From 5be4779584def40a0676d848ddd0ff32b64fbbb2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 19 Oct 2026 01:05:48 +0000
Subject: [PATCH 01/10] build(deps): bump
 nextcloud-libraries/parse-package-engines-action

Bumps [nextcloud-libraries/parse-package-engines-action](https://github.com/nextcloud-libraries/parse-package-engines-action) from 0.1.0 to 0.2.0.
- [Release notes](https://github.com/nextcloud-libraries/parse-package-engines-action/releases)
- [Commits](https://github.com/nextcloud-libraries/parse-package-engines-action/compare/122ae05d4257008180a514e1ddeb0c1b9d094bdd...39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92)

---
updated-dependencies:
- dependency-name: nextcloud-libraries/parse-package-engines-action
  dependency-version: 0.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 workflow-templates/appstore-build-publish.yml | 2 +-
 workflow-templates/command-compile.yml        | 2 +-
 workflow-templates/command-openapi.yml        | 2 +-
 workflow-templates/cypress.yml                | 2 +-
 workflow-templates/documentation.yml          | 2 +-
 workflow-templates/lint-eslint.yml            | 2 +-
 workflow-templates/lint-stylelint.yml         | 2 +-
 workflow-templates/lint-typescript.yml        | 2 +-
 workflow-templates/node-test.yml              | 2 +-
 workflow-templates/npm-audit-fix.yml          | 2 +-
 workflow-templates/npm-build.yml              | 2 +-
 workflow-templates/openapi.yml                | 2 +-
 workflow-templates/playwright.yml             | 4 ++--
 13 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/workflow-templates/appstore-build-publish.yml b/workflow-templates/appstore-build-publish.yml
index 43461b1..8f1e541 100644
--- a/workflow-templates/appstore-build-publish.yml
+++ b/workflow-templates/appstore-build-publish.yml
@@ -59,7 +59,7 @@ jobs:
           expression: "//info//dependencies//nextcloud/@min-version"
 
       - name: Read package.json node and npm engines version
-        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
+        uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
         id: versions
         # Continue if no package.json
         continue-on-error: true
diff --git a/workflow-templates/command-compile.yml b/workflow-templates/command-compile.yml
index 222576c..6ff8ec8 100644
--- a/workflow-templates/command-compile.yml
+++ b/workflow-templates/command-compile.yml
@@ -116,7 +116,7 @@ jobs:
           git config --local user.name 'nextcloud-command'
 
       - name: Read package.json node and npm engines version
-        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
+        uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
         id: package-engines-versions
 
       - name: Set up node ${{ steps.package-engines-versions.outputs.node-version }}
diff --git a/workflow-templates/command-openapi.yml b/workflow-templates/command-openapi.yml
index 062ea14..b47a727 100644
--- a/workflow-templates/command-openapi.yml
+++ b/workflow-templates/command-openapi.yml
@@ -124,7 +124,7 @@ jobs:
 
       - name: Read package.json node and npm engines version
         if: steps.check_typescript_openapi.outputs.files_exists == 'true'
-        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
+        uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
         id: node_versions
         # Continue if no package.json
         continue-on-error: true
diff --git a/workflow-templates/cypress.yml b/workflow-templates/cypress.yml
index 3b530f1..7e596ba 100644
--- a/workflow-templates/cypress.yml
+++ b/workflow-templates/cypress.yml
@@ -63,7 +63,7 @@ jobs:
           composer-options: '--no-dev'
 
       - name: Read package.json node and npm engines version
-        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
+        uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
         id: versions
 
       - name: Set up node ${{ steps.versions.outputs.node-version }}
diff --git a/workflow-templates/documentation.yml b/workflow-templates/documentation.yml
index 3f38aec..d701a69 100644
--- a/workflow-templates/documentation.yml
+++ b/workflow-templates/documentation.yml
@@ -35,7 +35,7 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
+        uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
         id: versions
 
       - name: Set up node ${{ steps.versions.outputs.node-version }}
diff --git a/workflow-templates/lint-eslint.yml b/workflow-templates/lint-eslint.yml
index c1353ce..8021ce5 100644
--- a/workflow-templates/lint-eslint.yml
+++ b/workflow-templates/lint-eslint.yml
@@ -61,7 +61,7 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
+        uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
         id: versions
 
       - name: Set up node ${{ steps.versions.outputs.node-version }}
diff --git a/workflow-templates/lint-stylelint.yml b/workflow-templates/lint-stylelint.yml
index fd55805..39fb96e 100644
--- a/workflow-templates/lint-stylelint.yml
+++ b/workflow-templates/lint-stylelint.yml
@@ -30,7 +30,7 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
+        uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
         id: versions
 
       - name: Set up node ${{ steps.versions.outputs.node-version }}
diff --git a/workflow-templates/lint-typescript.yml b/workflow-templates/lint-typescript.yml
index beb5c67..09fba33 100644
--- a/workflow-templates/lint-typescript.yml
+++ b/workflow-templates/lint-typescript.yml
@@ -60,7 +60,7 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
+        uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
         id: versions
 
       - name: Set up node ${{ steps.versions.outputs.node-version }}
diff --git a/workflow-templates/node-test.yml b/workflow-templates/node-test.yml
index 5e3b634..4d9458a 100644
--- a/workflow-templates/node-test.yml
+++ b/workflow-templates/node-test.yml
@@ -65,7 +65,7 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
+        uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
         id: versions
 
       - name: Set up node ${{ steps.versions.outputs.node-version }}
diff --git a/workflow-templates/npm-audit-fix.yml b/workflow-templates/npm-audit-fix.yml
index f34c177..a8c8d12 100644
--- a/workflow-templates/npm-audit-fix.yml
+++ b/workflow-templates/npm-audit-fix.yml
@@ -73,7 +73,7 @@ jobs:
 
       - name: Read package.json node and npm engines version
         if: steps.freeze.outputs.active != 'true'
-        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
+        uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
         id: versions
 
       - name: Set up node ${{ steps.versions.outputs.node-version }}
diff --git a/workflow-templates/npm-build.yml b/workflow-templates/npm-build.yml
index 22783c4..66c2538 100644
--- a/workflow-templates/npm-build.yml
+++ b/workflow-templates/npm-build.yml
@@ -58,7 +58,7 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
+        uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
         id: versions
 
       - name: Set up node ${{ steps.versions.outputs.node-version }}
diff --git a/workflow-templates/openapi.yml b/workflow-templates/openapi.yml
index 721f52f..e721ca5 100644
--- a/workflow-templates/openapi.yml
+++ b/workflow-templates/openapi.yml
@@ -52,7 +52,7 @@ jobs:
 
       - name: Read package.json node and npm engines version
         if: steps.check_typescript_openapi.outputs.files_exists == 'true'
-        uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
+        uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
         id: node_versions
         # Continue if no package.json
         continue-on-error: true
diff --git a/workflow-templates/playwright.yml b/workflow-templates/playwright.yml
index 9eaa4d5..c824025 100644
--- a/workflow-templates/playwright.yml
+++ b/workflow-templates/playwright.yml
@@ -51,7 +51,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Read package.json
-      uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
+      uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
       id: versions
     - name: Check composer.json
       id: check_composer
@@ -107,7 +107,7 @@ jobs:
         persist-credentials: false
 
     - name: Read package.json
-      uses: nextcloud-libraries/parse-package-engines-action@122ae05d4257008180a514e1ddeb0c1b9d094bdd # v0.1.0
+      uses: nextcloud-libraries/parse-package-engines-action@39fcc545a815c353dd0a3fd8fd2ef6e59fd02b92 # v0.2.0
       id: versions
 
     - name: Set up node

From 3b2ff4bee1b5000358f84e70e106a6427ee828a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?John=20Molakvo=C3=A6?= <skjnldsv@users.noreply.github.com>
Date: Tue, 20 Oct 2026 08:52:55 +0200
Subject: [PATCH 02/10] chore: add 'kristian-zendato' to non-community
 usernames
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: John Molakvoæ <skjnldsv@users.noreply.github.com>
---
 non-community-usernames.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/non-community-usernames.txt b/non-community-usernames.txt
index 20dbdea..fac5070 100644
--- a/non-community-usernames.txt
+++ b/non-community-usernames.txt
@@ -22,6 +22,7 @@ joshtrichards
 JuliaKirschenheuter
 Koc
 kra-mo
+kristian-zendato
 lukasdotcom
 max65482
 MB-Finski

From aa3183919788c6c6445aa5f2d72761f40ec228db Mon Sep 17 00:00:00 2001
From: Maksim Sukharev <antreesy.web@gmail.com>
Date: Wed, 21 Oct 2026 17:58:22 +0200
Subject: [PATCH 03/10] fix(sync-workflow-templates): sync from the .github
 repo of the same organization

- `nextcloud-libraries/.github` merges this template unchanged
- Its repositories then synced the templates of `nextcloud/.github`
- Use `github.repository_owner` for the checkout and both links
- Link to `HEAD`, because the default branch is `master` here and `main` in nextcloud-libraries

Assisted-by: ClaudeCode:claude-opus-5-5
Signed-off-by: Maksim Sukharev <antreesy.web@gmail.com>
---
 workflow-templates/sync-workflow-templates.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/workflow-templates/sync-workflow-templates.yml b/workflow-templates/sync-workflow-templates.yml
index 5d84aec..7b2a61a 100644
--- a/workflow-templates/sync-workflow-templates.yml
+++ b/workflow-templates/sync-workflow-templates.yml
@@ -47,7 +47,7 @@ jobs:
         with:
           persist-credentials: false
           path: source
-          repository: nextcloud/.github
+          repository: ${{ github.repository_owner }}/.github
 
       - name: Checkout app
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -108,7 +108,7 @@ jobs:
                   echo "ℹ️ Locked version: $locked_version"
                   echo "ℹ️ Current version: $new_version"
                   echo "🆙 Updating existing workflow: $filename"
-                  echo "- 🆙 Updated [$filename](https://github.com/nextcloud/.github/commits/master/workflow-templates/$filename)" >> $GITHUB_ENV
+                  echo "- 🆙 Updated [$filename](https://github.com/${GITHUB_REPOSITORY_OWNER}/.github/commits/HEAD/workflow-templates/$filename)" >> $GITHUB_ENV
 
                   cp "$workflow" "$target_file"
 
@@ -160,7 +160,7 @@ jobs:
           draft: ${{ env.DRAFT_ONLY == 1 }}
           add-paths: .github/workflows/*.yml,.github/actions-lock.txt
           body: |
-            Automated update of all workflow templates from [nextcloud/.github](https://github.com/nextcloud/.github)
+            Automated update of all workflow templates from [${{ github.repository_owner }}/.github](https://github.com/${{ github.repository_owner }}/.github)
             ${{ env.SUMMARY }}
           labels: |
             dependencies

From 2a7824c16063c149968642b07140e11fa4080c44 Mon Sep 17 00:00:00 2001
From: Maksim Sukharev <antreesy.web@gmail.com>
Date: Wed, 21 Oct 2026 18:05:11 +0200
Subject: [PATCH 04/10] feat(dispatch-workflow): reapply workflow patches like
 the sync workflow

- Dispatch overwrote the workflows and dropped repository changes stored as `workflow.yml.patch`
- Use the same patch handling as `sync-workflow-templates.yml`
- If a patch fails, the PR is a draft and its body lists the failed workflow
- Only commit `.github/workflows/*.yml`, so `.orig` and `.rej` files stay out of the PR
- Mention the dispatch workflows in the "Patching workflows" section of the README

Assisted-by: ClaudeCode:claude-opus-5-5
Signed-off-by: Maksim Sukharev <antreesy.web@gmail.com>
---
 .github/workflows/dispatch-workflow-repo.yml | 28 ++++++++++++++++-
 .github/workflows/dispatch-workflow.yml      | 33 ++++++++++++++++++--
 README.md                                    |  4 +--
 3 files changed, 60 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/dispatch-workflow-repo.yml b/.github/workflows/dispatch-workflow-repo.yml
index e943964..5097b63 100644
--- a/.github/workflows/dispatch-workflow-repo.yml
+++ b/.github/workflows/dispatch-workflow-repo.yml
@@ -65,6 +65,8 @@ jobs:
 
       - name: Copy all workflow templates
         run: |
+          echo 'SUMMARY<<EOF' >> $GITHUB_ENV
+          draft_only=0
           for workflow in ./source/workflow-templates/*.yml; do
             if [ -f "$workflow" ]; then
               filename=$(basename "$workflow")
@@ -73,18 +75,42 @@ jobs:
               # Only copy if the file exists in the target repository
               if [ -f "$target_file" ]; then
                 echo "Updating existing workflow: $filename"
+                echo "- 🆙 Updated $filename" >> $GITHUB_ENV
                 cp "$workflow" "$target_file"
+
+                # Apply patch if one exists
+                if [ -f "$target_file.patch" ]; then
+                  echo "🩹 Applying patch"
+                  cd ./target
+                  set +e
+                  patch -p1 < ".github/workflows/$filename.patch"
+                  patch_worked=$?
+                  set -e
+                  cd -
+                  if [[ "$patch_worked" == "0" ]]; then
+                    echo "  - Patch applied" >> $GITHUB_ENV
+                  else
+                    echo "  - [ ] ❌ Patch failed" >> $GITHUB_ENV
+                    draft_only=1
+                  fi
+                fi
               else
                 echo "Skipping $filename (does not exist in target repository)"
               fi
             fi
           done
+          echo 'EOF' >> $GITHUB_ENV
+          echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV
 
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
-          body: 'Automated update of all workflow templates from https://github.com/${{ github.repository }} triggered by ${{ github.actor }}'
+          body: |
+            Automated update of all workflow templates from https://github.com/${{ github.repository }} triggered by ${{ github.actor }}
+            ${{ env.SUMMARY }}
           branch: 'feat/workflow-auto-update-all-templates-${{ github.event.inputs.branch }}'
+          draft: ${{ env.DRAFT_ONLY == 1 }}
+          add-paths: .github/workflows/*.yml
           commit-message: 'ci: update all workflow templates from organization template repository'
           committer: Nextcloud bot <bot@nextcloud.com>
           author: Nextcloud bot <bot@nextcloud.com>
diff --git a/.github/workflows/dispatch-workflow.yml b/.github/workflows/dispatch-workflow.yml
index 0286101..2827e8e 100644
--- a/.github/workflows/dispatch-workflow.yml
+++ b/.github/workflows/dispatch-workflow.yml
@@ -93,14 +93,43 @@ jobs:
 
       - name: Copy workflow # zizmor: ignore[template-injection]
         if: steps.check_file_existence.outputs.files_exists == 'true'
-        run: cp './source/workflow-templates/${{ github.event.inputs.name }}' ./target/.github/workflows
+        run: |
+          echo 'SUMMARY<<EOF' >> $GITHUB_ENV
+          draft_only=0
+          filename='${{ github.event.inputs.name }}'
+          target_file="./target/.github/workflows/$filename"
+          echo "- 🆙 Updated $filename" >> $GITHUB_ENV
+          cp "./source/workflow-templates/$filename" "$target_file"
+
+          # Apply patch if one exists
+          if [ -f "$target_file.patch" ]; then
+            echo "🩹 Applying patch"
+            cd ./target
+            set +e
+            patch -p1 < ".github/workflows/$filename.patch"
+            patch_worked=$?
+            set -e
+            cd -
+            if [[ "$patch_worked" == "0" ]]; then
+              echo "  - Patch applied" >> $GITHUB_ENV
+            else
+              echo "  - [ ] ❌ Patch failed" >> $GITHUB_ENV
+              draft_only=1
+            fi
+          fi
+          echo 'EOF' >> $GITHUB_ENV
+          echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV
 
       - name: Create Pull Request
         if: steps.check_file_existence.outputs.files_exists == 'true'
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
-          body: 'Automated update of the ${{ github.event.inputs.name }} workflow from https://github.com/${{ github.repository }} triggered by ${{ github.actor }}'
+          body: |
+            Automated update of the ${{ github.event.inputs.name }} workflow from https://github.com/${{ github.repository }} triggered by ${{ github.actor }}
+            ${{ env.SUMMARY }}
           branch: 'feat/workflow-auto-update-${{ github.event.inputs.name }}'
+          draft: ${{ env.DRAFT_ONLY == 1 }}
+          add-paths: .github/workflows/*.yml
           commit-message: 'ci: update ${{ github.event.inputs.name }} workflow from template'
           committer: Nextcloud bot <bot@nextcloud.com>
           author: Nextcloud bot <bot@nextcloud.com>
diff --git a/README.md b/README.md
index 7bbe9ce..13c726b 100644
--- a/README.md
+++ b/README.md
@@ -34,8 +34,8 @@ Example:
 1. Modify `.github/workflows/phpunit-mariadb.yml`
 2. Save patch `git diff .github/workflows/phpunit-mariadb.yml > .github/workflows/phpunit-mariadb.yml.patch`
 
-The `sync-workflow-templates.yml` action also supports this and reapplies the patches if possible.
-If there was an error it will be outlined in the PR description.
+The `sync-workflow-templates.yml` action and the organization dispatch workflows (`dispatch-workflow.yml`, `dispatch-workflow-repo.yml` and `dispatch-workflow-org.yml`) also support this and reapply the patches if possible.
+If there was an error it will be outlined in the PR description and the PR is opened as a draft.
 
 ## Update workflows manually
 

From e2d2cf00e4389ee5d3870305aab94ffd7510cc36 Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Fri, 23 Oct 2026 13:37:36 +0200
Subject: [PATCH 05/10] fix(nextcloud-ocp): Don't use hardcoded PHP to update
 nextcloud/ocp

Assisted-by: ClaudeCode:claude-opus-5-5
Signed-off-by: Joas Schilling <coding@schilljs.com>
---
 workflow-templates/update-nextcloud-ocp-matrix.yml | 4 ++--
 workflow-templates/update-nextcloud-ocp.yml        | 9 +++++++--
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/workflow-templates/update-nextcloud-ocp-matrix.yml b/workflow-templates/update-nextcloud-ocp-matrix.yml
index 2d69d3c..77b108e 100644
--- a/workflow-templates/update-nextcloud-ocp-matrix.yml
+++ b/workflow-templates/update-nextcloud-ocp-matrix.yml
@@ -48,10 +48,10 @@ jobs:
         id: versions
         uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3
 
-      - name: Set up php8.3
+      - name: Set up php${{ steps.versions.outputs.php-min }}
         uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
-          php-version: 8.3
+          php-version: ${{ steps.versions.outputs.php-min }}
           # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation
           extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite
           coverage: none
diff --git a/workflow-templates/update-nextcloud-ocp.yml b/workflow-templates/update-nextcloud-ocp.yml
index 44c0201..b2a6469 100644
--- a/workflow-templates/update-nextcloud-ocp.yml
+++ b/workflow-templates/update-nextcloud-ocp.yml
@@ -74,11 +74,16 @@ jobs:
           fi
           rm version.php
 
-      - name: Set up php8.3
+      - name: Get php version
+        id: versions
+        if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success'
+        uses: nextcloud-libraries/nextcloud-version-matrix@cd0211ffcef1065e2020cd579e4843b8746e7a58 # v1.3.3
+
+      - name: Set up php${{ steps.versions.outputs.php-min }}
         if: steps.freeze.outputs.active != 'true' && steps.checkout.outcome == 'success'
         uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
-          php-version: 8.3
+          php-version: ${{ steps.versions.outputs.php-min }}
           # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation
           extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite
           coverage: none

From ef68ff43169c1b972379c91d4268c652b15afc55 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 24 Oct 2026 01:03:31 +0000
Subject: [PATCH 06/10] ci(deps): bump zizmorcore/zizmor-action in
 /.github/workflows

Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.6.4 to 0.7.1.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/cc914d7f3750a2d13d75c7f184a1060aa0e9d482...85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/lint-yaml.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/lint-yaml.yml b/.github/workflows/lint-yaml.yml
index 4f3bfed..5630772 100644
--- a/.github/workflows/lint-yaml.yml
+++ b/.github/workflows/lint-yaml.yml
@@ -33,7 +33,7 @@ jobs:
             line-length: warning
 
       - name: Run zizmor 🌈 on actions
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
         with:
           inputs: '.github/workflows/*.yml'
           advanced-security: false
@@ -41,7 +41,7 @@ jobs:
           min-severity: 'medium'
 
       - name: Run zizmor 🌈 on workflow-templates
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
         with:
           inputs: 'workflow-templates/*.yml'
           advanced-security: false

From 91c4942115b8dfa77f11b25bed265b215b3c9b6e Mon Sep 17 00:00:00 2001
From: Joas Schilling <213943+nickvergessen@users.noreply.github.com>
Date: Tue, 27 Oct 2026 10:02:36 +0100
Subject: [PATCH 07/10] chore: Update non-community-usernames.txt

Signed-off-by: Joas Schilling <213943+nickvergessen@users.noreply.github.com>
---
 non-community-usernames.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/non-community-usernames.txt b/non-community-usernames.txt
index fac5070..78df9ab 100644
--- a/non-community-usernames.txt
+++ b/non-community-usernames.txt
@@ -50,5 +50,6 @@ sudormant
 susnux
 tcitworld
 viktorix
+WSHAPER
 Yuvrajsinghspd09
 ZetaTom

From 7e63a77d7beea8bfdc292abb8759eb9571a1adf9 Mon Sep 17 00:00:00 2001
From: Hamza <40746210+hamza221@users.noreply.github.com>
Date: Tue, 27 Oct 2026 23:25:50 +0100
Subject: [PATCH 08/10] fix: Add 'madbob' to non-community usernames list

Signed-off-by: Hamza <40746210+hamza221@users.noreply.github.com>
---
 non-community-usernames.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/non-community-usernames.txt b/non-community-usernames.txt
index 78df9ab..1cc4793 100644
--- a/non-community-usernames.txt
+++ b/non-community-usernames.txt
@@ -24,6 +24,7 @@ Koc
 kra-mo
 kristian-zendato
 lukasdotcom
+madbob
 max65482
 MB-Finski
 mejo-

From cf48300cfb66c16f9210bd5cb3301a3ca8452c04 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 31 Oct 2026 02:03:22 +0000
Subject: [PATCH 09/10] ci(deps): bump zizmorcore/zizmor-action in
 /.github/workflows

Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.7.1 to 0.8.0.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e...53290badfa369cb0bf7ad16342cb62c2fa47ac7b)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/lint-yaml.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/lint-yaml.yml b/.github/workflows/lint-yaml.yml
index 5630772..fb56b47 100644
--- a/.github/workflows/lint-yaml.yml
+++ b/.github/workflows/lint-yaml.yml
@@ -33,7 +33,7 @@ jobs:
             line-length: warning
 
       - name: Run zizmor 🌈 on actions
-        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
         with:
           inputs: '.github/workflows/*.yml'
           advanced-security: false
@@ -41,7 +41,7 @@ jobs:
           min-severity: 'medium'
 
       - name: Run zizmor 🌈 on workflow-templates
-        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
         with:
           inputs: 'workflow-templates/*.yml'
           advanced-security: false

From 7e3309137119e52de9f8df5aebdc45ecd1f69b15 Mon Sep 17 00:00:00 2001
From: Joas Schilling <213943+nickvergessen@users.noreply.github.com>
Date: Sat, 31 Oct 2026 10:07:31 +0100
Subject: [PATCH 10/10] Update non-community-usernames.txt

---
 non-community-usernames.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/non-community-usernames.txt b/non-community-usernames.txt
index 1cc4793..5f1d2b9 100644
--- a/non-community-usernames.txt
+++ b/non-community-usernames.txt
@@ -12,6 +12,7 @@ DorraJaouad
 edward-ly
 elzody
 enjeck
+GhassenKefi
 grnd-alt
 hweihwang
 individual-it