[vitormattos]

Purpose

Backport the npm-audit workflow enrollment from LibreCodeCoop/extract PR #165 to stable32. The source is the pinned and secured LibreCodeCoop/.github PR #104.

Change

• Install the exact catalog npm-audit-fix.yml plus an existing-consumer-compatible local .patch.
• Retain the original npm audit schedule, labels and branch matrix for maintained Extract branches.
• Use short-lived LibreCode Workflow Automation GitHub App token, DCO and conventional fix(deps) PR titles, without auto approval/merge.
• The central sync workflow from Extract main (PR fix(ci): adopt LibreCode-managed npm audit workflow #165) targets this branch, so the stable branch does not need its own sync-workflow-templates.yml.

Preflight

The installed workflow matches catalog plus patch byte-for-byte. Its adoption by the updater is validated in the parent PR, with an idempotent second run. GitHub CI must pass before merging.

Dependency

Merge catalog PR #104 first, then main consumer PR #165, then the stable backports. Independent review required. No merge/release here.

[vitormattos]

Closing this newly created backport because Nextcloud stable32 reached end of life (September-2026) and no longer receives security fixes. The supported Extract main branch targets Nextcloud 33. The npm-audit and workflow-sync matrices in Extract PR #165 have been corrected to exclude these EOL branches. Official support policy: https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule . No merge or branch deletion was performed.