ci: update workflows from templates

.github/workflows/ai-policy.yml

@@ -32,7 +32,9 @@ jobs:
       - name: Collect PR commit messages
         id: collect
         env:
-          GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT }}
+          # Fall back to the default token when the PAT is unavailable
+          # (e.g. Dependabot- or fork-triggered runs don't receive Actions secrets)
+          GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT || github.token }}
           COMMITS_URL: ${{ github.event.pull_request.commits_url }}
         run: |
           set -euo pipefail
@@ -125,7 +127,9 @@ jobs:
       - name: Create 'AI assisted' label if absent
         if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true'
         env:
-          GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT }}
+          # Fall back to the default token when the PAT is unavailable
+          # (e.g. Dependabot- or fork-triggered runs don't receive Actions secrets)
+          GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT || github.token }}
         run: |
           gh api "repos/${{ github.repository }}/labels" \
             --method POST \
@@ -137,7 +141,9 @@ jobs:
       - name: Label PR as AI assisted
         if: steps.ai_trailers.outputs.ai_assisted == 'true' || steps.agent_signoff.outputs.agent_signoff == 'true' || steps.co_authored.outputs.co_authored == 'true'
         env:
-          GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT }}
+          # Fall back to the default token when the PAT is unavailable
+          # (e.g. Dependabot- or fork-triggered runs don't receive Actions secrets)
+          GH_TOKEN: ${{ secrets.COMMAND_BOT_PAT || github.token }}
         run: |
           gh api "repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels" \
             --method POST \

.github/workflows/appstore-build-publish.yml

@@ -65,8 +65,8 @@ jobs:
         continue-on-error: true
         with:
           path: ${{ env.APP_NAME }}
-          fallbackNode: '^20'
-          fallbackNpm: '^10'
+          fallbackNode: '^24'
+          fallbackNpm: '^11.3'
 
       - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
         # Skip if no package.json

.github/workflows/integration.yml

@@ -151,54 +151,6 @@ jobs:
         run: |
           cat data/nextcloud.log
 
-      - name: Query count
-        if: ${{ matrix.databases == 'mysql' && matrix.php-versions == '8.3' && matrix.server-versions == 'master' && github.event_name == 'pull_request' }}
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{secrets.GITHUB_TOKEN}}
-          script: |
-            let myOutput = ''
-            let myError = ''
-
-            const options = {}
-            options.listeners = {
-              stdout: (data) => {
-                myOutput += data.toString()
-              },
-              stderr: (data) => {
-                myError += data.toString()
-              }
-            }
-            await exec.exec(`/bin/bash -c "cat query.log | egrep '(DELETE|UPDATE|INSERT|SELECT)' | awk 'sub(/^[^DISU]*/, \\"\\")' | wc -l"`, [], options)
-            msg = myOutput
-            const queryCount = parseInt(myOutput, 10)
-
-            myOutput = ''
-            await exec.exec('cat', ['apps/${{ env.APP_NAME }}/tests/integration/base-query-count.txt'], options)
-            const baseCount = parseInt(myOutput, 10)
-
-            const absoluteIncrease = queryCount - baseCount
-            const relativeIncrease = baseCount <= 0 ? 100 : (parseInt((absoluteIncrease / baseCount * 10000), 10) / 100)
-
-            if (absoluteIncrease >= 100 || relativeIncrease > 5) {
-              const comment = `🐢 Performance warning.\nIt looks like the query count of the integration tests increased with this PR.\nDatabase query count is now ` + queryCount + ' was ' + baseCount + ' (+' + relativeIncrease + '%)\nPlease check your code again. If you added a new test this can be expected and the base value in tests/integration/base-query-count.txt can be increased.'
-              github.rest.issues.createComment({
-                issue_number: context.issue.number,
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                body: comment
-              })
-            }
-            if (queryCount < 100) {
-              const comment = `🐈 Performance messuring seems broken. Failed to get query count.`
-              github.rest.issues.createComment({
-                issue_number: context.issue.number,
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                body: comment
-              })
-            }
-
   summary:
     permissions:
       contents: none

.github/workflows/lint-eslint.yml

@@ -64,8 +64,8 @@ jobs:
         uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
         id: versions
         with:
-          fallbackNode: '^20'
-          fallbackNpm: '^10'
+          fallbackNode: '^24'
+          fallbackNpm: '^11.3'
 
       - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/lint-stylelint.yml

@@ -33,8 +33,8 @@ jobs:
         uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
         id: versions
         with:
-          fallbackNode: '^20'
-          fallbackNpm: '^10'
+          fallbackNode: '^24'
+          fallbackNpm: '^11.3'
 
       - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/npm-audit-fix.yml

@@ -43,8 +43,8 @@ jobs:
         uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
         id: versions
         with:
-          fallbackNode: '^20'
-          fallbackNpm: '^10'
+          fallbackNode: '^24'
+          fallbackNpm: '^11.3'
 
       - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/node.yml → .github/workflows/npm-build.yml

@@ -6,7 +6,7 @@
 # SPDX-FileCopyrightText: 2021-2024 Nextcloud GmbH and Nextcloud contributors
 # SPDX-License-Identifier: MIT
 
-name: Node
+name: Build Javascript
 
 on: pull_request
 
@@ -61,8 +61,8 @@ jobs:
         uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
         id: versions
         with:
-          fallbackNode: '^20'
-          fallbackNpm: '^10'
+          fallbackNode: '^24'
+          fallbackNpm: '^11.3'
 
       - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/openapi.yml

@@ -57,8 +57,8 @@ jobs:
         # Continue if no package.json
         continue-on-error: true
         with:
-          fallbackNode: '^20'
-          fallbackNpm: '^10'
+          fallbackNode: '^24'
+          fallbackNpm: '^11.3'
 
       - name: Set up node ${{ steps.node_versions.outputs.nodeVersion }}
         if: ${{ steps.node_versions.outputs.nodeVersion }}
@@ -86,7 +86,7 @@ jobs:
 
       - name: Check openapi*.json and typescript changes
         run: |
-          bash -c "[[ ! \"`git status --porcelain openapi.json src/types/openapi/openapi.ts `\" ]] || (echo 'Please run \"composer run openapi\" and commit the openapi*.json files and (if applicable) src/types/openapi/openapi*.ts, see the section \"Show changes on failure\" for details' && exit 1)"
+          bash -c "[[ ! \"`git status --porcelain `\" ]] || (echo 'Please run \"composer run openapi\" and commit the openapi*.json files and (if applicable) src/types/openapi/openapi*.ts, see the section \"Show changes on failure\" for details' && exit 1)"
 
       - name: Show changes on failure
         if: failure()

.github/workflows/pr-feedback.yml

@@ -36,7 +36,7 @@ jobs:
           blocklist=$(curl https://raw.githubusercontent.com/nextcloud/.github/master/non-community-usernames.txt | paste -s -d, -)
           echo "blocklist=$blocklist" >> "$GITHUB_OUTPUT"
 
-      - uses: nextcloud/pr-feedback-action@c8c97a6b11ff6379e629a8fbde09572730cacec9 # main
+      - uses: nextcloud/pr-feedback-action@5227c55be184087d0aef6338bee210d8620b6297 # v1.0.1
         with:
           feedback-message: |
             Hello there,

REUSE.toml

@@ -24,7 +24,7 @@ SPDX-FileCopyrightText = "2024 Nextcloud GmbH and Nextcloud contributors"
 SPDX-License-Identifier = "AGPL-3.0-or-later"
 
 [[annotations]]
-path = [".scoper-production-dependencies", "vendor-bin/php-scoper/composer.json", "vendor-bin/php-scoper/composer.lock"]
+path = [".scoper-production-dependencies", "vendor-bin/php-scoper/composer.json", "vendor-bin/php-scoper/composer.lock", "vendor-bin/php-scoper/patches.lock.json"]
 precedence = "aggregate"
 SPDX-FileCopyrightText = "2025 Nextcloud GmbH and Nextcloud contributors"
 SPDX-License-Identifier = "AGPL-3.0-or-later"

vendor-bin/php-scoper/composer.json

@@ -14,12 +14,12 @@
 	"extra": {
 		"patches": {
 			"thecodingmachine/safe": {
-				"PHP 8.4 compatibility, patch 1": "https://patch-diff.githubusercontent.com/raw/thecodingmachine/safe/pull/464.patch",
-				"PHP 8.4 compatibility, patch 2": "https://patch-diff.githubusercontent.com/raw/thecodingmachine/safe/pull/466.patch",
-				"PHP 8.4 compatibility, patch 3": "https://github.com/blizzz/safe/commit/6eeee2a20ffb2be3456ae8615b227c78e1ca8a20.patch"
+				"PHP 8.4 compatibility, patch 1": "patches/thecodingmachine_safe_464.patch",
+				"PHP 8.4 compatibility, patch 2": "patches/thecodingmachine_safe_466.patch",
+				"PHP 8.4 compatibility, patch 3": "patches/blizzz_safe_6eeee2a20ffb2be3456ae8615b227c78e1ca8a20.patch"
 			},
 			"humbug/php-scoper": {
-				"PHP 8.5 compatibility, patch1": "https://patch-diff.githubusercontent.com/raw/blizzz/php-scoper/pull/1.patch"
+				"PHP 8.5 compatibility, patch1": "patches/blizzz_php-scoper_1.patch"
 			}
 		}
 	}