From 0091abbd391fda4efffd89bd051197ee521c9c48 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Tue, 15 Sep 2026 17:18:35 +0200 Subject: [PATCH 1/6] feat(npm-audit): Add automerge workflow for npm-audit-fix Assisted-by: ClaudeCode:claude-sonnet-5 Signed-off-by: Joas Schilling --- ...pm-audit-fix-approve-merge.properties.json | 11 ++++ .../npm-audit-fix-approve-merge.yml | 59 +++++++++++++++++++ 2 files changed, 70 insertions(+) create mode 100644 workflow-templates/npm-audit-fix-approve-merge.properties.json create mode 100644 workflow-templates/npm-audit-fix-approve-merge.yml diff --git a/workflow-templates/npm-audit-fix-approve-merge.properties.json b/workflow-templates/npm-audit-fix-approve-merge.properties.json new file mode 100644 index 0000000..4032cbc --- /dev/null +++ b/workflow-templates/npm-audit-fix-approve-merge.properties.json @@ -0,0 +1,11 @@ +{ + "name": "Auto approve and merge of npm audit fix", + "description": "Auto approve and merge of npm audit fix pull requests", + "iconName": "octicon shield-check", + "categories": [ + "JavaScript" + ], + "filePatterns": [ + "^.github/workflows/npm-audit-fix.yml$" + ] +} diff --git a/workflow-templates/npm-audit-fix-approve-merge.yml b/workflow-templates/npm-audit-fix-approve-merge.yml new file mode 100644 index 0000000..efe5e13 --- /dev/null +++ b/workflow-templates/npm-audit-fix-approve-merge.yml @@ -0,0 +1,59 @@ +# This workflow is provided via the organization template repository +# +# https://github.com/nextcloud/.github +# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization +# +# SPDX-FileCopyrightText: Nextcloud GmbH and Nextcloud contributors +# SPDX-License-Identifier: MIT + +name: Auto approve npm audit fix + +on: + pull_request_target: # zizmor: ignore[dangerous-triggers] + branches: + - main + - master + - stable* + +permissions: + contents: read + +concurrency: + group: npm-audit-fix-approve-merge-${{ github.head_ref || github.run_id }} + cancel-in-progress: true + +jobs: + auto-approve-merge: + if: github.actor == 'nextcloud-command' + runs-on: ubuntu-latest-low + permissions: + # for auto-approve-action to approve PRs + pull-requests: write + # for alexwilson/enable-github-automerge-action to approve PRs + contents: write + + steps: + - name: Disabled on forks + if: ${{ github.event.pull_request.head.repo.full_name != github.repository }} + run: | + echo 'Can not approve PRs from forks' + exit 1 + + - uses: mdecoleman/pr-branch-name@55795d86b4566d300d237883103f052125cc7508 # v3.0.0 + id: branchname + with: + repo-token: ${{ secrets.GITHUB_TOKEN }} + + - name: GitHub actions bot approve + if: startsWith(steps.branchname.outputs.branch, 'automated/noid/') && endsWith(steps.branchname.outputs.branch, 'fix-npm-audit') + run: gh pr review --approve "$PR_URL" + env: + PR_URL: ${{ github.event.pull_request.html_url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + # Enable GitHub auto merge + - name: Auto merge + uses: alexwilson/enable-github-automerge-action@2c32e18a76e0726ffe7a573bfff2d42a20885126 # 3.0.0 + if: startsWith(steps.branchname.outputs.branch, 'automated/noid/') && endsWith(steps.branchname.outputs.branch, 'fix-npm-audit') + with: + github-token: ${{ secrets.GITHUB_TOKEN }} From 551d5996e6bf292c0d3fb66b861938080d1e00d2 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Tue, 15 Sep 2026 17:22:47 +0200 Subject: [PATCH 2/6] fix(nextcloud-ocp): Suggest automerge only when action is there Assisted-by: ClaudeCode:claude-sonnet-5 Signed-off-by: Joas Schilling --- .../update-nextcloud-ocp-approve-merge.properties.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/workflow-templates/update-nextcloud-ocp-approve-merge.properties.json b/workflow-templates/update-nextcloud-ocp-approve-merge.properties.json index 21d7e03..4c7edd7 100644 --- a/workflow-templates/update-nextcloud-ocp-approve-merge.properties.json +++ b/workflow-templates/update-nextcloud-ocp-approve-merge.properties.json @@ -6,6 +6,7 @@ "PHP" ], "filePatterns": [ - "^composer.json$" + "^.github/workflows/update-nextcloud-ocp.yml$", + "^.github/workflows/update-nextcloud-ocp-matrix.yml$" ] } From 9ebd15da736ec0ea65cda56a5d8dd8a686e8b01d Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Wed, 16 Sep 2026 10:41:39 +0200 Subject: [PATCH 3/6] fix: Move the auto-merge into the main action Assisted-by: ClaudeCode:claude-sonnet-5 Signed-off-by: Joas Schilling --- ...pm-audit-fix-approve-merge.properties.json | 11 ---- .../npm-audit-fix-approve-merge.yml | 59 ------------------- workflow-templates/npm-audit-fix.yml | 24 +++++++- ...extcloud-ocp-approve-merge.properties.json | 12 ---- .../update-nextcloud-ocp-approve-merge.yml | 49 ++++----------- .../update-nextcloud-ocp-matrix.yml | 24 +++++++- workflow-templates/update-nextcloud-ocp.yml | 24 +++++++- 7 files changed, 80 insertions(+), 123 deletions(-) delete mode 100644 workflow-templates/npm-audit-fix-approve-merge.properties.json delete mode 100644 workflow-templates/npm-audit-fix-approve-merge.yml delete mode 100644 workflow-templates/update-nextcloud-ocp-approve-merge.properties.json diff --git a/workflow-templates/npm-audit-fix-approve-merge.properties.json b/workflow-templates/npm-audit-fix-approve-merge.properties.json deleted file mode 100644 index 4032cbc..0000000 --- a/workflow-templates/npm-audit-fix-approve-merge.properties.json +++ /dev/null @@ -1,11 +0,0 @@ -{ - "name": "Auto approve and merge of npm audit fix", - "description": "Auto approve and merge of npm audit fix pull requests", - "iconName": "octicon shield-check", - "categories": [ - "JavaScript" - ], - "filePatterns": [ - "^.github/workflows/npm-audit-fix.yml$" - ] -} diff --git a/workflow-templates/npm-audit-fix-approve-merge.yml b/workflow-templates/npm-audit-fix-approve-merge.yml deleted file mode 100644 index efe5e13..0000000 --- a/workflow-templates/npm-audit-fix-approve-merge.yml +++ /dev/null @@ -1,59 +0,0 @@ -# This workflow is provided via the organization template repository -# -# https://github.com/nextcloud/.github -# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization -# -# SPDX-FileCopyrightText: Nextcloud GmbH and Nextcloud contributors -# SPDX-License-Identifier: MIT - -name: Auto approve npm audit fix - -on: - pull_request_target: # zizmor: ignore[dangerous-triggers] - branches: - - main - - master - - stable* - -permissions: - contents: read - -concurrency: - group: npm-audit-fix-approve-merge-${{ github.head_ref || github.run_id }} - cancel-in-progress: true - -jobs: - auto-approve-merge: - if: github.actor == 'nextcloud-command' - runs-on: ubuntu-latest-low - permissions: - # for auto-approve-action to approve PRs - pull-requests: write - # for alexwilson/enable-github-automerge-action to approve PRs - contents: write - - steps: - - name: Disabled on forks - if: ${{ github.event.pull_request.head.repo.full_name != github.repository }} - run: | - echo 'Can not approve PRs from forks' - exit 1 - - - uses: mdecoleman/pr-branch-name@55795d86b4566d300d237883103f052125cc7508 # v3.0.0 - id: branchname - with: - repo-token: ${{ secrets.GITHUB_TOKEN }} - - - name: GitHub actions bot approve - if: startsWith(steps.branchname.outputs.branch, 'automated/noid/') && endsWith(steps.branchname.outputs.branch, 'fix-npm-audit') - run: gh pr review --approve "$PR_URL" - env: - PR_URL: ${{ github.event.pull_request.html_url }} - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - # Enable GitHub auto merge - - name: Auto merge - uses: alexwilson/enable-github-automerge-action@2c32e18a76e0726ffe7a573bfff2d42a20885126 # 3.0.0 - if: startsWith(steps.branchname.outputs.branch, 'automated/noid/') && endsWith(steps.branchname.outputs.branch, 'fix-npm-audit') - with: - github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/workflow-templates/npm-audit-fix.yml b/workflow-templates/npm-audit-fix.yml index b382c55..b9403d5 100644 --- a/workflow-templates/npm-audit-fix.yml +++ b/workflow-templates/npm-audit-fix.yml @@ -15,12 +15,17 @@ on: - cron: '30 2 * * 0' permissions: - contents: read + contents: write + pull-requests: write jobs: build: runs-on: ubuntu-latest + env: + # env variable for maintainers: 'false' disables auto-merge for these pull requests + AUTOMERGE: true + strategy: fail-fast: false matrix: @@ -69,6 +74,7 @@ jobs: npm run build --if-present - name: Create Pull Request + id: create-pull-request if: steps.checkout.outcome == 'success' uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: @@ -83,3 +89,19 @@ jobs: labels: | dependencies 3. to review + + # Approve using the default GITHUB_TOKEN, as the PR itself was created + # using COMMAND_BOT_PAT and GitHub does not allow an account to approve its own PR + - name: GitHub actions bot approve + if: steps.create-pull-request.outputs.pull-request-operation != 'none' + run: gh pr review --approve "$PR_URL" + env: + PR_URL: ${{ steps.create-pull-request.outputs.pull-request-url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Enable auto merge + if: steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE) + uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0 + with: + token: ${{ secrets.GITHUB_TOKEN }} + pull-request-number: ${{ steps.create-pull-request.outputs.pull-request-number }} diff --git a/workflow-templates/update-nextcloud-ocp-approve-merge.properties.json b/workflow-templates/update-nextcloud-ocp-approve-merge.properties.json deleted file mode 100644 index 4c7edd7..0000000 --- a/workflow-templates/update-nextcloud-ocp-approve-merge.properties.json +++ /dev/null @@ -1,12 +0,0 @@ -{ - "name": "Auto approve and merge of nextcloud/ocp updates", - "description": "Auto approve and merge of nextcloud/ocp dev dependency updates", - "iconName": "octicon git-pull-request", - "categories": [ - "PHP" - ], - "filePatterns": [ - "^.github/workflows/update-nextcloud-ocp.yml$", - "^.github/workflows/update-nextcloud-ocp-matrix.yml$" - ] -} diff --git a/workflow-templates/update-nextcloud-ocp-approve-merge.yml b/workflow-templates/update-nextcloud-ocp-approve-merge.yml index 88c54da..4d9f82a 100644 --- a/workflow-templates/update-nextcloud-ocp-approve-merge.yml +++ b/workflow-templates/update-nextcloud-ocp-approve-merge.yml @@ -6,17 +6,14 @@ # SPDX-FileCopyrightText: 2023-2024 Nextcloud GmbH and Nextcloud contributors # SPDX-License-Identifier: MIT -name: Auto approve nextcloud/ocp +# TODO: Remove this after a grace period of 6 months to give everyone the chance to remove the workflow +# TODO: To be removed mid 2027. +name: No-op please remove this workflow -on: - pull_request_target: # zizmor: ignore[dangerous-triggers] - branches: - - main - - master - - stable* +on: pull_request permissions: - contents: read + contents: none concurrency: group: update-nextcloud-ocp-approve-merge-${{ github.head_ref || github.run_id }} @@ -24,36 +21,12 @@ concurrency: jobs: auto-approve-merge: - if: github.actor == 'nextcloud-command' runs-on: ubuntu-latest-low - permissions: - # for auto-approve-action to approve PRs - pull-requests: write - # for alexwilson/enable-github-automerge-action to approve PRs - contents: write + if: always() - steps: - - name: Disabled on forks - if: ${{ github.event.pull_request.head.repo.full_name != github.repository }} - run: | - echo 'Can not approve PRs from forks' - exit 1 - - - uses: mdecoleman/pr-branch-name@55795d86b4566d300d237883103f052125cc7508 # v3.0.0 - id: branchname - with: - repo-token: ${{ secrets.GITHUB_TOKEN }} + # This is the summary, we just avoid to rename it so that branch protection rules still match + name: auto-approve-merge - - name: GitHub actions bot approve - if: startsWith(steps.branchname.outputs.branch, 'automated/noid/') && endsWith(steps.branchname.outputs.branch, 'update-nextcloud-ocp') - run: gh pr review --approve "$PR_URL" - env: - PR_URL: ${{ github.event.pull_request.html_url }} - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - # Enable GitHub auto merge - - name: Auto merge - uses: alexwilson/enable-github-automerge-action@2c32e18a76e0726ffe7a573bfff2d42a20885126 # 3.0.0 - if: startsWith(steps.branchname.outputs.branch, 'automated/noid/') && endsWith(steps.branchname.outputs.branch, 'update-nextcloud-ocp') - with: - github-token: ${{ secrets.GITHUB_TOKEN }} + steps: + - name: No-op please remove this workflow + run: echo "Approve and auto-merge has been folded into update-nextcloud-ocp.yml / update-nextcloud-ocp-matrix.yml, please remove this file"; exit 1; diff --git a/workflow-templates/update-nextcloud-ocp-matrix.yml b/workflow-templates/update-nextcloud-ocp-matrix.yml index 376fdc5..92e48ef 100644 --- a/workflow-templates/update-nextcloud-ocp-matrix.yml +++ b/workflow-templates/update-nextcloud-ocp-matrix.yml @@ -14,8 +14,9 @@ on: - cron: '5 2 * * 0' permissions: - contents: read + contents: write issues: write + pull-requests: write jobs: update-nextcloud-ocp: @@ -24,6 +25,10 @@ jobs: # Only allowed to be run on nextcloud repositories if: ${{ github.repository_owner == 'nextcloud' }} + env: + # env variable for maintainers: 'false' disables auto-merge for these pull requests + AUTOMERGE: true + strategy: fail-fast: false matrix: @@ -91,6 +96,7 @@ jobs: body: 'Please check the output of the GitHub action and manually resolve the issues
${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
${{ steps.codeowners.outputs.codeowners }}' - name: Create Pull Request + id: create-pull-request uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: token: ${{ secrets.COMMAND_BOT_PAT }} @@ -110,3 +116,19 @@ jobs: labels: | dependencies 3. to review + + # Approve using the default GITHUB_TOKEN, as the PR itself was created + # using COMMAND_BOT_PAT and GitHub does not allow an account to approve its own PR + - name: GitHub actions bot approve + if: steps.create-pull-request.outputs.pull-request-operation != 'none' + run: gh pr review --approve "$PR_URL" + env: + PR_URL: ${{ steps.create-pull-request.outputs.pull-request-url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Enable auto merge + if: steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE) + uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0 + with: + token: ${{ secrets.GITHUB_TOKEN }} + pull-request-number: ${{ steps.create-pull-request.outputs.pull-request-number }} diff --git a/workflow-templates/update-nextcloud-ocp.yml b/workflow-templates/update-nextcloud-ocp.yml index 3b60a2e..174d68a 100644 --- a/workflow-templates/update-nextcloud-ocp.yml +++ b/workflow-templates/update-nextcloud-ocp.yml @@ -14,8 +14,9 @@ on: - cron: "5 2 * * 0" permissions: - contents: read + contents: write issues: write + pull-requests: write jobs: update-nextcloud-ocp: @@ -24,6 +25,10 @@ jobs: # Only allowed to be run on nextcloud repositories if: ${{ github.repository_owner == 'nextcloud' }} + env: + # env variable for maintainers: 'false' disables auto-merge for these pull requests + AUTOMERGE: true + strategy: fail-fast: false matrix: @@ -100,6 +105,7 @@ jobs: body: 'Please check the output of the GitHub action and manually resolve the issues
${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
${{ steps.codeowners.outputs.codeowners }}' - name: Create Pull Request + id: create-pull-request if: steps.checkout.outcome == 'success' uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: @@ -120,3 +126,19 @@ jobs: labels: | dependencies 3. to review + + # Approve using the default GITHUB_TOKEN, as the PR itself was created + # using COMMAND_BOT_PAT and GitHub does not allow an account to approve its own PR + - name: GitHub actions bot approve + if: steps.create-pull-request.outputs.pull-request-operation != 'none' + run: gh pr review --approve "$PR_URL" + env: + PR_URL: ${{ steps.create-pull-request.outputs.pull-request-url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Enable auto merge + if: steps.create-pull-request.outputs.pull-request-operation != 'none' && fromJSON(env.AUTOMERGE) + uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0 + with: + token: ${{ secrets.GITHUB_TOKEN }} + pull-request-number: ${{ steps.create-pull-request.outputs.pull-request-number }} From 01744f37afe28ccaa65f40168985f4d10006e056 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Wed, 16 Sep 2026 10:58:26 +0200 Subject: [PATCH 4/6] fix(nextcloud-ocp): Adjust input name Signed-off-by: Joas Schilling --- workflow-templates/update-nextcloud-ocp-matrix.yml | 2 +- workflow-templates/update-nextcloud-ocp.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/workflow-templates/update-nextcloud-ocp-matrix.yml b/workflow-templates/update-nextcloud-ocp-matrix.yml index 92e48ef..513301e 100644 --- a/workflow-templates/update-nextcloud-ocp-matrix.yml +++ b/workflow-templates/update-nextcloud-ocp-matrix.yml @@ -106,7 +106,7 @@ jobs: signoff: true branch: 'automated/noid/${{ matrix.branches }}-update-nextcloud-ocp' title: '[${{ matrix.branches }}] Update nextcloud/ocp dependency' - add-path: | + add-paths: | composer.json composer.lock vendor-bin/nextcloud-ocp/composer.json diff --git a/workflow-templates/update-nextcloud-ocp.yml b/workflow-templates/update-nextcloud-ocp.yml index 174d68a..bc3b424 100644 --- a/workflow-templates/update-nextcloud-ocp.yml +++ b/workflow-templates/update-nextcloud-ocp.yml @@ -116,7 +116,7 @@ jobs: signoff: true branch: 'automated/noid/${{ matrix.branches }}-update-nextcloud-ocp' title: '[${{ matrix.branches }}] Update nextcloud/ocp dependency' - add-path: | + add-paths: | composer.json composer.lock vendor-bin/nextcloud-ocp/composer.json From 2ffcb04883213d81917af9045efba3a4e03f9216 Mon Sep 17 00:00:00 2001 From: Maksim Sukharev Date: Fri, 18 Sep 2026 14:46:25 +0200 Subject: [PATCH 5/6] fix: add 'main' branch to playwright.yml Signed-off-by: Maksim Sukharev --- workflow-templates/playwright.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/workflow-templates/playwright.yml b/workflow-templates/playwright.yml index b8cbb23..ed2416f 100644 --- a/workflow-templates/playwright.yml +++ b/workflow-templates/playwright.yml @@ -29,6 +29,7 @@ name: Playwright Tests on: pull_request: branches: + - main - master - stable35 - stable34 @@ -194,4 +195,4 @@ jobs: steps: - name: Summary status - run: if ${{ needs.playwright-tests.result != 'success' }}; then exit 1; fi \ No newline at end of file + run: if ${{ needs.playwright-tests.result != 'success' }}; then exit 1; fi From cf6248d5ef28a328cde764daf80bc5fae4705ade Mon Sep 17 00:00:00 2001 From: Matthieu Gallien Date: Sat, 19 Sep 2026 12:28:14 +0200 Subject: [PATCH 6/6] Adding Claudio Cambra Signed-off-by: Matthieu Gallien --- non-community-usernames.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/non-community-usernames.txt b/non-community-usernames.txt index a92ed53..ed14a73 100644 --- a/non-community-usernames.txt +++ b/non-community-usernames.txt @@ -3,6 +3,7 @@ bigcat88 burdoto CarlSchwan Chartman123 +claucambra cristianscheid dartcafe datenangebot