VladPolskiy/nextcloud-server
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2025-07-22 18:25:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: Harden some and ignore others that are blocked from forks

Browse Source 
Signed-off-by: Joas Schilling <coding@schilljs.com>
This commit is contained in:
Joas Schilling
2025-05-23 21:13:44 +02:00
parent 519d77db33
commit 94e071e30f
5 changed files with 95 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
.github/workflows/block-merge-eol.yml vendored
View File

@ -27,13 +27,22 @@ jobs:
steps:
- name: Set server major version environment
run: |
# retrieve version number from branch reference
server_major=$(echo "${{ github.base_ref }}" | sed -En 's/stable//p')
echo "server_major=$server_major" >> $GITHUB_ENV
echo "current_month=$(date +%Y-%m)" >> $GITHUB_ENV
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
with:
github-token: ${{secrets.GITHUB_TOKEN}}
script: |
const regex = /^stable(\d+)$/
const baseRef = context.payload.pull_request.base.ref
const match = baseRef.match(regex)
if (match) {
console.log('Setting server_major to ' + match[1]);
core.exportVariable('server_major', match[1]);
console.log('Setting current_month to ' + (new Date()).toISOString().substr(0, 7));
core.exportVariable('current_month', (new Date()).toISOString().substr(0, 7));
}
- name: Checking if ${{ env.server_major }} is EOL
- name: Checking if server ${{ env.server_major }} is EOL
if: ${{ env.server_major != '' }}
run: |
curl -s https://raw.githubusercontent.com/nextcloud-releases/updater_server/production/config/major_versions.json \
| jq '.["${{ env.server_major }}"]["eol"] // "9999-99" | . >= "${{ env.current_month }}"' \

26
.github/workflows/block-merge-freeze.yml vendored
View File

@ -28,8 +28,30 @@ jobs:
runs-on: ubuntu-latest-low
steps:
- name: Download version.php from ${{ github.base_ref }}
run: curl 'https://raw.githubusercontent.com/nextcloud/server/${{ github.base_ref }}/version.php' --output version.php
- name: Register server reference to fallback to master branch
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
with:
github-token: ${{secrets.GITHUB_TOKEN}}
script: |
const baseRef = context.payload.pull_request.base.ref
if (baseRef === 'main' || baseRef === 'master') {
core.exportVariable('server_ref', 'master');
console.log('Setting server_ref to master');
} else {
const regex = /^stable(\d+)$/
const match = baseRef.match(regex)
if (match) {
core.exportVariable('server_ref', match[0]);
console.log('Setting server_ref to ' + match[0]);
} else {
console.log('Not based on master/main/stable*, so skipping freeze check');
}
}
- name: Download version.php from ${{ env.server_ref }}
if: ${{ env.server_ref != '' }}
run: curl 'https://raw.githubusercontent.com/nextcloud/server/${{ env.server_ref }}/version.php' --output version.php
- name: Run check
if: ${{ env.server_ref != '' }}
run: cat version.php | grep 'OC_VersionString' | grep -i -v 'RC'

24
.github/workflows/block-outdated-3rdparty.yml vendored
View File

@ -40,16 +40,36 @@ jobs:
run: |
echo "commit=$(git submodule status | grep ' 3rdparty' | egrep -o '[a-f0-9]{40}')" >> "$GITHUB_OUTPUT"
- name: Register server reference to fallback to master branch
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
with:
github-token: ${{secrets.GITHUB_TOKEN}}
script: |
const baseRef = context.payload.pull_request.base.ref
if (baseRef === 'main' || baseRef === 'master') {
core.exportVariable('server_ref', 'master');
console.log('Setting server_ref to master');
} else {
const regex = /^stable(\d+)$/
const match = baseRef.match(regex)
if (match) {
core.exportVariable('server_ref', match[0]);
console.log('Setting server_ref to ' + match[0]);
} else {
console.log('Not based on master/main/stable*, so skipping freeze check');
}
}
- name: Last 3rdparty commit on target branch
id: target
run: |
echo "commit=$(git ls-remote https://github.com/nextcloud/3rdparty refs/heads/${{ github.base_ref }} | awk '{ print $1}')" >> "$GITHUB_OUTPUT"
echo "commit=$(git ls-remote https://github.com/nextcloud/3rdparty refs/heads/${{ env.server_ref }} | awk '{ print $1}')" >> "$GITHUB_OUTPUT"
- name: Compare if 3rdparty commits are different
run: |
echo '3rdparty/ seems to not point to the last commit of the dedicated branch:'
echo 'Branch has: ${{ steps.actual.outputs.commit }}'
echo '${{ github.base_ref }} has: ${{ steps.target.outputs.commit }}'
echo '${{ env.server_ref }} has: ${{ steps.target.outputs.commit }}'
- name: Fail if 3rdparty commits are different
if: ${{ steps.changes.outputs.src != 'false' && steps.actual.outputs.commit != steps.target.outputs.commit }}

35
.github/workflows/command-pull-3rdparty.yml vendored
View File

@ -45,18 +45,49 @@ jobs:
token: ${{ secrets.COMMAND_BOT_PAT }}
ref: ${{ steps.comment-branch.outputs.head_ref }}
- name: Register server reference to fallback to master branch
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
with:
github-token: ${{secrets.GITHUB_TOKEN}}
script: |
const baseRef = context.payload.pull_request.base.ref
if (baseRef === 'main' || baseRef === 'master') {
core.exportVariable('server_ref', 'master');
console.log('Setting server_ref to master');
} else {
const regex = /^stable(\d+)$/
const match = baseRef.match(regex)
if (match) {
core.exportVariable('server_ref', match[0]);
console.log('Setting server_ref to ' + match[0]);
} else {
console.log('Not based on master/main/stable*, so skipping freeze check');
}
}
- name: Setup git
run: |
git config --local user.email 'nextcloud-command@users.noreply.github.com'
git config --local user.name 'nextcloud-command'
- name: Add reaction on failure
uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v3.0.1
if: ${{ env.server_ref == '' }}
with:
token: ${{ secrets.COMMAND_BOT_PAT }}
repository: ${{ github.event.repository.full_name }}
comment-id: ${{ github.event.comment.id }}
reactions: '-1'
- name: Pull 3rdparty
run: git submodule foreach 'if [ "$sm_path" == "3rdparty" ]; then git pull origin '"'"'${{ github.event.issue.pull_request.base.ref }}'"'"'; fi'
if: ${{ env.server_ref != '' }}
run: git submodule foreach 'if [ "$sm_path" == "3rdparty" ]; then git pull origin '"'"'${{ env.server_ref }}'"'"'; fi'
- name: Commit and push changes
if: ${{ env.server_ref != '' }}
run: |
git add 3rdparty
git commit -s -m 'Update submodule 3rdparty to latest ${{ github.event.issue.pull_request.base.ref }}'
git commit -s -m 'Update submodule 3rdparty to latest ${{ env.server_ref }}'
git push
- name: Add reaction on failure

2
.github/workflows/performance.yml vendored
View File

@ -73,7 +73,7 @@ jobs:
output: before.json
profiler-branch: master
- name: Apply PR
- name: Apply PR # zizmor: ignore[template-injection]
run: |
git remote add pr '${{ github.event.pull_request.head.repo.clone_url }}'
git fetch pr '${{ github.event.pull_request.head.ref }}'