Sync .github/workflows from 2026.x to 2025.4

.github/workflows/cla.yaml

@@ -8,7 +8,7 @@ on:
 
 jobs:
   cla-workflow:
-    uses: pimcore/workflows-collection-public/.github/workflows/reusable-cla-check.yaml@v1.3.0
+    uses: pimcore/workflows-collection-public/.github/workflows/reusable-cla-check.yaml@main
     if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
     secrets:
       CLA_ACTION_ACCESS_TOKEN: ${{ secrets.CLA_ACTION_ACCESS_TOKEN }}

.github/workflows/copilot-setup-steps.yml

@@ -0,0 +1,51 @@
+name: "Copilot Setup Steps"
+
+# Automatically run the setup steps when they are changed to allow for easy validation, and
+# allow manual testing through the repository's "Actions" tab
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+  pull_request:
+    paths:
+      - .github/workflows/copilot-setup-steps.yml
+
+jobs:
+  # The job MUST be called `copilot-setup-steps` or it will not be picked up by Copilot.
+  # The steps MUST be defined inline here: the Copilot coding agent only reads `steps`
+  # (plus permissions/runs-on/services/snapshot/timeout-minutes) from this job, so a
+  # reusable-workflow `uses:` call would be ignored by Copilot.
+  copilot-setup-steps:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: "Install PHP"
+        uses: "shivammathur/setup-php@v2"
+        with:
+          php-version: "8.4"
+
+      - name: "Configure private pimcore package repository"
+        run: |
+          composer config repositories.private-packagist '{"type": "composer", "url": "https://repo.pimcore.com/github-actions/", "canonical": true}'
+
+      - name: "Install dependencies with Composer"
+        uses: "ramsey/composer-install@v3"
+        # Pass the private-Packagist token via a step-scoped env var instead of
+        # writing it to Composer's global auth.json. A global credential would
+        # persist on the runner filesystem and remain readable by the Copilot
+        # coding agent after setup; COMPOSER_AUTH lives only for this step.
+        env:
+          COMPOSER_AUTH: '{"http-basic":{"repo.pimcore.com":{"username":"github-actions","password":"${{ secrets.COMPOSER_PIMCORE_REPO_PACKAGIST_TOKEN }}"}}}'
+        with:
+          composer-options: "--no-scripts --ignore-platform-reqs"
+
+      - name: Restore composer.json
+        if: ${{ always() }}
+        run: git restore composer.json

.github/workflows/frontend-publish-unified.yaml

@@ -4,116 +4,132 @@ on:
   push:
     branches:
       - "[0-9]+.x"
+      - "[0-9]+.[0-9]+"
     tags:
       - "v*"
   workflow_dispatch:
 
-env:
-  BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
-  TARGET_RELEASE: 1.0.0
+concurrency:
+  group: frontend-publish-${{ github.ref }}
+  cancel-in-progress: false
 
 permissions:
-  id-token: write  # Required for OIDC
   contents: read
 
-jobs:
-  canary-build:
-    if: github.event_name != 'push' || !startsWith(github.ref, 'refs/tags/')
-    permissions:
-      contents: write
-    uses: ./.github/workflows/shared-frontend-build.yaml
+env:
+  # Canary base used when a version line has no published release yet
+  # (matches the reference implementation, data-hub#1119).
+  FALLBACK_TARGET_RELEASE: "2025.4.0"
 
-  canary-generate-version:
-    if: github.event_name != 'push' || !startsWith(github.ref, 'refs/tags/')
-    needs: canary-build
+jobs:
+  gate:
     runs-on: ubuntu-latest
     outputs:
-      generated_version: ${{ steps.gen.outputs.version }}
+      publish: ${{ steps.check.outputs.publish }}
+      target-release: ${{ steps.target.outputs.target-release }}
+      canary-tag: ${{ steps.target.outputs.canary-tag }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
-      - name: Generate Canary Version
-        id: gen
-        shell: bash
-        run: |
-          # Get the base version (e.g., "1.2.3") from package.json
-          BASE_VERSION=${{ env.TARGET_RELEASE }}
-          # Remove any pre-release suffix if present
-          BASE_VERSION=${BASE_VERSION%%-*}
-          # Create a timestamp (YYYYMMDD--HHMMSS)
-          TIMESTAMP=$(date +'%Y%m%d-%H%M%S')
-          # Get a short commit hash (7 characters)
-          GIT_HASH=$(git rev-parse --short=7 HEAD)
-          NEW_VERSION="${BASE_VERSION}-canary.${TIMESTAMP}-${GIT_HASH}"
-          echo "Computed version: ${NEW_VERSION}"
-          echo "version=${NEW_VERSION}" >> "$GITHUB_OUTPUT"
-
-  canary-publish:
-    if: github.event_name != 'push' || !startsWith(github.ref, 'refs/tags/')
-    needs: canary-generate-version
-    permissions:
-      id-token: write  # Required for OIDC
-      contents: read
-    uses: ./.github/workflows/shared-npm-publish.yaml
-    with:
-      version: "${{ needs.canary-generate-version.outputs.generated_version }}"
-      tag: "canary"
+      - name: Set up Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: "24"
 
-  release-determine-version:
-    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.extract_version.outputs.version }}
-      npm_tag: ${{ steps.extract_npm.outputs.npm_tag }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Extract version from tag
-        id: extract_version
+      - name: Check for frontend changes
+        id: check
         shell: bash
+        env:
+          BEFORE: ${{ github.event.before }}
         run: |
-          # In a push event on a tag, github.ref_name contains the tag name (e.g. "v1.2.3")
-          TAG_NAME="${GITHUB_REF_NAME}"  
-          echo "Detected tag: ${TAG_NAME}"
-          # Remove the leading "v" using Bash parameter expansion
-          VERSION="${TAG_NAME#v}"
-          echo "Computed version: ${VERSION}"
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          publish=false
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            publish=true
+          elif [[ ! "${GITHUB_REF_NAME}" =~ ^[0-9]+\.(x|[0-9]+)$ ]]; then
+            # Canaries only from version branches (e.g. 2026.x, 2026.2, 2.4)
+            publish=false
+          elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
+            publish=true
+          elif [[ -z "${BEFORE}" || "${BEFORE}" =~ ^0+$ ]]; then
+            # New branch: no base to diff against — publish rather than miss one
+            publish=true
+          elif ! git fetch --quiet --no-tags --depth=1 origin "${BEFORE}"; then
+            # Base commit unavailable (e.g. after a force push) — publish rather than miss one
+            publish=true
+          elif CHANGED="$(git diff --name-only "${BEFORE}" "${GITHUB_SHA}" -- assets)"; then
+            if [[ -n "${CHANGED}" ]]; then
+              publish=true
+            fi
+          else
+            # Diff failed — publish rather than miss one
+            publish=true
+          fi
+          echo "Frontend changed / must publish: ${publish}"
+          echo "publish=${publish}" >> "$GITHUB_OUTPUT"
 
-      - name: Extract npm tag
-        id: extract_npm
+      - name: Determine canary target release and tag
+        id: target
+        if: steps.check.outputs.publish == 'true'
         shell: bash
         run: |
-          # Retrieve the version from the previous step
-          VERSION="${{ steps.extract_version.outputs.version }}"
-          echo "Using version: ${VERSION}"
-
-          # Determine the npm tag:
-          # If the version contains a hyphen, assume there is a pre-release identifier.
-          if [[ "$VERSION" == *"-"* ]]; then
-              # Extract text after the first hyphen
-              pre_release="${VERSION#*-}"
-              # Extract only the leading contiguous alphabetical string
-              npm_tag="$(echo "$pre_release" | grep -oE '^[A-Za-z]+' | tr '[:upper:]' '[:lower:]')"
-
-              # Fallback: if nothing is extracted, default to latest.
-              if [ -z "$npm_tag" ]; then
-                  npm_tag="latest"
-              fi
+          # Tag runs: the reusable workflow derives the release version from the
+          # tag itself, so target-release is unused here — emit a non-empty
+          # placeholder so the publish job still runs. canary-tag is irrelevant
+          # for tag/release publishes.
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            echo "target-release=tag" >> "$GITHUB_OUTPUT"
+            echo "canary-tag=canary" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          BRANCH="${GITHUB_REF_NAME}"
+          # Per-branch canary dist-tag so every live version branch publishes its
+          # own canary (canary-2026.x, canary-2026.2, canary-2.4, …).
+          echo "canary-tag=canary-${BRANCH}" >> "$GITHUB_OUTPUT"
+
+          # Canary base = next release of this branch's line; the branch name
+          # (e.g. "2026.x", "2026.2") is itself a valid semver range.
+          PKG_NAME="$(node -p "require('./assets/package.json').name" 2>/dev/null || true)"
+          LINE_LATEST="$([ -n "${PKG_NAME}" ] && npm view "${PKG_NAME}@${BRANCH}" version --json 2>/dev/null | node -p '(v=>{if(Array.isArray(v))v=v[v.length-1];return typeof v==="string"?v:""})(JSON.parse(require("fs").readFileSync(0,"utf8")))' 2>/dev/null || true)"
+          if [[ "${LINE_LATEST}" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
+            # Line already has published releases: base the canary on the next one.
+            if [[ "${BRANCH}" == *.x ]]; then
+              TARGET="${BASH_REMATCH[1]}.$(( BASH_REMATCH[2] + 1 )).0"
+            else
+              TARGET="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.$(( BASH_REMATCH[3] + 1 ))"
+            fi
           else
-              npm_tag="latest"
+            # No release published on this line yet: fall back to the configured
+            # base so a brand-new version branch still publishes canaries
+            # (matches the reference implementation, data-hub#1119).
+            TARGET="${FALLBACK_TARGET_RELEASE}"
           fi
-          echo "Computed npm tag: ${npm_tag}"
-
-          # Export the npm tag as an output for downstream steps
-          echo "npm_tag=${npm_tag}" >> "$GITHUB_OUTPUT"
+          echo "Canary target release for ${BRANCH}: ${TARGET}"
+          echo "target-release=${TARGET}" >> "$GITHUB_OUTPUT"
 
-  publish-release:
-    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
-    needs: release-determine-version
-    uses: ./.github/workflows/shared-npm-publish.yaml
+  publish:
+    needs: gate
+    if: needs.gate.outputs.publish == 'true' && needs.gate.outputs.target-release != ''
+    permissions:
+      id-token: write   # Required for OIDC trusted publishing
+      contents: write
+    uses: pimcore/workflows-collection-public/.github/workflows/reusable-frontend-publish-unified.yaml@main
     with:
-      version: "${{ needs.release-determine-version.outputs.version }}"
-      tag: "${{ needs.release-determine-version.outputs.npm_tag }}"
+      target-release: ${{ needs.gate.outputs.target-release }}
+      canary-tag: ${{ needs.gate.outputs.canary-tag }}
+      working-directory: ./assets
+      node-version: "24"
+      build-script: ci-build
+      build-output-path: ./build-dist/
+      # studio-ui runs tests as part of the publish gate; the API client is
+      # already committed by the build workflow, so no need to regenerate here.
+      test: true
+      api-client: false
+      # Publishing must not push commits back to the branch.
+      commit-lint-output: false
+      commit-build-output: false
+      pre-publish-script: ci-prepublish
+      # OIDC trusted publishing (no NPM_TOKEN). npm is pinned to 11 because
+      # npm@12 fails at publish time with a broken sigstore dependency.
+      npm-cli-version: "11"