[main] ci(actions): Update workflow templates from organization template repository

.github/actions-lock.txt

@@ -1,25 +1,25 @@
 # SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
 # SPDX-License-Identifier: MIT
-93826e24ee7f83d32dc39574505abc5a appstore-build-publish.yml
-c1476a553c3223e70e49de980f22315e dependabot-approve-merge.yml
+dfb0baf2977822a54a45530bafbade45 appstore-build-publish.yml
+e6351c608939c31ae1e32923aa82aa10 dependabot-approve-merge.yml
 2581a67c5bcdcd570427e6d51db767d7 fixup.yml
-89736ea5a0440c90b73f5c722a456073 lint-eslint.yml
+4276208e79e34e2c23756469acecde13 lint-eslint.yml
 43fd0c5fb704cabc5f11cdfaf513236d lint-info-xml.yml
-79006ab196f5664fc444e63645cfd8a7 lint-php-cs.yml
-300be6a756abda800e40850918f2d964 lint-php.yml
-69ab1f99e6b290ca48c6ad916fd567cd lint-stylelint.yml
+230493ed3855e3f7d9209cc63e9dbe13 lint-php-cs.yml
+994cce702e8c1ec02e45e113e48512b6 lint-php.yml
+99024d814801405672676fd03f57c2ce lint-stylelint.yml
 03759c9dc0fa748cb927b9f9cadf2925 node.yml
-6d8eebf482b2932971b7912139f16d9f phpunit-mariadb.yml
-3cacf28a710b387e83d3858af40b7ffe phpunit-mysql.yml
-f89c18551d6a29af9bca63a0fd30a039 phpunit-oci.yml
-12a43f55ac6aedc321b62e00f9d864f0 phpunit-pgsql.yml
-ba5a538fea1a9e53dfcbeb53b83ea6fa phpunit-sqlite.yml
-d47b15109ec7ef7e52fda996796449ed playwright.yml
+9a40d9f4ed2a328a0ae7fedc5b380089 phpunit-mariadb.yml
+ccf70525553e797b8d7a1fb30d344323 phpunit-mysql.yml
+dc762923203b94da162ea3339b23ea65 phpunit-oci.yml
+2b074ba7d721c93009615d0f917ad972 phpunit-pgsql.yml
+eaef9ddd2f5552e34c3bc921a48c5e1f phpunit-sqlite.yml
+cc0602ed005f19639c69c0b975c9c84f playwright.yml
 2639f2b96989a4fcbb441ca8f1fecb2f pr-feedback.yml
-6c355cb7b5d4da4d56a58e6d7f82881b psalm-matrix.yml
+d1e7dba2e25a3921ba09a8357bcd47c5 psalm-matrix.yml
 bea8a43904976fa01f1e091046541b37 release-relay.yml
 2dbec18233063b42f4d8e03bbb43671c reuse.yml
-511439ba27869e0324f283142cc8b3df sync-workflow-templates.yml
+3688c8c5aa6a98dcd3b5019dcecccddd sync-workflow-templates.yml
 abcb8206c3f6c5a9dc86cccf57846bfc update-nextcloud-ocp-approve-merge.yml
-ba78daa94b11b18fd0cf340160e5c776 update-nextcloud-ocp-matrix.yml
-deb0d5cd79d29e8b73f689be32b4108d npm-build.yml
+c79dbe3860294a80ca4a77430ca6af99 update-nextcloud-ocp-matrix.yml
+6e07ed85ca156b6bf121a50dc1af6712 npm-build.yml

.github/workflows/appstore-build-publish.yml

@@ -59,7 +59,7 @@ jobs:
           expression: "//info//dependencies//nextcloud/@min-version"
 
       - name: Read package.json node and npm engines version
-        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
+        uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
         id: versions
         # Continue if no package.json
         continue-on-error: true
@@ -69,7 +69,7 @@ jobs:
       - name: Set up node ${{ steps.versions.outputs.node-version }}
         # Skip if no package.json
         if: ${{ steps.versions.outcome == 'success' }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ steps.versions.outputs.node-version }}
           package-manager-cache: false
@@ -86,7 +86,7 @@ jobs:
           filename: ${{ env.APP_NAME }}/appinfo/info.xml
 
       - name: Set up php ${{ steps.php-versions.outputs.php-min }}
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ steps.php-versions.outputs.php-min }}
           coverage: none

.github/workflows/dependabot-approve-merge.yml

@@ -9,7 +9,7 @@
 name: Auto approve Dependabot PRs
 
 on:
-  pull_request:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     branches:
       - main
       - master

.github/workflows/lint-eslint.yml

@@ -61,11 +61,11 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
+        uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
         id: versions
 
       - name: Set up node ${{ steps.versions.outputs.node-version }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ steps.versions.outputs.node-version }}
 

.github/workflows/lint-php-cs.yml

@@ -34,7 +34,7 @@ jobs:
         uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3
 
       - name: Set up php${{ steps.versions.outputs.php-min }}
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ steps.versions.outputs.php-min }}
           extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite

.github/workflows/lint-php.yml

@@ -49,7 +49,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up php ${{ matrix.php-versions }}
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php-versions }}
           extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite

.github/workflows/lint-stylelint.yml

@@ -30,11 +30,11 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
+        uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
         id: versions
 
       - name: Set up node ${{ steps.versions.outputs.node-version }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ steps.versions.outputs.node-version }}
 

.github/workflows/npm-build.yml

@@ -58,11 +58,11 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
+        uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
         id: versions
 
       - name: Set up node ${{ steps.versions.outputs.node-version }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ steps.versions.outputs.node-version }}
 

.github/workflows/phpunit-mariadb.yml

@@ -104,7 +104,7 @@ jobs:
           path: apps/${{ env.APP_NAME }}
 
       - name: Set up php ${{ matrix.php-versions }}
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php-versions }}
           # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation

.github/workflows/phpunit-mysql.yml

@@ -102,7 +102,7 @@ jobs:
           path: apps/${{ env.APP_NAME }}
 
       - name: Set up php ${{ matrix.php-versions }}
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php-versions }}
           # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation

.github/workflows/phpunit-oci.yml

@@ -114,7 +114,7 @@ jobs:
           path: apps/${{ env.APP_NAME }}
 
       - name: Set up php ${{ matrix.php-versions }}
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php-versions }}
           # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation

.github/workflows/phpunit-pgsql.yml

@@ -105,7 +105,7 @@ jobs:
           path: apps/${{ env.APP_NAME }}
 
       - name: Set up php ${{ matrix.php-versions }}
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php-versions }}
           # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation

.github/workflows/phpunit-sqlite.yml

@@ -94,7 +94,7 @@ jobs:
           path: apps/${{ env.APP_NAME }}
 
       - name: Set up php ${{ matrix.php-versions }}
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php-versions }}
           # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation

.github/workflows/playwright.yml

@@ -48,7 +48,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Read package.json
-      uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
+      uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
       id: versions
     - name: Check composer.json
       id: check_composer
@@ -61,7 +61,7 @@ jobs:
       with:
         composer-options: '--no-dev'
     - name: Set up node
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: ${{ steps.versions.outputs.node-version }}
     - name: Set up npm
@@ -104,11 +104,11 @@ jobs:
         persist-credentials: false
 
     - name: Read package.json
-      uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
+      uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
       id: versions
 
     - name: Set up node
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: ${{ steps.versions.outputs.node-version }}
 
@@ -129,7 +129,7 @@ jobs:
 
     - name: Upload blob report to GitHub Actions Artifacts
       if: ${{ !cancelled() }}
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: blob-report-${{ matrix.shardIndex }}
         path: blob-report
@@ -154,7 +154,7 @@ jobs:
       with:
         persist-credentials: false
 
-    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+    - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       if: steps.cache.outputs.cache-hit != 'true'
       with:
         node-version: ${{ needs.playwright-tests.outputs.node-version }}
@@ -168,7 +168,7 @@ jobs:
       run: npm ci
 
     - name: Download blob reports from GitHub Actions Artifacts
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
       with:
         path: all-blob-reports
         pattern: blob-report-*
@@ -178,7 +178,7 @@ jobs:
       run: npx playwright merge-reports --config tests/playwright/merge.config.ts --reporter html,github ./all-blob-reports
 
     - name: Upload HTML report
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: html-report--attempt-${{ github.run_attempt }}
         path: playwright-report

.github/workflows/psalm-matrix.yml

@@ -52,7 +52,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up php${{ needs.matrix.outputs.php-min }}
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ needs.matrix.outputs.php-min }}
           extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite

.github/workflows/sync-workflow-templates.yml

@@ -12,7 +12,7 @@ name: Update workflows
 on:
   workflow_dispatch:
   schedule:
-      - cron: "5 2 * * 0"
+      - cron: "45 22 * * 6"
 
 permissions:
   contents: read
@@ -45,7 +45,7 @@ jobs:
         with:
           persist-credentials: false
           path: source
-          repository: nextcloud/.github
+          repository: ${{ github.repository_owner }}/.github
 
       - name: Checkout app
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -54,7 +54,32 @@ jobs:
           path: target
           ref: ${{ matrix.branches }}
 
+      - name: Check for active merge freeze
+        id: freeze
+        env:
+          BRANCH_NAME: ${{ matrix.branches }}
+        run: |
+          if [[ ! -f target/.github/workflows/block-merge-freeze.yml ]]; then
+            echo 'No block-merge-freeze workflow, continuing'
+            exit 0
+          fi
+          if [[ "$BRANCH_NAME" == 'main' || "$BRANCH_NAME" == 'master' ]]; then
+            SERVER_REF='master'
+          elif [[ "$BRANCH_NAME" =~ ^stable[0-9]+$ ]]; then
+            SERVER_REF="$BRANCH_NAME"
+          else
+            echo 'Not based on master/main/stable*, so skipping freeze check'
+            exit 0
+          fi
+          curl -sf "https://raw.githubusercontent.com/nextcloud/server/$SERVER_REF/version.php" --output version.php
+          if grep 'OC_VersionString' version.php | grep -q -i -E '(\.0\.0 RC[3-9]|\.[1-9][0-9]* RC)'; then
+            echo "Merge freeze is active for $SERVER_REF, skipping"
+            echo 'active=true' >> $GITHUB_OUTPUT
+          fi
+          rm version.php
+
       - name: Copy all workflow templates
+        if: steps.freeze.outputs.active != 'true'
         run: |
           echo 'SUMMARY<<EOF' >> $GITHUB_ENV
           draft_only=0
@@ -81,7 +106,7 @@ jobs:
                   echo "ℹ️ Locked version: $locked_version"
                   echo "ℹ️ Current version: $new_version"
                   echo "🆙 Updating existing workflow: $filename"
-                  echo "- 🆙 Updated [$filename](https://github.com/nextcloud/.github/commits/master/workflow-templates/$filename)" >> $GITHUB_ENV
+                  echo "- 🆙 Updated [$filename](https://github.com/${GITHUB_REPOSITORY_OWNER}/.github/commits/HEAD/workflow-templates/$filename)" >> $GITHUB_ENV
 
                   cp "$workflow" "$target_file"
 
@@ -119,6 +144,7 @@ jobs:
           echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV
 
       - name: Create Pull Request
+        if: steps.freeze.outputs.active != 'true'
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.COMMAND_BOT_WORKFLOWS }}
@@ -132,7 +158,7 @@ jobs:
           draft: ${{ env.DRAFT_ONLY == 1 }}
           add-paths: .github/workflows/*.yml,.github/actions-lock.txt
           body: |
-            Automated update of all workflow templates from [nextcloud/.github](https://github.com/nextcloud/.github)
+            Automated update of all workflow templates from [${{ github.repository_owner }}/.github](https://github.com/${{ github.repository_owner }}/.github)
             ${{ env.SUMMARY }}
           labels: |
             dependencies

.github/workflows/update-nextcloud-ocp-matrix.yml

@@ -11,7 +11,7 @@ name: Update nextcloud/ocp
 on:
   workflow_dispatch:
   schedule:
-    - cron: '5 2 * * 0'
+    - cron: '5 22 * * 6'
 
 permissions:
   contents: write
@@ -49,7 +49,7 @@ jobs:
         uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3
 
       - name: Set up php8.3
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: 8.3
           # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation