[stable31] fix(ci): adopt LibreCode-managed npm audit workflow

.github/workflows/npm-audit-fix.yml

@@ -1,6 +1,6 @@
 # This workflow is provided via the organization template repository
 #
-# https://github.com/nextcloud/.github
+# https://github.com/LibreCodeCoop/.github
 # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
 #
 # SPDX-FileCopyrightText: 2023-2024 Nextcloud GmbH and Nextcloud contributors
@@ -12,7 +12,7 @@ on:
   workflow_dispatch:
   schedule:
     # At 2:30 on Sundays
-    - cron: "30 2 * * 0"
+    - cron: '30 2 * * 0'
 
 permissions:
   contents: read
@@ -26,38 +26,41 @@ jobs:
       matrix:
         branches:
           - ${{ github.event.repository.default_branch }}
-          - "stable32"
-          - "stable31"
-          - "stable30"
+          - 'stable32'
+          - 'stable31'
 
     name: npm-audit-fix-${{ matrix.branches }}
 
     steps:
       - name: Checkout
         id: checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ matrix.branches }}
         continue-on-error: true
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+        if: steps.checkout.outcome == 'success'
+        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
         id: versions
         with:
-          fallbackNode: "^20"
-          fallbackNpm: "^10"
+          fallbackNode: '^24'
+          fallbackNpm: '^11.3'
 
       - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        if: steps.checkout.outcome == 'success'
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ steps.versions.outputs.nodeVersion }}
 
       - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
+        if: steps.checkout.outcome == 'success'
         run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
 
       - name: Fix npm audit
         id: npm-audit
+        if: steps.checkout.outcome == 'success'
         uses: nextcloud-libraries/npm-audit-action@1b1728b2b4a7a78d69de65608efcf4db0e3e42d0 # v0.2.0
 
       - name: Run npm ci and npm run build
@@ -68,17 +71,29 @@ jobs:
           npm ci
           npm run build --if-present
 
+      - name: Create GitHub App token for dependency PR
+        id: app-token
+        if: steps.checkout.outcome == 'success'
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ vars.LIBRECODE_WORKFLOW_APP_CLIENT_ID }}
+          private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: ${{ github.event.repository.name }}
+          permission-contents: write
+          permission-pull-requests: write
+
       - name: Create Pull Request
         if: steps.checkout.outcome == 'success'
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
-          token: ${{ secrets.COMMAND_BOT_PAT }}
-          commit-message: "fix(deps): Fix npm audit"
+          token: ${{ steps.app-token.outputs.token }}
+          commit-message: 'fix(deps): resolve npm audit vulnerabilities'
           committer: GitHub <noreply@github.com>
-          author: nextcloud-command <nextcloud-command@users.noreply.github.com>
+          author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
           signoff: true
           branch: automated/noid/${{ matrix.branches }}-fix-npm-audit
-          title: "[${{ matrix.branches }}] Fix npm audit"
+          title: "${{ matrix.branches != github.event.repository.default_branch && format('[{0}] ', matrix.branches) || '' }}fix(deps): resolve npm audit vulnerabilities"
           body: ${{ steps.npm-audit.outputs.markdown }}
           labels: |
             dependencies

.github/workflows/npm-audit-fix.yml.patch

@@ -0,0 +1,30 @@
+# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+--- a/.github/workflows/npm-audit-fix.yml
++++ b/.github/workflows/npm-audit-fix.yml
+@@ -11,8 +11,8 @@
+ on:
+   workflow_dispatch:
+   schedule:
+-    # At 22:30 on Saturdays
+-    - cron: '30 22 * * 6'
++    # At 2:30 on Sundays
++    - cron: '30 2 * * 0'
+
+ permissions:
+   contents: read
+@@ -26,6 +26,8 @@
+       matrix:
+         branches:
+           - ${{ github.event.repository.default_branch }}
++          - 'stable32'
++          - 'stable31'
+
+     name: npm-audit-fix-${{ matrix.branches }}
+
+@@ -95,3 +97,4 @@
+           body: ${{ steps.npm-audit.outputs.markdown }}
+           labels: |
+             dependencies
++            3. to review