From ebd51d507c89c079df908fcb0ecfdaa92df964e9 Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Fri, 12 Jun 2026 12:48:37 +0200
Subject: [PATCH 1/6] ci(workflows): Cancel concurrent runs after pushing a
 branch again

Signed-off-by: Joas Schilling <coding@schilljs.com>
---
 .github/workflows/codeql.yml            | 4 ++++
 .github/workflows/dependency-review.yml | 4 ++++
 .github/workflows/lint.yml              | 4 ++++
 .github/workflows/repair.yml            | 4 ++++
 .github/workflows/upgrade.yml           | 4 ++++
 5 files changed, 20 insertions(+)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c843bbe8d..9cb4b8406 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -18,6 +18,10 @@ on:
     # The branches below must be a subset of the branches above
     branches: [ master ]
 
+concurrency:
+  group: codeql-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     name: Analyze
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 1fd74e4a5..6dcef1fd2 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -10,6 +10,10 @@ on: [pull_request]
 permissions:
   contents: read
 
+concurrency:
+  group: dependency-review-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   dependency-review:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 996636912..73ba210e6 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -7,6 +7,10 @@ on:
       - master
       - stable*
 
+concurrency:
+  group: lint-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   php:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/repair.yml b/.github/workflows/repair.yml
index 74ca32311..7433e80d6 100644
--- a/.github/workflows/repair.yml
+++ b/.github/workflows/repair.yml
@@ -16,6 +16,10 @@ env:
 permissions:
   contents: read
 
+concurrency:
+  group: repair-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   matrix:
     runs-on: ubuntu-latest-low
diff --git a/.github/workflows/upgrade.yml b/.github/workflows/upgrade.yml
index fa533dccb..6cf9642e2 100644
--- a/.github/workflows/upgrade.yml
+++ b/.github/workflows/upgrade.yml
@@ -13,6 +13,10 @@ on:
 env:
   APP_NAME: bookmarks
 
+concurrency:
+  group: upgrade-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

From 2ab5a92dd6a3cc9a244fe2d05ceda3abe2fea59a Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Fri, 12 Jun 2026 12:57:26 +0200
Subject: [PATCH 2/6] ci(workflows): Fix actions/checkout usage to not leave
 credentials behind

Signed-off-by: Joas Schilling <coding@schilljs.com>
---
 .github/dependabot.yml                  |  6 ++++++
 .github/workflows/codeql.yml            |  4 +++-
 .github/workflows/dependency-review.yml |  5 ++++-
 .github/workflows/floccus.yml           |  8 +++++---
 .github/workflows/lint.yml              | 21 ++++++++++++++++-----
 .github/workflows/repair.yml            |  8 ++++++--
 .github/workflows/upgrade.yml           |  9 ++++++---
 7 files changed, 46 insertions(+), 15 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9459995f7..5bed41f15 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -43,6 +43,8 @@ updates:
   - dependency-name: christophwurst/nextcloud
     versions:
     - 20.0.7
+  cooldown:
+    default-days: 7
 - package-ecosystem: npm
   directory: "/"
   schedule:
@@ -97,6 +99,8 @@ updates:
   - dependency-name: "@vue/test-utils"
     versions:
     - 1.1.3
+  cooldown:
+    default-days: 7
 - package-ecosystem: github-actions
   directory: "/"
   schedule:
@@ -105,3 +109,5 @@ updates:
     time: "03:00"
     timezone: Europe/Paris
   open-pull-requests-limit: 10
+  cooldown:
+    default-days: 7
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9cb4b8406..cd13b3d7e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -40,7 +40,9 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        persist-credentials: false
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 6dcef1fd2..0fc377a38 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -19,6 +19,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@v5
diff --git a/.github/workflows/floccus.yml b/.github/workflows/floccus.yml
index efb27c6a7..3aed0502c 100644
--- a/.github/workflows/floccus.yml
+++ b/.github/workflows/floccus.yml
@@ -33,8 +33,9 @@ jobs:
 
     steps:
       - name: Checkout floccus
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           path: floccus
           ref: ${{ matrix.floccus-branch }}
           repository: floccusAddon/floccus
@@ -154,8 +155,9 @@ jobs:
           path: ./
 
       - name: Checkout bookmarks app
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           path: ${{ env.APP_NAME }}
 
       - name: Install bookmarks app
@@ -191,7 +193,7 @@ jobs:
             echo 'Waiting for the Grid'
             sleep 1
           done
-          
+
           echo "Selenium Grid is up - executing tests"
 
       - name: Run tests
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 73ba210e6..186f625b6 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -21,7 +21,10 @@ jobs:
 
     name: php${{ matrix.php-versions }}
     steps:
-      - uses: actions/checkout@v6
+      - name: Checkout app
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up php ${{ matrix.php-versions }}
         uses: shivammathur/setup-php@v2
@@ -41,8 +44,10 @@ jobs:
 
     name: cs php${{ matrix.php-versions }}
     steps:
-    - name: Checkout
-      uses: actions/checkout@v6
+    - name: Checkout app
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        persist-credentials: false
 
     - name: Set up php
       uses: shivammathur/setup-php@v2
@@ -65,7 +70,10 @@ jobs:
 
     name: eslint node${{ matrix.node-version }}
     steps:
-      - uses: actions/checkout@v6
+      - name: Checkout app
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Read package.json node and npm engines version
         uses: skjnldsv/read-package-engines-version-actions@v3
@@ -98,7 +106,10 @@ jobs:
 
     name: stylelint node${{ matrix.node-version }}
     steps:
-      - uses: actions/checkout@v6
+      - name: Checkout app
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Read package.json node and npm engines version
         uses: skjnldsv/read-package-engines-version-actions@v3
diff --git a/.github/workflows/repair.yml b/.github/workflows/repair.yml
index 7433e80d6..d8e4a4e65 100644
--- a/.github/workflows/repair.yml
+++ b/.github/workflows/repair.yml
@@ -29,6 +29,8 @@ jobs:
     steps:
       - name: Checkout app
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Get version matrix
         id: versions
@@ -73,8 +75,9 @@ jobs:
 
     steps:
       - name: Checkout server
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           repository: nextcloud/server
           ref: ${{ matrix.server-versions }}
 
@@ -92,8 +95,9 @@ jobs:
           extensions: mbstring, iconv, fileinfo, intl, sqlite, pdo_mysql, pdo_sqlite, pgsql, pdo_pgsql, gd, zip
 
       - name: Checkout app
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           path: apps/${{ env.APP_NAME }}
 
       - name: Install app
diff --git a/.github/workflows/upgrade.yml b/.github/workflows/upgrade.yml
index 6cf9642e2..32780e9fb 100644
--- a/.github/workflows/upgrade.yml
+++ b/.github/workflows/upgrade.yml
@@ -64,8 +64,9 @@ jobs:
 
     steps:
       - name: Checkout server
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           repository: nextcloud/server
           ref: ${{ matrix.server-versions }}
 
@@ -83,8 +84,9 @@ jobs:
           extensions: mbstring, iconv, fileinfo, intl, sqlite, pdo_mysql, pdo_sqlite, pgsql, pdo_pgsql, gd, zip
 
       - name: Checkout app
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           repository: nextcloud/bookmarks
           ref: ${{ matrix.prev-version }}
           path: apps/${{ env.APP_NAME }}
@@ -125,8 +127,9 @@ jobs:
           ./occ app:disable ${{ env.APP_NAME }}
 
       - name: Checkout app
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           path: apps/${{ env.APP_NAME }}
 
       - name: Install app

From e58776856f14c4ef7a29c6b35ecff53703fec2d2 Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Fri, 12 Jun 2026 13:37:01 +0200
Subject: [PATCH 3/6] ci(workflows): Pin all actions

Signed-off-by: Joas Schilling <coding@schilljs.com>
---
 .github/workflows/codeql.yml            |  6 ++--
 .github/workflows/dependency-review.yml |  2 +-
 .github/workflows/floccus.yml           | 10 +++----
 .github/workflows/issues.yml            |  8 ++---
 .github/workflows/lint.yml              | 39 +++++++++++++------------
 .github/workflows/repair.yml            |  2 +-
 .github/workflows/upgrade.yml           |  2 +-
 7 files changed, 36 insertions(+), 33 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index cd13b3d7e..ffe24d3ed 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -46,7 +46,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -57,7 +57,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v4
+      uses: github/codeql-action/autobuild@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -71,4 +71,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 0fc377a38..048aca21d 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -24,4 +24,4 @@ jobs:
           persist-credentials: false
 
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v5
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5
diff --git a/.github/workflows/floccus.yml b/.github/workflows/floccus.yml
index 3aed0502c..3865e0be3 100644
--- a/.github/workflows/floccus.yml
+++ b/.github/workflows/floccus.yml
@@ -41,7 +41,7 @@ jobs:
           repository: floccusAddon/floccus
 
       - name: Set up node ${{ matrix.node-version }}
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: ${{ matrix.node-version }}
 
@@ -49,7 +49,7 @@ jobs:
         run: npm i -g npm@"${{ matrix.npm-version }}"
 
       - name: Cache node modules
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         env:
           cache-name: cache-node-modules
         with:
@@ -67,7 +67,7 @@ jobs:
           npm run build-release --if-present
 
       - name: Save context
-        uses: buildjet/cache/save@v4
+        uses: buildjet/cache/save@3e70d19e31d6a8030aeddf6ed8dbe601f94d09f4 # v4.0.2
         with:
           key: floccus-context-${{ matrix.floccus-branch }}-${{ github.run_id }}
           path: ./
@@ -140,7 +140,7 @@ jobs:
     steps:
 
       - name: Set up node ${{ matrix.node-version }}
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: ${{ matrix.node-version }}
 
@@ -148,7 +148,7 @@ jobs:
         run: npm i -g npm@"${{ matrix.npm-version }}"
 
       - name: Restore context
-        uses: buildjet/cache/restore@v4
+        uses: buildjet/cache/restore@3e70d19e31d6a8030aeddf6ed8dbe601f94d09f4 # v4.0.2
         with:
           fail-on-cache-miss: true
           key: floccus-context-${{matrix.floccus-branch}}-${{ github.run_id }}
diff --git a/.github/workflows/issues.yml b/.github/workflows/issues.yml
index ea56ea587..bf75d89e4 100644
--- a/.github/workflows/issues.yml
+++ b/.github/workflows/issues.yml
@@ -12,11 +12,11 @@ jobs:
     runs-on: ubuntu-latest
     name: Add first comment
     steps:
-      - uses: ben-z/actions-comment-on-issue@1.0.3
+      - uses: ben-z/actions-comment-on-issue@402eb412a8f396be0d4ac52a823ec7121206cc26 # 1.0.3
         with:
           message: |
             Hello :wave:
-            
+
             Thank you for taking the time to open this issue with the bookmarks app. I know it's frustrating when software
             causes problems. You have made the right choice to come here and open an issue to make sure your problem gets looked at
             and if possible solved.
@@ -24,7 +24,7 @@ jobs:
             in my free time, because it is not an official Nextcloud product. My day job at Nextcloud is pretty awesome but sadly leaves me with
             less time for side projects like this one than I used to have.
             I still try to answer all issues and if possible fix all bugs here, but it sometimes takes a while until I get to it.
-            Until then, please be patient. 
+            Until then, please be patient.
             Note also that GitHub is a place where people meet to make software better *together*. Nobody here is under any obligation
             to help you, solve your problems or deliver on any expectations or demands you may have, but if enough people come together we can
             collaborate to make this software better. For everyone.
@@ -34,7 +34,7 @@ jobs:
             One last word: If you feel, at any point, like you need to vent, this is not the place for it; you can go to the forum,
             to twitter or somewhere else. But this is a technical issue tracker, so please make sure to
             focus on the tech and keep your opinions to yourself. (Also see our [Code of Conduct](https://nextcloud.com/contribute/code-of-conduct/). Really.)
-            
+
             I look forward to working with you on this issue
             Cheers :blue_heart:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 186f625b6..0c2d7c71c 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -7,6 +7,9 @@ on:
       - master
       - stable*
 
+permissions:
+  contents: read
+
 concurrency:
   group: lint-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
@@ -27,7 +30,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up php ${{ matrix.php-versions }}
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
         with:
           php-version: ${{ matrix.php-versions }}
           coverage: none
@@ -44,22 +47,22 @@ jobs:
 
     name: cs php${{ matrix.php-versions }}
     steps:
-    - name: Checkout app
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      with:
-        persist-credentials: false
+      - name: Checkout app
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
-    - name: Set up php
-      uses: shivammathur/setup-php@v2
-      with:
-        php-version: ${{ matrix.php-versions }}
-        coverage: none
+      - name: Set up php
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
+        with:
+          php-version: ${{ matrix.php-versions }}
+          coverage: none
 
-    - name: Install dependencies
-      run: composer i
+      - name: Install dependencies
+        run: composer i
 
-    - name: Run coding standards check
-      run: composer run cs:check || ( echo 'Please run `composer run cs:fix` to format your code' && exit 1 )
+      - name: Run coding standards check
+        run: composer run cs:check || ( echo 'Please run `composer run cs:fix` to format your code' && exit 1 )
 
   node:
     runs-on: ubuntu-latest
@@ -76,14 +79,14 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@v3
+        uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
         id: versions
         with:
           fallbackNode: '^12'
           fallbackNpm: '^6'
 
       - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: ${{ steps.versions.outputs.nodeVersion }}
 
@@ -112,14 +115,14 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@v3
+        uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
         id: versions
         with:
           fallbackNode: '^12'
           fallbackNpm: '^6'
 
       - name: Set up node ${{ steps.versions.outputs.nodeVersion }}
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: ${{ steps.versions.outputs.nodeVersion }}
 
diff --git a/.github/workflows/repair.yml b/.github/workflows/repair.yml
index d8e4a4e65..d746cfa77 100644
--- a/.github/workflows/repair.yml
+++ b/.github/workflows/repair.yml
@@ -88,7 +88,7 @@ jobs:
           git submodule update --init --force --recursive --depth=1
 
       - name: Set up php ${{ matrix.php-versions }}
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
         with:
           php-version: ${{ matrix.php-versions }}
           tools: phpunit
diff --git a/.github/workflows/upgrade.yml b/.github/workflows/upgrade.yml
index 32780e9fb..745f8aaa6 100644
--- a/.github/workflows/upgrade.yml
+++ b/.github/workflows/upgrade.yml
@@ -77,7 +77,7 @@ jobs:
           git submodule update --init --force --recursive --depth=1
 
       - name: Set up php ${{ matrix.php-versions }}
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
         with:
           php-version: ${{ matrix.php-versions }}
           tools: phpunit

From b455ad6cab921448c5709655b2ab2bb887da9957 Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Fri, 12 Jun 2026 13:38:49 +0200
Subject: [PATCH 4/6] ci(workflows): Update workflows from template repo

Signed-off-by: Joas Schilling <coding@schilljs.com>
---
 .github/workflows/{node.yml => npm-build.yml} | 12 +++-------
 .github/workflows/phpunit-mariadb.yml         | 16 +++++---------
 .github/workflows/phpunit-mysql.yml           | 16 +++++---------
 .github/workflows/phpunit-pgsql.yml           | 16 +++++---------
 .github/workflows/phpunit-sqlite.yml          | 16 +++++---------
 .github/workflows/psalm-matrix.yml            | 22 ++++++-------------
 6 files changed, 30 insertions(+), 68 deletions(-)
 rename .github/workflows/{node.yml => npm-build.yml} (94%)

diff --git a/.github/workflows/node.yml b/.github/workflows/npm-build.yml
similarity index 94%
rename from .github/workflows/node.yml
rename to .github/workflows/npm-build.yml
index cb6e1d652..0782cf334 100644
--- a/.github/workflows/node.yml
+++ b/.github/workflows/npm-build.yml
@@ -6,15 +6,9 @@
 # SPDX-FileCopyrightText: 2021-2024 Nextcloud GmbH and Nextcloud contributors
 # SPDX-License-Identifier: MIT
 
-name: Node
+name: Build Javascript
 
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-      - master
-      - stable*
+on: pull_request
 
 permissions:
   contents: read
@@ -59,7 +53,7 @@ jobs:
     name: NPM build
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/phpunit-mariadb.yml b/.github/workflows/phpunit-mariadb.yml
index c8e0da3ef..e3ffe993f 100644
--- a/.github/workflows/phpunit-mariadb.yml
+++ b/.github/workflows/phpunit-mariadb.yml
@@ -8,13 +8,7 @@
 
 name: PHPUnit MariaDB
 
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-      - master
-      - stable*
+on: pull_request
 
 permissions:
   contents: read
@@ -31,7 +25,7 @@ jobs:
       server-max: ${{ steps.versions.outputs.branches-max-list }}
     steps:
       - name: Checkout app
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -97,7 +91,7 @@ jobs:
           echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV
 
       - name: Checkout server
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           submodules: true
@@ -105,13 +99,13 @@ jobs:
           ref: ${{ matrix.server-versions }}
 
       - name: Checkout app
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: apps/${{ env.APP_NAME }}
 
       - name: Set up php ${{ matrix.php-versions }}
-        uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
         with:
           php-version: ${{ matrix.php-versions }}
           # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation
diff --git a/.github/workflows/phpunit-mysql.yml b/.github/workflows/phpunit-mysql.yml
index bd57bdb73..11840658e 100644
--- a/.github/workflows/phpunit-mysql.yml
+++ b/.github/workflows/phpunit-mysql.yml
@@ -8,13 +8,7 @@
 
 name: PHPUnit MySQL
 
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-      - master
-      - stable*
+on: pull_request
 
 permissions:
   contents: read
@@ -30,7 +24,7 @@ jobs:
       matrix: ${{ steps.versions.outputs.sparse-matrix }}
     steps:
       - name: Checkout app
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -95,7 +89,7 @@ jobs:
           echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV
 
       - name: Checkout server
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           submodules: true
@@ -103,13 +97,13 @@ jobs:
           ref: ${{ matrix.server-versions }}
 
       - name: Checkout app
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: apps/${{ env.APP_NAME }}
 
       - name: Set up php ${{ matrix.php-versions }}
-        uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
         with:
           php-version: ${{ matrix.php-versions }}
           # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation
diff --git a/.github/workflows/phpunit-pgsql.yml b/.github/workflows/phpunit-pgsql.yml
index 92c1b6a89..c09d9794a 100644
--- a/.github/workflows/phpunit-pgsql.yml
+++ b/.github/workflows/phpunit-pgsql.yml
@@ -8,13 +8,7 @@
 
 name: PHPUnit PostgreSQL
 
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-      - master
-      - stable*
+on: pull_request
 
 permissions:
   contents: read
@@ -31,7 +25,7 @@ jobs:
       server-max: ${{ steps.versions.outputs.branches-max-list }}
     steps:
       - name: Checkout app
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -98,7 +92,7 @@ jobs:
           echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV
 
       - name: Checkout server
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           submodules: true
@@ -106,13 +100,13 @@ jobs:
           ref: ${{ matrix.server-versions }}
 
       - name: Checkout app
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: apps/${{ env.APP_NAME }}
 
       - name: Set up php ${{ matrix.php-versions }}
-        uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
         with:
           php-version: ${{ matrix.php-versions }}
           # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation
diff --git a/.github/workflows/phpunit-sqlite.yml b/.github/workflows/phpunit-sqlite.yml
index 70b6f055b..1d1426890 100644
--- a/.github/workflows/phpunit-sqlite.yml
+++ b/.github/workflows/phpunit-sqlite.yml
@@ -8,13 +8,7 @@
 
 name: PHPUnit SQLite
 
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-      - master
-      - stable*
+on: pull_request
 
 permissions:
   contents: read
@@ -31,7 +25,7 @@ jobs:
       server-max: ${{ steps.versions.outputs.branches-max-list }}
     steps:
       - name: Checkout app
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -87,7 +81,7 @@ jobs:
           echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV
 
       - name: Checkout server
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           submodules: true
@@ -95,13 +89,13 @@ jobs:
           ref: ${{ matrix.server-versions }}
 
       - name: Checkout app
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
           path: apps/${{ env.APP_NAME }}
 
       - name: Set up php ${{ matrix.php-versions }}
-        uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
         with:
           php-version: ${{ matrix.php-versions }}
           # https://docs.nextcloud.com/server/stable/admin_manual/installation/source_installation.html#prerequisites-for-manual-installation
diff --git a/.github/workflows/psalm-matrix.yml b/.github/workflows/psalm-matrix.yml
index dd83f45a3..112450d89 100644
--- a/.github/workflows/psalm-matrix.yml
+++ b/.github/workflows/psalm-matrix.yml
@@ -8,13 +8,7 @@
 
 name: Static analysis
 
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-      - master
-      - stable*
+on: pull_request
 
 concurrency:
   group: psalm-${{ github.head_ref || github.run_id }}
@@ -28,9 +22,10 @@ jobs:
     runs-on: ubuntu-latest-low
     outputs:
       ocp-matrix: ${{ steps.versions.outputs.ocp-matrix }}
+      php-min: ${{ steps.versions.outputs.php-min }}
     steps:
       - name: Checkout app
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -52,14 +47,14 @@ jobs:
     name: static-psalm-analysis ${{ matrix.ocp-version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
-      - name: Set up php${{ matrix.php-min }}
-        uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0
+      - name: Set up php${{ needs.matrix.outputs.php-min }}
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
         with:
-          php-version: ${{ matrix.php-min }}
+          php-version: ${{ needs.matrix.outputs.php-min }}
           extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, sqlite, pdo_sqlite
           coverage: none
           ini-file: development
@@ -73,9 +68,6 @@ jobs:
           composer remove nextcloud/ocp --dev --no-scripts
           composer i
 
-      - name: Check for vulnerable PHP dependencies
-        run: composer require --dev roave/security-advisories:dev-latest
-
       - name: Install dependencies # zizmor: ignore[template-injection]
         run: composer require --dev 'nextcloud/ocp:${{ matrix.ocp-version }}' --ignore-platform-reqs --with-dependencies
 

From 6970577e185c358adea7159787819230efb81391 Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Fri, 12 Jun 2026 13:41:14 +0200
Subject: [PATCH 5/6] ci(workflows): Adjust permissions of custom workflows

Signed-off-by: Joas Schilling <coding@schilljs.com>
---
 .github/workflows/floccus.yml | 5 ++++-
 .github/workflows/issues.yml  | 6 ++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/floccus.yml b/.github/workflows/floccus.yml
index 3865e0be3..a768fa518 100644
--- a/.github/workflows/floccus.yml
+++ b/.github/workflows/floccus.yml
@@ -19,6 +19,9 @@ concurrency:
   group: floccus-tests-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   init:
     runs-on: ubuntu-latest
@@ -205,7 +208,7 @@ jobs:
           npm run test
 
   summary:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-low
     needs: [ init, selenium ]
 
     if: always()
diff --git a/.github/workflows/issues.yml b/.github/workflows/issues.yml
index bf75d89e4..abbf4f387 100644
--- a/.github/workflows/issues.yml
+++ b/.github/workflows/issues.yml
@@ -7,8 +7,14 @@ on:
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+permissions:
+  contents: read
+
 jobs:
   first_comment:
+    permissions:
+      issues: write
+
     runs-on: ubuntu-latest
     name: Add first comment
     steps:

From b4189e2a216e103ad200c5c5590ba74f37bf3bfb Mon Sep 17 00:00:00 2001
From: Joas Schilling <coding@schilljs.com>
Date: Fri, 12 Jun 2026 13:45:21 +0200
Subject: [PATCH 6/6] ci(dependabot): Fix dependabot bot directory for github
 actions

Signed-off-by: Joas Schilling <coding@schilljs.com>
---
 .github/dependabot.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5bed41f15..a3eae35e0 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -102,7 +102,7 @@ updates:
   cooldown:
     default-days: 7
 - package-ecosystem: github-actions
-  directory: "/"
+  directory: ".github/workflows"
   schedule:
     interval: weekly
     day: saturday