Skip to content

Commit ed83371

Browse files
nickvergessennickvergessen
authored
Merge pull request #14030 from nextcloud/backport/14029/stable32
[stable32] ci(actions): Pin CI actions
2 parents 08e80b6 + 7f74fc3 commit ed83371

File tree

9 files changed

+156
-94
lines changed

9 files changed

+156
-94
lines changed

‎.github/workflows/block-merge-eol.yml‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -27,14 +27,23 @@ jobs:
2727

2828
steps:
2929
- name: Set server major version environment
30-
run: |
31-
# retrieve version number from branch reference
32-
server_major=$(echo "${{ github.base_ref }}" | sed -En 's/stable//p')
33-
echo "server_major=$server_major" >> $GITHUB_ENV
34-
echo "current_month=$(date +%Y-%m)" >> $GITHUB_ENV
35-
36-
- name: Checking if ${{ env.server_major }} is EOL
30+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
31+
with:
32+
github-token: ${{secrets.GITHUB_TOKEN}}
33+
script: |
34+
const regex = /^stable(\d+)$/
35+
const baseRef = context.payload.pull_request.base.ref
36+
const match = baseRef.match(regex)
37+
if (match) {
38+
console.log('Setting server_major to ' + match[1]);
39+
core.exportVariable('server_major', match[1]);
40+
console.log('Setting current_day to ' + (new Date()).toISOString().substr(0, 10));
41+
core.exportVariable('current_day', (new Date()).toISOString().substr(0, 10));
42+
}
43+
44+
- name: Checking if server ${{ env.server_major }} is EOL
45+
if: ${{ env.server_major != '' }}
3746
run: |
3847
curl -s https://raw.githubusercontent.com/nextcloud-releases/updater_server/production/config/major_versions.json \
39-
| jq '.["${{ env.server_major }}"]["eol"] // "9999-99" | . >= "${{ env.current_month }}"' \
48+
| jq '.["${{ env.server_major }}"]["eol"] // "9999-99-99" | . >= "${{ env.current_day }}"' \
4049
| grep -q true

‎.github/workflows/block-merge-freeze.yml‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,29 @@ jobs:
2929

3030
steps:
3131
- name: Register server reference to fallback to master branch
32-
run: |
33-
server_ref="$(if [ '${{ github.base_ref }}' = 'main' ]; then echo -n 'master'; else echo -n '${{ github.base_ref }}'; fi)"
34-
echo "server_ref=$server_ref" >> $GITHUB_ENV
32+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
33+
with:
34+
github-token: ${{secrets.GITHUB_TOKEN}}
35+
script: |
36+
const baseRef = context.payload.pull_request.base.ref
37+
if (baseRef === 'main' || baseRef === 'master') {
38+
core.exportVariable('server_ref', 'master');
39+
console.log('Setting server_ref to master');
40+
} else {
41+
const regex = /^stable(\d+)$/
42+
const match = baseRef.match(regex)
43+
if (match) {
44+
core.exportVariable('server_ref', match[0]);
45+
console.log('Setting server_ref to ' + match[0]);
46+
} else {
47+
console.log('Not based on master/main/stable*, so skipping freeze check');
48+
}
49+
}
50+
3551
- name: Download version.php from ${{ env.server_ref }}
52+
if: ${{ env.server_ref != '' }}
3653
run: curl 'https://raw.githubusercontent.com/nextcloud/server/${{ env.server_ref }}/version.php' --output version.php
3754

3855
- name: Run check
56+
if: ${{ env.server_ref != '' }}
3957
run: cat version.php | grep 'OC_VersionString' | grep -i -v 'RC'

‎.github/workflows/check-occ-command.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,18 @@ on:
55
paths:
66
- '**.rst'
77

8+
permissions:
9+
contents: read
10+
811
jobs:
912
check-occ-command:
1013
name: Check occ command syntax
1114
runs-on: ubuntu-latest
1215
steps:
13-
- uses: actions/checkout@v5
16+
- name: Checkout
17+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
18+
with:
19+
persist-credentials: false
1420

1521
- name: Run script
1622
run: |

‎.github/workflows/codespell.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,17 +6,20 @@ on:
66
branches:
77
- master
88

9+
permissions:
10+
contents: read
11+
912
jobs:
1013
codespell:
1114
name: Check spelling
1215
runs-on: self-hosted
1316
steps:
1417
- name: Check out code
15-
uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v4.2.2
18+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1619
with:
1720
persist-credentials: false
1821

1922
- name: Check spelling
20-
uses: codespell-project/actions-codespell@406322ec52dd7b488e48c1c4b82e2a8b3a1bf630 # v2.1
23+
uses: codespell-project/actions-codespell@8f01853be192eb0f849a5c7d721450e7a467c579 # v2.2
2124
with:
2225
skip: '**.svg,**.js'

‎.github/workflows/generate_catalog_templates.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,15 @@ on:
88
- 'user_manual/**'
99
- '!user_manual/locale/**'
1010

11+
permissions:
12+
contents: read
13+
1114
jobs:
1215
user_manual:
1316
runs-on: ubuntu-latest
1417
steps:
1518
- name: Checkout repository
16-
uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v4.2.2
19+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1720
with:
1821
persist-credentials: false
1922

‎.github/workflows/openapi.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,9 @@ jobs:
1515

1616
steps:
1717
- name: Checkout
18-
uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v4.2.2
18+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1919
with:
20-
submodules: true
20+
persist-credentials: false
2121

2222
- name: Set up php
2323
uses: shivammathur/setup-php@20529878ed81ef8e78ddf08b480401e6101a850f # v2

‎.github/workflows/pr-feedback.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ on:
1515
schedule:
1616
- cron: '30 1 * * *'
1717

18+
permissions:
19+
contents: read
20+
pull-requests: write
21+
1822
jobs:
1923
pr-feedback:
2024
if: ${{ github.repository_owner == 'nextcloud' }}
@@ -32,7 +36,7 @@ jobs:
3236
blocklist=$(curl https://raw.githubusercontent.com/nextcloud/.github/master/non-community-usernames.txt | paste -s -d, -)
3337
echo "blocklist=$blocklist" >> "$GITHUB_OUTPUT"
3438
35-
- uses: marcelklehr/pr-feedback-action@1883b38a033fb16f576875e0cf45f98b857655c4
39+
- uses: nextcloud/pr-feedback-action@f0cab224dea8e1f282f9451de322f323c78fc7a5 # main
3640
with:
3741
feedback-message: |
3842
Hello there,
@@ -46,6 +50,6 @@ jobs:
4650
4751
(If you believe you should not receive this message, you can add yourself to the [blocklist](https://github.com/nextcloud/.github/blob/master/non-community-usernames.txt).)
4852
days-before-feedback: 14
49-
start-date: '2024-04-30'
53+
start-date: '2025-06-12'
5054
exempt-authors: '${{ steps.blocklist.outputs.blocklist }},${{ steps.scrape.outputs.users }}'
5155
exempt-bots: true

‎.github/workflows/sphinxbuild.yml‎

Lines changed: 76 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -7,79 +7,95 @@ on:
77
- master
88
- stable*
99

10+
permissions:
11+
contents: read
12+
1013
jobs:
1114
user_manual:
1215
runs-on: ubuntu-latest
1316
steps:
14-
- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
15-
- uses: actions/setup-python@v5
16-
with:
17-
python-version: '3.10'
18-
cache: 'pip'
19-
- name: Install pip dependencies
20-
run: pip install -r requirements.txt
21-
- name: Build using Makefile
22-
run: cd user_manual && make html
23-
- name: Pack the results in local tar file
24-
shell: bash
25-
run: tar czf /tmp/documentation.tar.gz -C user_manual/_build/html .
26-
- name: Upload static documentation
27-
uses: actions/upload-artifact@v4.6.2
28-
with:
29-
name: User manual.zip
30-
path: "/tmp/documentation.tar.gz"
17+
- name: Checkout
18+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
19+
with:
20+
persist-credentials: false
21+
22+
- uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
23+
with:
24+
python-version: '3.10'
25+
cache: 'pip'
26+
- name: Install pip dependencies
27+
run: pip install -r requirements.txt
28+
- name: Build using Makefile
29+
run: cd user_manual && make html
30+
- name: Pack the results in local tar file
31+
shell: bash
32+
run: tar czf /tmp/documentation.tar.gz -C user_manual/_build/html .
33+
- name: Upload static documentation
34+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
35+
with:
36+
name: User manual.zip
37+
path: "/tmp/documentation.tar.gz"
3138

3239
user_manual-en:
3340
runs-on: ubuntu-latest
3441
steps:
35-
- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
36-
- uses: actions/setup-python@v5
37-
with:
38-
python-version: '3.10'
39-
cache: 'pip'
40-
- name: Install pip dependencies
41-
run: pip install -r requirements.txt
42-
- name: Build using Makefile
43-
run: cd user_manual && make html-lang-en
42+
- name: Checkout
43+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
44+
with:
45+
persist-credentials: false
46+
- uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
47+
with:
48+
python-version: '3.10'
49+
cache: 'pip'
50+
- name: Install pip dependencies
51+
run: pip install -r requirements.txt
52+
- name: Build using Makefile
53+
run: cd user_manual && make html-lang-en
4454

4555
developer_manual:
4656
runs-on: ubuntu-latest
4757
steps:
48-
- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
49-
- uses: actions/setup-python@v5
50-
with:
51-
python-version: '3.10'
52-
cache: 'pip'
53-
- name: Install pip dependencies
54-
run: pip install -r requirements.txt
55-
- name: Build using Makefile
56-
run: cd developer_manual && make html
57-
- name: Pack the results in local tar file
58-
shell: bash
59-
run: tar czf /tmp/documentation.tar.gz -C developer_manual/_build/html/com .
60-
- name: Upload static documentation
61-
uses: actions/upload-artifact@v4.6.2
62-
with:
63-
name: Developer manual.zip
64-
path: "/tmp/documentation.tar.gz"
58+
- name: Checkout
59+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
60+
with:
61+
persist-credentials: false
62+
- uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
63+
with:
64+
python-version: '3.10'
65+
cache: 'pip'
66+
- name: Install pip dependencies
67+
run: pip install -r requirements.txt
68+
- name: Build using Makefile
69+
run: cd developer_manual && make html
70+
- name: Pack the results in local tar file
71+
shell: bash
72+
run: tar czf /tmp/documentation.tar.gz -C developer_manual/_build/html/com .
73+
- name: Upload static documentation
74+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
75+
with:
76+
name: Developer manual.zip
77+
path: "/tmp/documentation.tar.gz"
6578

6679
admin_manual:
6780
runs-on: ubuntu-latest
6881
steps:
69-
- uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
70-
- uses: actions/setup-python@v5
71-
with:
72-
python-version: '3.10'
73-
cache: 'pip'
74-
- name: Install pip dependencies
75-
run: pip install -r requirements.txt
76-
- name: Build using Makefile
77-
run: cd admin_manual && make html
78-
- name: Pack the results in local tar file
79-
shell: bash
80-
run: tar czf /tmp/documentation.tar.gz -C admin_manual/_build/html/com .
81-
- name: Upload static documentation
82-
uses: actions/upload-artifact@v4.6.2
83-
with:
84-
name: Administration manual.zip
85-
path: "/tmp/documentation.tar.gz"
82+
- name: Checkout
83+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
84+
with:
85+
persist-credentials: false
86+
- uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
87+
with:
88+
python-version: '3.10'
89+
cache: 'pip'
90+
- name: Install pip dependencies
91+
run: pip install -r requirements.txt
92+
- name: Build using Makefile
93+
run: cd admin_manual && make html
94+
- name: Pack the results in local tar file
95+
shell: bash
96+
run: tar czf /tmp/documentation.tar.gz -C admin_manual/_build/html/com .
97+
- name: Upload static documentation
98+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
99+
with:
100+
name: Administration manual.zip
101+
path: "/tmp/documentation.tar.gz"

‎.github/workflows/transifex.yml‎

Lines changed: 18 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2,25 +2,28 @@ name: AutoMerge Transifex Pull Requests
22
on:
33
pull_request:
44

5+
permissions:
6+
contents: read
7+
58
jobs:
69
approve:
7-
runs-on: ubuntu-latest
10+
if: github.event.pull_request.user.login == 'transifex-integration[bot]'
11+
runs-on: ubuntu-latest-low
12+
permissions:
13+
# for hmarr/auto-approve-action to approve PRs
14+
pull-requests: write
15+
# for alexwilson/enable-github-automerge-action to approve PRs
16+
contents: write
17+
818
name: Approve
919
steps:
10-
- uses: hmarr/auto-approve-action@v4.0.0
11-
if: github.actor == 'transifex-integration[bot]'
20+
- uses: hmarr/auto-approve-action@f0939ea97e9205ef24d872e76833fa908a770363 # v4.0.0
1221
with:
1322
github-token: "${{ secrets.GITHUB_TOKEN }}"
1423

15-
automerge:
16-
runs-on: ubuntu-latest
17-
name: Auto-merge
18-
needs: approve
19-
steps:
20-
- uses: pascalgn/automerge-action@v0.16.4
21-
if: github.actor == 'transifex-integration[bot]'
22-
env:
23-
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
24-
MERGE_LABELS: ""
25-
MERGE_RETRIES: 10
26-
MERGE_RETRY_SLEEP: 120000
24+
# Enable GitHub auto merge
25+
- name: Auto merge
26+
uses: alexwilson/enable-github-automerge-action@56e3117d1ae1540309dc8f7a9f2825bc3c5f06ff # v2.0.0
27+
if: startsWith(steps.branchname.outputs.branch, 'translations_')
28+
with:
29+
github-token: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)