From 55c876c0960cbd343d6f1a4b92dcffd83e118083 Mon Sep 17 00:00:00 2001 From: Vitor Mattos Date: Sun, 20 Sep 2026 21:32:17 -0300 Subject: [PATCH 1/2] ci: adopt cataloged App Store release workflow Signed-off-by: Vitor Mattos --- .github/workflows/appstore-build-publish.yml | 51 ++++++++++++++------ 1 file changed, 36 insertions(+), 15 deletions(-) diff --git a/.github/workflows/appstore-build-publish.yml b/.github/workflows/appstore-build-publish.yml index e043d760..fa16f41f 100644 --- a/.github/workflows/appstore-build-publish.yml +++ b/.github/workflows/appstore-build-publish.yml @@ -1,6 +1,6 @@ # This workflow is provided via the organization template repository # -# https://github.com/nextcloud/.github +# https://github.com/LibreCodeCoop/.github # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization # # SPDX-FileCopyrightText: 2021-2024 Nextcloud GmbH and Nextcloud contributors @@ -19,9 +19,6 @@ jobs: build_and_publish: runs-on: ubuntu-latest - # Only allowed to be run on nextcloud-releases repositories - # if: ${{ github.repository_owner == 'nextcloud-releases' }} - steps: - name: Check actor permission uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0 @@ -71,7 +68,7 @@ jobs: - name: Set up node ${{ steps.versions.outputs.nodeVersion }} # Skip if no package.json if: ${{ steps.versions.outputs.nodeVersion }} - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: ${{ steps.versions.outputs.nodeVersion }} package-manager-cache: false @@ -83,12 +80,12 @@ jobs: - name: Get php version id: php-versions - uses: icewind1991/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3 + uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3 with: filename: ${{ env.APP_NAME }}/appinfo/info.xml - name: Set up php ${{ steps.php-versions.outputs.php-min }} - uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2.37.0 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: ${{ steps.php-versions.outputs.php-min }} coverage: none @@ -103,9 +100,11 @@ jobs: - name: Install composer dependencies if: steps.check_composer.outputs.files_exists == 'true' - run: | - cd ${{ env.APP_NAME }} - composer install --no-dev + uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0 + with: + composer-options: '--no-dev' + working-directory: ${{ env.APP_NAME }} + ignore-cache: 'yes' - name: Build ${{ env.APP_NAME }} # Skip if no package.json @@ -141,6 +140,14 @@ jobs: cd ${{ env.APP_NAME }} make appstore + - name: Verify app store package + if: steps.krankerl.outputs.files_exists != 'true' + working-directory: ${{ env.APP_NAME }} + run: | + if make -qp 2>/dev/null | grep -q '^verify-appstore-package:'; then + make verify-appstore-package + fi + - name: Check server download link for ${{ fromJSON(steps.appinfo.outputs.result).nextcloud.min-version }} run: | NCVERSION='${{ fromJSON(steps.appinfo.outputs.result).nextcloud.min-version }}' @@ -173,7 +180,7 @@ jobs: tar -xvf ${{ env.APP_NAME }}.tar.gz cd ../../../ # Setting up keys - echo '${{ secrets.APP_PRIVATE_KEY }}' > ${{ env.APP_NAME }}.key # zizmor: ignore[secrets-outside-env] + echo '${{ secrets.APP_PRIVATE_KEY }}' > ${{ env.APP_NAME }}.key wget --quiet "https://github.com/nextcloud/app-certificate-requests/raw/master/${{ env.APP_NAME }}/${{ env.APP_NAME }}.crt" # Signing php nextcloud/occ integrity:sign-app --privateKey=../${{ env.APP_NAME }}.key --certificate=../${{ env.APP_NAME }}.crt --path=../${{ env.APP_NAME }}/build/artifacts/${{ env.APP_NAME }} @@ -181,8 +188,15 @@ jobs: cd ${{ env.APP_NAME }}/build/artifacts tar -zcvf ${{ env.APP_NAME }}.tar.gz ${{ env.APP_NAME }} + - name: Validate release artifact + uses: LibreCodeCoop/github-workflows/actions/validate-release-artifact@eabf9eeacf26f8ef8c01a72641bf8e2ed1ba3637 # v0.2.0 + with: + artifact: ${{ env.APP_NAME }}/build/artifacts/${{ env.APP_NAME }}.tar.gz + app-name: ${{ env.APP_NAME }} + version: ${{ env.APP_VERSION }} + - name: Attach tarball to github release - uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # v2.11.5 + uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # 2.11.5 id: attach_to_release with: repo_token: ${{ secrets.GITHUB_TOKEN }} @@ -192,9 +206,16 @@ jobs: overwrite: true - name: Upload app to Nextcloud appstore - uses: nextcloud-releases/nextcloud-appstore-push-action@a011fe619bcf6e77ddebc96f9908e1af4071b9c1 # v1.0.3 + uses: nextcloud-libraries/nextcloud-appstore-push-action@a011fe619bcf6e77ddebc96f9908e1af4071b9c1 # v1.0.3 with: app_name: ${{ env.APP_NAME }} - appstore_token: ${{ secrets.APPSTORE_TOKEN }} # zizmor: ignore[secrets-outside-env] + appstore_token: ${{ secrets.APPSTORE_TOKEN }} download_url: ${{ steps.attach_to_release.outputs.browser_download_url }} - app_private_key: ${{ secrets.APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env] + app_private_key: ${{ secrets.APP_PRIVATE_KEY }} + + - name: Verify App Store publication + uses: LibreCodeCoop/github-workflows/actions/verify-appstore-publication@0bb30136a7fcb7e70b7ae579addeeda882f4c457 # v0.2.0 + with: + app-name: ${{ env.APP_NAME }} + version: ${{ env.APP_VERSION }} + nextcloud-platform: ${{ fromJSON(steps.appinfo.outputs.result).nextcloud.min-version }} From 0ce269b05d9f6427edc869a68075fcf79f997986 Mon Sep 17 00:00:00 2001 From: Vitor Mattos Date: Sun, 20 Sep 2026 21:37:00 -0300 Subject: [PATCH 2/2] ci: add explicit Nextcloud release apply workflow Signed-off-by: Vitor Mattos --- .github/workflows/release-nextcloud-app.yml | 95 +++++++++++++++++++++ 1 file changed, 95 insertions(+) create mode 100644 .github/workflows/release-nextcloud-app.yml diff --git a/.github/workflows/release-nextcloud-app.yml b/.github/workflows/release-nextcloud-app.yml new file mode 100644 index 00000000..3bb9a7ae --- /dev/null +++ b/.github/workflows/release-nextcloud-app.yml @@ -0,0 +1,95 @@ +# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors +# SPDX-License-Identifier: AGPL-3.0-or-later + +name: Create Nextcloud app release + +on: + workflow_dispatch: + inputs: + version: + description: Release version in MAJOR.MINOR.PATCH form + required: true + type: string + stable_branch: + description: Stable branch to release from + required: true + type: string + milestone: + description: Closed milestone that must have no open issues + required: false + default: '' + type: string + blocker_queries: + description: JSON array of GitHub issue search fragments that must return zero open items + required: false + default: '[]' + type: string + +permissions: + contents: write + issues: read + pull-requests: read + +concurrency: + group: release-${{ inputs.stable_branch }} + cancel-in-progress: false + +jobs: + release: + name: Create v${{ inputs.version }} + if: github.ref == 'refs/heads/main' + runs-on: ubuntu-latest + environment: release + timeout-minutes: 15 + + steps: + - name: Check actor permission + uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0 + with: + require: write + + - name: Checkout release branch + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ inputs.stable_branch }} + fetch-depth: 0 + persist-credentials: false + + - name: Validate release plan + uses: LibreCodeCoop/github-workflows/actions/release-plan@94ad33acf3cdf261db5b90a2297f92325c48c5d2 # v0.2.0 + with: + version: ${{ inputs.version }} + stable-branch: ${{ inputs.stable_branch }} + milestone: ${{ inputs.milestone }} + blocker-queries: ${{ inputs.blocker_queries }} + github-token: ${{ github.token }} + + - name: Validate publication credentials + env: + APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }} + APPSTORE_TOKEN: ${{ secrets.APPSTORE_TOKEN }} + shell: bash + run: | + set -euo pipefail + if [ -z "$APP_PRIVATE_KEY" ]; then + echo "::error::APP_PRIVATE_KEY is not configured." + exit 1 + fi + if [ -z "$APPSTORE_TOKEN" ]; then + echo "::error::APPSTORE_TOKEN is not configured." + exit 1 + fi + + - name: Create GitHub release + env: + GH_TOKEN: ${{ github.token }} + RELEASE_VERSION: ${{ inputs.version }} + STABLE_BRANCH: ${{ inputs.stable_branch }} + shell: bash + run: | + set -euo pipefail + gh release create "v$RELEASE_VERSION" \ + --repo "$GITHUB_REPOSITORY" \ + --target "$STABLE_BRANCH" \ + --title "v$RELEASE_VERSION" \ + --generate-notes