From 2c9e0eac5a181cf26c3c87db47f23d8660833abb Mon Sep 17 00:00:00 2001 From: Vitor Mattos <1079143+vitormattos@users.noreply.github.com> Date: Sun, 25 Oct 2026 15:27:21 +0000 Subject: [PATCH 1/3] fix(ci): adopt secured LibreCode npm audit workflow Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com> --- .github/workflows/npm-audit-fix.yml | 45 +++++++++++++++-------- .github/workflows/npm-audit-fix.yml.patch | 30 +++++++++++++++ 2 files changed, 60 insertions(+), 15 deletions(-) create mode 100644 .github/workflows/npm-audit-fix.yml.patch diff --git a/.github/workflows/npm-audit-fix.yml b/.github/workflows/npm-audit-fix.yml index b0c75b2..ff3e9f0 100644 --- a/.github/workflows/npm-audit-fix.yml +++ b/.github/workflows/npm-audit-fix.yml @@ -1,6 +1,6 @@ # This workflow is provided via the organization template repository # -# https://github.com/nextcloud/.github +# https://github.com/LibreCodeCoop/.github # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization # # SPDX-FileCopyrightText: 2023-2024 Nextcloud GmbH and Nextcloud contributors @@ -12,7 +12,7 @@ on: workflow_dispatch: schedule: # At 2:30 on Sundays - - cron: "30 2 * * 0" + - cron: '30 2 * * 0' permissions: contents: read @@ -26,38 +26,41 @@ jobs: matrix: branches: - ${{ github.event.repository.default_branch }} - - "stable32" - - "stable31" - - "stable30" + - 'stable32' + - 'stable31' name: npm-audit-fix-${{ matrix.branches }} steps: - name: Checkout id: checkout - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false ref: ${{ matrix.branches }} continue-on-error: true - name: Read package.json node and npm engines version - uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3 + if: steps.checkout.outcome == 'success' + uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4 id: versions with: - fallbackNode: "^20" - fallbackNpm: "^10" + fallbackNode: '^24' + fallbackNpm: '^11.3' - name: Set up node ${{ steps.versions.outputs.nodeVersion }} - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0 + if: steps.checkout.outcome == 'success' + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: ${{ steps.versions.outputs.nodeVersion }} - name: Set up npm ${{ steps.versions.outputs.npmVersion }} + if: steps.checkout.outcome == 'success' run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}' - name: Fix npm audit id: npm-audit + if: steps.checkout.outcome == 'success' uses: nextcloud-libraries/npm-audit-action@1b1728b2b4a7a78d69de65608efcf4db0e3e42d0 # v0.2.0 - name: Run npm ci and npm run build @@ -68,17 +71,29 @@ jobs: npm ci npm run build --if-present + - name: Create GitHub App token for dependency PR + id: app-token + if: steps.checkout.outcome == 'success' + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 + with: + client-id: ${{ vars.LIBRECODE_WORKFLOW_APP_CLIENT_ID }} + private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} + repositories: ${{ github.event.repository.name }} + permission-contents: write + permission-pull-requests: write + - name: Create Pull Request if: steps.checkout.outcome == 'success' - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 with: - token: ${{ secrets.COMMAND_BOT_PAT }} - commit-message: "fix(deps): Fix npm audit" + token: ${{ steps.app-token.outputs.token }} + commit-message: 'fix(deps): resolve npm audit vulnerabilities' committer: GitHub - author: nextcloud-command + author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> signoff: true branch: automated/noid/${{ matrix.branches }}-fix-npm-audit - title: "[${{ matrix.branches }}] Fix npm audit" + title: "${{ matrix.branches != github.event.repository.default_branch && format('[{0}] ', matrix.branches) || '' }}fix(deps): resolve npm audit vulnerabilities" body: ${{ steps.npm-audit.outputs.markdown }} labels: | dependencies diff --git a/.github/workflows/npm-audit-fix.yml.patch b/.github/workflows/npm-audit-fix.yml.patch new file mode 100644 index 0000000..9327c8c --- /dev/null +++ b/.github/workflows/npm-audit-fix.yml.patch @@ -0,0 +1,30 @@ +# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors +# SPDX-License-Identifier: AGPL-3.0-or-later + +--- a/.github/workflows/npm-audit-fix.yml ++++ b/.github/workflows/npm-audit-fix.yml +@@ -11,8 +11,8 @@ + on: + workflow_dispatch: + schedule: +- # At 22:30 on Saturdays +- - cron: '30 22 * * 6' ++ # At 2:30 on Sundays ++ - cron: '30 2 * * 0' + + permissions: + contents: read +@@ -26,6 +26,8 @@ + matrix: + branches: + - ${{ github.event.repository.default_branch }} ++ - 'stable32' ++ - 'stable31' + + name: npm-audit-fix-${{ matrix.branches }} + +@@ -95,3 +97,4 @@ + body: ${{ steps.npm-audit.outputs.markdown }} + labels: | + dependencies ++ 3. to review From 2530d236d51fd9963835c110c88609cf3359dee2 Mon Sep 17 00:00:00 2001 From: Vitor Mattos <1079143+vitormattos@users.noreply.github.com> Date: Sun, 25 Oct 2026 15:53:59 +0000 Subject: [PATCH 2/3] ci(actions): enroll npm audit without changing other workflows Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com> --- .github/workflows/sync-workflow-templates.yml | 35 ++++++++++++------- .../sync-workflow-templates.yml.patch | 11 +++++- 2 files changed, 33 insertions(+), 13 deletions(-) diff --git a/.github/workflows/sync-workflow-templates.yml b/.github/workflows/sync-workflow-templates.yml index d7aacf2..eb2930a 100644 --- a/.github/workflows/sync-workflow-templates.yml +++ b/.github/workflows/sync-workflow-templates.yml @@ -29,6 +29,8 @@ jobs: matrix: branches: - ${{ github.event.repository.default_branch }} + - 'stable32' + - 'stable31' name: Update workflows in ${{ matrix.branches }} @@ -38,17 +40,25 @@ jobs: steps: - name: Check actor permission - uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0 - with: - require: admin + if: ${{ github.event_name == 'workflow_dispatch' }} + shell: bash + env: + GH_TOKEN: ${{ github.token }} + run: | + set -euo pipefail + permission="$(gh api "repos/${GITHUB_REPOSITORY}/collaborators/${GITHUB_ACTOR}/permission" --jq '.permission')" + [[ "${permission}" == "admin" ]] || { + echo "::error::Manual workflow runs require repository admin permission; ${GITHUB_ACTOR} has ${permission}" + exit 1 + } - name: Validate workflow sync authentication shell: bash env: AUTH_MODE: ${{ vars.WORKFLOW_SYNC_AUTH_MODE || 'librecode-app' }} - LIBRECODE_APP_ID: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }} + LIBRECODE_APP_CLIENT_ID: ${{ vars.LIBRECODE_WORKFLOW_APP_CLIENT_ID }} LIBRECODE_APP_PRIVATE_KEY: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }} - CONSUMER_APP_ID: ${{ vars.WORKFLOW_SYNC_APP_ID }} + CONSUMER_APP_CLIENT_ID: ${{ vars.WORKFLOW_SYNC_APP_CLIENT_ID }} CONSUMER_APP_PRIVATE_KEY: ${{ secrets.WORKFLOW_SYNC_APP_PRIVATE_KEY }} CONSUMER_TOKEN: ${{ secrets.WORKFLOW_SYNC_TOKEN }} run: | @@ -56,14 +66,14 @@ jobs: case "${AUTH_MODE}" in librecode-app) - [[ -n "${LIBRECODE_APP_ID}" && -n "${LIBRECODE_APP_PRIVATE_KEY}" ]] || { - echo "::error::librecode-app requires LIBRECODE_WORKFLOW_APP_ID and LIBRECODE_WORKFLOW_APP_PRIVATE_KEY" + [[ -n "${LIBRECODE_APP_CLIENT_ID}" && -n "${LIBRECODE_APP_PRIVATE_KEY}" ]] || { + echo "::error::librecode-app requires LIBRECODE_WORKFLOW_APP_CLIENT_ID and LIBRECODE_WORKFLOW_APP_PRIVATE_KEY" exit 1 } ;; github-app) - [[ -n "${CONSUMER_APP_ID}" && -n "${CONSUMER_APP_PRIVATE_KEY}" ]] || { - echo "::error::github-app requires WORKFLOW_SYNC_APP_ID and WORKFLOW_SYNC_APP_PRIVATE_KEY" + [[ -n "${CONSUMER_APP_CLIENT_ID}" && -n "${CONSUMER_APP_PRIVATE_KEY}" ]] || { + echo "::error::github-app requires WORKFLOW_SYNC_APP_CLIENT_ID and WORKFLOW_SYNC_APP_PRIVATE_KEY" exit 1 } ;; @@ -86,7 +96,7 @@ jobs: id: librecode-app-token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - app-id: ${{ vars.LIBRECODE_WORKFLOW_APP_ID }} + client-id: ${{ vars.LIBRECODE_WORKFLOW_APP_CLIENT_ID }} private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }} owner: ${{ github.repository_owner }} repositories: ${{ github.event.repository.name }} @@ -99,7 +109,7 @@ jobs: id: consumer-app-token uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - app-id: ${{ vars.WORKFLOW_SYNC_APP_ID }} + client-id: ${{ vars.WORKFLOW_SYNC_APP_CLIENT_ID }} private-key: ${{ secrets.WORKFLOW_SYNC_APP_PRIVATE_KEY }} owner: ${{ github.repository_owner }} repositories: ${{ github.event.repository.name }} @@ -157,11 +167,12 @@ jobs: - name: Synchronize workflow templates id: sync - uses: LibreCodeCoop/.github/actions/sync-workflows@492e6c7c5a9bb7642f39238583003d2cb93f3ba6 # organization helpers + uses: ./source/actions/sync-workflows with: source: source/workflow-templates target: target catalog-commit: ${{ steps.catalog-revision.outputs.sha }} + include: npm-audit-fix.yml - name: Create Pull Request if: ${{ steps.sync.outputs.changed == 'true' }} diff --git a/.github/workflows/sync-workflow-templates.yml.patch b/.github/workflows/sync-workflow-templates.yml.patch index a90c064..88c4a93 100644 --- a/.github/workflows/sync-workflow-templates.yml.patch +++ b/.github/workflows/sync-workflow-templates.yml.patch @@ -1,7 +1,7 @@ diff --git a/.github/workflows/sync-workflow-templates.yml b/.github/workflows/sync-workflow-templates.yml --- a/.github/workflows/sync-workflow-templates.yml +++ b/.github/workflows/sync-workflow-templates.yml -@@ -26,6 +26,8 @@ jobs: +@@ -29,6 +29,8 @@ matrix: branches: - ${{ github.event.repository.default_branch }} @@ -9,3 +9,12 @@ diff --git a/.github/workflows/sync-workflow-templates.yml b/.github/workflows/s + - 'stable31' name: Update workflows in ${{ matrix.branches }} + +@@ -170,6 +172,7 @@ + source: source/workflow-templates + target: target + catalog-commit: ${{ steps.catalog-revision.outputs.sha }} ++ include: npm-audit-fix.yml + + - name: Create Pull Request + if: ${{ steps.sync.outputs.changed == 'true' }} From 62cd3865d5c75cbecfe97a4640294e45c2578a07 Mon Sep 17 00:00:00 2001 From: Vitor Mattos <1079143+vitormattos@users.noreply.github.com> Date: Sun, 25 Oct 2026 16:07:07 +0000 Subject: [PATCH 3/3] fix(ci): exclude EOL Nextcloud branches from npm audit Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com> --- .github/workflows/npm-audit-fix.yml | 2 -- .github/workflows/npm-audit-fix.yml.patch | 11 +---------- .github/workflows/sync-workflow-templates.yml | 2 -- .github/workflows/sync-workflow-templates.yml.patch | 11 +---------- 4 files changed, 2 insertions(+), 24 deletions(-) diff --git a/.github/workflows/npm-audit-fix.yml b/.github/workflows/npm-audit-fix.yml index ff3e9f0..039d0db 100644 --- a/.github/workflows/npm-audit-fix.yml +++ b/.github/workflows/npm-audit-fix.yml @@ -26,8 +26,6 @@ jobs: matrix: branches: - ${{ github.event.repository.default_branch }} - - 'stable32' - - 'stable31' name: npm-audit-fix-${{ matrix.branches }} diff --git a/.github/workflows/npm-audit-fix.yml.patch b/.github/workflows/npm-audit-fix.yml.patch index 9327c8c..bfbc531 100644 --- a/.github/workflows/npm-audit-fix.yml.patch +++ b/.github/workflows/npm-audit-fix.yml.patch @@ -14,16 +14,7 @@ permissions: contents: read -@@ -26,6 +26,8 @@ - matrix: - branches: - - ${{ github.event.repository.default_branch }} -+ - 'stable32' -+ - 'stable31' - - name: npm-audit-fix-${{ matrix.branches }} - -@@ -95,3 +97,4 @@ +@@ -95,3 +95,4 @@ body: ${{ steps.npm-audit.outputs.markdown }} labels: | dependencies diff --git a/.github/workflows/sync-workflow-templates.yml b/.github/workflows/sync-workflow-templates.yml index eb2930a..daa2bfe 100644 --- a/.github/workflows/sync-workflow-templates.yml +++ b/.github/workflows/sync-workflow-templates.yml @@ -29,8 +29,6 @@ jobs: matrix: branches: - ${{ github.event.repository.default_branch }} - - 'stable32' - - 'stable31' name: Update workflows in ${{ matrix.branches }} diff --git a/.github/workflows/sync-workflow-templates.yml.patch b/.github/workflows/sync-workflow-templates.yml.patch index 88c4a93..acd0be5 100644 --- a/.github/workflows/sync-workflow-templates.yml.patch +++ b/.github/workflows/sync-workflow-templates.yml.patch @@ -1,16 +1,7 @@ diff --git a/.github/workflows/sync-workflow-templates.yml b/.github/workflows/sync-workflow-templates.yml --- a/.github/workflows/sync-workflow-templates.yml +++ b/.github/workflows/sync-workflow-templates.yml -@@ -29,6 +29,8 @@ - matrix: - branches: - - ${{ github.event.repository.default_branch }} -+ - 'stable32' -+ - 'stable31' - - name: Update workflows in ${{ matrix.branches }} - -@@ -170,6 +172,7 @@ +@@ -170,6 +170,7 @@ source: source/workflow-templates target: target catalog-commit: ${{ steps.catalog-revision.outputs.sha }}