Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/dispatch-workflow-repo.yml
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ jobs:
if [ -f "$workflow" ]; then
filename=$(basename "$workflow")
target_file="./target/.github/workflows/$filename"

# Only copy if the file exists in the target repository
if [ -f "$target_file" ]; then
echo "Updating existing workflow: $filename"
Expand Down
10 changes: 7 additions & 3 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ SPDX-License-Identifier: MIT

# This repository contains Nextcloud's workflow templates

## Setup a new template on your repository
## Set up a new template on your repository

When creating a new workflow on your repository, you will see templates originating from here.
https://github.com/nextcloud/viewer/actions/new
Expand All @@ -18,10 +18,13 @@ There is a GitHub action for that as well. Simply install
https://github.com/nextcloud/.github/blob/master/workflow-templates/sync-workflow-templates.yml
into your repository and a cron job will update the workflows from the template every sunday morning.

> [!NOTE]
> [!IMPORTANT]
> GitHub does not allow pull request that touch workflows to be auto-approved and auto-merged to improve security.
> But it's at least much easier to be aware of the updates and you just need to approve and merge the PRs.

> [!WARNING]
> Do not forget to check the diff for conflicts and missing patches before approving, especially when updating the workflows on stable branches!

## Patching workflows

It's also possible to customise workflows by putting a `workflow.yml.patch` file right next to it.
Expand All @@ -38,7 +41,8 @@ If there was an error it will be outlined in the PR description.

You can also run the following shell script on your machine to update all workflows of an app. It should be run inside the cloned repository of an app and requires rsync to be installed.

⚠️ Do not forget to check the diff for unwanted changes before committing, especially when updating the workflows on stable branches!
> [!WARNING]
> Do not forget to check the diff for unwanted changes before committing, especially when updating the workflows on stable branches!

```sh
#!/bin/sh
Expand Down
40 changes: 20 additions & 20 deletions SECURITY.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,14 +3,14 @@ SPDX-FileCopyrightText: 2021-2024 Nextcloud GmbH and Nextcloud contributors
SPDX-License-Identifier: MIT
-->

# Security Policy
# Security Policy

## 💡 TLDR: Report security issues at [hackerone.com/nextcloud](https://hackerone.com/nextcloud)

### Found a security bug in Nextcloud? Let's get it fixed!

If you believe you have found an issue that meets our
[definition of a security vulnerability](https://nextcloud.com/security/threat-model),
If you believe you have found an issue that meets our
[definition of a security vulnerability](https://nextcloud.com/security/threat-model),
we encourage you to let us know right away. Please use the reporting process described below.

| If you are a... | See section... |
Expand All @@ -36,8 +36,8 @@ Your report should include:

If you require encrypted communication, please request it in your initial message.

> **Note:** This process is for confidential reporting of software vulnerabilities only.
> For general support or configuration help, see
> **Note:** This process is for confidential reporting of software vulnerabilities only.
> For general support or configuration help, see
> [Nextcloud Support](https://nextcloud.com/support/).

## What to Expect After Reporting
Expand All @@ -50,42 +50,42 @@ A member of our security team will:
- Follow up with any questions
- Coordinate the fix and public disclosure

We apply, test, and release fixes for all relevant, supported stable branches in the next
security update. Vulnerabilities are publicly announced after the fix is released. As a thank
We apply, test, and release fixes for all relevant, supported stable branches in the next
security update. Vulnerabilities are publicly announced after the fix is released. As a thank
you, we will add your name to our [Hall of Fame](https://hackerone.com/nextcloud/thanks).

If your report concerns an app not maintained by Nextcloud (e.g., community-maintained apps
hosted by Nextcloud or hosted elsewhere), our security team will coordinate with the current
If your report concerns an app not maintained by Nextcloud (e.g., community-maintained apps
hosted by Nextcloud or hosted elsewhere), our security team will coordinate with the current
maintainer to help resolve the issue in a similar fashion.

## Bug Bounties

If you are interested in a bug bounty, please note that complete, detailed reports can
contribute to higher bounty awards. Details on past bounties are available at
If you are interested in a bug bounty, please note that complete, detailed reports can
contribute to higher bounty awards. Details on past bounties are available at
[HackerOne](https://hackerone.com/nextcloud).

## Security Advisories

Published advisories for Nextcloud Server, Clients, and Apps are available at the
[Nextcloud Security Advisories](https://github.com/nextcloud/security-advisories/security/advisories)
Published advisories for Nextcloud Server, Clients, and Apps are available at the
[Nextcloud Security Advisories](https://github.com/nextcloud/security-advisories/security/advisories)
page.

## Supported Versions

Each major release of Nextcloud Server receives security updates for one year from its
initial release date. The Nextcloud project typically supports at least the two most recent
Each major release of Nextcloud Server receives security updates for one year from its
initial release date. The Nextcloud project typically supports at least the two most recent
major releases.

To stay protected:
- Ensure your Nextcloud Server is always running a supported major release
- Promptly apply all maintenance releases (these include critical security and functionality
- Promptly apply all maintenance releases (these include critical security and functionality
bug fixes)
- Monitor the end-of-life (EOL) date for your major release (after this date, no further
maintenance releases will be published. Upgrading to a newer major release is strongly
- Monitor the end-of-life (EOL) date for your major release (after this date, no further
maintenance releases will be published. Upgrading to a newer major release is strongly
recommended.)

See the
[Maintenance and Release Schedule](https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule)
See the
[Maintenance and Release Schedule](https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule)
for details.

---
Expand Down
2 changes: 1 addition & 1 deletion workflow-templates/phpunit-mysql.yml
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@ jobs:
uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
with:
working-directory: apps/${{ env.APP_NAME }}

- name: Set up Nextcloud
env:
DB_PORT: 4444
Expand Down
2 changes: 1 addition & 1 deletion workflow-templates/phpunit-oci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -145,7 +145,7 @@ jobs:
uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
with:
working-directory: apps/${{ env.APP_NAME }}

- name: Set up Nextcloud
env:
DB_PORT: 1521
Expand Down
2 changes: 1 addition & 1 deletion workflow-templates/phpunit-pgsql.yml
Original file line number Diff line number Diff line change
Expand Up @@ -136,7 +136,7 @@ jobs:
uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
with:
working-directory: apps/${{ env.APP_NAME }}

- name: Set up Nextcloud
env:
DB_PORT: 4444
Expand Down
2 changes: 1 addition & 1 deletion workflow-templates/phpunit-sqlite.yml
Original file line number Diff line number Diff line change
Expand Up @@ -125,7 +125,7 @@ jobs:
uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
with:
working-directory: apps/${{ env.APP_NAME }}

- name: Set up Nextcloud
env:
DB_PORT: 4444
Expand Down
2 changes: 1 addition & 1 deletion workflow-templates/psalm-matrix.yml
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ jobs:

- name: Install composer dependencies
uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0

- name: Install nextcloud/ocp:${{ matrix.ocp-version }}
env:
OCP_VERSION: ${{ matrix.ocp-version }}
Expand Down
2 changes: 1 addition & 1 deletion workflow-templates/psalm.yml
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ jobs:

- name: Install composer dependencies
uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0

- name: Install nextcloud/ocp:dev-${{ steps.versions.outputs.branches-max }}
run: composer require --dev nextcloud/ocp:dev-${{ steps.versions.outputs.branches-max }} --ignore-platform-reqs --with-dependencies

Expand Down
2 changes: 1 addition & 1 deletion workflow-templates/rector-apply.yml
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ jobs:

- name: Install composer dependencies
uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0

- name: Rector
run: composer run rector

Expand Down
Loading