From f16f6b35de45219054cb451399340222517f5b96 Mon Sep 17 00:00:00 2001
From: Conduction Release Bot <release-bot@conduction.nl>
Date: Thu, 6 Aug 2026 15:11:04 +0200
Subject: [PATCH] fix(release): keep .hydra out of the package
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

openregister ships a symlink in every release:

  openregister/.hydra -> /home/rubenlinde/nextcloud-docker-dev/workspace/
                         server/apps-extra/hydra

An absolute path on one developer's machine, committed to the repo before
.gitignore covered it, so ignoring it now does not untrack it and rsync
happily copies it into the tarball.

Any extractor that guards against path traversal then refuses the whole
archive. Nextcloud's own does: installing openregister through the App
Versions app fails with

  Out-of-path file extraction {…/openregister/.hydra --> /home/rubenlinde/…}

and nothing is installed. The archive is otherwise valid, which is why
`tar tzf` and GNU tar are perfectly happy with it and the problem only
appears at install time.

.hydra is developer tooling and has no business in a release anyway, so
it joins .claude, .cursor and .vscode in the excludes for all three
release workflows. openregister still needs the tracked symlink removed;
this stops any app shipping one by accident.
---
 .github/workflows/release-beta.yml   | 1 +
 .github/workflows/release-stable.yml | 1 +
 .github/workflows/release.yml        | 1 +
 3 files changed, 3 insertions(+)

diff --git a/.github/workflows/release-beta.yml b/.github/workflows/release-beta.yml
index 6f49f80..d6259e8 100644
--- a/.github/workflows/release-beta.yml
+++ b/.github/workflows/release-beta.yml
@@ -214,6 +214,7 @@ jobs:
             --exclude='/.git' \
             --exclude='/.github' \
             --exclude='/.claude' \
+            --exclude='/.hydra' \
             --exclude='/.cursor' \
             --exclude='/.vscode' \
             --exclude='/.nextcloud' \
diff --git a/.github/workflows/release-stable.yml b/.github/workflows/release-stable.yml
index f071fba..2442beb 100644
--- a/.github/workflows/release-stable.yml
+++ b/.github/workflows/release-stable.yml
@@ -185,6 +185,7 @@ jobs:
             --exclude='/.git' \
             --exclude='/.github' \
             --exclude='/.claude' \
+            --exclude='/.hydra' \
             --exclude='/.cursor' \
             --exclude='/.vscode' \
             --exclude='/.nextcloud' \
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d636333..61bdbee 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -231,6 +231,7 @@ jobs:
             --exclude='/.git' \
             --exclude='/.github' \
             --exclude='/.claude' \
+            --exclude='/.hydra' \
             --exclude='/.cursor' \
             --exclude='/.vscode' \
             --exclude='/.nextcloud' \