chore: refresh upstream workflows

patches/nextcloud/appstore-build-publish.yml.patch

@@ -1,6 +1,6 @@
 --- upstream/vendor/nextcloud/appstore-build-publish.yml
 +++ workflow-templates/appstore-build-publish.yml
-@@ -1,202 +1,36 @@
+@@ -1,200 +1,36 @@
 -# This workflow is provided via the organization template repository
 -#
 -# https://github.com/nextcloud/.github
@@ -62,27 +62,25 @@
 -          expression: "//info//dependencies//nextcloud/@min-version"
 -
 -      - name: Read package.json node and npm engines version
--        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
+-        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
 -        id: versions
 -        # Continue if no package.json
 -        continue-on-error: true
 -        with:
--          path: ${{ env.APP_NAME }}
--          fallbackNode: '^24'
--          fallbackNpm: '^11.3'
+-          path: ${{ env.APP_NAME }}/package.json
 -
--      - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
+-      - name: Set up node ${{ steps.versions.outputs.node-version }}
 -        # Skip if no package.json
--        if: ${{ steps.versions.outputs.nodeVersion }}
--        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+-        if: ${{ steps.versions.outcome == 'success' }}
+-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
 -        with:
--          node-version: ${{ steps.versions.outputs.nodeVersion }}
+-          node-version: ${{ steps.versions.outputs.node-version }}
 -          package-manager-cache: false
 -
--      - name: Set up npm ${{ steps.versions.outputs.npmVersion }}
+-      - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
 -        # Skip if no package.json
--        if: ${{ steps.versions.outputs.npmVersion }}
--        run: npm i -g 'npm@${{ steps.versions.outputs.npmVersion }}'
+-        if: ${{ steps.versions.outcome == 'success' }}
+-        run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
 -
 -      - name: Get php version
 -        id: php-versions
@@ -91,7 +89,7 @@
 -          filename: ${{ env.APP_NAME }}/appinfo/info.xml
 -
 -      - name: Set up php ${{ steps.php-versions.outputs.php-min }}
--        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+-        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
 -        with:
 -          php-version: ${{ steps.php-versions.outputs.php-min }}
 -          coverage: none
@@ -114,7 +112,7 @@
 -
 -      - name: Build ${{ env.APP_NAME }}
 -        # Skip if no package.json
--        if: ${{ steps.versions.outputs.nodeVersion }}
+-        if: ${{ steps.versions.outcome == 'success' }}
 -        env:
 -          CYPRESS_INSTALL_BINARY: 0
 -        run: |
@@ -231,7 +229,7 @@
 +    runs-on: ubuntu-latest
 +    steps:
 +      - name: Build and publish release
-+        uses: LibreCodeCoop/.github/actions/nextcloud-appstore-publish@748b0416ea5b734292671dd0feec33aaf8ec6b82
++        uses: LibreCodeCoop/.github/actions/nextcloud-appstore-publish@600b84354bdbb2da4fc32e9d4eecac1fcce60666
 +        with:
 +          app-name: ${{ github.event.repository.name }}
 +          release-tag: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.event.release.tag_name }}

patches/nextcloud/node-npm-engine-defaults.yml.patch

@@ -0,0 +1,16 @@
+# SPDX-FileCopyrightText: 2026 LibreCode coop and contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+--- upstream/vendor/nextcloud/workflow.yml
++++ workflow-templates/workflow.yml
+@@ -69,6 +69,8 @@
+         with:
+-          node-version: ${{ steps.versions.outputs.node-version }}
++          node-version: ${{ steps.versions.outputs.node-version || '^24' }}
+
+       - name: Set up npm ${{ steps.versions.outputs.package-manager-version }}
+-        run: npm i -g 'npm@${{ steps.versions.outputs.package-manager-version }}'
++        env:
++          NPM_VERSION: ${{ steps.versions.outputs.package-manager-name == 'npm' && steps.versions.outputs.package-manager-version || '^11.3' }}
++        run: npm i -g "npm@${NPM_VERSION}"
+

patches/nextcloud/openapi.yml.patch

@@ -8,3 +8,19 @@
  # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
  #
  # SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+@@ -61,11 +61,13 @@
+         if: ${{ steps.node_versions.outcome == 'success' }}
+         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+         with:
+-          node-version: ${{ steps.node_versions.outputs.node-version }}
++          node-version: ${{ steps.node_versions.outputs.node-version || '^24' }}
+
+       - name: Set up npm ${{ steps.node_versions.outputs.package-manager-version }}
+         if: ${{ steps.node_versions.outcome == 'success' }}
+-        run: npm i -g 'npm@${{ steps.node_versions.outputs.package-manager-version }}'
++        env:
++          NPM_VERSION: ${{ steps.node_versions.outputs.package-manager-name == 'npm' && steps.node_versions.outputs.package-manager-version || '^11.3' }}
++        run: npm i -g "npm@${NPM_VERSION}"
+
+       - name: Install dependencies
+         if: ${{ steps.node_versions.outcome == 'success' }}

patches/nextcloud/sync-workflow-templates.yml.patch

@@ -20,6 +20,11 @@
  name: Update workflows
  on:
    workflow_dispatch:
+@@ -14,3 +17,3 @@
+   schedule:
+-      - cron: "45 22 * * 6"
++      - cron: "5 2 * * 0"
+
 @@ -26,9 +29,6 @@
        matrix:
          branches:
@@ -157,10 +162,34 @@
 
        - name: Checkout app
          uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-@@ -56,86 +163,31 @@
+@@ -56,112 +163,31 @@
            path: target
            ref: ${{ matrix.branches }}
 
+-      - name: Check for active merge freeze
+-        id: freeze
+-        env:
+-          BRANCH_NAME: ${{ matrix.branches }}
+-        run: |
+-          if [[ ! -f target/.github/workflows/block-merge-freeze.yml ]]; then
+-            echo 'No block-merge-freeze workflow, continuing'
+-            exit 0
+-          fi
+-          if [[ "$BRANCH_NAME" == 'main' || "$BRANCH_NAME" == 'master' ]]; then
+-            SERVER_REF='master'
+-          elif [[ "$BRANCH_NAME" =~ ^stable[0-9]+$ ]]; then
+-            SERVER_REF="$BRANCH_NAME"
+-          else
+-            echo 'Not based on master/main/stable*, so skipping freeze check'
+-            exit 0
+-          fi
+-          curl -sf "https://raw.githubusercontent.com/nextcloud/server/$SERVER_REF/version.php" --output version.php
+-          if grep 'OC_VersionString' version.php | grep -q -i -E '(\.0\.0 RC[3-9]|\.[1-9][0-9]* RC)'; then
+-            echo "Merge freeze is active for $SERVER_REF, skipping"
+-            echo 'active=true' >> $GITHUB_OUTPUT
+-          fi
+-          rm version.php
+-
 +      - name: Synchronize workflow templates
 +        id: sync
 +        uses: ./source/actions/sync-workflows
@@ -169,6 +198,7 @@
 +          target: target
 +          catalog-commit: ${{ steps.catalog-revision.outputs.sha }}
 -      - name: Copy all workflow templates
+-        if: steps.freeze.outputs.active != 'true'
 -        run: |
 -          echo 'SUMMARY<<EOF' >> $GITHUB_ENV
 -          draft_only=0
@@ -233,6 +263,7 @@
 -          echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV
 -
        - name: Create Pull Request
+-        if: steps.freeze.outputs.active != 'true'
 +        if: ${{ steps.sync.outputs.changed == 'true' }}
          uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
          with:

tests/test_render_upstream.py

@@ -269,6 +269,33 @@ def test_rejects_unsafe_paths(self) -> None:
             with self.assertRaisesRegex(ValueError, "unsafe path"):
                 load_templates(manifest)
 
+    def test_node_npm_workflows_preserve_fallbacks(self) -> None:
+        root = Path(__file__).resolve().parents[1]
+        managed = [
+            ("lint-eslint", "versions"),
+            ("lint-stylelint", "versions"),
+            ("lint-typescript", "versions"),
+            ("node-test", "versions"),
+            ("npm-build", "versions"),
+            ("openapi", "node_versions"),
+        ]
+        for name, step in managed:
+            with self.subTest(workflow=name):
+                content = (root / f"workflow-templates/{name}.yml").read_text()
+                self.assertIn(
+                    f"node-version: ${{{{ steps.{step}.outputs.node-version || '^24' }}}}",
+                    content,
+                )
+                self.assertIn(
+                    f"NPM_VERSION: ${{{{ steps.{step}.outputs.package-manager-name == 'npm' && steps.{step}.outputs.package-manager-version || '^11.3' }}}}",
+                    content,
+                )
+                self.assertIn('run: npm i -g "npm@${NPM_VERSION}"', content)
+                self.assertNotIn(
+                    f"npm@${{{{ steps.{step}.outputs.package-manager-version }}}}'",
+                    content,
+                )
+
     def test_render_pull_request_body_for_successful_report(self) -> None:
         body = render_pull_request_body(
             {

upstream/sources.json

@@ -5,8 +5,8 @@
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/appstore-build-publish.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/42804704e35b4f28500f135e60f9c7a0a5c6c07a/workflow-templates/appstore-build-publish.yml",
-      "sha256": "c1838915d6f48072f8594d04e908a1eea0cf100c542c917f2f16143d734a7d11",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/be42c5d25f81f94fba5756aa27778851d0c063b4/workflow-templates/appstore-build-publish.yml",
+      "sha256": "7342c22d491c6095a50aff20d81d4ebc7e289b6159a7eac63d21ecdaa4bd5bb8",
       "destination": "upstream/vendor/nextcloud/appstore-build-publish.yml"
     },
     {
@@ -23,8 +23,8 @@
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/lint-eslint.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/42804704e35b4f28500f135e60f9c7a0a5c6c07a/workflow-templates/lint-eslint.yml",
-      "sha256": "6ebe1e660ea68ac490c51bab8bcbb35109f9037096d53089a636db5eab4d63f6",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/e9c3f34e252af7ae3fadd238d80ea9fd51c991fd/workflow-templates/lint-eslint.yml",
+      "sha256": "860792cea5bcfe36aab444f3037e79088ba7837cc15a4d31ca076e7c21e052e5",
       "destination": "upstream/vendor/nextcloud/lint-eslint.yml"
     },
     {
@@ -41,71 +41,71 @@
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/lint-php.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/fb5f5adee71c8c62b76ec2fb9499261233a5ff6a/workflow-templates/lint-php.yml",
-      "sha256": "cdf80971a01d51a42cbcf4e0326e3830fa3613b0072b322d5277ba310873dd4b",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/be42c5d25f81f94fba5756aa27778851d0c063b4/workflow-templates/lint-php.yml",
+      "sha256": "b241d8c3bff49b7e0bb9e396acbe442f09a42cd6b22bd3aa97c39830f8821648",
       "destination": "upstream/vendor/nextcloud/lint-php.yml"
     },
     {
       "name": "nextcloud-lint-php-cs",
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/lint-php-cs.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/fb5f5adee71c8c62b76ec2fb9499261233a5ff6a/workflow-templates/lint-php-cs.yml",
-      "sha256": "e6047b215571aa2746bd3d2786a14b3e0122fc34e70755a29ff573bb21e1672c",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/be42c5d25f81f94fba5756aa27778851d0c063b4/workflow-templates/lint-php-cs.yml",
+      "sha256": "b4629d23fddb88b395063d208afb2d21bdfa57ce00804018ae41ea208eef1bcd",
       "destination": "upstream/vendor/nextcloud/lint-php-cs.yml"
     },
     {
       "name": "nextcloud-lint-stylelint",
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/lint-stylelint.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/42804704e35b4f28500f135e60f9c7a0a5c6c07a/workflow-templates/lint-stylelint.yml",
-      "sha256": "58667560a500d7f0b472f71897768a230bbba20628aba91f59a0888067ff025d",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/e9c3f34e252af7ae3fadd238d80ea9fd51c991fd/workflow-templates/lint-stylelint.yml",
+      "sha256": "73b15c6d0aeebc9dc96ecbbe373bafd486192fa94746742da0b72fdd50d8a8ba",
       "destination": "upstream/vendor/nextcloud/lint-stylelint.yml"
     },
     {
       "name": "nextcloud-lint-typescript",
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/lint-typescript.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/42804704e35b4f28500f135e60f9c7a0a5c6c07a/workflow-templates/lint-typescript.yml",
-      "sha256": "6711f3e18f9c08a8d8f3de851b565846293c5e91eb49d96a11ed8611975ac0b1",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/e9c3f34e252af7ae3fadd238d80ea9fd51c991fd/workflow-templates/lint-typescript.yml",
+      "sha256": "d6a2b673e397e757b352809fe4317bd037d5765b65e6a617fbb23a0891f321e9",
       "destination": "upstream/vendor/nextcloud/lint-typescript.yml"
     },
     {
       "name": "nextcloud-node-test",
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/node-test.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/42804704e35b4f28500f135e60f9c7a0a5c6c07a/workflow-templates/node-test.yml",
-      "sha256": "850616dd6832bb4dfffa31485c517c64ba6a4a1be0caa94fa36778d9407f1abc",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/e9c3f34e252af7ae3fadd238d80ea9fd51c991fd/workflow-templates/node-test.yml",
+      "sha256": "aabdfd85a80862e02ba9db27810c6b65c16b8d8649c29ba51198a534669cea00",
       "destination": "upstream/vendor/nextcloud/node-test.yml"
     },
     {
       "name": "nextcloud-npm-build",
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/npm-build.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/42804704e35b4f28500f135e60f9c7a0a5c6c07a/workflow-templates/npm-build.yml",
-      "sha256": "fd6f721910d9ee1283570d17b674e140fd91cfdc7c1f06f4339ca5b1dc144121",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/e9c3f34e252af7ae3fadd238d80ea9fd51c991fd/workflow-templates/npm-build.yml",
+      "sha256": "890084d4d7927051b67d0c25e89181b2cdc862b455564e84fccab917807456d9",
       "destination": "upstream/vendor/nextcloud/npm-build.yml"
     },
     {
       "name": "nextcloud-openapi",
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/openapi.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/42804704e35b4f28500f135e60f9c7a0a5c6c07a/workflow-templates/openapi.yml",
-      "sha256": "1657c25052aefa493b0ebffbb798c88ba07ecafdb8d47ca84331bfbdd65264c4",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/be42c5d25f81f94fba5756aa27778851d0c063b4/workflow-templates/openapi.yml",
+      "sha256": "57e3c50be49bf2dad1da4700b49931c65e69bded1786c276a7df1204ff3c4d79",
       "destination": "upstream/vendor/nextcloud/openapi.yml"
     },
     {
       "name": "nextcloud-psalm",
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/psalm.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/fb5f5adee71c8c62b76ec2fb9499261233a5ff6a/workflow-templates/psalm.yml",
-      "sha256": "02d1db3a1549f5fa933b7157fc1a18d4b4593b35745a1f18be3f49e6e0499bd8",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/be42c5d25f81f94fba5756aa27778851d0c063b4/workflow-templates/psalm.yml",
+      "sha256": "9455962a22c7e0a7b5aa37f037d4898b76968d4fcbf88afa720466def9566c08",
       "destination": "upstream/vendor/nextcloud/psalm.yml"
     },
     {
@@ -122,8 +122,8 @@
       "repository": "nextcloud/.github",
       "ref": "master",
       "path": "workflow-templates/sync-workflow-templates.yml",
-      "url": "https://raw.githubusercontent.com/nextcloud/.github/e137952600ed786d2dfd1bf928fadf92d295483c/workflow-templates/sync-workflow-templates.yml",
-      "sha256": "b1a49a5dbc35ca40a1485bed5f84ef042c6c738f5c81cb229035f24fd6dc0cf0",
+      "url": "https://raw.githubusercontent.com/nextcloud/.github/593089b25a456dc70dc66eb09efb35de69a5f621/workflow-templates/sync-workflow-templates.yml",
+      "sha256": "afeb694de2555c139e5fdfbbbe8e6af32ab609ba7eee2d32cc894872a6a3ac7d",
       "destination": "upstream/vendor/nextcloud/sync-workflow-templates.yml"
     }
   ]

upstream/templates.json

@@ -20,7 +20,8 @@
       "name": "nextcloud-lint-eslint",
       "source": "upstream/vendor/nextcloud/lint-eslint.yml",
       "patches": [
-        "patches/nextcloud/lint-eslint.yml.patch"
+        "patches/nextcloud/lint-eslint.yml.patch",
+        "patches/nextcloud/node-npm-engine-defaults.yml.patch"
       ],
       "destination": "workflow-templates/lint-eslint.yml"
     },
@@ -52,31 +53,35 @@
       "name": "nextcloud-lint-stylelint",
       "source": "upstream/vendor/nextcloud/lint-stylelint.yml",
       "patches": [
-        "patches/nextcloud/lint-stylelint.yml.patch"
+        "patches/nextcloud/lint-stylelint.yml.patch",
+        "patches/nextcloud/node-npm-engine-defaults.yml.patch"
       ],
       "destination": "workflow-templates/lint-stylelint.yml"
     },
     {
       "name": "nextcloud-lint-typescript",
       "source": "upstream/vendor/nextcloud/lint-typescript.yml",
       "patches": [
-        "patches/nextcloud/lint-typescript.yml.patch"
+        "patches/nextcloud/lint-typescript.yml.patch",
+        "patches/nextcloud/node-npm-engine-defaults.yml.patch"
       ],
       "destination": "workflow-templates/lint-typescript.yml"
     },
     {
       "name": "nextcloud-node-test",
       "source": "upstream/vendor/nextcloud/node-test.yml",
       "patches": [
-        "patches/nextcloud/node-test.yml.patch"
+        "patches/nextcloud/node-test.yml.patch",
+        "patches/nextcloud/node-npm-engine-defaults.yml.patch"
       ],
       "destination": "workflow-templates/node-test.yml"
     },
     {
       "name": "nextcloud-npm-build",
       "source": "upstream/vendor/nextcloud/npm-build.yml",
       "patches": [
-        "patches/nextcloud/npm-build.yml.patch"
+        "patches/nextcloud/npm-build.yml.patch",
+        "patches/nextcloud/node-npm-engine-defaults.yml.patch"
       ],
       "destination": "workflow-templates/npm-build.yml"
     },