chore: merge master and add Handlebars to critical_changes.rst

Co-authored-by: miaulalala <7427347+miaulalala@users.noreply.github.com>

Author: Copilot

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.12 as final
+FROM python:3.13 as final
 
 USER root
 

.docker/sphinx-latex/Dockerfile

@@ -0,0 +1,30 @@
+FROM ubuntu:24.04
+
+LABEL org.opencontainers.image.source="https://github.com/nextcloud/documentation"
+LABEL org.opencontainers.image.description="Sphinx + LaTeX build environment for Nextcloud documentation"
+LABEL org.opencontainers.image.licenses="AGPL-3.0"
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    git \
+    lsb-release \
+    make \
+    latexmk \
+    tex-gyre \
+    texlive-fonts-extra \
+    texlive-fonts-extra-links \
+    texlive-fonts-recommended \
+    texlive-latex-extra \
+    texlive-latex-recommended \
+    texlive-xetex \
+    xindy \
+  && mktexlsr \
+  && rm -rf /var/lib/apt/lists/*
+
+# Allow pip to install packages system-wide inside the container when running
+# as root (avoids PEP 668 "externally managed environment" error)
+RUN printf '[global]\nbreak-system-packages = true\n' > /etc/pip.conf

.github/dependabot.yml

@@ -17,3 +17,11 @@ updates:
     open-pull-requests-limit: 10
     cooldown:
       default-days: 10
+  - package-ecosystem: "docker"
+    directory: "/.docker/sphinx-latex"
+    schedule:
+      interval: "weekly"
+      time: "06:00"
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 10

.github/labeler.yml

@@ -0,0 +1,18 @@
+# SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: MIT
+
+"manual: admin":
+  - changed-files:
+    - any-glob-to-any-file: "admin_manual/**"
+
+"manual: developer":
+  - changed-files:
+    - any-glob-to-any-file: "developer_manual/**"
+
+"manual: user":
+  - changed-files:
+    - any-glob-to-any-file: "user_manual/**"
+
+"github_actions":
+  - changed-files:
+    - any-glob-to-any-file: ".github/workflows/**"

.github/pull_request_template.md

@@ -9,3 +9,10 @@ Please add a screenshot of your changed or added page(s).
 This helps reviewers to quickly see how the resulting
 lists, code blocks, headers and links look.
 -->
+
+### ✅ Checklist
+
+- [ ] I have built the documentation locally and reviewed the output
+- [ ] Screenshots are included for visual changes
+- [ ] I have not moved or renamed pages (or added a redirect if I did)
+- [ ] I have run `codespell` or similar and addressed any spelling issues

.github/workflows/block-merge-eol.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Set server major version environment
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}
           script: |

.github/workflows/block-merge-freeze.yml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Register server reference to fallback to master branch
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}
           script: |

.github/workflows/docker-build.yml

@@ -0,0 +1,55 @@
+name: Build and publish sphinx-latex Docker image
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - ".docker/sphinx-latex/**"
+  pull_request:
+    paths:
+      - ".docker/sphinx-latex/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-and-publish:
+    name: Build and publish sphinx-latex Docker image
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+
+      - name: Login to GitHub Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata for Docker
+        id: meta
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+        with:
+          images: ghcr.io/${{ github.repository }}/sphinx-latex
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=sha,prefix=sha-
+
+      - name: Build and publish Docker image
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        with:
+          context: .docker/sphinx-latex
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=registry,ref=ghcr.io/${{ github.repository }}/sphinx-latex:latest
+          cache-to: type=inline

.github/workflows/generate_catalog_templates.yml

@@ -36,7 +36,7 @@ jobs:
           sudo chown -R 1001:1001 user_manual/locale/source
           ls -la user_manual/locale/source
 
-      - uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
+      - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         id: cpr
         with:
           token: ${{ secrets.COMMAND_BOT_PAT }}

.github/workflows/labeling.yml

@@ -0,0 +1,87 @@
+# SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: MIT
+
+name: Labeling
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+  issues:
+    types: [opened]
+
+permissions:
+  contents: read
+
+jobs:
+  label-by-files:
+    if: github.event_name == 'pull_request'
+    name: Label by changed files
+
+    runs-on: ubuntu-latest-low
+
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Apply labels based on changed files
+        uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          sync-labels: false
+
+  triage-pr:
+    needs: [label-by-files]
+    if: >
+      always() &&
+      github.event_name == 'pull_request' &&
+      (github.event.action == 'opened' || github.event.action == 'reopened')
+    name: Apply default PR triage label
+
+    runs-on: ubuntu-latest-low
+
+    permissions:
+      pull-requests: write
+
+    steps:
+      - name: Add '3. to review' if no triage label is set
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const triageLabels = ['0. Needs triage', '1. to develop', '2. developing', '3. to review', '4. to release']
+            const currentLabels = context.payload.pull_request.labels.map(l => l.name)
+            if (!triageLabels.some(l => currentLabels.includes(l))) {
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.pull_request.number,
+                labels: ['3. to review'],
+              })
+            }
+
+  triage-issue:
+    if: github.event_name == 'issues'
+    name: Apply default issue triage label
+
+    runs-on: ubuntu-latest-low
+
+    permissions:
+      issues: write
+
+    steps:
+      - name: Add '0. Needs triage' if no triage label is set
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const triageLabels = ['0. Needs triage', '1. to develop', '2. developing', '3. to review', '4. to release']
+            const currentLabels = context.payload.issue.labels.map(l => l.name)
+            if (!triageLabels.some(l => currentLabels.includes(l))) {
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.issue.number,
+                labels: ['0. Needs triage'],
+              })
+            }