feat: release pipeline with build, tag, and comparison workflows

[skjnldsv]

Summary

Adds a release pipeline that builds Nextcloud server archives, tags all bundled repositories, and compares the output against the existing release script.

Runs automatically when a release is published, alongside the existing changelog workflow.

Workflows

release.yml — Orchestrator

Triggers on release: published (tags starting with v only). Calls the tagger and builder in parallel.

release-tag.yml — Tag all repositories

Tags all bundled app repos at their stable branch HEAD.

• Reads app list from stableXX.json + non-build repos from tag-only.json
• Uses gh release create + gh release delete to create tags
• Falls back to repo default branch if stable branch not found
• Idempotent: skips existing tags
• Manual dispatch with force option to recreate tags

release-build.yml — Build and compare release

Builds release archives and compares against the release script's assets on the same release.

Pipeline:

1. Validate version.php (confirms bump PR is merged)
2. Auto-detect ref: use tag if it exists, fall back to branch HEAD
3. Detect compatible PHP version from server
4. Fetch server, 3rdparty, updater, example-files, docs (parallel)
5. Fetch all apps via matrix (parallel, with smart composer detection)
6. Assemble, clean dev files, update version.php, sign, generate metadata
7. Create tar.bz2 + zip + checksums
8. Compare file list against release script output

Configuration

App configs (stableXX.json, master.json)

[
  {"id": "activity", "repo": "nextcloud/activity"},
  {"id": "suspicious_login", "repo": "nextcloud/suspicious_login", "composer_args": "--no-dev -a --quiet --no-scripts"}
]

Optional composer_args overrides the default composer flags when needed.

tag-only.json

Non-build repos to tag (server, 3rdparty, updater, example-files, documentation).

Composer detection

Only runs if composer.json has actual runtime dependencies. Prevents creating empty vendor/ autoloaders in apps that don't need them.

---

Migration plan: from release script to full workflow

Step 1: Merge this PR

The workflow runs alongside the release script. Both produce archives. The compare job validates parity.

Step 2: Add workflow_dispatch to orchestrator

The orchestrator becomes the entry point instead of reacting to releases.

Step 3: Add release-exists guard

Before publishing, check that the release doesn't already exist to prevent duplicates.

Step 4: Enable publish job

Create release on nextcloud-releases/server with archives attached. Create reference release on nextcloud/server. Handle --prerelease for alpha/beta/rc, --latest for current stable.

Step 5: Use environment protection

Add a production environment with required reviewers for the publish job. Build runs automatically, publish waits for approval.

Step 6: Remove from release script

• Archive creation + upload
• Tag creation (tag.php)
• GitHub release creation

Step 7: Automate updater server

Generate releases.json entry with updater signatures and create a PR to nextcloud/updater_server.

Step 8: Automate download server

Webhook on release to pull assets, or direct upload from workflow.