chore: sync workflows from Nextcloud organization

.github/workflows/ai-policy.yml

@@ -27,23 +27,16 @@ concurrency:
 
 jobs:
   check-ai-trailers:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-low
     steps:
-      - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
       - name: Collect PR commit messages
         id: collect
         env:
-          BASE_REF: ${{ github.base_ref }}
+          GH_TOKEN: ${{ github.token }}
+          COMMITS_URL: ${{ github.event.pull_request.commits_url }}
         run: |
           set -euo pipefail
-          git fetch origin "${BASE_REF}"
-          MERGE_BASE=$(git merge-base "origin/${BASE_REF}" HEAD)
-          git log --format="%B" "${MERGE_BASE}..HEAD" > /tmp/pr_commits.txt
+          gh api ${COMMITS_URL} | jq -r '.[] | .commit.message' > /tmp/pr_commits.txt
           echo "--- PR commit messages ---"
           cat /tmp/pr_commits.txt
           echo "--------------------------"
@@ -83,10 +76,10 @@ jobs:
         run: |
           set -euo pipefail
           AI_ASSISTED=false
-          if grep -qiE '^(AI-assistant|Assisted-by):' /tmp/pr_commits.txt; then
+          if grep -qiE '^(AI-assistant|Assisted-by|AI-Assisted-By):' /tmp/pr_commits.txt; then
             AI_ASSISTED=true
-            echo "Found AI-assistant/Assisted-by trailer(s):"
-            grep -iE '^(AI-assistant|Assisted-by):' /tmp/pr_commits.txt
+            echo "Found AI-assistant/Assisted-by/AI-Assisted-By trailer(s):"
+            grep -iE '^(AI-assistant|Assisted-by|AI-Assisted-By):' /tmp/pr_commits.txt
           fi
           echo "ai_assisted=${AI_ASSISTED}" >> "$GITHUB_OUTPUT"
 

workflow-templates/ai-policy.yml

@@ -27,23 +27,16 @@ concurrency:
 
 jobs:
   check-ai-trailers:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-low
     steps:
-      - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
       - name: Collect PR commit messages
         id: collect
         env:
-          BASE_REF: ${{ github.base_ref }}
+          GH_TOKEN: ${{ github.token }}
+          COMMITS_URL: ${{ github.event.pull_request.commits_url }}
         run: |
           set -euo pipefail
-          git fetch origin "${BASE_REF}"
-          MERGE_BASE=$(git merge-base "origin/${BASE_REF}" HEAD)
-          git log --format="%B" "${MERGE_BASE}..HEAD" > /tmp/pr_commits.txt
+          gh api ${COMMITS_URL} | jq -r '.[] | .commit.message' > /tmp/pr_commits.txt
           echo "--- PR commit messages ---"
           cat /tmp/pr_commits.txt
           echo "--------------------------"
@@ -83,10 +76,10 @@ jobs:
         run: |
           set -euo pipefail
           AI_ASSISTED=false
-          if grep -qiE '^(AI-assistant|Assisted-by):' /tmp/pr_commits.txt; then
+          if grep -qiE '^(AI-assistant|Assisted-by|AI-Assisted-By):' /tmp/pr_commits.txt; then
             AI_ASSISTED=true
-            echo "Found AI-assistant/Assisted-by trailer(s):"
-            grep -iE '^(AI-assistant|Assisted-by):' /tmp/pr_commits.txt
+            echo "Found AI-assistant/Assisted-by/AI-Assisted-By trailer(s):"
+            grep -iE '^(AI-assistant|Assisted-by|AI-Assisted-By):' /tmp/pr_commits.txt
           fi
           echo "ai_assisted=${AI_ASSISTED}" >> "$GITHUB_OUTPUT"
 

workflow-templates/dependabot-approve-merge.yml

@@ -46,12 +46,32 @@ jobs:
 
       - name: Dependabot metadata
         id: metadata
+        if: startsWith(steps.branchname.outputs.branch, 'dependabot/')
         uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: GitHub actions bot approve
+      - name: Check for ignored dependencies in the PR
+        id: validate
         if: startsWith(steps.branchname.outputs.branch, 'dependabot/')
+        env:
+          IGNORE_PATTERN: ${{ env.IGNORE_PATTERN }}
+          DEPENDENCY_NAMES: ${{ steps.metadata.outputs.dependency-names }}
+        run: |
+          if [[ -z ${IGNORE_PATTERN} ]]; then
+              echo "ignore=false" >> "$GITHUB_OUTPUT"
+          elif [[ -z ${DEPENDENCY_NAMES} ]]; then
+              echo "ignore=false" >> "$GITHUB_OUTPUT"
+          elif [[ ${DEPENDENCY_NAMES} =~ ${IGNORE_PATTERN} ]]; then
+              echo "ignore=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: GitHub actions bot approve
+        id: auto_approve
+        if: ${{
+          startsWith(steps.branchname.outputs.branch, 'dependabot/')
+          && steps.validate.outputs.ignore != 'true'
+          }}
         run: gh pr review --approve "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
@@ -60,6 +80,15 @@ jobs:
       # Enable GitHub auto merge
       - name: Auto merge
         uses: alexwilson/enable-github-automerge-action@2c32e18a76e0726ffe7a573bfff2d42a20885126 # 3.0.0
-        if: startsWith(steps.branchname.outputs.branch, 'dependabot/') && (github.event.action == 'opened' || github.event.action == 'reopened') && (steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor')
+        if: ${{
+          startsWith(steps.branchname.outputs.branch, 'dependabot/')
+          && steps.auto_approve.conclusion == 'success'
+          && (github.event.action == 'opened' || github.event.action == 'reopened')
+          && (
+            steps.metadata.outputs.update-type == 'version-update:semver-patch'
+            || (fromJSON(env.ALLOW_MINOR) && steps.metadata.outputs.update-type == 'version-update:semver-minor')
+            || (fromJSON(env.ALLOW_MAJOR) && steps.metadata.outputs.update-type == 'version-update:semver-major')
+          )
+          }}
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}