From 1ca3cc8a50036bbad8e4bec76648f750f21685ed Mon Sep 17 00:00:00 2001
From: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Date: Mon, 19 Oct 2026 18:53:23 +0000
Subject: [PATCH 1/4] chore: refresh tracked Nextcloud upstream workflow
 sources

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
---
 upstream/sources.json                         | 44 +++++++++----------
 .../nextcloud/appstore-build-publish.yml      | 24 +++++-----
 upstream/vendor/nextcloud/lint-eslint.yml     | 15 +++----
 upstream/vendor/nextcloud/lint-php-cs.yml     |  2 +-
 upstream/vendor/nextcloud/lint-php.yml        |  2 +-
 upstream/vendor/nextcloud/lint-stylelint.yml  | 15 +++----
 upstream/vendor/nextcloud/lint-typescript.yml | 15 +++----
 upstream/vendor/nextcloud/node-test.yml       | 15 +++----
 upstream/vendor/nextcloud/npm-build.yml       | 15 +++----
 upstream/vendor/nextcloud/openapi.yml         | 23 +++++-----
 upstream/vendor/nextcloud/psalm.yml           |  2 +-
 .../nextcloud/sync-workflow-templates.yml     | 28 +++++++++++-
 workflow-templates/lint-eslint.yml            | 13 +++---
 workflow-templates/lint-stylelint.yml         | 13 +++---
 workflow-templates/lint-typescript.yml        | 13 +++---
 workflow-templates/node-test.yml              | 13 +++---
 workflow-templates/npm-build.yml              | 13 +++---
 workflow-templates/openapi.yml                | 19 ++++----
 18 files changed, 136 insertions(+), 148 deletions(-)

diff --git a/upstream/sources.json b/upstream/sources.json
index 2d4f17a..090f1fb 100644
--- a/upstream/sources.json
+++ b/upstream/sources.json
@@ -5,8 +5,8 @@
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/appstore-build-publish.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/42804704e35b4f28500f135e60f9c7a0a5c6c07a/workflow-templates/appstore-build-publish.yml",
-      "sha256": "c1838915d6f48072f8594d04e908a1eea0cf100c542c917f2f16143d734a7d11",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/be42c5d25f81f94fba5756aa27778851d0c063b4/workflow-templates/appstore-build-publish.yml",
+      "sha256": "7342c22d491c6095a50aff20d81d4ebc7e289b6159a7eac63d21ecdaa4bd5bb8",
       "destination": "upstream/vendor/nextcloud/appstore-build-publish.yml"
     },
     {
@@ -23,8 +23,8 @@
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/lint-eslint.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/42804704e35b4f28500f135e60f9c7a0a5c6c07a/workflow-templates/lint-eslint.yml",
-      "sha256": "6ebe1e660ea68ac490c51bab8bcbb35109f9037096d53089a636db5eab4d63f6",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/e9c3f34e252af7ae3fadd238d80ea9fd51c991fd/workflow-templates/lint-eslint.yml",
+      "sha256": "860792cea5bcfe36aab444f3037e79088ba7837cc15a4d31ca076e7c21e052e5",
       "destination": "upstream/vendor/nextcloud/lint-eslint.yml"
     },
     {
@@ -41,8 +41,8 @@
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/lint-php.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/fb5f5adee71c8c62b76ec2fb9499261233a5ff6a/workflow-templates/lint-php.yml",
-      "sha256": "cdf80971a01d51a42cbcf4e0326e3830fa3613b0072b322d5277ba310873dd4b",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/be42c5d25f81f94fba5756aa27778851d0c063b4/workflow-templates/lint-php.yml",
+      "sha256": "b241d8c3bff49b7e0bb9e396acbe442f09a42cd6b22bd3aa97c39830f8821648",
       "destination": "upstream/vendor/nextcloud/lint-php.yml"
     },
     {
@@ -50,8 +50,8 @@
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/lint-php-cs.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/fb5f5adee71c8c62b76ec2fb9499261233a5ff6a/workflow-templates/lint-php-cs.yml",
-      "sha256": "e6047b215571aa2746bd3d2786a14b3e0122fc34e70755a29ff573bb21e1672c",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/be42c5d25f81f94fba5756aa27778851d0c063b4/workflow-templates/lint-php-cs.yml",
+      "sha256": "b4629d23fddb88b395063d208afb2d21bdfa57ce00804018ae41ea208eef1bcd",
       "destination": "upstream/vendor/nextcloud/lint-php-cs.yml"
     },
     {
@@ -59,8 +59,8 @@
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/lint-stylelint.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/42804704e35b4f28500f135e60f9c7a0a5c6c07a/workflow-templates/lint-stylelint.yml",
-      "sha256": "58667560a500d7f0b472f71897768a230bbba20628aba91f59a0888067ff025d",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/e9c3f34e252af7ae3fadd238d80ea9fd51c991fd/workflow-templates/lint-stylelint.yml",
+      "sha256": "73b15c6d0aeebc9dc96ecbbe373bafd486192fa94746742da0b72fdd50d8a8ba",
       "destination": "upstream/vendor/nextcloud/lint-stylelint.yml"
     },
     {
@@ -68,8 +68,8 @@
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/lint-typescript.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/42804704e35b4f28500f135e60f9c7a0a5c6c07a/workflow-templates/lint-typescript.yml",
-      "sha256": "6711f3e18f9c08a8d8f3de851b565846293c5e91eb49d96a11ed8611975ac0b1",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/e9c3f34e252af7ae3fadd238d80ea9fd51c991fd/workflow-templates/lint-typescript.yml",
+      "sha256": "d6a2b673e397e757b352809fe4317bd037d5765b65e6a617fbb23a0891f321e9",
       "destination": "upstream/vendor/nextcloud/lint-typescript.yml"
     },
     {
@@ -77,8 +77,8 @@
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/node-test.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/42804704e35b4f28500f135e60f9c7a0a5c6c07a/workflow-templates/node-test.yml",
-      "sha256": "850616dd6832bb4dfffa31485c517c64ba6a4a1be0caa94fa36778d9407f1abc",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/e9c3f34e252af7ae3fadd238d80ea9fd51c991fd/workflow-templates/node-test.yml",
+      "sha256": "aabdfd85a80862e02ba9db27810c6b65c16b8d8649c29ba51198a534669cea00",
       "destination": "upstream/vendor/nextcloud/node-test.yml"
     },
     {
@@ -86,8 +86,8 @@
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/npm-build.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/42804704e35b4f28500f135e60f9c7a0a5c6c07a/workflow-templates/npm-build.yml",
-      "sha256": "fd6f721910d9ee1283570d17b674e140fd91cfdc7c1f06f4339ca5b1dc144121",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/e9c3f34e252af7ae3fadd238d80ea9fd51c991fd/workflow-templates/npm-build.yml",
+      "sha256": "890084d4d7927051b67d0c25e89181b2cdc862b455564e84fccab917807456d9",
       "destination": "upstream/vendor/nextcloud/npm-build.yml"
     },
     {
@@ -95,8 +95,8 @@
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/openapi.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/42804704e35b4f28500f135e60f9c7a0a5c6c07a/workflow-templates/openapi.yml",
-      "sha256": "1657c25052aefa493b0ebffbb798c88ba07ecafdb8d47ca84331bfbdd65264c4",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/be42c5d25f81f94fba5756aa27778851d0c063b4/workflow-templates/openapi.yml",
+      "sha256": "57e3c50be49bf2dad1da4700b49931c65e69bded1786c276a7df1204ff3c4d79",
       "destination": "upstream/vendor/nextcloud/openapi.yml"
     },
     {
@@ -104,8 +104,8 @@
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/psalm.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/fb5f5adee71c8c62b76ec2fb9499261233a5ff6a/workflow-templates/psalm.yml",
-      "sha256": "02d1db3a1549f5fa933b7157fc1a18d4b4593b35745a1f18be3f49e6e0499bd8",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/be42c5d25f81f94fba5756aa27778851d0c063b4/workflow-templates/psalm.yml",
+      "sha256": "9455962a22c7e0a7b5aa37f037d4898b76968d4fcbf88afa720466def9566c08",
       "destination": "upstream/vendor/nextcloud/psalm.yml"
     },
     {
@@ -122,8 +122,8 @@
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/sync-workflow-templates.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/e137952600ed786d2dfd1bf928fadf92d295483c/workflow-templates/sync-workflow-templates.yml",
-      "sha256": "b1a49a5dbc35ca40a1485bed5f84ef042c6c738f5c81cb229035f24fd6dc0cf0",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/593089b25a456dc70dc66eb09efb35de69a5f621/workflow-templates/sync-workflow-templates.yml",
+      "sha256": "afeb694de2555c139e5fdfbbbe8e6af32ab609ba7eee2d32cc894872a6a3ac7d",
       "destination": "upstream/vendor/nextcloud/sync-workflow-templates.yml"
     }
   ]
diff --git a/upstream/vendor/nextcloud/appstore-build-publish.yml b/upstream/vendor/nextcloud/appstore-build-publish.yml
index ba35bd8..43461b1 100644
--- a/upstream/vendor/nextcloud/appstore-build-publish.yml
+++ b/upstream/vendor/nextcloud/appstore-build-publish.yml
@@ -59,27 +59,25 @@ jobs:
           expression: "//info//dependencies//nextcloud/@min-version"
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
+        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
         id: versions
         # Continue if no package.json
         continue-on-error: true
         with:
-          path: ${{ env.APP_NAME }}
-          fallbackNode: '^24'
-          fallbackNpm: '^11.3'
+          path: ${{ env.APP_NAME }}/package.json
 
-      - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
+      - name: Set up node ${{ steps.versions.outputs.node-version }}
         # Skip if no package.json
-        if: ${{ steps.versions.outputs.nodeVersion }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        if: ${{ steps.versions.outcome == 'success' }}
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ steps.versions.outputs.nodeVersion }}
+          node-version: ${{ steps.versions.outputs.node-version }}
           package-manager-cache: false
 
-      - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
+      - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
         # Skip if no package.json
-        if: ${{ steps.versions.outputs.npmVersion }}
-        run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
+        if: ${{ steps.versions.outcome == 'success' }}
+        run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
 
       - name: Get php version
         id: php-versions
@@ -88,7 +86,7 @@ jobs:
           filename: ${{ env.APP_NAME }}/appinfo/info.xml
 
       - name: Set up php ${{ steps.php-versions.outputs.php-min }}
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ steps.php-versions.outputs.php-min }}
           coverage: none
@@ -111,7 +109,7 @@ jobs:
 
       - name: Build ${{ env.APP_NAME }}
         # Skip if no package.json
-        if: ${{ steps.versions.outputs.nodeVersion }}
+        if: ${{ steps.versions.outcome == 'success' }}
         env:
           CYPRESS_INSTALL_BINARY: 0
         run: |
diff --git a/upstream/vendor/nextcloud/lint-eslint.yml b/upstream/vendor/nextcloud/lint-eslint.yml
index 317e3c6..c1353ce 100644
--- a/upstream/vendor/nextcloud/lint-eslint.yml
+++ b/upstream/vendor/nextcloud/lint-eslint.yml
@@ -61,19 +61,16 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
+        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
         id: versions
-        with:
-          fallbackNode: '^24'
-          fallbackNpm: '^11.3'
 
-      - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - name: Set up node ${{ steps.versions.outputs.node-version }}
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ steps.versions.outputs.nodeVersion }}
+          node-version: ${{ steps.versions.outputs.node-version }}
 
-      - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
-        run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
+      - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
+        run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
 
       - name: Install dependencies
         env:
diff --git a/upstream/vendor/nextcloud/lint-php-cs.yml b/upstream/vendor/nextcloud/lint-php-cs.yml
index 06d0842..6c92411 100644
--- a/upstream/vendor/nextcloud/lint-php-cs.yml
+++ b/upstream/vendor/nextcloud/lint-php-cs.yml
@@ -34,7 +34,7 @@ jobs:
         uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3
 
       - name: Set up php${{ steps.versions.outputs.php-min }}
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ steps.versions.outputs.php-min }}
           extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite
diff --git a/upstream/vendor/nextcloud/lint-php.yml b/upstream/vendor/nextcloud/lint-php.yml
index e4c6e9b..53b6f38 100644
--- a/upstream/vendor/nextcloud/lint-php.yml
+++ b/upstream/vendor/nextcloud/lint-php.yml
@@ -49,7 +49,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up php ${{ matrix.php-versions }}
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php-versions }}
           extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite
diff --git a/upstream/vendor/nextcloud/lint-stylelint.yml b/upstream/vendor/nextcloud/lint-stylelint.yml
index 89149dd..fd55805 100644
--- a/upstream/vendor/nextcloud/lint-stylelint.yml
+++ b/upstream/vendor/nextcloud/lint-stylelint.yml
@@ -30,19 +30,16 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
+        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
         id: versions
-        with:
-          fallbackNode: '^24'
-          fallbackNpm: '^11.3'
 
-      - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - name: Set up node ${{ steps.versions.outputs.node-version }}
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ steps.versions.outputs.nodeVersion }}
+          node-version: ${{ steps.versions.outputs.node-version }}
 
-      - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
-        run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
+      - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
+        run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
 
       - name: Install dependencies
         env:
diff --git a/upstream/vendor/nextcloud/lint-typescript.yml b/upstream/vendor/nextcloud/lint-typescript.yml
index 51037d4..beb5c67 100644
--- a/upstream/vendor/nextcloud/lint-typescript.yml
+++ b/upstream/vendor/nextcloud/lint-typescript.yml
@@ -60,19 +60,16 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
+        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
         id: versions
-        with:
-          fallbackNode: '^24'
-          fallbackNpm: '^11.3'
 
-      - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - name: Set up node ${{ steps.versions.outputs.node-version }}
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ steps.versions.outputs.nodeVersion }}
+          node-version: ${{ steps.versions.outputs.node-version }}
 
-      - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
-        run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
+      - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
+        run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
 
       - name: Install dependencies
         env:
diff --git a/upstream/vendor/nextcloud/node-test.yml b/upstream/vendor/nextcloud/node-test.yml
index c25b088..5e3b634 100644
--- a/upstream/vendor/nextcloud/node-test.yml
+++ b/upstream/vendor/nextcloud/node-test.yml
@@ -65,19 +65,16 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
+        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
         id: versions
-        with:
-          fallbackNode: '^24'
-          fallbackNpm: '^11.3'
 
-      - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - name: Set up node ${{ steps.versions.outputs.node-version }}
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ steps.versions.outputs.nodeVersion }}
+          node-version: ${{ steps.versions.outputs.node-version }}
 
-      - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
-        run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
+      - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
+        run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
 
       - name: Install dependencies & build
         env:
diff --git a/upstream/vendor/nextcloud/npm-build.yml b/upstream/vendor/nextcloud/npm-build.yml
index a7f1e42..22783c4 100644
--- a/upstream/vendor/nextcloud/npm-build.yml
+++ b/upstream/vendor/nextcloud/npm-build.yml
@@ -58,19 +58,16 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
+        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
         id: versions
-        with:
-          fallbackNode: '^24'
-          fallbackNpm: '^11.3'
 
-      - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - name: Set up node ${{ steps.versions.outputs.node-version }}
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ steps.versions.outputs.nodeVersion }}
+          node-version: ${{ steps.versions.outputs.node-version }}
 
-      - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
-        run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
+      - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
+        run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
 
       - name: Validate package-lock.json # See https://github.com/npm/cli/issues/4460
         run: |
diff --git a/upstream/vendor/nextcloud/openapi.yml b/upstream/vendor/nextcloud/openapi.yml
index f8a1460..721f52f 100644
--- a/upstream/vendor/nextcloud/openapi.yml
+++ b/upstream/vendor/nextcloud/openapi.yml
@@ -35,7 +35,7 @@ jobs:
         uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3
 
       - name: Set up php
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ steps.php_versions.outputs.php-available }}
           extensions: xml
@@ -52,26 +52,23 @@ jobs:
 
       - name: Read package.json node and npm engines version
         if: steps.check_typescript_openapi.outputs.files_exists == 'true'
-        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
+        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
         id: node_versions
         # Continue if no package.json
         continue-on-error: true
-        with:
-          fallbackNode: '^24'
-          fallbackNpm: '^11.3'
 
-      - name: Set up node ${{ steps.node_versions.outputs.nodeVersion }}
-        if: ${{ steps.node_versions.outputs.nodeVersion }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - name: Set up node ${{ steps.node_versions.outputs.node-version }}
+        if: ${{ steps.node_versions.outcome == 'success' }}
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ steps.node_versions.outputs.nodeVersion }}
+          node-version: ${{ steps.node_versions.outputs.node-version }}
 
-      - name: Set up npm ${{ steps.node_versions.outputs.npmVersion }}
-        if: ${{ steps.node_versions.outputs.nodeVersion }}
-        run: npm i -g 'npm@${{ steps.node_versions.outputs.npmVersion }}'
+      - name: Set up npm ${{ steps.node_versions.outputs.package-manager-version }}
+        if: ${{ steps.node_versions.outcome == 'success' }}
+        run: npm i -g 'npm@${{ steps.node_versions.outputs.package-manager-version }}'
 
       - name: Install dependencies
-        if: ${{ steps.node_versions.outputs.nodeVersion }}
+        if: ${{ steps.node_versions.outcome == 'success' }}
         env:
           CYPRESS_INSTALL_BINARY: 0
           PUPPETEER_SKIP_DOWNLOAD: true
diff --git a/upstream/vendor/nextcloud/psalm.yml b/upstream/vendor/nextcloud/psalm.yml
index d6e2d52..8500151 100644
--- a/upstream/vendor/nextcloud/psalm.yml
+++ b/upstream/vendor/nextcloud/psalm.yml
@@ -36,7 +36,7 @@ jobs:
         run: grep 'phpVersion="${{ steps.versions.outputs.php-min }}' psalm.xml
 
       - name: Set up php${{ steps.versions.outputs.php-available }}
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ steps.versions.outputs.php-available }}
           extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite
diff --git a/upstream/vendor/nextcloud/sync-workflow-templates.yml b/upstream/vendor/nextcloud/sync-workflow-templates.yml
index 40d39e1..5d84aec 100644
--- a/upstream/vendor/nextcloud/sync-workflow-templates.yml
+++ b/upstream/vendor/nextcloud/sync-workflow-templates.yml
@@ -12,7 +12,7 @@ name: Update workflows
 on:
   workflow_dispatch:
   schedule:
-      - cron: "5 2 * * 0"
+      - cron: "45 22 * * 6"
 
 permissions:
   contents: read
@@ -56,7 +56,32 @@ jobs:
           path: target
           ref: ${{ matrix.branches }}
 
+      - name: Check for active merge freeze
+        id: freeze
+        env:
+          BRANCH_NAME: ${{ matrix.branches }}
+        run: |
+          if [[ ! -f target/.github/workflows/block-merge-freeze.yml ]]; then
+            echo 'No block-merge-freeze workflow, continuing'
+            exit 0
+          fi
+          if [[ "$BRANCH_NAME" == 'main' || "$BRANCH_NAME" == 'master' ]]; then
+            SERVER_REF='master'
+          elif [[ "$BRANCH_NAME" =~ ^stable[0-9]+$ ]]; then
+            SERVER_REF="$BRANCH_NAME"
+          else
+            echo 'Not based on master/main/stable*, so skipping freeze check'
+            exit 0
+          fi
+          curl -sf "https://raw.githubusercontent.com/nextcloud/server/$SERVER_REF/version.php" --output version.php
+          if grep 'OC_VersionString' version.php | grep -q -i -E '(\.0\.0 RC[3-9]|\.[1-9][0-9]* RC)'; then
+            echo "Merge freeze is active for $SERVER_REF, skipping"
+            echo 'active=true' >> $GITHUB_OUTPUT
+          fi
+          rm version.php
+
       - name: Copy all workflow templates
+        if: steps.freeze.outputs.active != 'true'
         run: |
           echo 'SUMMARY<<EOF' >> $GITHUB_ENV
           draft_only=0
@@ -121,6 +146,7 @@ jobs:
           echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV
 
       - name: Create Pull Request
+        if: steps.freeze.outputs.active != 'true'
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.COMMAND_BOT_WORKFLOWS }}
diff --git a/workflow-templates/lint-eslint.yml b/workflow-templates/lint-eslint.yml
index 54897be..5123d67 100644
--- a/workflow-templates/lint-eslint.yml
+++ b/workflow-templates/lint-eslint.yml
@@ -61,19 +61,16 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
+        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
         id: versions
-        with:
-          fallbackNode: '^24'
-          fallbackNpm: '^11.3'
 
-      - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
+      - name: Set up node ${{ steps.versions.outputs.node-version }}
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ steps.versions.outputs.nodeVersion }}
+          node-version: ${{ steps.versions.outputs.node-version }}
 
-      - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
-        run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
+      - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
+        run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
 
       - name: Install dependencies
         env:
diff --git a/workflow-templates/lint-stylelint.yml b/workflow-templates/lint-stylelint.yml
index 69ae74d..46e0dcf 100644
--- a/workflow-templates/lint-stylelint.yml
+++ b/workflow-templates/lint-stylelint.yml
@@ -30,19 +30,16 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
+        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
         id: versions
-        with:
-          fallbackNode: '^24'
-          fallbackNpm: '^11.3'
 
-      - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
+      - name: Set up node ${{ steps.versions.outputs.node-version }}
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ steps.versions.outputs.nodeVersion }}
+          node-version: ${{ steps.versions.outputs.node-version }}
 
-      - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
-        run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
+      - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
+        run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
 
       - name: Install dependencies
         env:
diff --git a/workflow-templates/lint-typescript.yml b/workflow-templates/lint-typescript.yml
index b101192..9f23c43 100644
--- a/workflow-templates/lint-typescript.yml
+++ b/workflow-templates/lint-typescript.yml
@@ -60,19 +60,16 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
+        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
         id: versions
-        with:
-          fallbackNode: '^24'
-          fallbackNpm: '^11.3'
 
-      - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
+      - name: Set up node ${{ steps.versions.outputs.node-version }}
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ steps.versions.outputs.nodeVersion }}
+          node-version: ${{ steps.versions.outputs.node-version }}
 
-      - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
-        run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
+      - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
+        run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
 
       - name: Install dependencies
         env:
diff --git a/workflow-templates/node-test.yml b/workflow-templates/node-test.yml
index 7c7020b..0a69971 100644
--- a/workflow-templates/node-test.yml
+++ b/workflow-templates/node-test.yml
@@ -65,19 +65,16 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
+        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
         id: versions
-        with:
-          fallbackNode: '^24'
-          fallbackNpm: '^11.3'
 
-      - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
+      - name: Set up node ${{ steps.versions.outputs.node-version }}
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ steps.versions.outputs.nodeVersion }}
+          node-version: ${{ steps.versions.outputs.node-version }}
 
-      - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
-        run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
+      - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
+        run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
 
       - name: Install dependencies & build
         env:
diff --git a/workflow-templates/npm-build.yml b/workflow-templates/npm-build.yml
index fbf8c11..3ee0a85 100644
--- a/workflow-templates/npm-build.yml
+++ b/workflow-templates/npm-build.yml
@@ -58,19 +58,16 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
+        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
         id: versions
-        with:
-          fallbackNode: '^24'
-          fallbackNpm: '^11.3'
 
-      - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
+      - name: Set up node ${{ steps.versions.outputs.node-version }}
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ steps.versions.outputs.nodeVersion }}
+          node-version: ${{ steps.versions.outputs.node-version }}
 
-      - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
-        run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
+      - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
+        run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
 
       - name: Validate package-lock.json # See https://github.com/npm/cli/issues/4460
         run: |
diff --git a/workflow-templates/openapi.yml b/workflow-templates/openapi.yml
index 98f2f08..bc19b40 100644
--- a/workflow-templates/openapi.yml
+++ b/workflow-templates/openapi.yml
@@ -52,26 +52,23 @@ jobs:
 
       - name: Read package.json node and npm engines version
         if: steps.check_typescript_openapi.outputs.files_exists == 'true'
-        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
+        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
         id: node_versions
         # Continue if no package.json
         continue-on-error: true
-        with:
-          fallbackNode: '^24'
-          fallbackNpm: '^11.3'
 
-      - name: Set up node ${{ steps.node_versions.outputs.nodeVersion }}
-        if: ${{ steps.node_versions.outputs.nodeVersion }}
+      - name: Set up node ${{ steps.node_versions.outputs.node-version }}
+        if: ${{ steps.node_versions.outcome == 'success' }}
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ steps.node_versions.outputs.nodeVersion }}
+          node-version: ${{ steps.node_versions.outputs.node-version }}
 
-      - name: Set up npm ${{ steps.node_versions.outputs.npmVersion }}
-        if: ${{ steps.node_versions.outputs.nodeVersion }}
-        run: npm i -g 'npm@${{ steps.node_versions.outputs.npmVersion }}'
+      - name: Set up npm ${{ steps.node_versions.outputs.package-manager-version }}
+        if: ${{ steps.node_versions.outcome == 'success' }}
+        run: npm i -g 'npm@${{ steps.node_versions.outputs.package-manager-version }}'
 
       - name: Install dependencies
-        if: ${{ steps.node_versions.outputs.nodeVersion }}
+        if: ${{ steps.node_versions.outcome == 'success' }}
         env:
           CYPRESS_INSTALL_BINARY: 0
           PUPPETEER_SKIP_DOWNLOAD: true

From 675e31810ac510a37f84324d01c65d5d7e62adaf Mon Sep 17 00:00:00 2001
From: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Date: Mon, 19 Oct 2026 18:53:40 +0000
Subject: [PATCH 2/4] fix: reconcile LibreCode downstream patches with
 Nextcloud upstream

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
---
 .../appstore-build-publish.yml.patch          | 106 +++++++-----------
 .../sync-workflow-templates.yml.patch         |  80 +++++++++----
 2 files changed, 98 insertions(+), 88 deletions(-)

diff --git a/patches/nextcloud/appstore-build-publish.yml.patch b/patches/nextcloud/appstore-build-publish.yml.patch
index 14f0812..261b9e3 100644
--- a/patches/nextcloud/appstore-build-publish.yml.patch
+++ b/patches/nextcloud/appstore-build-publish.yml.patch
@@ -1,34 +1,44 @@
 --- upstream/vendor/nextcloud/appstore-build-publish.yml
 +++ workflow-templates/appstore-build-publish.yml
-@@ -1,202 +1,36 @@
--# This workflow is provided via the organization template repository
--#
+@@ -1,9 +1,9 @@
+ # This workflow is provided via the organization template repository
+ #
 -# https://github.com/nextcloud/.github
--# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
--#
++# https://github.com/LibreCodeCoop/.github
+ # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
+ #
 -# SPDX-FileCopyrightText: 2021-2024 Nextcloud GmbH and Nextcloud contributors
--# SPDX-License-Identifier: MIT
--
--name: Build and publish app release
--
--on:
--  release:
--    types: [published]
--
--permissions:
--  contents: write
--
--jobs:
--  build_and_publish:
--    runs-on: ubuntu-latest
++# SPDX-FileCopyrightText: 2021-2026 Nextcloud GmbH, LibreCode coop and contributors
+ # SPDX-License-Identifier: MIT
+ 
+ name: Build and publish app release
+@@ -11,6 +11,12 @@
+ on:
+   release:
+     types: [published]
++  workflow_dispatch:
++    inputs:
++      release_tag:
++        description: Existing release tag to build and publish.
++        required: true
++        type: string
+ 
+ permissions:
+   contents: write
+@@ -18,183 +24,13 @@
+ jobs:
+   build_and_publish:
+     runs-on: ubuntu-latest
 -
 -    # Only allowed to be run on nextcloud-releases repositories
 -    if: ${{ github.repository_owner == 'nextcloud-releases' }}
 -
--    steps:
+     steps:
 -      - name: Check actor permission
 -        uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0
--        with:
++      - name: Build and publish release
++        uses: LibreCodeCoop/.github/actions/nextcloud-appstore-publish@600b84354bdbb2da4fc32e9d4eecac1fcce60666
+         with:
 -          require: write
 -
 -      - name: Set app env
@@ -62,27 +72,25 @@
 -          expression: "//info//dependencies//nextcloud/@min-version"
 -
 -      - name: Read package.json node and npm engines version
--        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
+-        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
 -        id: versions
 -        # Continue if no package.json
 -        continue-on-error: true
 -        with:
--          path: ${{ env.APP_NAME }}
--          fallbackNode: '^24'
--          fallbackNpm: '^11.3'
+-          path: ${{ env.APP_NAME }}/package.json
 -
--      - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
+-      - name: Set up node ${{ steps.versions.outputs.node-version }}
 -        # Skip if no package.json
--        if: ${{ steps.versions.outputs.nodeVersion }}
--        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+-        if: ${{ steps.versions.outcome == 'success' }}
+-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
 -        with:
--          node-version: ${{ steps.versions.outputs.nodeVersion }}
+-          node-version: ${{ steps.versions.outputs.node-version }}
 -          package-manager-cache: false
 -
--      - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
+-      - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
 -        # Skip if no package.json
--        if: ${{ steps.versions.outputs.npmVersion }}
--        run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
+-        if: ${{ steps.versions.outcome == 'success' }}
+-        run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
 -
 -      - name: Get php version
 -        id: php-versions
@@ -91,7 +99,7 @@
 -          filename: ${{ env.APP_NAME }}/appinfo/info.xml
 -
 -      - name: Set up php ${{ steps.php-versions.outputs.php-min }}
--        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+-        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
 -        with:
 -          php-version: ${{ steps.php-versions.outputs.php-min }}
 -          coverage: none
@@ -114,7 +122,7 @@
 -
 -      - name: Build ${{ env.APP_NAME }}
 -        # Skip if no package.json
--        if: ${{ steps.versions.outputs.nodeVersion }}
+-        if: ${{ steps.versions.outcome == 'success' }}
 -        env:
 -          CYPRESS_INSTALL_BINARY: 0
 -        run: |
@@ -203,36 +211,6 @@
 -          appstore_token: ${{ secrets.APPSTORE_TOKEN }}
 -          download_url: ${{ steps.attach_to_release.outputs.browser_download_url }}
 -          app_private_key: ${{ secrets.APP_PRIVATE_KEY }}
-+# This workflow is provided via the organization template repository
-+#
-+# https://github.com/LibreCodeCoop/.github
-+# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
-+#
-+# SPDX-FileCopyrightText: 2021-2026 Nextcloud GmbH, LibreCode coop and contributors
-+# SPDX-License-Identifier: MIT
-+
-+name: Build and publish app release
-+
-+on:
-+  release:
-+    types: [published]
-+  workflow_dispatch:
-+    inputs:
-+      release_tag:
-+        description: Existing release tag to build and publish.
-+        required: true
-+        type: string
-+
-+permissions:
-+  contents: write
-+
-+jobs:
-+  build_and_publish:
-+    runs-on: ubuntu-latest
-+    steps:
-+      - name: Build and publish release
-+        uses: LibreCodeCoop/.github/actions/nextcloud-appstore-publish@748b0416ea5b734292671dd0feec33aaf8ec6b82
-+        with:
 +          app-name: ${{ github.event.repository.name }}
 +          release-tag: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.event.release.tag_name }}
 +          github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/patches/nextcloud/sync-workflow-templates.yml.patch b/patches/nextcloud/sync-workflow-templates.yml.patch
index 9829e17..970fb24 100644
--- a/patches/nextcloud/sync-workflow-templates.yml.patch
+++ b/patches/nextcloud/sync-workflow-templates.yml.patch
@@ -1,25 +1,31 @@
 --- upstream/vendor/nextcloud/sync-workflow-templates.yml
 +++ workflow-templates/sync-workflow-templates.yml
-@@ -1,13 +1,16 @@
+@@ -1,18 +1,21 @@
  # This workflow is provided via the organization template repository
  #
-+# https://github.com/LibreCodeCoop/.github
 -# https://github.com/nextcloud/.github
++# https://github.com/LibreCodeCoop/.github
  # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
  #
  # SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
  # SPDX-License-Identifier: MIT
  
+-# This workflow will update all workflow templates
+-# Additionally it will reapply `workflow.yml.patch` files after syncing and only then commit the result
 +# This workflow will update all workflow templates.
 +# Additionally it will reapply workflow.yml.patch files after syncing and only then commit the result.
 +#
 +# Authentication is selected explicitly with vars.WORKFLOW_SYNC_AUTH_MODE.
 +# See docs/cross-repository-automation.md for modes, credentials and GITHUB_TOKEN limitations.
--# This workflow will update all workflow templates
--# Additionally it will reapply `workflow.yml.patch` files after syncing and only then commit the result
  name: Update workflows
  on:
    workflow_dispatch:
+   schedule:
+-      - cron: "45 22 * * 6"
++      - cron: "5 2 * * 0"
+ 
+ permissions:
+   contents: read
 @@ -26,9 +29,6 @@
        matrix:
          branches:
@@ -34,6 +40,7 @@
  
      steps:
        - name: Check actor permission
+-        uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0
 +        if: ${{ github.event_name == 'workflow_dispatch' }}
 +        shell: bash
 +        env:
@@ -89,7 +96,8 @@
 +        if: ${{ vars.WORKFLOW_SYNC_AUTH_MODE == '' || vars.WORKFLOW_SYNC_AUTH_MODE == 'librecode-app' }}
 +        id: librecode-app-token
 +        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-+        with:
+         with:
+-          require: admin
 +          client-id: ${{ vars.LIBRECODE_WORKFLOW_APP_CLIENT_ID }}
 +          private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
 +          owner: ${{ github.repository_owner }}
@@ -102,8 +110,7 @@
 +        if: ${{ vars.WORKFLOW_SYNC_AUTH_MODE == 'github-app' }}
 +        id: consumer-app-token
 +        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
--        uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0
-         with:
++        with:
 +          client-id: ${{ vars.WORKFLOW_SYNC_APP_CLIENT_ID }}
 +          private-key: ${{ secrets.WORKFLOW_SYNC_APP_PRIVATE_KEY }}
 +          owner: ${{ github.repository_owner }}
@@ -139,13 +146,13 @@
 +
 +          echo "::add-mask::${token}"
 +          echo "token=${token}" >> "${GITHUB_OUTPUT}"
--          require: admin
  
        - name: Checkout workflow repository
          uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
          with:
            persist-credentials: false
            path: source
+-          repository: nextcloud/.github
 +          repository: LibreCodeCoop/.github
 +
 +      - name: Record workflow catalog revision
@@ -153,22 +160,39 @@
 +        working-directory: source
 +        shell: bash
 +        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
--          repository: nextcloud/.github
  
        - name: Checkout app
          uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-@@ -56,86 +163,31 @@
+@@ -56,112 +163,31 @@
            path: target
            ref: ${{ matrix.branches }}
  
-+      - name: Synchronize workflow templates
-+        id: sync
-+        uses: ./source/actions/sync-workflows
-+        with:
-+          source: source/workflow-templates
-+          target: target
-+          catalog-commit: ${{ steps.catalog-revision.outputs.sha }}
+-      - name: Check for active merge freeze
+-        id: freeze
+-        env:
+-          BRANCH_NAME: ${{ matrix.branches }}
+-        run: |
+-          if [[ ! -f target/.github/workflows/block-merge-freeze.yml ]]; then
+-            echo 'No block-merge-freeze workflow, continuing'
+-            exit 0
+-          fi
+-          if [[ "$BRANCH_NAME" == 'main' || "$BRANCH_NAME" == 'master' ]]; then
+-            SERVER_REF='master'
+-          elif [[ "$BRANCH_NAME" =~ ^stable[0-9]+$ ]]; then
+-            SERVER_REF="$BRANCH_NAME"
+-          else
+-            echo 'Not based on master/main/stable*, so skipping freeze check'
+-            exit 0
+-          fi
+-          curl -sf "https://raw.githubusercontent.com/nextcloud/server/$SERVER_REF/version.php" --output version.php
+-          if grep 'OC_VersionString' version.php | grep -q -i -E '(\.0\.0 RC[3-9]|\.[1-9][0-9]* RC)'; then
+-            echo "Merge freeze is active for $SERVER_REF, skipping"
+-            echo 'active=true' >> $GITHUB_OUTPUT
+-          fi
+-          rm version.php
+-
 -      - name: Copy all workflow templates
+-        if: steps.freeze.outputs.active != 'true'
 -        run: |
 -          echo 'SUMMARY<<EOF' >> $GITHUB_ENV
 -          draft_only=0
@@ -177,7 +201,7 @@
 -            if [ -f "$workflow" ]; then
 -              filename=$(basename "$workflow")
 -              target_file="./target/.github/workflows/$filename"
- 
+-
 -              # Only copy if the file exists in the target repository
 -              if [ -f "$target_file" ]; then
 -                if [ -f "./target/.github/actions-lock.txt" ]; then
@@ -231,29 +255,37 @@
 -          done
 -          echo 'EOF' >> $GITHUB_ENV
 -          echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV
--
++      - name: Synchronize workflow templates
++        id: sync
++        uses: ./source/actions/sync-workflows
++        with:
++          source: source/workflow-templates
++          target: target
++          catalog-commit: ${{ steps.catalog-revision.outputs.sha }}
+ 
        - name: Create Pull Request
+-        if: steps.freeze.outputs.active != 'true'
 +        if: ${{ steps.sync.outputs.changed == 'true' }}
          uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
          with:
-+          token: ${{ steps.auth-token.outputs.token }}
 -          token: ${{ secrets.COMMAND_BOT_WORKFLOWS }}
++          token: ${{ steps.auth-token.outputs.token }}
            commit-message: 'ci(actions): Update workflow templates from organization template repository'
            committer: GitHub <noreply@github.com>
-+          author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 -          author: nextcloud-command <nextcloud-command@users.noreply.github.com>
++          author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
            path: target
            signoff: true
            branch: 'automated/noid/${{ matrix.branches }}-update-workflows'
            title: '[${{ matrix.branches }}] ci(actions): Update workflow templates from organization template repository'
-+          draft: ${{ steps.sync.outputs.patch_failed == 'true' }}
 -          draft: ${{ env.DRAFT_ONLY == 1 }}
++          draft: ${{ steps.sync.outputs.patch_failed == 'true' }}
            add-paths: .github/workflows/*.yml,.github/actions-lock.txt
            body: |
-+            Automated update of workflow templates from [LibreCodeCoop/.github](https://github.com/LibreCodeCoop/.github)
-+            ${{ steps.sync.outputs.summary }}
 -            Automated update of all workflow templates from [nextcloud/.github](https://github.com/nextcloud/.github)
 -            ${{ env.SUMMARY }}
++            Automated update of workflow templates from [LibreCodeCoop/.github](https://github.com/LibreCodeCoop/.github)
++            ${{ steps.sync.outputs.summary }}
            labels: |
              dependencies
              3. to review

From 03599555fcd0262888d62cf6da2b6fc21aaa94b7 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Date: Mon, 19 Oct 2026 19:28:55 +0000
Subject: [PATCH 3/4] refactor: minimize downstream patch churn after upstream
 refresh

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
---
 .../appstore-build-publish.yml.patch          | 82 ++++++++++++-------
 .../sync-workflow-templates.yml.patch         | 49 ++++++-----
 2 files changed, 75 insertions(+), 56 deletions(-)

diff --git a/patches/nextcloud/appstore-build-publish.yml.patch b/patches/nextcloud/appstore-build-publish.yml.patch
index 261b9e3..4cbc043 100644
--- a/patches/nextcloud/appstore-build-publish.yml.patch
+++ b/patches/nextcloud/appstore-build-publish.yml.patch
@@ -1,44 +1,34 @@
 --- upstream/vendor/nextcloud/appstore-build-publish.yml
 +++ workflow-templates/appstore-build-publish.yml
-@@ -1,9 +1,9 @@
- # This workflow is provided via the organization template repository
- #
+@@ -1,200 +1,36 @@
+-# This workflow is provided via the organization template repository
+-#
 -# https://github.com/nextcloud/.github
-+# https://github.com/LibreCodeCoop/.github
- # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
- #
+-# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
+-#
 -# SPDX-FileCopyrightText: 2021-2024 Nextcloud GmbH and Nextcloud contributors
-+# SPDX-FileCopyrightText: 2021-2026 Nextcloud GmbH, LibreCode coop and contributors
- # SPDX-License-Identifier: MIT
- 
- name: Build and publish app release
-@@ -11,6 +11,12 @@
- on:
-   release:
-     types: [published]
-+  workflow_dispatch:
-+    inputs:
-+      release_tag:
-+        description: Existing release tag to build and publish.
-+        required: true
-+        type: string
- 
- permissions:
-   contents: write
-@@ -18,183 +24,13 @@
- jobs:
-   build_and_publish:
-     runs-on: ubuntu-latest
+-# SPDX-License-Identifier: MIT
+-
+-name: Build and publish app release
+-
+-on:
+-  release:
+-    types: [published]
+-
+-permissions:
+-  contents: write
+-
+-jobs:
+-  build_and_publish:
+-    runs-on: ubuntu-latest
 -
 -    # Only allowed to be run on nextcloud-releases repositories
 -    if: ${{ github.repository_owner == 'nextcloud-releases' }}
 -
-     steps:
+-    steps:
 -      - name: Check actor permission
 -        uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0
-+      - name: Build and publish release
-+        uses: LibreCodeCoop/.github/actions/nextcloud-appstore-publish@600b84354bdbb2da4fc32e9d4eecac1fcce60666
-         with:
+-        with:
 -          require: write
 -
 -      - name: Set app env
@@ -211,6 +201,36 @@
 -          appstore_token: ${{ secrets.APPSTORE_TOKEN }}
 -          download_url: ${{ steps.attach_to_release.outputs.browser_download_url }}
 -          app_private_key: ${{ secrets.APP_PRIVATE_KEY }}
++# This workflow is provided via the organization template repository
++#
++# https://github.com/LibreCodeCoop/.github
++# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
++#
++# SPDX-FileCopyrightText: 2021-2026 Nextcloud GmbH, LibreCode coop and contributors
++# SPDX-License-Identifier: MIT
++
++name: Build and publish app release
++
++on:
++  release:
++    types: [published]
++  workflow_dispatch:
++    inputs:
++      release_tag:
++        description: Existing release tag to build and publish.
++        required: true
++        type: string
++
++permissions:
++  contents: write
++
++jobs:
++  build_and_publish:
++    runs-on: ubuntu-latest
++    steps:
++      - name: Build and publish release
++        uses: LibreCodeCoop/.github/actions/nextcloud-appstore-publish@600b84354bdbb2da4fc32e9d4eecac1fcce60666
++        with:
 +          app-name: ${{ github.event.repository.name }}
 +          release-tag: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.event.release.tag_name }}
 +          github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/patches/nextcloud/sync-workflow-templates.yml.patch b/patches/nextcloud/sync-workflow-templates.yml.patch
index 970fb24..a2d494b 100644
--- a/patches/nextcloud/sync-workflow-templates.yml.patch
+++ b/patches/nextcloud/sync-workflow-templates.yml.patch
@@ -1,31 +1,30 @@
 --- upstream/vendor/nextcloud/sync-workflow-templates.yml
 +++ workflow-templates/sync-workflow-templates.yml
-@@ -1,18 +1,21 @@
+@@ -1,13 +1,16 @@
  # This workflow is provided via the organization template repository
  #
--# https://github.com/nextcloud/.github
 +# https://github.com/LibreCodeCoop/.github
+-# https://github.com/nextcloud/.github
  # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
  #
  # SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
  # SPDX-License-Identifier: MIT
  
--# This workflow will update all workflow templates
--# Additionally it will reapply `workflow.yml.patch` files after syncing and only then commit the result
 +# This workflow will update all workflow templates.
 +# Additionally it will reapply workflow.yml.patch files after syncing and only then commit the result.
 +#
 +# Authentication is selected explicitly with vars.WORKFLOW_SYNC_AUTH_MODE.
 +# See docs/cross-repository-automation.md for modes, credentials and GITHUB_TOKEN limitations.
+-# This workflow will update all workflow templates
+-# Additionally it will reapply `workflow.yml.patch` files after syncing and only then commit the result
  name: Update workflows
  on:
    workflow_dispatch:
+@@ -14,3 +17,3 @@
    schedule:
 -      - cron: "45 22 * * 6"
 +      - cron: "5 2 * * 0"
  
- permissions:
-   contents: read
 @@ -26,9 +29,6 @@
        matrix:
          branches:
@@ -40,7 +39,6 @@
  
      steps:
        - name: Check actor permission
--        uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0
 +        if: ${{ github.event_name == 'workflow_dispatch' }}
 +        shell: bash
 +        env:
@@ -96,8 +94,7 @@
 +        if: ${{ vars.WORKFLOW_SYNC_AUTH_MODE == '' || vars.WORKFLOW_SYNC_AUTH_MODE == 'librecode-app' }}
 +        id: librecode-app-token
 +        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-         with:
--          require: admin
++        with:
 +          client-id: ${{ vars.LIBRECODE_WORKFLOW_APP_CLIENT_ID }}
 +          private-key: ${{ secrets.LIBRECODE_WORKFLOW_APP_PRIVATE_KEY }}
 +          owner: ${{ github.repository_owner }}
@@ -110,7 +107,8 @@
 +        if: ${{ vars.WORKFLOW_SYNC_AUTH_MODE == 'github-app' }}
 +        id: consumer-app-token
 +        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-+        with:
+-        uses: skjnldsv/check-actor-permission@69e92a3c4711150929bca9fcf34448c5bf5526e7 # v3.0
+         with:
 +          client-id: ${{ vars.WORKFLOW_SYNC_APP_CLIENT_ID }}
 +          private-key: ${{ secrets.WORKFLOW_SYNC_APP_PRIVATE_KEY }}
 +          owner: ${{ github.repository_owner }}
@@ -146,13 +144,13 @@
 +
 +          echo "::add-mask::${token}"
 +          echo "token=${token}" >> "${GITHUB_OUTPUT}"
+-          require: admin
  
        - name: Checkout workflow repository
          uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
          with:
            persist-credentials: false
            path: source
--          repository: nextcloud/.github
 +          repository: LibreCodeCoop/.github
 +
 +      - name: Record workflow catalog revision
@@ -160,6 +158,7 @@
 +        working-directory: source
 +        shell: bash
 +        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+-          repository: nextcloud/.github
  
        - name: Checkout app
          uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -191,6 +190,13 @@
 -          fi
 -          rm version.php
 -
++      - name: Synchronize workflow templates
++        id: sync
++        uses: ./source/actions/sync-workflows
++        with:
++          source: source/workflow-templates
++          target: target
++          catalog-commit: ${{ steps.catalog-revision.outputs.sha }}
 -      - name: Copy all workflow templates
 -        if: steps.freeze.outputs.active != 'true'
 -        run: |
@@ -201,7 +207,7 @@
 -            if [ -f "$workflow" ]; then
 -              filename=$(basename "$workflow")
 -              target_file="./target/.github/workflows/$filename"
--
+ 
 -              # Only copy if the file exists in the target repository
 -              if [ -f "$target_file" ]; then
 -                if [ -f "./target/.github/actions-lock.txt" ]; then
@@ -255,37 +261,30 @@
 -          done
 -          echo 'EOF' >> $GITHUB_ENV
 -          echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV
-+      - name: Synchronize workflow templates
-+        id: sync
-+        uses: ./source/actions/sync-workflows
-+        with:
-+          source: source/workflow-templates
-+          target: target
-+          catalog-commit: ${{ steps.catalog-revision.outputs.sha }}
- 
+-
        - name: Create Pull Request
 -        if: steps.freeze.outputs.active != 'true'
 +        if: ${{ steps.sync.outputs.changed == 'true' }}
          uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
          with:
--          token: ${{ secrets.COMMAND_BOT_WORKFLOWS }}
 +          token: ${{ steps.auth-token.outputs.token }}
+-          token: ${{ secrets.COMMAND_BOT_WORKFLOWS }}
            commit-message: 'ci(actions): Update workflow templates from organization template repository'
            committer: GitHub <noreply@github.com>
--          author: nextcloud-command <nextcloud-command@users.noreply.github.com>
 +          author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
+-          author: nextcloud-command <nextcloud-command@users.noreply.github.com>
            path: target
            signoff: true
            branch: 'automated/noid/${{ matrix.branches }}-update-workflows'
            title: '[${{ matrix.branches }}] ci(actions): Update workflow templates from organization template repository'
--          draft: ${{ env.DRAFT_ONLY == 1 }}
 +          draft: ${{ steps.sync.outputs.patch_failed == 'true' }}
+-          draft: ${{ env.DRAFT_ONLY == 1 }}
            add-paths: .github/workflows/*.yml,.github/actions-lock.txt
            body: |
--            Automated update of all workflow templates from [nextcloud/.github](https://github.com/nextcloud/.github)
--            ${{ env.SUMMARY }}
 +            Automated update of workflow templates from [LibreCodeCoop/.github](https://github.com/LibreCodeCoop/.github)
 +            ${{ steps.sync.outputs.summary }}
+-            Automated update of all workflow templates from [nextcloud/.github](https://github.com/nextcloud/.github)
+-            ${{ env.SUMMARY }}
            labels: |
              dependencies
              3. to review

From 33c7163603845395774b811d9008604d6366fcb6 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Date: Mon, 19 Oct 2026 19:29:06 +0000
Subject: [PATCH 4/4] fix: preserve Node and npm fallbacks in refreshed
 workflows

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
---
 .../node-npm-engine-defaults.yml.patch        | 16 +++++++++++
 patches/nextcloud/openapi.yml.patch           | 16 +++++++++++
 tests/test_render_upstream.py                 | 27 +++++++++++++++++++
 upstream/templates.json                       | 15 +++++++----
 workflow-templates/lint-eslint.yml            |  6 +++--
 workflow-templates/lint-stylelint.yml         |  6 +++--
 workflow-templates/lint-typescript.yml        |  6 +++--
 workflow-templates/node-test.yml              |  6 +++--
 workflow-templates/npm-build.yml              |  6 +++--
 workflow-templates/openapi.yml                |  6 +++--
 10 files changed, 93 insertions(+), 17 deletions(-)
 create mode 100644 patches/nextcloud/node-npm-engine-defaults.yml.patch

diff --git a/patches/nextcloud/node-npm-engine-defaults.yml.patch b/patches/nextcloud/node-npm-engine-defaults.yml.patch
new file mode 100644
index 0000000..42f0387
--- /dev/null
+++ b/patches/nextcloud/node-npm-engine-defaults.yml.patch
@@ -0,0 +1,16 @@
+# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+--- upstream/vendor/nextcloud/workflow.yml
++++ workflow-templates/workflow.yml
+@@ -69,6 +69,8 @@
+         with:
+-          node-version: ${{ steps.versions.outputs.node-version }}
++          node-version: ${{ steps.versions.outputs.node-version || '^24' }}
+ 
+       - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
+-        run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
++        env:
++          NPM_VERSION: ${{ steps.versions.outputs.package-manager-name == 'npm' && steps.versions.outputs.package-manager-version || '^11.3' }}
++        run: npm i -g "npm@${NPM_VERSION}"
+ 
diff --git a/patches/nextcloud/openapi.yml.patch b/patches/nextcloud/openapi.yml.patch
index 2fb3ad6..7011a98 100644
--- a/patches/nextcloud/openapi.yml.patch
+++ b/patches/nextcloud/openapi.yml.patch
@@ -8,3 +8,19 @@
  # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
  #
  # SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+@@ -61,11 +61,13 @@
+         if: ${{ steps.node_versions.outcome == 'success' }}
+         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+         with:
+-          node-version: ${{ steps.node_versions.outputs.node-version }}
++          node-version: ${{ steps.node_versions.outputs.node-version || '^24' }}
+ 
+       - name: Set up npm ${{ steps.node_versions.outputs.package-manager-version }}
+         if: ${{ steps.node_versions.outcome == 'success' }}
+-        run: npm i -g 'npm@${{ steps.node_versions.outputs.package-manager-version }}'
++        env:
++          NPM_VERSION: ${{ steps.node_versions.outputs.package-manager-name == 'npm' && steps.node_versions.outputs.package-manager-version || '^11.3' }}
++        run: npm i -g "npm@${NPM_VERSION}"
+ 
+       - name: Install dependencies
+         if: ${{ steps.node_versions.outcome == 'success' }}
diff --git a/tests/test_render_upstream.py b/tests/test_render_upstream.py
index 50c179e..f34b7bf 100644
--- a/tests/test_render_upstream.py
+++ b/tests/test_render_upstream.py
@@ -269,6 +269,33 @@ def test_rejects_unsafe_paths(self) -> None:
             with self.assertRaisesRegex(ValueError, "unsafe path"):
                 load_templates(manifest)
 
+    def test_node_npm_workflows_preserve_fallbacks(self) -> None:
+        root = Path(__file__).resolve().parents[1]
+        managed = [
+            ("lint-eslint", "versions"),
+            ("lint-stylelint", "versions"),
+            ("lint-typescript", "versions"),
+            ("node-test", "versions"),
+            ("npm-build", "versions"),
+            ("openapi", "node_versions"),
+        ]
+        for name, step in managed:
+            with self.subTest(workflow=name):
+                content = (root / f"workflow-templates/{name}.yml").read_text()
+                self.assertIn(
+                    f"node-version: ${{{{ steps.{step}.outputs.node-version || '^24' }}}}",
+                    content,
+                )
+                self.assertIn(
+                    f"NPM_VERSION: ${{{{ steps.{step}.outputs.package-manager-name == 'npm' && steps.{step}.outputs.package-manager-version || '^11.3' }}}}",
+                    content,
+                )
+                self.assertIn('run: npm i -g "npm@${NPM_VERSION}"', content)
+                self.assertNotIn(
+                    f"npm@${{{{ steps.{step}.outputs.package-manager-version }}}}'",
+                    content,
+                )
+
     def test_render_pull_request_body_for_successful_report(self) -> None:
         body = render_pull_request_body(
             {
diff --git a/upstream/templates.json b/upstream/templates.json
index db9334b..7c2d108 100644
--- a/upstream/templates.json
+++ b/upstream/templates.json
@@ -20,7 +20,8 @@
       "name": "nextcloud-lint-eslint",
       "source": "upstream/vendor/nextcloud/lint-eslint.yml",
       "patches": [
-        "patches/nextcloud/lint-eslint.yml.patch"
+        "patches/nextcloud/lint-eslint.yml.patch",
+        "patches/nextcloud/node-npm-engine-defaults.yml.patch"
       ],
       "destination": "workflow-templates/lint-eslint.yml"
     },
@@ -52,7 +53,8 @@
       "name": "nextcloud-lint-stylelint",
       "source": "upstream/vendor/nextcloud/lint-stylelint.yml",
       "patches": [
-        "patches/nextcloud/lint-stylelint.yml.patch"
+        "patches/nextcloud/lint-stylelint.yml.patch",
+        "patches/nextcloud/node-npm-engine-defaults.yml.patch"
       ],
       "destination": "workflow-templates/lint-stylelint.yml"
     },
@@ -60,7 +62,8 @@
       "name": "nextcloud-lint-typescript",
       "source": "upstream/vendor/nextcloud/lint-typescript.yml",
       "patches": [
-        "patches/nextcloud/lint-typescript.yml.patch"
+        "patches/nextcloud/lint-typescript.yml.patch",
+        "patches/nextcloud/node-npm-engine-defaults.yml.patch"
       ],
       "destination": "workflow-templates/lint-typescript.yml"
     },
@@ -68,7 +71,8 @@
       "name": "nextcloud-node-test",
       "source": "upstream/vendor/nextcloud/node-test.yml",
       "patches": [
-        "patches/nextcloud/node-test.yml.patch"
+        "patches/nextcloud/node-test.yml.patch",
+        "patches/nextcloud/node-npm-engine-defaults.yml.patch"
       ],
       "destination": "workflow-templates/node-test.yml"
     },
@@ -76,7 +80,8 @@
       "name": "nextcloud-npm-build",
       "source": "upstream/vendor/nextcloud/npm-build.yml",
       "patches": [
-        "patches/nextcloud/npm-build.yml.patch"
+        "patches/nextcloud/npm-build.yml.patch",
+        "patches/nextcloud/node-npm-engine-defaults.yml.patch"
       ],
       "destination": "workflow-templates/npm-build.yml"
     },
diff --git a/workflow-templates/lint-eslint.yml b/workflow-templates/lint-eslint.yml
index 5123d67..e28ecbb 100644
--- a/workflow-templates/lint-eslint.yml
+++ b/workflow-templates/lint-eslint.yml
@@ -67,10 +67,12 @@ jobs:
       - name: Set up node ${{ steps.versions.outputs.node-version }}
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ steps.versions.outputs.node-version }}
+          node-version: ${{ steps.versions.outputs.node-version || '^24' }}
 
       - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
-        run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
+        env:
+          NPM_VERSION: ${{ steps.versions.outputs.package-manager-name == 'npm' && steps.versions.outputs.package-manager-version || '^11.3' }}
+        run: npm i -g "npm@${NPM_VERSION}"
 
       - name: Install dependencies
         env:
diff --git a/workflow-templates/lint-stylelint.yml b/workflow-templates/lint-stylelint.yml
index 46e0dcf..e082e53 100644
--- a/workflow-templates/lint-stylelint.yml
+++ b/workflow-templates/lint-stylelint.yml
@@ -36,10 +36,12 @@ jobs:
       - name: Set up node ${{ steps.versions.outputs.node-version }}
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ steps.versions.outputs.node-version }}
+          node-version: ${{ steps.versions.outputs.node-version || '^24' }}
 
       - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
-        run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
+        env:
+          NPM_VERSION: ${{ steps.versions.outputs.package-manager-name == 'npm' && steps.versions.outputs.package-manager-version || '^11.3' }}
+        run: npm i -g "npm@${NPM_VERSION}"
 
       - name: Install dependencies
         env:
diff --git a/workflow-templates/lint-typescript.yml b/workflow-templates/lint-typescript.yml
index 9f23c43..11bea41 100644
--- a/workflow-templates/lint-typescript.yml
+++ b/workflow-templates/lint-typescript.yml
@@ -66,10 +66,12 @@ jobs:
       - name: Set up node ${{ steps.versions.outputs.node-version }}
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ steps.versions.outputs.node-version }}
+          node-version: ${{ steps.versions.outputs.node-version || '^24' }}
 
       - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
-        run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
+        env:
+          NPM_VERSION: ${{ steps.versions.outputs.package-manager-name == 'npm' && steps.versions.outputs.package-manager-version || '^11.3' }}
+        run: npm i -g "npm@${NPM_VERSION}"
 
       - name: Install dependencies
         env:
diff --git a/workflow-templates/node-test.yml b/workflow-templates/node-test.yml
index 0a69971..55c06a6 100644
--- a/workflow-templates/node-test.yml
+++ b/workflow-templates/node-test.yml
@@ -71,10 +71,12 @@ jobs:
       - name: Set up node ${{ steps.versions.outputs.node-version }}
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ steps.versions.outputs.node-version }}
+          node-version: ${{ steps.versions.outputs.node-version || '^24' }}
 
       - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
-        run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
+        env:
+          NPM_VERSION: ${{ steps.versions.outputs.package-manager-name == 'npm' && steps.versions.outputs.package-manager-version || '^11.3' }}
+        run: npm i -g "npm@${NPM_VERSION}"
 
       - name: Install dependencies & build
         env:
diff --git a/workflow-templates/npm-build.yml b/workflow-templates/npm-build.yml
index 3ee0a85..ef4ce9b 100644
--- a/workflow-templates/npm-build.yml
+++ b/workflow-templates/npm-build.yml
@@ -64,10 +64,12 @@ jobs:
       - name: Set up node ${{ steps.versions.outputs.node-version }}
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ steps.versions.outputs.node-version }}
+          node-version: ${{ steps.versions.outputs.node-version || '^24' }}
 
       - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
-        run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
+        env:
+          NPM_VERSION: ${{ steps.versions.outputs.package-manager-name == 'npm' && steps.versions.outputs.package-manager-version || '^11.3' }}
+        run: npm i -g "npm@${NPM_VERSION}"
 
       - name: Validate package-lock.json # See https://github.com/npm/cli/issues/4460
         run: |
diff --git a/workflow-templates/openapi.yml b/workflow-templates/openapi.yml
index bc19b40..7324b16 100644
--- a/workflow-templates/openapi.yml
+++ b/workflow-templates/openapi.yml
@@ -61,11 +61,13 @@ jobs:
         if: ${{ steps.node_versions.outcome == 'success' }}
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ steps.node_versions.outputs.node-version }}
+          node-version: ${{ steps.node_versions.outputs.node-version || '^24' }}
 
       - name: Set up npm ${{ steps.node_versions.outputs.package-manager-version }}
         if: ${{ steps.node_versions.outcome == 'success' }}
-        run: npm i -g 'npm@${{ steps.node_versions.outputs.package-manager-version }}'
+        env:
+          NPM_VERSION: ${{ steps.node_versions.outputs.package-manager-name == 'npm' && steps.node_versions.outputs.package-manager-version || '^11.3' }}
+        run: npm i -g "npm@${NPM_VERSION}"
 
       - name: Install dependencies
         if: ${{ steps.node_versions.outcome == 'success' }}