From 5ab443dd75abc45f2d5541d8b12dfe4cd042fed0 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Date: Thu, 5 Nov 2026 01:57:57 +0000
Subject: [PATCH 01/11] ci: use PHP 8.5 and reject stale published release
 actions

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
---
 actions/nextcloud-appstore-publish/action.yml | 17 +++++++++++++++--
 tests/test_release_tool_pins.py               |  7 +++++++
 tests/test_release_workflow_architecture.py   | 11 +++++++++++
 3 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/actions/nextcloud-appstore-publish/action.yml b/actions/nextcloud-appstore-publish/action.yml
index 3f66b68..c15c428 100644
--- a/actions/nextcloud-appstore-publish/action.yml
+++ b/actions/nextcloud-appstore-publish/action.yml
@@ -40,6 +40,19 @@ inputs:
 runs:
   using: composite
   steps:
+    - name: Verify publisher action matches current catalog
+      shell: bash
+      run: |
+        set -euo pipefail
+        catalog_action="$(mktemp)"
+        trap 'rm -f "${catalog_action}"' EXIT
+        curl --fail --silent --show-error --location --retry 3 \
+          https://raw.githubusercontent.com/LibreCodeCoop/.github/main/actions/nextcloud-appstore-publish/action.yml \
+          --output "${catalog_action}"
+        if ! cmp --silent "${GITHUB_ACTION_PATH}/action.yml" "${catalog_action}"; then
+          echo "::error::The pinned App Store publisher differs from the current LibreCodeCoop/.github catalog. Synchronize the workflow template to refresh the immutable Action pin before releasing."
+          exit 1
+        fi
     - name: Check actor permission
       uses: LibreCodeCoop/release-tool/actions/authorization-check@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
       with:
@@ -255,10 +268,10 @@ runs:
         cd "${APP_NAME}/build/artifacts"
         tar -zcvf "${APP_NAME}.tar.gz" "${APP_NAME}"
 
-    - name: Set up PHP 8.3 for release-tool
+    - name: Set up PHP 8.5 for release-tool
       uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
       with:
-        php-version: '8.3'
+        php-version: '8.5'
         coverage: none
       env:
         GITHUB_TOKEN: ${{ inputs.github-token }}
diff --git a/tests/test_release_tool_pins.py b/tests/test_release_tool_pins.py
index 73f916b..fe4b1a8 100644
--- a/tests/test_release_tool_pins.py
+++ b/tests/test_release_tool_pins.py
@@ -22,6 +22,13 @@ def test_prepare_release_keeps_trusted_pipeline_contract(self) -> None:
         self.assertIn("post-merge-event: pull_request_target", content)
         self.assertIn('git fetch --quiet origin "+refs/heads/main:refs/remotes/origin/main"', content)
 
+    def test_publisher_blocks_stale_immutable_action_pin(self) -> None:
+        content = (ROOT / 'actions/nextcloud-appstore-publish/action.yml').read_text(encoding='utf-8')
+        self.assertIn('Verify publisher action matches current catalog', content)
+        self.assertIn('LibreCodeCoop/.github/main/actions/nextcloud-appstore-publish/action.yml', content)
+        self.assertIn('cmp --silent "${GITHUB_ACTION_PATH}/action.yml" "${catalog_action}"', content)
+        self.assertIn('exit 1', content)
+
     def test_release_tool_consumers_use_same_release(self) -> None:
         for path in SURFACES:
             content = path.read_text(encoding="utf-8")
diff --git a/tests/test_release_workflow_architecture.py b/tests/test_release_workflow_architecture.py
index 1f90a3a..1ca00f1 100644
--- a/tests/test_release_workflow_architecture.py
+++ b/tests/test_release_workflow_architecture.py
@@ -43,6 +43,17 @@ def test_prepare_release_preserves_privileged_event_guards(self) -> None:
         self.assertIn("contains(github.event.pull_request.body, '<!-- release-tool:preparation ')", content)
         self.assertNotIn("paths-ignore:", content)
 
+    def test_publisher_switches_to_php85_after_signing(self) -> None:
+        content = PUBLISH.read_text()
+        self.assertNotIn('Set up PHP 8.3 for release-tool', content)
+        self.assertNotIn("php-version: '8.3'", content)
+        signing = content.index('php nextcloud/occ integrity:sign-app')
+        switch = content.index('name: Set up PHP 8.5 for release-tool')
+        self.assertLess(signing, switch)
+        validation = content.index('uses: LibreCodeCoop/release-tool/actions/artifact-validate@')
+        self.assertLess(switch, validation)
+        self.assertIn("php-version: '8.5'", content[switch:validation])
+
     def test_action_pins_are_immutable(self) -> None:
         for path in (NIGHTLY, PUBLISH, PREPARE):
             with self.subTest(file=path.name):

From 9f61fad11a7a8ccabb59ddd1cb47fd031dd7c2f1 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Date: Thu, 5 Nov 2026 01:59:44 +0000
Subject: [PATCH 02/11] ci: pin the PHP 8.5 publisher in the shared workflow
 catalog

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
---
 tests/test_appstore_publication_contract.py   | 2 +-
 workflow-templates/appstore-build-publish.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/test_appstore_publication_contract.py b/tests/test_appstore_publication_contract.py
index 8d1ee0f..f853665 100644
--- a/tests/test_appstore_publication_contract.py
+++ b/tests/test_appstore_publication_contract.py
@@ -26,7 +26,7 @@ def test_owned_template_is_not_regenerated_from_upstream(self) -> None:
 
     def test_consumer_template_is_thin_wrapper(self) -> None:
         content = TEMPLATE.read_text(encoding="utf-8")
-        self.assertIn("LibreCodeCoop/.github/actions/nextcloud-appstore-publish@600b84354bdbb2da4fc32e9d4eecac1fcce60666", content)
+        self.assertRegex(content, r"uses: LibreCodeCoop/\.github/actions/nextcloud-appstore-publish@[0-9a-f]{40}")
         self.assertNotIn("\n        run: |", content)
         self.assertLessEqual(len(content.splitlines()), 40)
 
diff --git a/workflow-templates/appstore-build-publish.yml b/workflow-templates/appstore-build-publish.yml
index 7a42936..fd38e86 100644
--- a/workflow-templates/appstore-build-publish.yml
+++ b/workflow-templates/appstore-build-publish.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Build and publish release
-        uses: LibreCodeCoop/.github/actions/nextcloud-appstore-publish@600b84354bdbb2da4fc32e9d4eecac1fcce60666 # main at 600b843
+        uses: LibreCodeCoop/.github/actions/nextcloud-appstore-publish@5ab443dd75abc45f2d5541d8b12dfe4cd042fed0 # PHP 8.5 publisher
         with:
           app-name: ${{ github.event.repository.name }}
           release-tag: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.event.release.tag_name }}

From cf5e78c9eea659385f06c232a6f449c343c41ef6 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Date: Thu, 5 Nov 2026 02:04:15 +0000
Subject: [PATCH 03/11] fix: preserve explicit manual recovery for older
 release actions

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
---
 actions/nextcloud-appstore-publish/action.yml | 1 +
 tests/test_release_tool_pins.py               | 1 +
 2 files changed, 2 insertions(+)

diff --git a/actions/nextcloud-appstore-publish/action.yml b/actions/nextcloud-appstore-publish/action.yml
index c15c428..2f5fda5 100644
--- a/actions/nextcloud-appstore-publish/action.yml
+++ b/actions/nextcloud-appstore-publish/action.yml
@@ -41,6 +41,7 @@ runs:
   using: composite
   steps:
     - name: Verify publisher action matches current catalog
+      if: inputs.manual-recovery != 'true'
       shell: bash
       run: |
         set -euo pipefail
diff --git a/tests/test_release_tool_pins.py b/tests/test_release_tool_pins.py
index fe4b1a8..926ff3a 100644
--- a/tests/test_release_tool_pins.py
+++ b/tests/test_release_tool_pins.py
@@ -25,6 +25,7 @@ def test_prepare_release_keeps_trusted_pipeline_contract(self) -> None:
     def test_publisher_blocks_stale_immutable_action_pin(self) -> None:
         content = (ROOT / 'actions/nextcloud-appstore-publish/action.yml').read_text(encoding='utf-8')
         self.assertIn('Verify publisher action matches current catalog', content)
+        self.assertIn("if: inputs.manual-recovery != 'true'", content)
         self.assertIn('LibreCodeCoop/.github/main/actions/nextcloud-appstore-publish/action.yml', content)
         self.assertIn('cmp --silent "${GITHUB_ACTION_PATH}/action.yml" "${catalog_action}"', content)
         self.assertIn('exit 1', content)

From 8b97fa506f8e8cbfd4e0fc570b5ae8565831d1f0 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Date: Thu, 5 Nov 2026 02:05:19 +0000
Subject: [PATCH 04/11] ci: repin publisher after manual recovery guard

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
---
 workflow-templates/appstore-build-publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/workflow-templates/appstore-build-publish.yml b/workflow-templates/appstore-build-publish.yml
index fd38e86..cb75615 100644
--- a/workflow-templates/appstore-build-publish.yml
+++ b/workflow-templates/appstore-build-publish.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Build and publish release
-        uses: LibreCodeCoop/.github/actions/nextcloud-appstore-publish@5ab443dd75abc45f2d5541d8b12dfe4cd042fed0 # PHP 8.5 publisher
+        uses: LibreCodeCoop/.github/actions/nextcloud-appstore-publish@cf5e78c9eea659385f06c232a6f449c343c41ef6 # PHP 8.5 publisher
         with:
           app-name: ${{ github.event.repository.name }}
           release-tag: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.event.release.tag_name }}

From c0003b53593492222bc830b738c3b033eb0f4948 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Date: Thu, 5 Nov 2026 02:07:04 +0000
Subject: [PATCH 05/11] ci: reject publisher versions behind latest
 release-tool

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
---
 actions/nextcloud-appstore-publish/action.yml | 14 ++++++++++++++
 tests/test_release_tool_pins.py               |  4 ++++
 2 files changed, 18 insertions(+)

diff --git a/actions/nextcloud-appstore-publish/action.yml b/actions/nextcloud-appstore-publish/action.yml
index 2f5fda5..b68dd46 100644
--- a/actions/nextcloud-appstore-publish/action.yml
+++ b/actions/nextcloud-appstore-publish/action.yml
@@ -43,6 +43,8 @@ runs:
     - name: Verify publisher action matches current catalog
       if: inputs.manual-recovery != 'true'
       shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.github-token }}
       run: |
         set -euo pipefail
         catalog_action="$(mktemp)"
@@ -54,6 +56,18 @@ runs:
           echo "::error::The pinned App Store publisher differs from the current LibreCodeCoop/.github catalog. Synchronize the workflow template to refresh the immutable Action pin before releasing."
           exit 1
         fi
+
+        pinned_shas="$(grep -oE 'LibreCodeCoop/release-tool/actions/[a-z-]+@[0-9a-f]{40}' "${GITHUB_ACTION_PATH}/action.yml" | sed -E 's/.*@//' | sort -u)"
+        if [[ ! "${pinned_shas}" =~ ^[0-9a-f]{40}$ ]]; then
+          echo "::error::The shared publisher must use one immutable release-tool revision."
+          exit 1
+        fi
+        latest_tag="$(gh api repos/LibreCodeCoop/release-tool/releases/latest --jq '.tag_name')"
+        latest_sha="$(gh api "repos/LibreCodeCoop/release-tool/git/ref/tags/${latest_tag}" --jq '.object.sha')"
+        if [[ "${pinned_shas}" != "${latest_sha}" ]]; then
+          echo "::error::The publisher pins release-tool ${pinned_shas}, but latest published ${latest_tag} is ${latest_sha}. Update all catalog pins before publishing."
+          exit 1
+        fi
     - name: Check actor permission
       uses: LibreCodeCoop/release-tool/actions/authorization-check@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
       with:
diff --git a/tests/test_release_tool_pins.py b/tests/test_release_tool_pins.py
index 926ff3a..3e258bc 100644
--- a/tests/test_release_tool_pins.py
+++ b/tests/test_release_tool_pins.py
@@ -29,6 +29,10 @@ def test_publisher_blocks_stale_immutable_action_pin(self) -> None:
         self.assertIn('LibreCodeCoop/.github/main/actions/nextcloud-appstore-publish/action.yml', content)
         self.assertIn('cmp --silent "${GITHUB_ACTION_PATH}/action.yml" "${catalog_action}"', content)
         self.assertIn('exit 1', content)
+        self.assertIn('repos/LibreCodeCoop/release-tool/releases/latest', content)
+        self.assertIn('repos/LibreCodeCoop/release-tool/git/ref/tags/${latest_tag}', content)
+        self.assertIn('pinned_shas', content)
+        self.assertIn('latest_sha', content)
 
     def test_release_tool_consumers_use_same_release(self) -> None:
         for path in SURFACES:

From 17d9c0eb7b1beb69e3aaab996dd1ac133e805c75 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Date: Thu, 5 Nov 2026 02:07:21 +0000
Subject: [PATCH 06/11] ci: synchronize latest-release guard in publisher pin

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
---
 workflow-templates/appstore-build-publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/workflow-templates/appstore-build-publish.yml b/workflow-templates/appstore-build-publish.yml
index cb75615..c475118 100644
--- a/workflow-templates/appstore-build-publish.yml
+++ b/workflow-templates/appstore-build-publish.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Build and publish release
-        uses: LibreCodeCoop/.github/actions/nextcloud-appstore-publish@cf5e78c9eea659385f06c232a6f449c343c41ef6 # PHP 8.5 publisher
+        uses: LibreCodeCoop/.github/actions/nextcloud-appstore-publish@c0003b53593492222bc830b738c3b033eb0f4948 # PHP 8.5 publisher
         with:
           app-name: ${{ github.event.repository.name }}
           release-tag: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.event.release.tag_name }}

From 2e9097e9448d4a4b53101078d569c57dc9970e7b Mon Sep 17 00:00:00 2001
From: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Date: Thu, 5 Nov 2026 02:41:30 +0000
Subject: [PATCH 07/11] ci: align release automation with published
 release-tool v0.12.0

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
---
 actions/nextcloud-appstore-publish/action.yml | 10 +++++-----
 tests/test_release_tool_pins.py               |  2 +-
 workflow-templates/nightly-release.yml        |  8 ++++----
 workflow-templates/prepare-release.yml        |  6 +++---
 4 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/actions/nextcloud-appstore-publish/action.yml b/actions/nextcloud-appstore-publish/action.yml
index b68dd46..d2cc904 100644
--- a/actions/nextcloud-appstore-publish/action.yml
+++ b/actions/nextcloud-appstore-publish/action.yml
@@ -69,7 +69,7 @@ runs:
           exit 1
         fi
     - name: Check actor permission
-      uses: LibreCodeCoop/release-tool/actions/authorization-check@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+      uses: LibreCodeCoop/release-tool/actions/authorization-check@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
       with:
         github-token: ${{ inputs.github-token }}
         repository: ${{ github.repository }}
@@ -107,7 +107,7 @@ runs:
 
     - name: Validate release identity
       id: release_identity
-      uses: LibreCodeCoop/release-tool/actions/release-identity@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+      uses: LibreCodeCoop/release-tool/actions/release-identity@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
       with:
         tag: ${{ inputs.release-tag }}
         working-directory: ${{ inputs.app-name }}
@@ -115,7 +115,7 @@ runs:
 
     - name: Inspect application build metadata
       id: build_metadata
-      uses: LibreCodeCoop/release-tool/actions/build-inspect@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+      uses: LibreCodeCoop/release-tool/actions/build-inspect@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
       with:
         root: ${{ inputs.app-name }}
 
@@ -292,7 +292,7 @@ runs:
         GITHUB_TOKEN: ${{ inputs.github-token }}
 
     - name: Validate release artifact
-      uses: LibreCodeCoop/release-tool/actions/artifact-validate@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+      uses: LibreCodeCoop/release-tool/actions/artifact-validate@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
       with:
         artifact: ${{ inputs.app-name }}/build/artifacts/${{ inputs.app-name }}.tar.gz
         app-name: ${{ inputs.app-name }}
@@ -321,7 +321,7 @@ runs:
         app_private_key: ${{ inputs.app-private-key }}
 
     - name: Verify App Store publication
-      uses: LibreCodeCoop/release-tool/actions/appstore-publication-wait@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+      uses: LibreCodeCoop/release-tool/actions/appstore-publication-wait@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
       with:
         app-name: ${{ inputs.app-name }}
         version: ${{ steps.release_identity.outputs.version }}
diff --git a/tests/test_release_tool_pins.py b/tests/test_release_tool_pins.py
index 3e258bc..c1ad541 100644
--- a/tests/test_release_tool_pins.py
+++ b/tests/test_release_tool_pins.py
@@ -7,7 +7,7 @@
 
 
 ROOT = Path(__file__).resolve().parents[1]
-RELEASE_TOOL_RELEASE_SHA = "30ba5d8a33089331d829f586546d34cd45a529d7"
+RELEASE_TOOL_RELEASE_SHA = "51355769089a6796c23d6c966108afbdaf858c32"
 SURFACES = (
     ROOT / "workflow-templates/prepare-release.yml",
     ROOT / "workflow-templates/nightly-release.yml",
diff --git a/workflow-templates/nightly-release.yml b/workflow-templates/nightly-release.yml
index bead5b3..c446f00 100644
--- a/workflow-templates/nightly-release.yml
+++ b/workflow-templates/nightly-release.yml
@@ -29,7 +29,7 @@ jobs:
     steps:
       - id: stable
         name: Resolve stable release line
-        uses: LibreCodeCoop/release-tool/actions/stable-select@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+        uses: LibreCodeCoop/release-tool/actions/stable-select@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
         with:
           github-token: ${{ github.token }}
 
@@ -62,7 +62,7 @@ jobs:
 
       - name: Inspect checked-out stable metadata
         id: build_metadata
-        uses: LibreCodeCoop/release-tool/actions/build-inspect@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+        uses: LibreCodeCoop/release-tool/actions/build-inspect@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
         with:
           root: ${{ env.APP_NAME }}
 
@@ -196,7 +196,7 @@ jobs:
           tar -zcf "${APP_NAME}.tar.gz" "${APP_NAME}"
 
       - name: Validate release artifact
-        uses: LibreCodeCoop/release-tool/actions/artifact-validate@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+        uses: LibreCodeCoop/release-tool/actions/artifact-validate@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
         with:
           artifact: ${{ env.APP_NAME }}/build/artifacts/${{ env.APP_NAME }}.tar.gz
           app-name: ${{ env.APP_NAME }}
@@ -222,7 +222,7 @@ jobs:
 
       - name: Build nightly change list
         id: release-note-changes
-        uses: LibreCodeCoop/release-tool/actions/release-notes@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+        uses: LibreCodeCoop/release-tool/actions/release-notes@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
         with:
           repository: ${{ github.repository }}
           branch: ${{ steps.nightly.outputs.branch }}
diff --git a/workflow-templates/prepare-release.yml b/workflow-templates/prepare-release.yml
index d35aec1..b618005 100644
--- a/workflow-templates/prepare-release.yml
+++ b/workflow-templates/prepare-release.yml
@@ -87,7 +87,7 @@ jobs:
           git fetch --quiet origin "+refs/heads/main:refs/remotes/origin/main"
 
       - name: Prepare release
-        uses: LibreCodeCoop/release-tool/actions/prepare@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+        uses: LibreCodeCoop/release-tool/actions/prepare@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
         with:
           branch: ${{ inputs.branch }}
           ref: ${{ inputs.ref }}
@@ -132,7 +132,7 @@ jobs:
           git fetch --quiet --unshallow --prune origin             "+refs/heads/${RELEASE_BRANCH}:refs/remotes/origin/${RELEASE_BRANCH}"             "+refs/tags/*:refs/tags/*"
 
       - name: Finalize merged release
-        uses: LibreCodeCoop/release-tool/actions/post-merge@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+        uses: LibreCodeCoop/release-tool/actions/post-merge@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
         with:
           pull-request-number: ${{ github.event.pull_request.number }}
           merger: ${{ github.event.pull_request.merged_by.login }}
@@ -158,7 +158,7 @@ jobs:
           ref: ${{ github.event.release.tag_name }}
 
       - name: Verify publication
-        uses: LibreCodeCoop/release-tool/actions/publication@30ba5d8a33089331d829f586546d34cd45a529d7 # v0.11.21
+        uses: LibreCodeCoop/release-tool/actions/publication@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
         with:
           github-release-id: ${{ github.event.release.id }}
           config-path: .nextcloud-release.yml

From 93e0ee486717b2a90f443f4ccac36640801a1a39 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Date: Thu, 5 Nov 2026 02:41:50 +0000
Subject: [PATCH 08/11] ci: pin App Store publisher to reviewed v0.12.0 catalog
 action

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
---
 workflow-templates/appstore-build-publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/workflow-templates/appstore-build-publish.yml b/workflow-templates/appstore-build-publish.yml
index c475118..0f5fa61 100644
--- a/workflow-templates/appstore-build-publish.yml
+++ b/workflow-templates/appstore-build-publish.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Build and publish release
-        uses: LibreCodeCoop/.github/actions/nextcloud-appstore-publish@c0003b53593492222bc830b738c3b033eb0f4948 # PHP 8.5 publisher
+        uses: LibreCodeCoop/.github/actions/nextcloud-appstore-publish@2e9097e9448d4a4b53101078d569c57dc9970e7b # PHP 8.5 publisher
         with:
           app-name: ${{ github.event.repository.name }}
           release-tag: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.event.release.tag_name }}

From df8048397238087b8a1bbfcc74bfe8c739cab1ab Mon Sep 17 00:00:00 2001
From: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Date: Thu, 5 Nov 2026 03:16:27 +0000
Subject: [PATCH 09/11] refactor: drop runtime release and catalog freshness
 guards

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
---
 actions/nextcloud-appstore-publish/action.yml | 28 -------------------
 tests/test_release_tool_pins.py               | 15 +++-------
 2 files changed, 4 insertions(+), 39 deletions(-)

diff --git a/actions/nextcloud-appstore-publish/action.yml b/actions/nextcloud-appstore-publish/action.yml
index d2cc904..fc85d96 100644
--- a/actions/nextcloud-appstore-publish/action.yml
+++ b/actions/nextcloud-appstore-publish/action.yml
@@ -40,34 +40,6 @@ inputs:
 runs:
   using: composite
   steps:
-    - name: Verify publisher action matches current catalog
-      if: inputs.manual-recovery != 'true'
-      shell: bash
-      env:
-        GH_TOKEN: ${{ inputs.github-token }}
-      run: |
-        set -euo pipefail
-        catalog_action="$(mktemp)"
-        trap 'rm -f "${catalog_action}"' EXIT
-        curl --fail --silent --show-error --location --retry 3 \
-          https://raw.githubusercontent.com/LibreCodeCoop/.github/main/actions/nextcloud-appstore-publish/action.yml \
-          --output "${catalog_action}"
-        if ! cmp --silent "${GITHUB_ACTION_PATH}/action.yml" "${catalog_action}"; then
-          echo "::error::The pinned App Store publisher differs from the current LibreCodeCoop/.github catalog. Synchronize the workflow template to refresh the immutable Action pin before releasing."
-          exit 1
-        fi
-
-        pinned_shas="$(grep -oE 'LibreCodeCoop/release-tool/actions/[a-z-]+@[0-9a-f]{40}' "${GITHUB_ACTION_PATH}/action.yml" | sed -E 's/.*@//' | sort -u)"
-        if [[ ! "${pinned_shas}" =~ ^[0-9a-f]{40}$ ]]; then
-          echo "::error::The shared publisher must use one immutable release-tool revision."
-          exit 1
-        fi
-        latest_tag="$(gh api repos/LibreCodeCoop/release-tool/releases/latest --jq '.tag_name')"
-        latest_sha="$(gh api "repos/LibreCodeCoop/release-tool/git/ref/tags/${latest_tag}" --jq '.object.sha')"
-        if [[ "${pinned_shas}" != "${latest_sha}" ]]; then
-          echo "::error::The publisher pins release-tool ${pinned_shas}, but latest published ${latest_tag} is ${latest_sha}. Update all catalog pins before publishing."
-          exit 1
-        fi
     - name: Check actor permission
       uses: LibreCodeCoop/release-tool/actions/authorization-check@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
       with:
diff --git a/tests/test_release_tool_pins.py b/tests/test_release_tool_pins.py
index c1ad541..736bf90 100644
--- a/tests/test_release_tool_pins.py
+++ b/tests/test_release_tool_pins.py
@@ -22,17 +22,10 @@ def test_prepare_release_keeps_trusted_pipeline_contract(self) -> None:
         self.assertIn("post-merge-event: pull_request_target", content)
         self.assertIn('git fetch --quiet origin "+refs/heads/main:refs/remotes/origin/main"', content)
 
-    def test_publisher_blocks_stale_immutable_action_pin(self) -> None:
-        content = (ROOT / 'actions/nextcloud-appstore-publish/action.yml').read_text(encoding='utf-8')
-        self.assertIn('Verify publisher action matches current catalog', content)
-        self.assertIn("if: inputs.manual-recovery != 'true'", content)
-        self.assertIn('LibreCodeCoop/.github/main/actions/nextcloud-appstore-publish/action.yml', content)
-        self.assertIn('cmp --silent "${GITHUB_ACTION_PATH}/action.yml" "${catalog_action}"', content)
-        self.assertIn('exit 1', content)
-        self.assertIn('repos/LibreCodeCoop/release-tool/releases/latest', content)
-        self.assertIn('repos/LibreCodeCoop/release-tool/git/ref/tags/${latest_tag}', content)
-        self.assertIn('pinned_shas', content)
-        self.assertIn('latest_sha', content)
+    def test_publisher_does_not_enforce_latest_release_at_runtime(self) -> None:
+        content = (ROOT / "actions/nextcloud-appstore-publish/action.yml").read_text(encoding="utf-8")
+        self.assertNotIn("Verify publisher action matches current catalog", content)
+        self.assertNotIn("repos/LibreCodeCoop/release-tool/releases/latest", content)
 
     def test_release_tool_consumers_use_same_release(self) -> None:
         for path in SURFACES:

From 8828d1047c31ac1c6bf1998436b2a73e7e5c6288 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Date: Thu, 5 Nov 2026 03:16:46 +0000
Subject: [PATCH 10/11] ci: rely on PHP 8.5 setup inside release-tool composite
 actions

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
---
 actions/nextcloud-appstore-publish/action.yml |  8 --------
 tests/test_release_workflow_architecture.py   | 15 ++++++---------
 2 files changed, 6 insertions(+), 17 deletions(-)

diff --git a/actions/nextcloud-appstore-publish/action.yml b/actions/nextcloud-appstore-publish/action.yml
index fc85d96..e6fc21d 100644
--- a/actions/nextcloud-appstore-publish/action.yml
+++ b/actions/nextcloud-appstore-publish/action.yml
@@ -255,14 +255,6 @@ runs:
         cd "${APP_NAME}/build/artifacts"
         tar -zcvf "${APP_NAME}.tar.gz" "${APP_NAME}"
 
-    - name: Set up PHP 8.5 for release-tool
-      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
-      with:
-        php-version: '8.5'
-        coverage: none
-      env:
-        GITHUB_TOKEN: ${{ inputs.github-token }}
-
     - name: Validate release artifact
       uses: LibreCodeCoop/release-tool/actions/artifact-validate@51355769089a6796c23d6c966108afbdaf858c32 # v0.12.0
       with:
diff --git a/tests/test_release_workflow_architecture.py b/tests/test_release_workflow_architecture.py
index 1ca00f1..e6173d0 100644
--- a/tests/test_release_workflow_architecture.py
+++ b/tests/test_release_workflow_architecture.py
@@ -43,16 +43,13 @@ def test_prepare_release_preserves_privileged_event_guards(self) -> None:
         self.assertIn("contains(github.event.pull_request.body, '<!-- release-tool:preparation ')", content)
         self.assertNotIn("paths-ignore:", content)
 
-    def test_publisher_switches_to_php85_after_signing(self) -> None:
+    def test_publisher_preserves_app_php_until_release_tool_validation(self) -> None:
         content = PUBLISH.read_text()
-        self.assertNotIn('Set up PHP 8.3 for release-tool', content)
-        self.assertNotIn("php-version: '8.3'", content)
-        signing = content.index('php nextcloud/occ integrity:sign-app')
-        switch = content.index('name: Set up PHP 8.5 for release-tool')
-        self.assertLess(signing, switch)
-        validation = content.index('uses: LibreCodeCoop/release-tool/actions/artifact-validate@')
-        self.assertLess(switch, validation)
-        self.assertIn("php-version: '8.5'", content[switch:validation])
+        self.assertIn("php-version: ${{ steps.php_versions.outputs.php-min }}", content)
+        self.assertNotIn("name: Set up PHP 8.5 for release-tool", content)
+        signing = content.index("php nextcloud/occ integrity:sign-app")
+        validation = content.index("uses: LibreCodeCoop/release-tool/actions/artifact-validate@")
+        self.assertLess(signing, validation)
 
     def test_action_pins_are_immutable(self) -> None:
         for path in (NIGHTLY, PUBLISH, PREPARE):

From 01db7c406c0c445627381804f60b62c61edbf220 Mon Sep 17 00:00:00 2001
From: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Date: Thu, 5 Nov 2026 03:17:17 +0000
Subject: [PATCH 11/11] ci: repin App Store template to simplified release
 publisher

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
---
 workflow-templates/appstore-build-publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/workflow-templates/appstore-build-publish.yml b/workflow-templates/appstore-build-publish.yml
index 0f5fa61..efd77be 100644
--- a/workflow-templates/appstore-build-publish.yml
+++ b/workflow-templates/appstore-build-publish.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Build and publish release
-        uses: LibreCodeCoop/.github/actions/nextcloud-appstore-publish@2e9097e9448d4a4b53101078d569c57dc9970e7b # PHP 8.5 publisher
+        uses: LibreCodeCoop/.github/actions/nextcloud-appstore-publish@8828d1047c31ac1c6bf1998436b2a73e7e5c6288 # PHP 8.5 publisher
         with:
           app-name: ${{ github.event.repository.name }}
           release-tag: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.event.release.tag_name }}