Tagging v9.0.0-rc.1 produced a startup_failure: the workflow was rejected
before any job ran. owncloud pins Actions to an org allowlist
(owncloud/admin:actions-allowlist.yml, allowed_actions: selected with
sha_pinning_required), and three pins in this file are not on it:
docker/setup-buildx-action @f87e5991 v4.4.1 (allowlist has v4.0.0)
docker/login-action @dbcb8138 v4.6.0 (allowlist has v4.1.0)
docker/build-push-action @c3c9e263 v7.4.0 (allowlist has v7.0.0)
Allowlist validation happens at parse time, so it does not care that all
three only appear in jobs already marked `if: false`.
Rather than pin them back, drop the jobs. Building, scanning and publishing
the production image moved to owncloud-docker/ocis, which is why these were
disabled in the first place; the image Trivy scan now runs there on every PR.
That leaves nothing to maintain here and removes all three offending pins.
Removes docker-build, docker-scan (dead too: it needs docker-build),
docker-manifest and docker-readme. Nothing outside that subgraph depended on
them, so the `docker_repos` and `is_production` outputs, the
PRODUCTION_RELEASE_TAGS / DOCKER_REPO_ROLLING / DOCKER_REPO_PRODUCTION env
vars and the REPOS computation go with them. is_prerelease stays, as
create-github-release still reads it.
The filesystem scan in security-scan-trivy is untouched.
Signed-off-by: Julian Koberg <julian.koberg@kiteworks.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix: the public share configuration and fixed graceful shutdown
* fix: [OCISDEV-1433] remove GRPC_MAX_CONNECTION_AGE
The setting closed healthy grpc connections on a timer so that clients would redo
their DNS lookup. It never helped against the failure it was reached for - a
connection whose peer stopped answering - because the age limit is enforced by
the server, the grace period was left at infinity so a request already in flight
was never ended, and any value without a unit suffix silently disabled it again.
Detecting a peer that stops answering is now the job of the grpc clients, which
ping the peer while a request is in flight. The servers here got the matching
enforcement policy so they accept those pings; the client side arrives with the
next reva bump.
* fix: Added the new variable OCDAV_DISABLE_PROPFIND_PUBLIC_LINK_RESOLUTION that disable the resolution of public link shares when answering PROPFIND requests.
* chore: bump reva
* fix: The keepalive added to grpc clinet
* chore: bump reva
* build(deps): bump go 1.26.8, grpc-go dependency
---------
(cherry picked from commit e86eb4d210)
For the 9.0 branch, the reva dependency was pointed at reva's main-branch
merge of PR #748 (commit 373f9509a, pseudo-version
v2.0.0-20261005091647-373f9509a363) instead of the 8.2-targeted
e0beaa380005, since the 8.2 merge predates the VaultMode/UploadSessionFilter.Orphaned
APIs already present on the 9.0 reva lineage.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
# Conflicts:
# changelog/unreleased/security-bump-grpc.md
# go.mod
# go.sum
# vendor/google.golang.org/grpc/server.go
# vendor/google.golang.org/grpc/stream.go
# vendor/google.golang.org/grpc/version.go
# vendor/modules.txt
* ci: pass the PR title through env: instead of interpolating it into the shell
acceptance-tests.yml and web-tests.yml both build their step script with
PR_TITLE="${{ github.event.pull_request.title }}". The expression is
substituted into the script text before bash parses it, so a pull request
title closing the quote runs as code on the runner.
Both steps write the value that gates the rest of the workflow
(docs-only, web-changed) to $GITHUB_OUTPUT, so an injected title can also
forge that value and skip the suite meant to test the pull request.
Passing the title through env: leaves it as an environment variable that is
never parsed as source. The [full-ci] check is unchanged.
* ci(release): take version_override through env: and reject non-version values
The env: move alone is not enough in release.yml: the value becomes the `version`
job output, which nine later run: blocks interpolate into their own script text --
one of them unquoted -- so a payload that never breaks out of the quotes at line 56
still executes in a different job. An allow-list on VERSION closes all nine at the
source.
All jobs previously ran with the GitHub-hosted default timeout of 360
minutes, so a hung job (e.g. apt-get stalling in the libcurl install
step of the acceptance tests) blocked a runner for 6 hours before
being killed.
Add an explicit timeout-minutes to every job, sized by workload:
- 120 min: acceptance/e2e/k8s/deployment/k6 test suites and the
release docker-build and build-binaries jobs
- 30-60 min: web build, code generation, license checks, scans,
npm/GitHub release publishing, pipeline report
- 5-15 min: change-detection gates, aggregate status jobs, changelog,
manifest/readme, stale-branch cleanup
The timeout counts only the job's own runtime (queue time and waiting
on `needs` dependencies are excluded) and applies per matrix entry.
Not covered: the jobs in commit-message.yml and translation-sync.yml
call reusable workflows via job-level `uses:`, which does not accept
timeout-minutes; those need timeouts in owncloud/reusable-workflows.
Signed-off-by: Lukas Hirt <info@hirt.cz>
* fix: fix CI (#12551)
* fix(ci): disable docker release jobs like in 8.1
The docker-build/manifest/readme jobs were enabled in 8.2 and wired into
create-github-release/audit-release. They fail at docker/login-action
("Username and password required") because DockerHub credentials are not
available, which cascades and cancels the whole release.
Restore the 8.1 behavior: re-add `if: false` to the docker jobs and unwire
them from the downstream release jobs.
* fix(ci): reinstall web deps in license-check job
Excluding web from the generated-code artifact (#12557, to avoid OOM on
upload) also dropped web/node_modules, which provides the
license-checker-rseidelsohn binary used by `make ci-node-check-licenses`.
The job failed with "license-checker-rseidelsohn: not found".
Run `pnpm install` in web before the license check so its node_modules is
present again.
---------
Co-authored-by: Roman Perekhod <2403905@gmail.com>
The release workflow is running out of memory when uploading the generated code.
This fixes it by excluding the web directory. The web directory is not needed because the build is handled via the generation.
Signed-off-by: Lukas Hirt <info@hirt.cz>
* chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
* chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3
* chore(deps): bump github.com/russellhaering/goxmldsig from 1.5.0 to 1.6.0
* build(deps): bump fpicalausa/remove-stale-branches from 2.4.0 to 2.6.1
* build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1
* build(deps): bump actions/download-artifact from 4.3.0 to 8.0.1
* build(deps): bump pnpm/action-setup from 5.0.0 to 6.0.8
* chore(deps): bump github.com/shamaton/msgpack/v2 to v2.4.1 and reva to v2.0.0-20260519092700-9da01c6fb954
* chore: regenerate lock fil s and vendor
* chore: changelog
* fix: bump golang.org/x/image to v0.39.0 (GO-2026-4815, GO-2026-4961, GO-2026-4962)
* fix: release fix passing version string value to image
* fix: bump release tag
* chore: bump go-git
* fix: missing fcntl64 int the build image due to GHA image update
