Skip to content

Commit 8682e5f

Browse files
nickvergessennickvergessen
committed
ci(actions): Pin CI actions
Signed-off-by: Joas Schilling <coding@schilljs.com>
1 parent 68d3f8b commit 8682e5f

File tree

9 files changed

+144
-79
lines changed

9 files changed

+144
-79
lines changed

‎.github/workflows/block-merge-eol.yml‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -27,14 +27,23 @@ jobs:
2727

2828
steps:
2929
- name: Set server major version environment
30-
run: |
31-
# retrieve version number from branch reference
32-
server_major=$(echo "${{ github.base_ref }}" | sed -En 's/stable//p')
33-
echo "server_major=$server_major" >> $GITHUB_ENV
34-
echo "current_month=$(date +%Y-%m)" >> $GITHUB_ENV
35-
36-
- name: Checking if ${{ env.server_major }} is EOL
30+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
31+
with:
32+
github-token: ${{secrets.GITHUB_TOKEN}}
33+
script: |
34+
const regex = /^stable(\d+)$/
35+
const baseRef = context.payload.pull_request.base.ref
36+
const match = baseRef.match(regex)
37+
if (match) {
38+
console.log('Setting server_major to ' + match[1]);
39+
core.exportVariable('server_major', match[1]);
40+
console.log('Setting current_day to ' + (new Date()).toISOString().substr(0, 10));
41+
core.exportVariable('current_day', (new Date()).toISOString().substr(0, 10));
42+
}
43+
44+
- name: Checking if server ${{ env.server_major }} is EOL
45+
if: ${{ env.server_major != '' }}
3746
run: |
3847
curl -s https://raw.githubusercontent.com/nextcloud-releases/updater_server/production/config/major_versions.json \
39-
| jq '.["${{ env.server_major }}"]["eol"] // "9999-99" | . >= "${{ env.current_month }}"' \
48+
| jq '.["${{ env.server_major }}"]["eol"] // "9999-99-99" | . >= "${{ env.current_day }}"' \
4049
| grep -q true

‎.github/workflows/block-merge-freeze.yml‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,29 @@ jobs:
2929

3030
steps:
3131
- name: Register server reference to fallback to master branch
32-
run: |
33-
server_ref="$(if [ '${{ github.base_ref }}' = 'main' ]; then echo -n 'master'; else echo -n '${{ github.base_ref }}'; fi)"
34-
echo "server_ref=$server_ref" >> $GITHUB_ENV
32+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
33+
with:
34+
github-token: ${{secrets.GITHUB_TOKEN}}
35+
script: |
36+
const baseRef = context.payload.pull_request.base.ref
37+
if (baseRef === 'main' || baseRef === 'master') {
38+
core.exportVariable('server_ref', 'master');
39+
console.log('Setting server_ref to master');
40+
} else {
41+
const regex = /^stable(\d+)$/
42+
const match = baseRef.match(regex)
43+
if (match) {
44+
core.exportVariable('server_ref', match[0]);
45+
console.log('Setting server_ref to ' + match[0]);
46+
} else {
47+
console.log('Not based on master/main/stable*, so skipping freeze check');
48+
}
49+
}
50+
3551
- name: Download version.php from ${{ env.server_ref }}
52+
if: ${{ env.server_ref != '' }}
3653
run: curl 'https://raw.githubusercontent.com/nextcloud/server/${{ env.server_ref }}/version.php' --output version.php
3754

3855
- name: Run check
56+
if: ${{ env.server_ref != '' }}
3957
run: cat version.php | grep 'OC_VersionString' | grep -i -v 'RC'

‎.github/workflows/check-occ-command.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,18 @@ on:
55
paths:
66
- '**.rst'
77

8+
permissions:
9+
contents: read
10+
811
jobs:
912
check-occ-command:
1013
name: Check occ command syntax
1114
runs-on: ubuntu-latest
1215
steps:
13-
- uses: actions/checkout@v6.0.2
16+
- name: Checkout
17+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
18+
with:
19+
persist-credentials: false
1420

1521
- name: Run script
1622
run: |

‎.github/workflows/codespell.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,16 @@ on:
66
branches:
77
- master
88

9+
permissions:
10+
contents: read
11+
912
jobs:
1013
codespell:
1114
name: Check spelling
1215
runs-on: self-hosted
1316
steps:
1417
- name: Check out code
15-
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v4.2.2
18+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1619
with:
1720
persist-credentials: false
1821

‎.github/workflows/generate_catalog_templates.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,15 @@ on:
88
- 'user_manual/**'
99
- '!user_manual/locale/**'
1010

11+
permissions:
12+
contents: read
13+
1114
jobs:
1215
user_manual:
1316
runs-on: ubuntu-latest
1417
steps:
1518
- name: Checkout repository
16-
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v4.2.2
19+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1720
with:
1821
persist-credentials: false
1922

‎.github/workflows/openapi.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,12 @@ jobs:
1515

1616
steps:
1717
- name: Checkout
18-
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v4.2.2
18+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
1919
with:
20-
submodules: true
20+
persist-credentials: false
2121

2222
- name: Set up php
23-
uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2
23+
uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0
2424
with:
2525
php-version: '8.1'
2626
# https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation

‎.github/workflows/pr-feedback.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ on:
1515
schedule:
1616
- cron: '30 1 * * *'
1717

18+
permissions:
19+
contents: read
20+
pull-requests: write
21+
1822
jobs:
1923
pr-feedback:
2024
if: ${{ github.repository_owner == 'nextcloud' }}
@@ -32,7 +36,7 @@ jobs:
3236
blocklist=$(curl https://raw.githubusercontent.com/nextcloud/.github/master/non-community-usernames.txt | paste -s -d, -)
3337
echo "blocklist=$blocklist" >> "$GITHUB_OUTPUT"
3438
35-
- uses: marcelklehr/pr-feedback-action@1883b38a033fb16f576875e0cf45f98b857655c4
39+
- uses: nextcloud/pr-feedback-action@f0cab224dea8e1f282f9451de322f323c78fc7a5 # main
3640
with:
3741
feedback-message: |
3842
Hello there,
@@ -46,6 +50,6 @@ jobs:
4650
4751
(If you believe you should not receive this message, you can add yourself to the [blocklist](https://github.com/nextcloud/.github/blob/master/non-community-usernames.txt).)
4852
days-before-feedback: 14
49-
start-date: '2024-04-30'
53+
start-date: '2025-06-12'
5054
exempt-authors: '${{ steps.blocklist.outputs.blocklist }},${{ steps.scrape.outputs.users }}'
5155
exempt-bots: true

‎.github/workflows/sphinxbuild.yml‎

Lines changed: 64 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,19 @@ on:
77
- master
88
- stable*
99

10+
permissions:
11+
contents: read
12+
1013
jobs:
1114
user_manual:
1215
runs-on: ubuntu-latest
1316
steps:
14-
- uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.1
15-
- uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6
17+
- name: Checkout
18+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
19+
with:
20+
persist-credentials: false
21+
22+
- uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
1623
with:
1724
python-version: '3.12'
1825
cache: 'pip'
@@ -32,54 +39,66 @@ jobs:
3239
user_manual-en:
3340
runs-on: ubuntu-latest
3441
steps:
35-
- uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.1
36-
- uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6
37-
with:
38-
python-version: '3.12'
39-
cache: 'pip'
40-
- name: Install pip dependencies
41-
run: pip install -r requirements.txt
42-
- name: Build using Makefile
43-
run: cd user_manual && make html-lang-en
42+
- name: Checkout
43+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
44+
with:
45+
persist-credentials: false
46+
47+
- uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
48+
with:
49+
python-version: '3.12'
50+
cache: 'pip'
51+
- name: Install pip dependencies
52+
run: pip install -r requirements.txt
53+
- name: Build using Makefile
54+
run: cd user_manual && make html-lang-en
4455

4556
developer_manual:
4657
runs-on: ubuntu-latest
4758
steps:
48-
- uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.1
49-
- uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6
50-
with:
51-
python-version: '3.12'
52-
cache: 'pip'
53-
- name: Install pip dependencies
54-
run: pip install -r requirements.txt
55-
- name: Build using Makefile
56-
run: cd developer_manual && make html
57-
- name: Pack the results in local tar file
58-
shell: bash
59-
run: tar czf /tmp/documentation.tar.gz -C developer_manual/_build/html/com .
60-
- name: Upload static documentation
61-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
62-
with:
63-
name: Developer manual.zip
64-
path: "/tmp/documentation.tar.gz"
59+
- name: Checkout
60+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
61+
with:
62+
persist-credentials: false
63+
64+
- uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
65+
with:
66+
python-version: '3.12'
67+
cache: 'pip'
68+
- name: Install pip dependencies
69+
run: pip install -r requirements.txt
70+
- name: Build using Makefile
71+
run: cd developer_manual && make html
72+
- name: Pack the results in local tar file
73+
shell: bash
74+
run: tar czf /tmp/documentation.tar.gz -C developer_manual/_build/html/com .
75+
- name: Upload static documentation
76+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
77+
with:
78+
name: Developer manual.zip
79+
path: "/tmp/documentation.tar.gz"
6580

6681
admin_manual:
6782
runs-on: ubuntu-latest
6883
steps:
69-
- uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.1
70-
- uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6
71-
with:
72-
python-version: '3.12'
73-
cache: 'pip'
74-
- name: Install pip dependencies
75-
run: pip install -r requirements.txt
76-
- name: Build using Makefile
77-
run: cd admin_manual && make html
78-
- name: Pack the results in local tar file
79-
shell: bash
80-
run: tar czf /tmp/documentation.tar.gz -C admin_manual/_build/html/com .
81-
- name: Upload static documentation
82-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
83-
with:
84-
name: Administration manual.zip
85-
path: "/tmp/documentation.tar.gz"
84+
- name: Checkout
85+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
86+
with:
87+
persist-credentials: false
88+
89+
- uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
90+
with:
91+
python-version: '3.12'
92+
cache: 'pip'
93+
- name: Install pip dependencies
94+
run: pip install -r requirements.txt
95+
- name: Build using Makefile
96+
run: cd admin_manual && make html
97+
- name: Pack the results in local tar file
98+
shell: bash
99+
run: tar czf /tmp/documentation.tar.gz -C admin_manual/_build/html/com .
100+
- name: Upload static documentation
101+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
102+
with:
103+
name: Administration manual.zip
104+
path: "/tmp/documentation.tar.gz"

‎.github/workflows/transifex.yml‎

Lines changed: 18 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2,25 +2,28 @@ name: AutoMerge Transifex Pull Requests
22
on:
33
pull_request:
44

5+
permissions:
6+
contents: read
7+
58
jobs:
69
approve:
7-
runs-on: ubuntu-latest
10+
if: github.event.pull_request.user.login == 'transifex-integration[bot]'
11+
runs-on: ubuntu-latest-low
12+
permissions:
13+
# for hmarr/auto-approve-action to approve PRs
14+
pull-requests: write
15+
# for alexwilson/enable-github-automerge-action to approve PRs
16+
contents: write
17+
818
name: Approve
919
steps:
10-
- uses: hmarr/auto-approve-action@v4.0.0
11-
if: github.actor == 'transifex-integration[bot]'
20+
- uses: hmarr/auto-approve-action@f0939ea97e9205ef24d872e76833fa908a770363 # v4.0.0
1221
with:
1322
github-token: "${{ secrets.GITHUB_TOKEN }}"
1423

15-
automerge:
16-
runs-on: ubuntu-latest
17-
name: Auto-merge
18-
needs: approve
19-
steps:
20-
- uses: pascalgn/automerge-action@v0.16.4
21-
if: github.actor == 'transifex-integration[bot]'
22-
env:
23-
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
24-
MERGE_LABELS: ""
25-
MERGE_RETRIES: 10
26-
MERGE_RETRY_SLEEP: 120000
24+
# Enable GitHub auto merge
25+
- name: Auto merge
26+
uses: alexwilson/enable-github-automerge-action@56e3117d1ae1540309dc8f7a9f2825bc3c5f06ff # v2.0.0
27+
if: startsWith(steps.branchname.outputs.branch, 'translations_')
28+
with:
29+
github-token: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)