build: drop the appstore target in favour of dist (#634)

Closes #622.

The Makefile had two packaging targets. `dist` copies an explicit allowlist
(`all_src`) and is what ships: `release.yml` points `artifact-glob` at
`build/dist/richdocuments.tar.gz` and the reusable release workflow runs
`make dist`. `appstore` rsynced the whole working tree and subtracted a
hand-maintained exclude list, writing to `build/richdocuments.tar.gz`, which
nothing reads.

Only the denylist rotted. It now lets through 19 tracked root entries that are
not part of `all_src`:

  .eslintrc.json  .github         .php-cs-fixer.dist.php  .prettierrc.json
  .tsconfig.json  .well-known     AGENTS.md               CHANGELOG.md
  CLAUDE.md       CODE_OF_CONDUCT.md  SECURITY.md         SUPPORT.md
  package.json    pnpm-lock.yaml  pnpm-workspace.yaml     sonar-project.properties
  src             tsconfig.json   vite.config.ts

It also excluded `vendor/bin` and `vendor-bin` but never `vendor` or
`node_modules`, so after any build it packaged those too. Five of its excludes
name files that no longer exist at all (`.drone.star`, `.php_cs.dist`,
`.scrutinizer.yml`, `nbproject`, `screenshots`), and it called
`occ integrity:sign-app` unconditionally, so it failed outright without release
certificates present.

Deleting it rather than extending the exclude list: an allowlist cannot silently
pick up new root files the way this one just did - `pnpm-workspace.yaml` joined
the list days after the issue was filed. `activity`, `oauth2` and `customgroups`
already have no such target, and the reusable release workflow now asserts that
artifacts are free of development files, so an appstore-style tarball would fail
that gate anyway.

Removed with it, all dead once the target is gone: `project_dir`, `sign_dir`,
`appstore_dir`, `source_dir`, `package_name`, and a duplicate `occ=` assignment
that the later `occ=$(CURDIR)/../../occ` already overrode - the earlier one
pointed at `../core/occ`, which for an app at `apps/<app>/` resolves to
`apps/core/occ` and never existed. Also dropped the two references to
`$(bower_deps)`, a variable no longer defined anywhere since the bower rules
were removed in #623.

The released artifact is unchanged, verified rather than argued: `make dist` in
`owncloudci/php:8.3` produces a tarball whose 171 entries are byte-identical to
the one built from the parent commit, and `make help` output is identical too.

Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
Co-authored-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: oc-tmueller

AGENTS.md

@@ -99,7 +99,7 @@ make clean
 
 - **Tests need a core checkout:** `make test-php-unit` resolves PHPUnit at `../../lib/composer/bin/phpunit`, so the app must be checked out as `apps/richdocuments` inside an ownCloud Server tree. It cannot be run from a standalone clone. The same holds for `make test-js`: the scripts in `js/` expect the globals the server puts on the page, so `tests/js/karma.config.cjs` loads jQuery, jQuery UI and `OC` from the surrounding core checkout (`core/js/core.json`, `core/vendor/`, `core/js/tests/specHelper.js`). Core's node dependencies have to be installed there once (`make` in the core root), which is what creates the `core/vendor` symlink.
 - **JavaScript unit tests only cover `js/`:** `tests/js/` runs the classic frontend. The Vue connector in `src/` has no unit tests yet; it needs a separate vitest setup, as used by `owncloud/web-extensions`.
-- **`make appstore` is release-only:** it unconditionally calls `occ integrity:sign-app` and needs a signing key and certificate in `~/.owncloud/certificates/`. Use `make dist` for a local build; `make dist` skips signing when no certificate is present.
+- **`make dist` is the only packaging target:** it copies an explicit allowlist (`all_src`) into `build/dist/` and is what the release workflow publishes. It calls `occ integrity:sign-app` only when a signing key and certificate are present in `~/.owncloud/certificates/`, and skips signing otherwise, so a local build needs no certificates.
 - **WOPI dependency:** Requires a running Collabora Online server that the ownCloud server can reach, and that can reach the ownCloud server in turn.
 - **Dual frontend:** Has both a classic frontend (`js/`) and an ownCloud Web connector (`src/`, built with Vite into `js/web/`). Frontend changes usually need to be made in both places.
 - **Generated frontend bundle is committed:** regenerate `js/web/richdocuments.js` with `pnpm build` and commit the result; never hand-edit it.

Makefile

@@ -6,19 +6,13 @@ COMPOSER_BIN := $(shell command -v composer 2> /dev/null)
 PNPM ?= npx --yes pnpm@10
 
 app_name=richdocuments
-project_dir=$(CURDIR)/../$(app_name)
 doc_files=README.md
 src_dirs=appinfo assets css img js l10n lib templates
 src_files=admin.php settings.php
 all_src=$(src_dirs) $(src_files) $(doc_files)
 build_dir=$(CURDIR)/build
 dist_dir=$(build_dir)/dist
-sign_dir=$(build_dir)/sign
-appstore_dir=$(build_dir)/appstore
-source_dir=$(build_dir)/source
-package_name=$(app_name)
 cert_dir=$(HOME)/.owncloud/certificates
-occ=$(CURDIR)/../core/occ
 
 # composer
 composer_deps=vendor
@@ -27,37 +21,6 @@ acceptance_test_deps=vendor-bin/behat/vendor
 # node
 nodejs_deps=node_modules
 
-appstore:
-	mkdir -p $(sign_dir)
-	rsync -a \
-	--exclude=.git \
-	--exclude=.phan \
-	--exclude=build \
-	--exclude=.drone.star \
-	--exclude=.gitignore \
-	--exclude=.php_cs.cache \
-	--exclude=.php_cs.dist \
-	--exclude=.scrutinizer.yml \
-	--exclude=CONTRIBUTING.md \
-	--exclude=composer.json \
-	--exclude=composer.lock \
-	--exclude=l10n/.gitkeep \
-	--exclude=l10n/.tx \
-	--exclude=l10n/no-php \
-	--exclude=Makefile \
-	--exclude=nbproject \
-	--exclude=screenshots \
-	--exclude=phpcs.xml \
-	--exclude=phpstan.neon \
-	--exclude=phpunit*xml \
-	--exclude=tests \
-	--exclude=vendor/bin \
-	--exclude=vendor-bin \
-	$(project_dir) $(sign_dir)
-	@echo "Signing…"
-	$(occ) integrity:sign-app --privateKey=$(cert_dir)/$(app_name).key --certificate=$(cert_dir)/$(app_name).crt --path=$(sign_dir)/$(app_name)
-	tar -czf $(build_dir)/$(app_name).tar.gz -C $(sign_dir) $(app_name)
-
 # signing
 occ=$(CURDIR)/../../occ
 private_key=$(HOME)/.owncloud/certificates/$(app_name).key
@@ -97,7 +60,7 @@ $(nodejs_deps): package.json pnpm-lock.yaml
 #
 # dist
 #
-$(dist_dir)/$(app_name): $(composer_deps) $(bower_deps)
+$(dist_dir)/$(app_name): $(composer_deps)
 	rm -Rf $@; mkdir -p $@
 	cp -R $(all_src) $@
 	rm -Rf $@/l10n/.gitkeep
@@ -124,7 +87,7 @@ clean-build:
 
 .PHONY: clean-deps
 clean-deps:
-	rm -Rf $(nodejs_deps) $(bower_deps)
+	rm -Rf $(nodejs_deps)
 	rm -Rf vendor
 	rm -Rf vendor-bin/**/vendor vendor-bin/**/composer.lock