Add "MFA Verified" check to workflowengine

.editorconfig

@@ -23,3 +23,7 @@ trim_trailing_whitespace = false
 
 [*.svg]
 insert_final_newline = false
+
+[build/psalm-baseline.xml]
+indent_size = 2
+indent_style = space

.github/CODEOWNERS

@@ -1,16 +1,42 @@
-*/Activity/*                        @nickvergessen
-*/Notifications/*                   @nickvergessen
-/apps/dav/lib/CalDAV                @ChristophWurst @miaulalala @tcitworld
-/apps/dav/lib/CardDAV               @ChristophWurst @miaulalala @tcitworld
+# App maintainers
+/apps/admin_audit/appinfo/info.xml            @luka-nextcloud @blizzz
+/apps/cloud_federation_api/appinfo/info.xml   @mejo-
+/apps/comments/appinfo/info.xml               @marcelklehr @Pytal
+/apps/contactsinteraction/appinfo/info.xml    @kesselb @miaulalala @ChristophWurst @GretaD @hamza221 @st3iny
+/apps/dashboard/appinfo/info.xml              @julien-nc @juliushaertl
+/apps/dav/lib/CalDAV                          @ChristophWurst @miaulalala @tcitworld
+/apps/dav/lib/CardDAV                         @ChristophWurst @miaulalala @tcitworld
+/apps/encryption/appinfo/info.xml             @come-nc @icewind1991
+/apps/federatedfilesharing/appinfo/info.xml   @icewind1991 @danxuliu
+/apps/federation/appinfo/info.xml             @vitormattos @datenangebot
+/apps/files/appinfo/info.xml                  @skjnldsv @Pytal @ArtificialOwl @come-nc @artonge @icewind1991 @szaimen @susnux @Fenn-CS
+/apps/files_external/appinfo/info.xml         @icewind1991 @artonge
+/apps/files_sharing/appinfo/info.xml          @skjnldsv @come-nc
+/apps/files_trashbin/appinfo/info.xml         @Pytal @icewind1991
+/apps/files_versions/appinfo/info.xml         @artonge @icewind1991
+/apps/oauth2/appinfo/info.xml                 @julien-nc @ChristophWurst
+/apps/provisioning_api/appinfo/info.xml       @provokateurin @nickvergessen
+/apps/settings/appinfo/info.xml               @Pytal @JuliaKirschenheuter
+/apps/systemtags/appinfo/info.xml             @Antreesy @marcelklehr
+/apps/theming/appinfo/info.xml                @skjnldsv @juliushaertl
+/apps/twofactor_backupcodes/appinfo/info.xml  @st3iny @miaulalala @ChristophWurst
+/apps/updatenotification/appinfo/info.xml     @Pytal @JuliaKirschenheuter
+/apps/user_ldap/appinfo/info.xml              @come-nc @blizzz
+/apps/user_status/appinfo/info.xml            @Antreesy @nickvergessen
+/apps/weather_status/appinfo/info.xml         @julien-nc @juliushaertl
+/apps/workflowengine/appinfo/info.xml         @blizzz @juliushaertl
+
+# Security team
+/resources/config/ca-bundle.crt     @ChristophWurst @miaulalala @nickvergessen
 
 # Two-Factor Authentication
 # https://github.com/nextcloud/wg-two-factor-authentication#members
-/apps/twofactor_backupcodes        @ChristophWurst @miaulalala @nickvergessen
-*/TwoFactorAuth/*                  @ChristophWurst @miaulalala @nickvergessen
-/core/templates/twofactor*         @ChristophWurst @miaulalala @nickvergessen
+/apps/twofactor_backupcodes         @ChristophWurst @miaulalala @nickvergessen
+*/TwoFactorAuth/*                   @ChristophWurst @miaulalala @nickvergessen
+/core/templates/twofactor*          @ChristophWurst @miaulalala @nickvergessen
 
-/lib/private/Profiler              @CarlSchwan
-/lib/public/Profiler               @CarlSchwan
-
-# Security team
-resources/config/ca-bundle.crt    @ChristophWurst @julien-nc @miaulalala @nickvergessen
+# Personal interest
+*/Activity/*                        @nickvergessen
+*/Notifications/*                   @nickvergessen
+/lib/private/Profiler               @CarlSchwan
+/lib/public/Profiler                @CarlSchwan

.github/ISSUE_TEMPLATE/BUG_REPORT.yml

@@ -17,12 +17,10 @@ body:
       options:
         - label: This is a **bug**, not a question or a configuration/webserver/proxy issue.
           required: true
-        - label: This issue is **not** already reported on Github _(I've searched it)_.
+        - label: This issue is **not** already reported on [Github](https://github.com/nextcloud/server/issues?q=is%3Aopen+is%3Aissue+label%3Abug) OR [Nextcloud Community Forum](https://help.nextcloud.com/) _(I've searched it)_.
           required: true
         - label: Nextcloud Server **is** up to date. See [Maintenance and Release Schedule](https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule) for supported versions.
           required: true
-        - label: Nextcloud Server **is** running on 64bit capable CPU, PHP and OS.
-          required: true
         - label: I agree to follow Nextcloud's [Code of Conduct](https://nextcloud.com/contribute/code-of-conduct/).
           required: true
   - type: textarea
@@ -62,14 +60,14 @@ body:
         Select installation method you've used.
         _Describe the method in the "Additional info" section if you chose "Other"._
       options:
-        - "Official All-in-One appliance"
         - "Community Web installer on a VPS or web space"
         - "Community Manual installation with Archive"
         - "Community Docker image"
         - "Community NextcloudPi appliance"
         - "Community SNAP package"
         - "Community VM appliance"
         - "Other Community project"
+        - "Official All-in-One appliance"
   - type: dropdown
     id: nextcloud-version
     attributes:
@@ -78,9 +76,9 @@ body:
         Select Nextcloud Server version.
         _Versions not listed here are not maintained and not supported anymore_
       options:
-        - "24"
         - "25"
         - "26"
+        - "27"
         - "master"
     validations:
       required: true
@@ -103,10 +101,10 @@ body:
         Select PHP engine version serving Nextcloud Server.
         _Describe in the "Additional info" section if you chose "Other"._
       options:
-        - "PHP 7.3"
         - "PHP 7.4"
         - "PHP 8.0"
         - "PHP 8.1"
+        - "PHP 8.2"
         - "Other"
   - type: dropdown
     id: webserver
@@ -118,7 +116,6 @@ body:
       options:
         - "Apache (supported)"
         - "Nginx"
-        - "Lighttpd"
         - "Other"
   - type: dropdown
     id: database
@@ -141,8 +138,8 @@ body:
       description: |
         Select if bug is present after an update or on a fresh install.
       options:
-        - "Updated from a minor version (ex. 22.2.3 to 22.2.4)"
-        - "Updated to a major version (ex. 22.2.3 to 23.0.1)"
+        - "Updated from a MINOR version (ex. 22.1 to 22.2)"
+        - "Upgraded to a MAJOR version (ex. 22 to 23)"
         - "Fresh Nextcloud Server install"
   - type: dropdown
     id: encryption
@@ -192,8 +189,6 @@ body:
         ```
         > NOTE: This will be automatically formatted into code for better readability.
       render: shell
-    validations:
-      required: true
   - type: textarea
     id: nextcloud-signingstatus
     attributes:

.github/dependabot.yml

@@ -64,7 +64,7 @@ updates:
     day: saturday
     time: "03:00"
     timezone: Europe/Paris
-  target-branch: stable24
+  target-branch: stable25
   labels:
     - "3. to review"
     - "feature: dependencies"
@@ -74,6 +74,8 @@ updates:
     # ignore all GitHub linguist patch updates
     - dependency-name: "*"
       update-types: ["version-update:semver-major", "version-update:semver-minor", "version-update:semver-patch"]
+  # Disable automatic rebasing because without a build CI will likely fail anyway
+  rebase-strategy: "disabled"
 
 - package-ecosystem: npm
   directory: "/"
@@ -82,7 +84,7 @@ updates:
     day: saturday
     time: "03:00"
     timezone: Europe/Paris
-  target-branch: stable25
+  target-branch: stable26
   labels:
     - "3. to review"
     - "feature: dependencies"
@@ -92,6 +94,8 @@ updates:
     # ignore all GitHub linguist patch updates
     - dependency-name: "*"
       update-types: ["version-update:semver-major", "version-update:semver-minor", "version-update:semver-patch"]
+  # Disable automatic rebasing because without a build CI will likely fail anyway
+  rebase-strategy: "disabled"
 
 - package-ecosystem: npm
   directory: "/"
@@ -100,7 +104,7 @@ updates:
     day: saturday
     time: "03:00"
     timezone: Europe/Paris
-  target-branch: stable26
+  target-branch: stable27
   labels:
     - "3. to review"
     - "feature: dependencies"
@@ -110,6 +114,8 @@ updates:
     # ignore all GitHub linguist patch updates
     - dependency-name: "*"
       update-types: ["version-update:semver-major", "version-update:semver-minor", "version-update:semver-patch"]
+  # Disable automatic rebasing because without a build CI will likely fail anyway
+  rebase-strategy: "disabled"
 
 # Testing StableXX composer
 - package-ecosystem: composer
@@ -119,7 +125,7 @@ updates:
     day: saturday
     time: "03:00"
     timezone: Europe/Paris
-  target-branch: stable24
+  target-branch: stable25
   labels:
     - "3. to review"
     - "feature: dependencies"
@@ -137,7 +143,7 @@ updates:
     day: saturday
     time: "03:00"
     timezone: Europe/Paris
-  target-branch: stable25
+  target-branch: stable26
   labels:
     - "3. to review"
     - "feature: dependencies"
@@ -147,3 +153,30 @@ updates:
     # ignore all GitHub linguist patch updates
     - dependency-name: "*"
       update-types: ["version-update:semver-major", "version-update:semver-minor", "version-update:semver-patch"]
+
+- package-ecosystem: composer
+  directory: "/build/integration"
+  schedule:
+    interval: weekly
+    day: saturday
+    time: "03:00"
+    timezone: Europe/Paris
+  target-branch: stable27
+  labels:
+    - "3. to review"
+    - "feature: dependencies"
+  reviewers:
+    - "nextcloud/server-dependabot"
+  ignore:
+    # ignore all GitHub linguist patch updates
+    - dependency-name: "*"
+      update-types: ["version-update:semver-major", "version-update:semver-minor", "version-update:semver-patch"]
+
+# GitHub Actions
+- package-ecosystem: "github-actions"
+  directory: "/"
+  schedule:
+    interval: weekly
+    day: saturday
+    time: "03:00"
+    timezone: Europe/Paris

.github/workflows/block-merge-eol.yml

@@ -3,10 +3,17 @@
 # https://github.com/nextcloud/.github
 # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
 
-name: Pull request checks
+name: Block merges for EOL
 
 on: pull_request
 
+permissions:
+  contents: read
+
+concurrency:
+  group: block-merge-eol-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   block-merges-eol:
     name: Block merges for EOL branches
@@ -24,7 +31,7 @@ jobs:
           # retrieve version number from branch reference
           server_major=$(echo "${{ github.base_ref }}" | sed -En 's/stable//p')
           echo "server_major=$server_major" >> $GITHUB_ENV
- 
+
       - name: Checking if ${{ env.server_major }} is EOL
         run: |
-          php -r 'echo json_encode(require_once "config.php");' | jq --arg version "${{ env.server_major }}" '.stable[$version]["100"].eol' | grep --silent -i 'false'
+          php -r 'echo json_encode(require_once "config.php");' | jq --arg version "${{ env.server_major }}" '.stable[$version]["100"].eol // .beta[$version]["100"].eol' | grep --silent -i 'false'

.github/workflows/block-merge-freeze.yml

@@ -3,13 +3,24 @@
 # https://github.com/nextcloud/.github
 # https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
 
-name: Pull request checks
+name: Block merges during freezes
 
-on: pull_request
+on:
+  pull_request:
+    types: [opened, ready_for_review, reopened, synchronize]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: block-merge-freeze-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
 
 jobs:
   block-merges-during-freeze:
-    name: Block merges during feature freezes
+    name: Block merges during freezes
+
+    if: github.event.pull_request.draft == false
 
     runs-on: ubuntu-latest
 

.github/workflows/command-compile.yml

@@ -18,43 +18,43 @@ jobs:
 
     steps:
       - name: Check actor permission
-        uses: skjnldsv/check-actor-permission@v2
+        uses: skjnldsv/check-actor-permission@e591dbfe838300c007028e1219ca82cc26e8d7c5 # v2
         with:
           require: write
 
       - name: Add reaction on start
-        uses: peter-evans/create-or-update-comment@v1
+        uses: peter-evans/create-or-update-comment@c6c9a1a66007646a28c153e2a8580a5bad27bcfa # v3.0.1
         with:
           token: ${{ secrets.COMMAND_BOT_PAT }}
           repository: ${{ github.event.repository.full_name }}
           comment-id: ${{ github.event.comment.id }}
-          reaction-type: "+1"
+          reactions: "+1"
 
       - name: Parse command
-        uses: skjnldsv/parse-command-comment@master
+        uses: skjnldsv/parse-command-comment@7cef1df370a99dfd5bf896d50121390c96785db8 # v2
         id: command
 
       # Init path depending on which command is run
       - name: Init path
         id: git-path
-        run: |    
+        run: |
           if ${{ startsWith(steps.command.outputs.arg1, '/') }}; then
-            echo "::set-output name=path::${{ github.workspace }}${{steps.command.outputs.arg1}}"
+            echo "path=${{ github.workspace }}${{steps.command.outputs.arg1}}" >> $GITHUB_OUTPUT
           else
-            echo "::set-output name=path::${{ github.workspace }}${{steps.command.outputs.arg2}}"
+            echo "path=${{ github.workspace }}${{steps.command.outputs.arg2}}" >> $GITHUB_OUTPUT
           fi
 
       - name: Init branch
-        uses: xt0rted/pull-request-comment-branch@v1
+        uses: xt0rted/pull-request-comment-branch@d97294d304604fa98a2600a6e2f916a84b596dc7 # v1
         id: comment-branch
-    
+
   process:
     runs-on: ubuntu-latest
     needs: init
 
     steps:
       - name: Checkout ${{ needs.init.outputs.head_ref }}
-        uses: actions/checkout@v3
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
         with:
           token: ${{ secrets.COMMAND_BOT_PAT }}
           fetch-depth: 0
@@ -66,14 +66,14 @@ jobs:
           git config --local user.name "nextcloud-command"
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@v1
+        uses: skjnldsv/read-package-engines-version-actions@8205673bab74a63eb9b8093402fd9e0e018663a1 # v2.1
         id: package-engines-versions
         with:
-          fallbackNode: '^12'
-          fallbackNpm: '^6'
+          fallbackNode: '^16'
+          fallbackNpm: '^7'
 
       - name: Set up node ${{ steps.package-engines-versions.outputs.nodeVersion }}
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3
         with:
           node-version: ${{ steps.package-engines-versions.outputs.nodeVersion }}
           cache: npm
@@ -90,7 +90,7 @@ jobs:
         if: ${{ needs.init.outputs.arg1 != 'fixup' && needs.init.outputs.arg1 != 'amend' }}
         run: |
           git add ${{ needs.init.outputs.git_path }}
-          git commit --signoff -m 'Compile assets'
+          git commit --signoff -m 'chore(assets): Recompile assets'
           git push origin ${{ needs.init.outputs.head_ref }}
 
       - name: Commit and push fixup
@@ -108,10 +108,10 @@ jobs:
           git push --force origin ${{ needs.init.outputs.head_ref }}
 
       - name: Add reaction on failure
-        uses: peter-evans/create-or-update-comment@v1
+        uses: peter-evans/create-or-update-comment@c6c9a1a66007646a28c153e2a8580a5bad27bcfa # v3.0.1
         if: failure()
         with:
           token: ${{ secrets.COMMAND_BOT_PAT }}
           repository: ${{ github.event.repository.full_name }}
           comment-id: ${{ github.event.comment.id }}
-          reaction-type: "-1"
+          reactions: "-1"