github/workflows/phpunit-mariadb.yml`
+2. Save patch `git diff .github/workflows/phpunit-mariadb.yml > .github/workflows/phpunit-mariadb.yml.patch`
+
+The `sync-workflow-templates.yml` action also supports this and reapplies the patches if possible.
+If there was an error it will be outlined in the PR description.
+
+## Update workflows manually
 
 You can run the following shell script on your machine to update all workflows of an app. It should be run inside the cloned repository of an app and requires rsync to be installed.
 
-⚠️ Do not forget to check the diff for unwanted changes before committing, especially when updating the workflows on stable branches!
+> [!WARNING]
+> Do not forget to check the diff for unwanted changes before committing, especially when updating the workflows on stable branches!
 
 ```sh
 #!/bin/sh
@@ -45,6 +63,15 @@ rsync -vr \
     "$temp/workflow-templates/" \
     ./.github/workflows/
 
+# Reapply patches
+for patch in ./.github/workflows/*.yml.patch; do
+    [ ! -f "$patch" ] && continue
+    echo "🩹 Applying $patch"
+    if ! patch -p1 < "$patch"; then
+        echo "❌ Failed to apply $patch, please resolve manually"
+    fi
+done
+
 # Cleanup
 rm -rf "$temp"
 ```

SECURITY.md

@@ -9,8 +9,9 @@ SPDX-License-Identifier: MIT
 
 [Security](https://nextcloud.com/security/) is very important to us.
 
-If you believe you have found a security vulnerability that meets our definition of a security
-vulnerability, please report is as described below.
+If you believe you have found an issue that meets our
+[definition of a security vulnerability](https://nextcloud.com/security/threat-model),
+we encourage you to let us know right away. Please use the reporting process described below.
 
 ## Context
 
@@ -36,7 +37,9 @@ Your report should include:
 
 ### What to Expect
 
-You should receive an initial acknowledgement within 24 hours in most cases.
+> **Note:** This process is for confidential reporting of software vulnerabilities only.
+> For general support or configuration help, see
+> [Nextcloud Support](https://nextcloud.com/support/).
 
 A member of the security team will confirm the vulnerability, determine its impact, follow-up with any questions,
 and coordinate the fix and publication.
@@ -50,20 +53,45 @@ If the vulnerability involves an app that is not maintained by Nextcloud (i.e. h
 Nextcloud project but community maintained, or hosted elsewhere), the security team will try to coordinate with the
 current maintainer and help to get the issue fixed in similar fashion.
 
-### Bug Bounties
+We apply, test, and release fixes for all relevant, supported stable branches in the next
+security update. Vulnerabilities are publicly announced after the fix is released. As a thank
+you, we will add your name to our [Hall of Fame](https://hackerone.com/nextcloud/thanks).
 
-If you are reporting for a bug bounty, more complete reports can contribute to a higher bounty award. Details
-on past bounty ranges can be found at [hackerone.com/nextcloud](https://hackerone.com/nextcloud).
+If your report concerns an app not maintained by Nextcloud (e.g., community-maintained apps
+hosted by Nextcloud or hosted elsewhere), our security team will coordinate with the current
+maintainer to help resolve the issue in a similar fashion.
 
 ## Existing Security Advisories
 
-Published security advisories for the Nextcloud Server, Clients and Apps can be viewed at
-[https://github.com/nextcloud/security-advisories/security/advisories](https://github.com/nextcloud/security-advisories/security/advisories).
+If you are interested in a bug bounty, please note that complete, detailed reports can
+contribute to higher bounty awards. Details on past bounties are available at
+[HackerOne](https://hackerone.com/nextcloud).
+
+## Security Advisories
+
+Published advisories for Nextcloud Server, Clients, and Apps are available at the
+[Nextcloud Security Advisories](https://github.com/nextcloud/security-advisories/security/advisories)
+page.
 
 ## Supported Versions
 
-Nextcloud Server major release versions are being supported with security updates for 1 year after their initial release.
-Please visit https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule for further details.
+Each major release of Nextcloud Server receives security updates for one year from its
+initial release date. The Nextcloud project typically supports at least the two most recent
+major releases.
+
+To stay protected:
+- Ensure your Nextcloud Server is always running a supported major release
+- Promptly apply all maintenance releases (these include critical security and functionality
+  bug fixes)
+- Monitor the end-of-life (EOL) date for your major release (after this date, no further
+  maintenance releases will be published. Upgrading to a newer major release is strongly
+  recommended.)
+
+See the
+[Maintenance and Release Schedule](https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule)
+for details.
+
+---
 
 ## Additional Information
 

workflow-templates/ai-policy.yml

@@ -32,7 +32,9 @@ jobs:
       - name: Collect PR commit messages
         id: collect
         env:
-          GH_TOKEN: ${{ github.token }}
+          # Fall back to the default token when the PAT is unavailable
+          # (e.g. Dependabot- or fork-triggered runs don't receive Actions secrets)
+          GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT || github.token }}
           COMMITS_URL: ${{ github.event.pull_request.commits_url }}
         run: |
           set -euo pipefail
@@ -125,7 +127,9 @@ jobs:
       - name: Create 'AI assisted' label if absent
         if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true'
         env:
-          GH_TOKEN: ${{ github.token }}
+          # Fall back to the default token when the PAT is unavailable
+          # (e.g. Dependabot- or fork-triggered runs don't receive Actions secrets)
+          GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT || github.token }}
         run: |
           gh api "repos/${{ github.repository }}/labels" \
             --method POST \
@@ -137,11 +141,13 @@ jobs:
       - name: Label PR as AI assisted
         if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true'
         env:
-          GH_TOKEN: ${{ github.token }}
+          # Fall back to the default token when the PAT is unavailable
+          # (e.g. Dependabot- or fork-triggered runs don't receive Actions secrets)
+          GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT || github.token }}
         run: |
-          gh pr edit "${{ github.event.pull_request.number }}" \
-            --repo "${{ github.repository }}" \
-            --add-label "AI assisted"
+          gh api "repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels" \
+            --method POST \
+            -f "labels[]=AI assisted"
           echo "Added 'AI assisted' label to PR #${{ github.event.pull_request.number }}"
 
       - name: Fail on coding-agent Signed-off-by

workflow-templates/cypress.yml

@@ -55,7 +55,9 @@ jobs:
 
       - name: Install composer dependencies
         if: steps.check_composer.outputs.files_exists == 'true'
-        run: composer install --no-dev
+        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
+        with:
+          composer-options: '--no-dev'
 
       - name: Set up node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -68,7 +70,7 @@ jobs:
           TESTING=true npm run build --if-present
 
       - name: Save context
-        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           key: cypress-context-${{ github.run_id }}
           path: ./
@@ -88,7 +90,7 @@ jobs:
 
     steps:
       - name: Restore context
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           fail-on-cache-miss: true
           key: cypress-context-${{ github.run_id }}
@@ -107,7 +109,7 @@ jobs:
         run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
 
       - name: Run ${{ startsWith(matrix.containers, 'component') && 'component' || 'E2E' }} cypress tests
-        uses: cypress-io/github-action@948d67d3074f1bbb6379c8bdbb04e95d2f8e593f # v7.4.0
+        uses: cypress-io/github-action@fa4a118725a8f001170d49631ea89e5d66fee626 # v7.4.1
         with:
           record: ${{ secrets.CYPRESS_RECORD_KEY && true }}
           parallel: ${{ secrets.CYPRESS_RECORD_KEY && true }}

workflow-templates/dependabot-approve-merge.yml

@@ -24,8 +24,15 @@ concurrency:
 
 jobs:
   auto-approve-merge:
-    if: github.event.pull_request.user.login == 'dependabot[bot]' || github.event.pull_request.user.login == 'renovate[bot]'
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
     runs-on: ubuntu-latest
+    env:
+      # env variable for maintainers: 'true' allows to auto-merge 1.0.2 -> 2.0.0
+      ALLOW_MAJOR: false
+      # env variable for maintainers: 'true' allows to auto-merge 1.0.2 -> 1.1.0
+      ALLOW_MINOR: true
+      # env variable for maintainers: RegExp string to ignore some dependencies from auto-approve and auto-merge
+      IGNORE_PATTERN: ''
     permissions:
       # for auto-approve step to work
       pull-requests: write

workflow-templates/phpstan.yml

@@ -47,12 +47,14 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Install dependencies
+      - name: Remove nextcloud/ocp
         run: |
           composer remove nextcloud/ocp --dev --no-scripts
-          composer i
 
-      - name: Install nextcloud/ocp
+      - name: Install composer dependencies
+        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
+
+      - name: Install nextcloud/ocp:dev-${{ steps.versions.outputs.branches-max }}
         run: composer require --dev nextcloud/ocp:dev-${{ steps.versions.outputs.branches-max }} --ignore-platform-reqs --with-dependencies
 
       - name: Run coding standards check

workflow-templates/rector-apply.yml

@@ -45,10 +45,12 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Install dependencies
+      - name: Remove nextcloud/ocp
         run: |
           composer remove nextcloud/ocp --dev --no-scripts
-          composer i
+
+      - name: Install composer dependencies
+        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
 
       - name: Rector
         run: composer run rector