From e09a637a2521d3bb734f68b04fb37dd0ea51146f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20M=C3=BCller?=
 <1005065+DeepDiver1975@users.noreply.github.com>
Date: Tue, 28 Jul 2026 14:01:23 +0200
Subject: [PATCH] feat: publish a signed release on tag push
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds a Release workflow that delegates to owncloud/reusable-workflows. On a
`v*` tag push it runs `make dist`, signs the bundle with ocsign instead of
`occ integrity:sign-app` (no ownCloud server required) and attaches the
tarball to a GitHub Release.

Until now `make dist` in CI silently skipped signing: `CAN_SIGN` is only set
when key, cert and occ all exist locally, so the `else` branch just echoed a
message and the build still exited 0. Since signing is mandatory on
ownCloud 11+, the reusable workflow now asserts the tarball carries a valid
`appinfo/signature.json` and fails the release otherwise.

Two Makefile changes are needed for this app:

The `appstore` target moved `../../config/config.php` aside around the sign
call, to stop occ reading the app's own config. ocsign does not read any
config, and without a core checkout that path does not exist, so the `mv`
failed with "cannot stat". Both lines are removed, which leaves `configdir`
unused, so its definition goes too.

`make dist` also emits two tarballs that are both named `notes.tar.gz` (a
source and an appstore bundle), which would collide as release assets, so the
workflow narrows `artifact-glob` to the appstore one.

Requires the SIGNING_KEY, SIGNING_CERT and SIGNING_CHAIN secrets on this
repository.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
---
 .github/workflows/release.yml | 24 ++++++++++++++++++++++++
 Makefile                      |  3 ---
 2 files changed, 24 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..ed763f96
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,24 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    permissions:
+      contents: write
+    uses: owncloud/reusable-workflows/.github/workflows/release.yml@main
+    with:
+      app-name: notes
+      # notes emits two tarballs both named notes.tar.gz (source and appstore);
+      # publish only the appstore one, otherwise the release assets collide.
+      artifact-glob: build/artifacts/appstore/*.tar.gz
+    secrets:
+      SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
+      SIGNING_CERT: ${{ secrets.SIGNING_CERT }}
+      SIGNING_CHAIN: ${{ secrets.SIGNING_CHAIN }}
diff --git a/Makefile b/Makefile
index 67a5ed3d..5ccdadfd 100644
--- a/Makefile
+++ b/Makefile
@@ -72,7 +72,6 @@ endif
 # * the certificate is located in ~/.owncloud/notes.crt
 occ=$(CURDIR)/../../occ
 phpunit_oc10=$(CURDIR)/../../lib/composer/bin/phpunit
-configdir=$(CURDIR)/../../config
 private_key=$(HOME)/.owncloud/certificates/$(app_name).key
 certificate=$(HOME)/.owncloud/certificates/$(app_name).crt
 sign=php -f $(occ) integrity:sign-app --privateKey="$(private_key)" --certificate="$(certificate)"
@@ -168,9 +167,7 @@ appstore: build
 	"CHANGELOG.md" \
 	$(appstore_build_directory)
 ifdef CAN_SIGN
-	mv $(configdir)/config.php $(configdir)/config-2.php
 	$(sign) --path="$(appstore_build_directory)"
-	mv $(configdir)/config-2.php $(configdir)/config.php
 else
 	@echo $(sign_skip_msg)
 endif