ci: run unit tests, code style and trivy on the 2.3.x line - #367
Open
oc-tmueller wants to merge 1 commit into
Open
ci: run unit tests, code style and trivy on the 2.3.x line#367oc-tmueller wants to merge 1 commit into
oc-tmueller wants to merge 1 commit into
Conversation
The 2.3 line only had release.yml, so anything landing on release-2.3.4 - including security backports - merged with no test evidence at all. The drone pipeline this branch still carries is dead. Port the master workflows, adjusted for the branch: - main.yml runs semantic-git-messages, php-codestyle and php-unit against php 7.4 and core 10.16. Both core-ref and core-ref-php74 have to be set, because the reusable workflows ignore core-ref on 7.4. - security-scan.yml builds the tree to scan with php 7.4. - lint-pr-title.yml is a verbatim copy - the repo squash-merges, so the PR title becomes the commit message. No build job: build.yml has no php-version input and would run "make dist" on the runner default php. release.yml already builds the tarball on tag, which is how v2.3.4 shipped. No acceptance job either - the reusable acceptance workflow installs a hardcoded 11.x daily server, which an app declaring max-version="10" cannot be enabled on. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
This was referenced Sep 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
release-2.3.4carries only.github/workflows/release.yml(added in #362 so the branch could be tagged) plus the dead.drone.star. Anything landing here - including the security backport in the follow-up PR of this stack - merges with no test evidence at all.What
Ports the
masterworkflows, adjusted for this branch:mastermain.ymlPHP_VERSIONS: '["7.4"]', newCORE_REF: '10.16'passed as bothcore-refandcore-ref-php74(the reusable workflows ignorecore-refon 7.4),pushtrigger onrelease-2.3.4security-scan.ymlphp-version: '7.4'so the scanned tree is built with 7.4lint-pr-title.ymlSame shape as the equivalent port on
owncloud/oauth2release-0.6(owncloud/oauth2#391).Omitted on purpose, both documented in a comment in
main.yml:build.ymlhas nophp-versioninput, so it would runmake diston the runner default php.release.ymlalready builds the tarball on tag, which is how v2.3.4 shipped itsopenidconnect.tar.gz.owncloud-daily-master-qa.tar.bz2(11.x) with theowncloudci/core:php83image, and an app declaringmax-version="10"cannot be enabled on that server.No production code is touched.
Makefile,phpunit.xml,phpstan.neon,.phanand.php-cs-fixer.dist.phpall already exist on this branch, so every target the reusable workflows invoke is present.Heads-up on the new gates
This is the first time these checks run on the 2.3 line, so they may flag pre-existing state rather than anything this PR introduces:
vendor-bin/owncloud-codestyle/composer.jsonpinsowncloud/coding-standard: ^4.1here vs^5.3onmaster.master, this branch vendors phpseclib instead ofprovide-ing it, so trivy scans a different tree.If either comes back red on code this PR does not touch, that gets its own issue - it should not widen the security backport that follows.
Stack
fix:backport of fix: verify token audience to prevent cross-client account takeover #356 and fix: verify token audience for introspected opaque tokens #365 (the audience checks) to the 10.x linechore:bump to 2.3.5Tests
Green CI on this PR is the test.