chore: sync workflows from Nextcloud organization

.github/workflows/dispatch-workflow-repo.yml

@@ -65,6 +65,8 @@ jobs:
 
       - name: Copy all workflow templates
         run: |
+          echo 'SUMMARY<<EOF' >> $GITHUB_ENV
+          draft_only=0
           for workflow in ./source/workflow-templates/*.yml; do
             if [ -f "$workflow" ]; then
               filename=$(basename "$workflow")
@@ -73,18 +75,42 @@ jobs:
               # Only copy if the file exists in the target repository
               if [ -f "$target_file" ]; then
                 echo "Updating existing workflow: $filename"
+                echo "- 🆙 Updated $filename" >> $GITHUB_ENV
                 cp "$workflow" "$target_file"
+
+                # Apply patch if one exists
+                if [ -f "$target_file.patch" ]; then
+                  echo "🩹 Applying patch"
+                  cd ./target
+                  set +e
+                  patch -p1 < ".github/workflows/$filename.patch"
+                  patch_worked=$?
+                  set -e
+                  cd -
+                  if [[ "$patch_worked" == "0" ]]; then
+                    echo "  - Patch applied" >> $GITHUB_ENV
+                  else
+                    echo "  - [ ] ❌ Patch failed" >> $GITHUB_ENV
+                    draft_only=1
+                  fi
+                fi
               else
                 echo "Skipping $filename (does not exist in target repository)"
               fi
             fi
           done
+          echo 'EOF' >> $GITHUB_ENV
+          echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV
 
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
-          body: 'Automated update of all workflow templates from https://github.com/${{ github.repository }} triggered by ${{ github.actor }}'
+          body: |
+            Automated update of all workflow templates from https://github.com/${{ github.repository }} triggered by ${{ github.actor }}
+            ${{ env.SUMMARY }}
           branch: 'feat/workflow-auto-update-all-templates-${{ github.event.inputs.branch }}'
+          draft: ${{ env.DRAFT_ONLY == 1 }}
+          add-paths: .github/workflows/*.yml
           commit-message: 'ci: update all workflow templates from organization template repository'
           committer: Nextcloud bot <bot@nextcloud.com>
           author: Nextcloud bot <bot@nextcloud.com>

.github/workflows/dispatch-workflow.yml

@@ -93,14 +93,43 @@ jobs:
 
       - name: Copy workflow # zizmor: ignore[template-injection]
         if: steps.check_file_existence.outputs.files_exists == 'true'
-        run: cp './source/workflow-templates/${{ github.event.inputs.name }}' ./target/.github/workflows
+        run: |
+          echo 'SUMMARY<<EOF' >> $GITHUB_ENV
+          draft_only=0
+          filename='${{ github.event.inputs.name }}'
+          target_file="./target/.github/workflows/$filename"
+          echo "- 🆙 Updated $filename" >> $GITHUB_ENV
+          cp "./source/workflow-templates/$filename" "$target_file"
+
+          # Apply patch if one exists
+          if [ -f "$target_file.patch" ]; then
+            echo "🩹 Applying patch"
+            cd ./target
+            set +e
+            patch -p1 < ".github/workflows/$filename.patch"
+            patch_worked=$?
+            set -e
+            cd -
+            if [[ "$patch_worked" == "0" ]]; then
+              echo "  - Patch applied" >> $GITHUB_ENV
+            else
+              echo "  - [ ] ❌ Patch failed" >> $GITHUB_ENV
+              draft_only=1
+            fi
+          fi
+          echo 'EOF' >> $GITHUB_ENV
+          echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV
 
       - name: Create Pull Request
         if: steps.check_file_existence.outputs.files_exists == 'true'
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
-          body: 'Automated update of the ${{ github.event.inputs.name }} workflow from https://github.com/${{ github.repository }} triggered by ${{ github.actor }}'
+          body: |
+            Automated update of the ${{ github.event.inputs.name }} workflow from https://github.com/${{ github.repository }} triggered by ${{ github.actor }}
+            ${{ env.SUMMARY }}
           branch: 'feat/workflow-auto-update-${{ github.event.inputs.name }}'
+          draft: ${{ env.DRAFT_ONLY == 1 }}
+          add-paths: .github/workflows/*.yml
           commit-message: 'ci: update ${{ github.event.inputs.name }} workflow from template'
           committer: Nextcloud bot <bot@nextcloud.com>
           author: Nextcloud bot <bot@nextcloud.com>

.github/workflows/lint-yaml.yml

@@ -33,15 +33,15 @@ jobs:
             line-length: warning
 
       - name: Run zizmor 🌈 on actions
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
         with:
           inputs: '.github/workflows/*.yml'
           advanced-security: false
           annotations: true
           min-severity: 'medium'
 
       - name: Run zizmor 🌈 on workflow-templates
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
         with:
           inputs: 'workflow-templates/*.yml'
           advanced-security: false

workflow-templates/sync-workflow-templates.yml

@@ -47,7 +47,7 @@ jobs:
         with:
           persist-credentials: false
           path: source
-          repository: nextcloud/.github
+          repository: ${{ github.repository_owner }}/.github
 
       - name: Checkout app
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -108,7 +108,7 @@ jobs:
                   echo "ℹ️ Locked version: $locked_version"
                   echo "ℹ️ Current version: $new_version"
                   echo "🆙 Updating existing workflow: $filename"
-                  echo "- 🆙 Updated [$filename](https://github.com/nextcloud/.github/commits/master/workflow-templates/$filename)" >> $GITHUB_ENV
+                  echo "- 🆙 Updated [$filename](https://github.com/${GITHUB_REPOSITORY_OWNER}/.github/commits/HEAD/workflow-templates/$filename)" >> $GITHUB_ENV
 
                   cp "$workflow" "$target_file"
 
@@ -160,7 +160,7 @@ jobs:
           draft: ${{ env.DRAFT_ONLY == 1 }}
           add-paths: .github/workflows/*.yml,.github/actions-lock.txt
           body: |
-            Automated update of all workflow templates from [nextcloud/.github](https://github.com/nextcloud/.github)
+            Automated update of all workflow templates from [${{ github.repository_owner }}/.github](https://github.com/${{ github.repository_owner }}/.github)
             ${{ env.SUMMARY }}
           labels: |
             dependencies