tests-deploy.yml

# SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
# SPDX-License-Identifier: MIT
name: Tests - Deploy

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: tests-deploy-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  nc-host-app-docker:
    runs-on: ubuntu-22.04
    name: NC In Host

    services:
      postgres:
        image: ghcr.io/nextcloud/continuous-integration-postgres-14:latest # zizmor: ignore[unpinned-images]
        ports:
          - 4444:5432/tcp
        env:
          POSTGRES_USER: root
          POSTGRES_PASSWORD: rootpassword
          POSTGRES_DB: nextcloud
        options: --health-cmd pg_isready --health-interval 5s --health-timeout 2s --health-retries 5

    steps:
      - name: Set app env
        run: echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV

      - name: Checkout server
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          submodules: true
          repository: nextcloud/server
          ref: master

      - name: Checkout AppAPI
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          path: apps/${{ env.APP_NAME }}

      - name: Set up php
        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
        with:
          php-version: '8.3'
          extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, pgsql, pdo_pgsql
          coverage: none
          ini-file: development
          ini-values:
            apc.enabled=on, apc.enable_cli=on, disable_functions=
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Check composer file existence
        id: check_composer
        uses: andstor/file-existence-action@558493d6c74bf472d87c84eab196434afc2fa029 # v2
        with:
          files: apps/${{ env.APP_NAME }}/composer.json

      - name: Set up dependencies
        if: steps.check_composer.outputs.files_exists == 'true'
        working-directory: apps/${{ env.APP_NAME }}
        run: composer i

      - name: Set up Nextcloud
        env:
          DB_PORT: 4444
        run: |
          mkdir data
          ./occ maintenance:install --verbose --database=pgsql --database-name=nextcloud --database-host=127.0.0.1 \
            --database-port=$DB_PORT --database-user=root --database-pass=rootpassword \
            --admin-user admin --admin-pass admin
          ./occ config:system:set loglevel --value=0 --type=integer
          ./occ config:system:set debug --value=true --type=boolean
          ./occ app:enable --force ${{ env.APP_NAME }}

      - name: Test deploy
        run: |
          PHP_CLI_SERVER_WORKERS=2 php -S 127.0.0.1:8080 &
          ./occ app_api:daemon:register docker_local_sock Docker docker-install http /var/run/docker.sock http://127.0.0.1:8080/index.php
          ./occ app_api:app:register app-skeleton-python docker_local_sock \
            --info-xml https://raw.githubusercontent.com/nextcloud/app-skeleton-python/main/appinfo/info.xml
          ./occ app_api:app:enable app-skeleton-python
          ./occ app_api:app:disable app-skeleton-python

      - name: Check logs
        run: |
          grep -q 'Hello from app-skeleton-python :)' data/nextcloud.log || error
          grep -q 'Bye bye from app-skeleton-python :(' data/nextcloud.log || error

      - name: Save container info & logs
        if: always()
        run: |
          docker inspect nc_app_app-skeleton-python | json_pp > container.json
          docker logs nc_app_app-skeleton-python > container.log 2>&1

      - name: Unregister Skeleton & Daemon
        run: |
          ./occ app_api:app:unregister app-skeleton-python
          ./occ app_api:daemon:unregister docker_local_sock

      - name: Test OCC commands(docker)
        run: python3 apps/${{ env.APP_NAME }}/tests/test_occ_commands_docker.py

      - name: Upload Container info
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: nc_host_app_docker_container.json
          path: container.json
          if-no-files-found: warn

      - name: Upload Container logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: nc_host_app_docker_container.log
          path: container.log
          if-no-files-found: warn

      - name: Upload NC logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: nc_host_app_docker_nextcloud.log
          path: data/nextcloud.log
          if-no-files-found: warn

  nc-docker-app-docker:
    runs-on: ubuntu-22.04
    name: NC In Julius Docker
    env:
      docker-image: ghcr.io/juliusknorr/nextcloud-dev-php83:master

    steps:
      - name: Set app env
        run: echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV

      - name: Create container
        run: |
          docker network create master_bridge
          docker run --net master_bridge --name nextcloud --rm -d -v /var/run/docker.sock:/var/run/docker.sock ${{ env.docker-image }}
          sudo chmod 766 /var/run/docker.sock

      - name: Wait for Nextcloud bootstrap
        run: |
          for i in $(seq 1 60); do
            if docker exec nextcloud test -f /var/www/html/version.php 2>/dev/null; then
              echo "Nextcloud source ready after ${i}0s"
              break
            fi
            echo "Waiting for Nextcloud bootstrap... ($i/60)"
            sleep 10
          done
          docker exec nextcloud test -f /var/www/html/version.php || (echo "Bootstrap timed out" && exit 1)

      - name: Install AppAPI
        run: |
          docker exec -w /var/www/html/apps nextcloud git clone https://github.com/nextcloud/${{ env.APP_NAME }}.git
          docker exec -w /var/www/html/apps/${{ env.APP_NAME }} nextcloud git fetch origin $GITHUB_REF
          docker exec -w /var/www/html/apps/${{ env.APP_NAME }} nextcloud git checkout FETCH_HEAD
          docker exec nextcloud sudo -u www-data php occ app:enable app_api
          docker exec nextcloud sudo -u www-data php occ app_api:daemon:register \
            docker_local_sock Docker docker-install http /var/run/docker.sock http://nextcloud/index.php \
            --net=master_bridge
          docker exec nextcloud sudo -u www-data php occ app_api:daemon:list

      - name: Registering and enabling Skeleton ExApp
        run: |
          docker exec nextcloud sudo -u www-data php occ app_api:app:register app-skeleton-python docker_local_sock \
            --info-xml https://raw.githubusercontent.com/nextcloud/app-skeleton-python/main/appinfo/info.xml
          docker exec nextcloud sudo -u www-data php occ app_api:app:enable app-skeleton-python

      - name: Docker inspect output
        if: always()
        run: docker inspect nc_app_app-skeleton-python

      - name: Disable ExApp
        run: |
          docker exec nextcloud sudo -u www-data php occ app_api:app:disable app-skeleton-python

      - name: Copy NC log to host
        if: always()
        run: docker cp nextcloud:/var/www/html/data/nextcloud.log nextcloud.log

      - name: Check logs
        run: |
          grep -q 'Hello from app-skeleton-python :)' nextcloud.log || error
          grep -q 'Bye bye from app-skeleton-python :(' nextcloud.log || error

      - name: Save container info & logs
        if: always()
        run: |
          docker inspect app-skeleton-python | json_pp > container.json
          docker logs nc_app_app-skeleton-python > container.log 2>&1

      - name: Unregister Skeleton & Daemon
        run: |
          docker exec nextcloud sudo -u www-data php occ app_api:app:unregister app-skeleton-python
          docker exec nextcloud sudo -u www-data php occ app_api:daemon:unregister docker_local_sock

      - name: Upload Container info
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: nc_docker_app_docker_container.json
          path: container.json
          if-no-files-found: warn

      - name: Upload Container logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: nc_docker_app_docker_container.log
          path: container.log
          if-no-files-found: warn

      - name: Upload NC logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: nc_docker_app_docker_nextcloud.log
          path: nextcloud.log
          if-no-files-found: warn

  nc-docker-dsp-http:
    runs-on: ubuntu-22.04
    name: NC In Julius Docker(DSP-HTTP)
    env:
      docker-image: ghcr.io/juliusknorr/nextcloud-dev-php83:master

    steps:
      - name: Set app env
        run: echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV

      - name: Create containers
        run: |
          docker network create master_bridge
          docker run -v /var/run/docker.sock:/var/run/docker.sock \
            -e NC_HAPROXY_PASSWORD="some_secure_password" \
            --net master_bridge --name nextcloud-appapi-dsp -h nextcloud-appapi-dsp \
            --privileged -d ghcr.io/nextcloud/nextcloud-appapi-dsp:latest
          docker run --net master_bridge --name nextcloud --rm -d ${{ env.docker-image }}

      - name: Wait for Nextcloud bootstrap
        run: |
          for i in $(seq 1 60); do
            if docker exec nextcloud test -f /var/www/html/version.php 2>/dev/null; then
              echo "Nextcloud source ready after ${i}0s"
              break
            fi
            echo "Waiting for Nextcloud bootstrap... ($i/60)"
            sleep 10
          done
          docker exec nextcloud test -f /var/www/html/version.php || (echo "Bootstrap timed out" && exit 1)

      - name: Install AppAPI
        run: |
          docker exec -w /var/www/html/apps nextcloud git clone https://github.com/nextcloud/${{ env.APP_NAME }}.git
          docker exec -w /var/www/html/apps/${{ env.APP_NAME }} nextcloud git fetch origin $GITHUB_REF
          docker exec -w /var/www/html/apps/${{ env.APP_NAME }} nextcloud git checkout FETCH_HEAD
          docker exec nextcloud sudo -u www-data php occ app:enable app_api
          docker exec nextcloud sudo -u www-data php occ app_api:daemon:register \
            docker_by_port Docker docker-install http nextcloud-appapi-dsp:2375 http://nextcloud/index.php \
            --net=master_bridge --haproxy_password=some_secure_password
          docker exec nextcloud sudo -u www-data php occ app_api:daemon:list
          docker exec nextcloud ping -c 1 nextcloud-appapi-dsp

      - name: Registering and enabling Skeleton ExApp
        run: |
          docker exec nextcloud sudo -u www-data php occ app_api:app:register app-skeleton-python docker_by_port \
            --info-xml https://raw.githubusercontent.com/nextcloud/app-skeleton-python/main/appinfo/info.xml
          docker exec nextcloud sudo -u www-data php occ app_api:app:enable app-skeleton-python

      - name: Docker inspect output
        if: always()
        run: docker inspect nc_app_app-skeleton-python

      - name: Disable ExApp
        run: |
          docker exec nextcloud sudo -u www-data php occ app_api:app:disable app-skeleton-python

      - name: Copy NC log to host
        if: always()
        run: docker cp nextcloud:/var/www/html/data/nextcloud.log nextcloud.log

      - name: Check logs
        run: |
          grep -q 'Hello from app-skeleton-python :)' nextcloud.log || error
          grep -q 'Bye bye from app-skeleton-python :(' nextcloud.log || error

      - name: Save container info & logs
        if: always()
        run: |
          docker inspect nc_app_app-skeleton-python | json_pp > container.json
          docker logs nc_app_app-skeleton-python > container.log 2>&1

      - name: Unregister Skeleton & Daemon
        run: |
          docker exec nextcloud sudo -u www-data php occ app_api:app:unregister app-skeleton-python
          docker exec nextcloud sudo -u www-data php occ app_api:daemon:unregister docker_by_port

      - name: Upload Container info
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: dsp_http_container.json
          path: container.json
          if-no-files-found: warn

      - name: Upload Container logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: dsp_http_container.log
          path: container.log
          if-no-files-found: warn

      - name: Upload NC logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: dsp_http_nextcloud.log
          path: nextcloud.log
          if-no-files-found: warn

  nc-docker-dsp-https-bridge:
    runs-on: ubuntu-22.04
    name: NC In Julius Docker(DSP-HTTPS-BRIDGE)
    env:
      docker-image: ghcr.io/juliusknorr/nextcloud-dev-php83:master

    steps:
      - name: Set app env
        run: echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV

      - name: Create certificates
        run: |
          mkdir certs
          openssl req -nodes -new -x509 -subj '/CN=host.docker.internal' -sha256 -keyout certs/privkey.pem -out certs/fullchain.pem -days 365000 > /dev/null 2>&1
          cat certs/fullchain.pem certs/privkey.pem | tee certs/cert.pem > /dev/null 2>&1

      - name: Create containers
        run: |
          docker network create master_bridge
          docker run -v /var/run/docker.sock:/var/run/docker.sock \
            -v `pwd`/certs/cert.pem:/certs/cert.pem \
            -e NC_HAPROXY_PASSWORD="some_secure_password" \
            -e BIND_ADDRESS="172.18.0.1" \
            -e EX_APPS_NET="ipv4@localhost" \
            --net host --name nextcloud-appapi-dsp -h nextcloud-appapi-dsp \
            --privileged -d ghcr.io/nextcloud/nextcloud-appapi-dsp:latest
          docker run --net master_bridge --name nextcloud --rm -d ${{ env.docker-image }}

      - name: Wait for Nextcloud bootstrap
        run: |
          for i in $(seq 1 60); do
            if docker exec nextcloud test -f /var/www/html/version.php 2>/dev/null; then
              echo "Nextcloud source ready after ${i}0s"
              break
            fi
            echo "Waiting for Nextcloud bootstrap... ($i/60)"
            sleep 10
          done
          docker exec nextcloud test -f /var/www/html/version.php || (echo "Bootstrap timed out" && exit 1)

      - name: Debug information
        run: |
          echo "hostname -I:"
          hostname -I
          echo ""
          echo "DSP networks:"
          docker exec nextcloud-appapi-dsp ip addr show | grep inet | awk '{print $2}' | cut -d/ -f1
          echo ""
          echo "Open ports:"
          netstat -lntu

      - name: Install AppAPI
        run: |
          docker exec -w /var/www/html/apps nextcloud git clone https://github.com/nextcloud/${{ env.APP_NAME }}.git
          docker exec -w /var/www/html/apps/${{ env.APP_NAME }} nextcloud git fetch origin $GITHUB_REF
          docker exec -w /var/www/html/apps/${{ env.APP_NAME }} nextcloud git checkout FETCH_HEAD
          docker exec nextcloud sudo -u www-data php occ app:enable app_api
          docker cp ./certs/cert.pem nextcloud:/
          docker exec nextcloud sudo -u www-data php occ security:certificates:import /cert.pem
          docker exec nextcloud sudo -u www-data php occ app_api:daemon:register \
            docker_by_port Docker docker-install https host.docker.internal:2375 http://nextcloud/index.php \
            --net=master_bridge --haproxy_password=some_secure_password
          docker exec nextcloud sudo -u www-data php occ app_api:daemon:list
          docker exec nextcloud ping -c 1 host.docker.internal

      - name: Registering and enabling Skeleton ExApp
        run: |
          docker exec nextcloud sudo -u www-data php occ app_api:app:register app-skeleton-python docker_by_port \
            --info-xml https://raw.githubusercontent.com/nextcloud/app-skeleton-python/main/appinfo/info.xml
          docker exec nextcloud sudo -u www-data php occ app_api:app:enable app-skeleton-python

      - name: Docker inspect output
        if: always()
        run: docker inspect nc_app_app-skeleton-python

      - name: Checking if ExApp container can access HTTPS DSP
        run: |
          docker exec nc_app_app-skeleton-python apt update
          docker exec nc_app_app-skeleton-python apt install curl -y
          docker exec nc_app_app-skeleton-python curl --resolve host.docker.internal:2375:172.18.0.1 https://host.docker.internal:2375

      - name: Disable ExApp
        run: |
          docker exec nextcloud sudo -u www-data php occ app_api:app:disable app-skeleton-python

      - name: Copy NC log to host
        if: always()
        run: docker cp nextcloud:/var/www/html/data/nextcloud.log nextcloud.log

      - name: Check logs
        run: |
          grep -q 'Hello from app-skeleton-python :)' nextcloud.log || error
          grep -q 'Bye bye from app-skeleton-python :(' nextcloud.log || error

      - name: Save HaProxy logs
        if: always()
        run: docker logs nextcloud-appapi-dsp > haproxy.log 2>&1

      - name: Save container info & logs
        if: always()
        run: |
          docker inspect nc_app_app-skeleton-python | json_pp > container.json
          docker logs nc_app_app-skeleton-python > container.log 2>&1

      - name: Unregister Skeleton & Daemon
        run: |
          docker exec nextcloud sudo -u www-data php occ app_api:app:unregister app-skeleton-python
          docker exec nextcloud sudo -u www-data php occ app_api:daemon:unregister docker_by_port

      - name: Upload HaProxy logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: dsp_https_bridge_haproxy.log
          path: haproxy.log
          if-no-files-found: warn

      - name: Upload Container info
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: dsp_https_bridge_container.json
          path: container.json
          if-no-files-found: warn

      - name: Upload Container logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: dsp_https_bridge_container.log
          path: container.log
          if-no-files-found: warn

      - name: Upload NC logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: dsp_https_bridge_nextcloud.log
          path: nextcloud.log
          if-no-files-found: warn

  nc-docker-dsp-https:
    runs-on: ubuntu-22.04
    name: NC In Julius Docker(DSP-HTTPS)
    env:
      docker-image: ghcr.io/juliusknorr/nextcloud-dev-php83:master

    steps:
      - name: Set app env
        run: echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV

      - name: Create certificates
        run: |
          mkdir certs
          openssl req -nodes -new -x509 -subj '/CN=host.docker.internal' -sha256 -keyout certs/privkey.pem -out certs/fullchain.pem -days 365000 > /dev/null 2>&1
          cat certs/fullchain.pem certs/privkey.pem | tee certs/cert.pem > /dev/null 2>&1

      - name: Create containers
        run: |
          docker run -v /var/run/docker.sock:/var/run/docker.sock \
            -v `pwd`/certs/cert.pem:/certs/cert.pem \
            -e NC_HAPROXY_PASSWORD="some_secure_password" \
            -e BIND_ADDRESS="172.17.0.1" \
            -e EX_APPS_NET="ipv4@localhost" \
            --net host --name nextcloud-appapi-dsp -h nextcloud-appapi-dsp \
            --privileged -d ghcr.io/nextcloud/nextcloud-appapi-dsp:latest
          docker run --net=bridge --name=nextcloud -p 8080:80 --rm -d ${{ env.docker-image }}

      - name: Wait for Nextcloud bootstrap
        run: |
          for i in $(seq 1 60); do
            if docker exec nextcloud test -f /var/www/html/version.php 2>/dev/null; then
              echo "Nextcloud source ready after ${i}0s"
              break
            fi
            echo "Waiting for Nextcloud bootstrap... ($i/60)"
            sleep 10
          done
          docker exec nextcloud test -f /var/www/html/version.php || (echo "Bootstrap timed out" && exit 1)

      - name: Debug information
        run: |
          echo "Hostname:"
          hostname -I
          echo "DSP networks:"
          docker exec nextcloud-appapi-dsp ip addr show | grep inet | awk '{print $2}' | cut -d/ -f1
          echo "Open ports:"
          netstat -lntu

      - name: Install AppAPI
        run: |
          docker exec -w /var/www/html/apps nextcloud git clone https://github.com/nextcloud/${{ env.APP_NAME }}.git
          docker exec -w /var/www/html/apps/${{ env.APP_NAME }} nextcloud git fetch origin $GITHUB_REF
          docker exec -w /var/www/html/apps/${{ env.APP_NAME }} nextcloud git checkout FETCH_HEAD
          docker exec nextcloud sudo -u www-data php occ app:enable app_api
          docker cp ./certs/cert.pem nextcloud:/
          docker exec nextcloud sudo -u www-data php occ security:certificates:import /cert.pem
          docker exec nextcloud sudo -u www-data php occ app_api:daemon:register \
            docker_by_port Docker docker-install https host.docker.internal:2375 http://localhost:8080/index.php \
            --net=host --haproxy_password=some_secure_password
          docker exec nextcloud sudo -u www-data php occ app_api:daemon:list
          docker exec nextcloud ping -c 1 host.docker.internal

      - name: Registering and enabling Skeleton ExApp
        run: |
          docker exec nextcloud sudo -u www-data php occ app_api:app:register app-skeleton-python docker_by_port \
            --info-xml https://raw.githubusercontent.com/nextcloud/app-skeleton-python/main/appinfo/info.xml
          docker exec nextcloud sudo -u www-data php occ app_api:app:enable app-skeleton-python

      - name: Checking if ExApp container can access HTTPS DSP
        run: |
          docker exec nc_app_app-skeleton-python apt update
          docker exec nc_app_app-skeleton-python apt install curl -y
          docker exec nc_app_app-skeleton-python curl --resolve host.docker.internal:2375:172.17.0.1 https://host.docker.internal:2375

      - name: Disable ExApp
        run: |
          docker exec nextcloud sudo -u www-data php occ app_api:app:disable app-skeleton-python

      - name: Copy NC log to host
        if: always()
        run: docker cp nextcloud:/var/www/html/data/nextcloud.log nextcloud.log

      - name: Check logs
        run: |
          grep -q 'Hello from app-skeleton-python :)' nextcloud.log || error
          grep -q 'Bye bye from app-skeleton-python :(' nextcloud.log || error

      - name: Save HaProxy logs
        if: always()
        run: docker logs nextcloud-appapi-dsp > haproxy.log 2>&1

      - name: Save container info & logs
        if: always()
        run: |
          docker inspect nc_app_app-skeleton-python | json_pp > container.json
          docker logs nc_app_app-skeleton-python > container.log 2>&1

      - name: Unregister Skeleton & Daemon
        run: |
          docker exec nextcloud sudo -u www-data php occ app_api:app:unregister app-skeleton-python
          docker exec nextcloud sudo -u www-data php occ app_api:daemon:unregister docker_by_port

      - name: Upload HaProxy logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: dsp_https_haproxy.log
          path: haproxy.log
          if-no-files-found: warn

      - name: Upload Container info
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: dsp_https_container.json
          path: container.json
          if-no-files-found: warn

      - name: Upload Container logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: dsp_https_container.log
          path: container.log
          if-no-files-found: warn

      - name: Upload NC logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: dsp_https_nextcloud.log
          path: nextcloud.log
          if-no-files-found: warn

  nc-host-app-docker-redis:
    runs-on: ubuntu-22.04
    name: NC In Host(Redis)

    services:
      postgres:
        image: ghcr.io/nextcloud/continuous-integration-postgres-14:latest # zizmor: ignore[unpinned-images]
        ports:
          - 4444:5432/tcp
        env:
          POSTGRES_USER: root
          POSTGRES_PASSWORD: rootpassword
          POSTGRES_DB: nextcloud
        options: --health-cmd pg_isready --health-interval 5s --health-timeout 2s --health-retries 5
      redis:
        image: redis # zizmor: ignore[unpinned-images]
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
          --name redis
        ports:
          - 6379:6379

    steps:
      - name: Set app env
        run: echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV

      - name: Checkout server
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          submodules: true
          repository: nextcloud/server
          ref: master

      - name: Checkout AppAPI
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          path: apps/${{ env.APP_NAME }}

      - name: Set up php 8.3
        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
        with:
          php-version: 8.3
          extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, pgsql, pdo_pgsql, redis
          coverage: none
          ini-file: development
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Check composer file existence
        id: check_composer
        uses: andstor/file-existence-action@558493d6c74bf472d87c84eab196434afc2fa029 # v2
        with:
          files: apps/${{ env.APP_NAME }}/composer.json

      - name: Set up dependencies
        if: steps.check_composer.outputs.files_exists == 'true'
        working-directory: apps/${{ env.APP_NAME }}
        run: composer i

      - name: Set up Nextcloud
        env:
          DB_PORT: 4444
          REDIS_HOST: localhost
          REDIS_PORT: 6379
        run: |
          mkdir data
          ./occ maintenance:install --verbose --database=pgsql --database-name=nextcloud --database-host=127.0.0.1 \
            --database-port=$DB_PORT --database-user=root --database-pass=rootpassword \
            --admin-user admin --admin-pass admin
          ./occ config:system:set loglevel --value=0 --type=integer
          ./occ config:system:set debug --value=true --type=boolean

          ./occ config:system:set memcache.local --value "\\OC\\Memcache\\Redis"
          ./occ config:system:set memcache.distributed --value "\\OC\\Memcache\\Redis"
          ./occ config:system:set memcache.locking --value "\\OC\\Memcache\\Redis"
          ./occ config:system:set redis host --value ${{ env.REDIS_HOST }}
          ./occ config:system:set redis port --value ${{ env.REDIS_PORT }}

          ./occ app:enable --force ${{ env.APP_NAME }}

      - name: Test deploy
        run: |
          PHP_CLI_SERVER_WORKERS=2 php -S 127.0.0.1:8080 &
          ./occ app_api:daemon:register docker_local_sock Docker docker-install http /var/run/docker.sock http://127.0.0.1:8080/index.php
          ./occ app_api:daemon:list
          ./occ app_api:app:register app-skeleton-python docker_local_sock \
            --info-xml https://raw.githubusercontent.com/nextcloud/app-skeleton-python/main/appinfo/info.xml
          ./occ app_api:app:enable app-skeleton-python
          ./occ app_api:app:disable app-skeleton-python

      - name: Check logs
        run: |
          grep -q 'Hello from app-skeleton-python :)' data/nextcloud.log || error
          grep -q 'Bye bye from app-skeleton-python :(' data/nextcloud.log || error

      - name: Save container info & logs
        if: always()
        run: |
          docker inspect nc_app_app-skeleton-python | json_pp > container.json
          docker logs nc_app_app-skeleton-python > container.log 2>&1

      - name: Unregister Skeleton & Daemon
        run: |
          ./occ app_api:app:unregister app-skeleton-python
          ./occ app_api:daemon:unregister docker_local_sock

      - name: Test OCC commands(docker)
        run: python3 apps/${{ env.APP_NAME }}/tests/test_occ_commands_docker.py

      - name: Check redis keys
        run: |
          docker exec redis redis-cli keys '*app_api*' || error

      - name: Upload Container info
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: nc_host_app_docker_redis_container.json
          path: container.json
          if-no-files-found: warn

      - name: Upload Container logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: nc_host_app_docker_redis_container.log
          path: container.log
          if-no-files-found: warn

      - name: Upload NC logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: nc_host_app_docker_redis_nextcloud.log
          path: data/nextcloud.log
          if-no-files-found: warn

  nc-host-app-docker-redis-deploy-options:
    runs-on: ubuntu-22.04
    name: NC In Host(Redis) Deploy options

    services:
      postgres:
        image: ghcr.io/nextcloud/continuous-integration-postgres-14:latest # zizmor: ignore[unpinned-images]
        ports:
          - 4444:5432/tcp
        env:
          POSTGRES_USER: root
          POSTGRES_PASSWORD: rootpassword
          POSTGRES_DB: nextcloud
        options: --health-cmd pg_isready --health-interval 5s --health-timeout 2s --health-retries 5
      redis:
        image: redis # zizmor: ignore[unpinned-images]
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
          --name redis
        ports:
          - 6379:6379

    steps:
      - name: Set app env
        run: echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV

      - name: Checkout server
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          submodules: true
          repository: nextcloud/server
          ref: master

      - name: Checkout AppAPI
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          path: apps/${{ env.APP_NAME }}

      - name: Set up php 8.3
        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
        with:
          php-version: 8.3
          extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, pgsql, pdo_pgsql, redis
          coverage: none
          ini-file: development
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Check composer file existence
        id: check_composer
        uses: andstor/file-existence-action@558493d6c74bf472d87c84eab196434afc2fa029 # v2
        with:
          files: apps/${{ env.APP_NAME }}/composer.json

      - name: Set up dependencies
        if: steps.check_composer.outputs.files_exists == 'true'
        working-directory: apps/${{ env.APP_NAME }}
        run: composer i

      - name: Set up Nextcloud
        env:
          DB_PORT: 4444
          REDIS_HOST: localhost
          REDIS_PORT: 6379
        run: |
          mkdir data
          ./occ maintenance:install --verbose --database=pgsql --database-name=nextcloud --database-host=127.0.0.1 \
            --database-port=$DB_PORT --database-user=root --database-pass=rootpassword \
            --admin-user admin --admin-pass admin
          ./occ config:system:set loglevel --value=0 --type=integer
          ./occ config:system:set debug --value=true --type=boolean

          ./occ config:system:set memcache.local --value "\\OC\\Memcache\\Redis"
          ./occ config:system:set memcache.distributed --value "\\OC\\Memcache\\Redis"
          ./occ config:system:set memcache.locking --value "\\OC\\Memcache\\Redis"
          ./occ config:system:set redis host --value ${{ env.REDIS_HOST }}
          ./occ config:system:set redis port --value ${{ env.REDIS_PORT }}

          ./occ app:enable --force ${{ env.APP_NAME }}

      - name: Test deploy
        run: |
          PHP_CLI_SERVER_WORKERS=2 php -S 127.0.0.1:8080 &
          ./occ app_api:daemon:register docker_local_sock Docker docker-install http /var/run/docker.sock http://127.0.0.1:8080/index.php
          ./occ app_api:daemon:list
          mkdir -p ./test_mount
          TEST_MOUNT_ABS_PATH=$(pwd)/test_mount
          ./occ app_api:app:register app-skeleton-python docker_local_sock \
            --info-xml https://raw.githubusercontent.com/nextcloud/app-skeleton-python/main/appinfo/info.xml \
            --env='TEST_ENV_2=2' \
            --mount "$TEST_MOUNT_ABS_PATH:/test_mount:rw"
          ./occ app_api:app:enable app-skeleton-python
          ./occ app_api:app:disable app-skeleton-python

      - name: Check logs
        run: |
          grep -q 'Hello from app-skeleton-python :)' data/nextcloud.log || error
          grep -q 'Bye bye from app-skeleton-python :(' data/nextcloud.log || error

      - name: Check docker inspect TEST_ENV_1
        run: |
          docker inspect --format '{{ json .Config.Env }}' nc_app_app-skeleton-python | grep -q '"TEST_ENV_1=0"' || error

      - name: Check docker inspect TEST_ENV_2
        run: |
          docker inspect --format '{{ json .Config.Env }}' nc_app_app-skeleton-python | grep -q '"TEST_ENV_2=2"' || error

      - name: Check docker inspect TEST_ENV_3
        run: |
          if docker inspect --format '{{ json .Config.Env }}' nc_app_app-skeleton-python | grep -q '"TEST_ENV_3='; then
            echo "TEST_ENV_3 should not be present in container env"
            exit 1
          fi

      - name: Check docker inspect TEST_MOUNT
        run: |
          docker inspect --format '{{ json .Mounts }}' nc_app_app-skeleton-python | grep -q "Source\":\"$(printf '%s' "$TEST_MOUNT_ABS_PATH" | sed 's/[][\.*^$]/\\&/g')" || { echo "Error: TEST_MOUNT_ABS_PATH not found"; exit 1; }

      - name: Save container info & logs
        if: always()
        run: |
          docker inspect nc_app_app-skeleton-python | json_pp > container.json
          docker logs nc_app_app-skeleton-python > container.log 2>&1

      - name: Unregister Skeleton & Daemon
        run: |
          ./occ app_api:app:unregister app-skeleton-python
          ./occ app_api:daemon:unregister docker_local_sock

      - name: Test OCC commands(docker)
        run: python3 apps/${{ env.APP_NAME }}/tests/test_occ_commands_docker.py

      - name: Check redis keys
        run: |
          docker exec redis redis-cli keys '*app_api*' || error

      - name: Upload Container info
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: nc_host_app_docker_redis_deploy_options_container.json
          path: container.json
          if-no-files-found: warn

      - name: Upload Container logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: nc_host_app_docker_redis_deploy_options_container.log
          path: container.log
          if-no-files-found: warn

      - name: Upload NC logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: nc_host_app_docker_redis_deploy_options_nextcloud.log
          path: data/nextcloud.log
          if-no-files-found: warn

  nc-host-network-host:
    runs-on: ubuntu-22.04
    name: NC In Host(network=host)

    services:
      postgres:
        image: ghcr.io/nextcloud/continuous-integration-postgres-14:latest # zizmor: ignore[unpinned-images]
        ports:
          - 4444:5432/tcp
        env:
          POSTGRES_USER: root
          POSTGRES_PASSWORD: rootpassword
          POSTGRES_DB: nextcloud
        options: --health-cmd pg_isready --health-interval 5s --health-timeout 2s --health-retries 5

    steps:
      - name: Set app env
        run: echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV

      - name: Checkout server
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          submodules: true
          repository: nextcloud/server
          ref: master

      - name: Checkout AppAPI
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          path: apps/${{ env.APP_NAME }}

      - name: Set up php 8.3
        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
        with:
          php-version: 8.3
          extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, pgsql, pdo_pgsql, redis
          coverage: none
          ini-file: development
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Check composer file existence
        id: check_composer
        uses: andstor/file-existence-action@558493d6c74bf472d87c84eab196434afc2fa029 # v2
        with:
          files: apps/${{ env.APP_NAME }}/composer.json

      - name: Set up dependencies
        if: steps.check_composer.outputs.files_exists == 'true'
        working-directory: apps/${{ env.APP_NAME }}
        run: composer i

      - name: Set up Nextcloud
        env:
          DB_PORT: 4444
        run: |
          mkdir data
          ./occ maintenance:install --verbose --database=pgsql --database-name=nextcloud --database-host=127.0.0.1 \
            --database-port=$DB_PORT --database-user=root --database-pass=rootpassword \
            --admin-user admin --admin-pass admin
          ./occ config:system:set loglevel --value=0 --type=integer
          ./occ config:system:set debug --value=true --type=boolean
          ./occ config:system:set overwrite.cli.url --value http://127.0.0.1:8080 --type=string
          ./occ app:enable --force ${{ env.APP_NAME }}

      - name: Test deploy
        run: |
          PHP_CLI_SERVER_WORKERS=2 php -S 127.0.0.1:8080 &
          ./occ app_api:daemon:register \
            docker_socket_local Docker docker-install http /var/run/docker.sock http://127.0.0.1:8080/index.php \
            --net=host --set-default
          ./occ app_api:daemon:list
          ./occ app_api:app:register app-skeleton-python \
            --info-xml https://raw.githubusercontent.com/nextcloud/app-skeleton-python/main/appinfo/info.xml
          ./occ app_api:app:enable app-skeleton-python
          ./occ app_api:app:disable app-skeleton-python

      - name: Check logs
        run: |
          grep -q 'Hello from app-skeleton-python :)' data/nextcloud.log || error
          grep -q 'Bye bye from app-skeleton-python :(' data/nextcloud.log || error

      - name: Save container info & logs
        if: always()
        run: |
          docker inspect nc_app_app-skeleton-python | json_pp > container.json
          docker logs nc_app_app-skeleton-python > container.log 2>&1

      - name: Unregister Skeleton & Daemon
        run: |
          ./occ app_api:app:unregister app-skeleton-python
          ./occ app_api:daemon:unregister docker_socket_local

      - name: Test OCC commands(docker)
        run: python3 apps/${{ env.APP_NAME }}/tests/test_occ_commands_docker.py

      - name: Upload Container info
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: nc_host_network_host_container.json
          path: container.json
          if-no-files-found: warn

      - name: Upload Container logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: nc_host_network_host_container.log
          path: container.log
          if-no-files-found: warn

      - name: Upload NC logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: nc_host_network_host_nextcloud.log
          path: data/nextcloud.log
          if-no-files-found: warn

  nc-docker-harp-bridge:
    runs-on: ubuntu-22.04
    name: NC In Julius Docker (HaRP-Bridge network)
    env:
      docker-image: ghcr.io/juliusknorr/nextcloud-dev-php83:master

    steps:
      - name: Set app env
        run: echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV

      - name: Checkout AppAPI
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Create containers
        run: |
          docker network create master_bridge
          docker run \
            -e HP_SHARED_KEY="some_very_secure_password" \
            -e NC_INSTANCE_URL="http://nextcloud" \
            -e HP_LOG_LEVEL="debug" \
            -v /var/run/docker.sock:/var/run/docker.sock \
            --net master_bridge --name appapi-harp -h appapi-harp \
            --restart unless-stopped \
            -d ghcr.io/nextcloud/nextcloud-appapi-harp:latest
          docker run --net master_bridge --name nextcloud-docker --rm -d ${{ env.docker-image }}

          sed -i 's/127\.0\.0\.1:8080/nextcloud-docker/' tests/simple-nginx-NOT-FOR-PRODUCTION.conf
          sed -i 's/127\.0\.0\.1:8780/appapi-harp:8780/' tests/simple-nginx-NOT-FOR-PRODUCTION.conf
          cat tests/simple-nginx-NOT-FOR-PRODUCTION.conf

          docker run --net master_bridge --name nextcloud --rm \
            -v $(pwd)/tests/simple-nginx-NOT-FOR-PRODUCTION.conf:/etc/nginx/conf.d/default.conf:ro \
            -d nginx

      - name: Wait for Nextcloud bootstrap
        run: |
          for i in $(seq 1 60); do
            if docker exec nextcloud-docker test -f /var/www/html/version.php 2>/dev/null; then
              echo "Nextcloud source ready after ${i}0s"
              break
            fi
            echo "Waiting for Nextcloud bootstrap... ($i/60)"
            sleep 10
          done
          docker exec nextcloud-docker test -f /var/www/html/version.php || (echo "Bootstrap timed out" && exit 1)

      - name: Install AppAPI
        run: |
          docker exec -w /var/www/html/apps nextcloud-docker git clone https://github.com/nextcloud/${{ env.APP_NAME }}.git
          docker exec -w /var/www/html/apps/${{ env.APP_NAME }} nextcloud-docker git fetch origin $GITHUB_REF
          docker exec -w /var/www/html/apps/${{ env.APP_NAME }} nextcloud-docker git checkout FETCH_HEAD
          docker exec nextcloud-docker sudo -u www-data php occ app:enable app_api
          docker exec nextcloud-docker sudo -u www-data php occ app_api:daemon:register \
            harp_proxy "Harp Proxy with DSP" "docker-install" "http" "appapi-harp:8780" "http://nextcloud" \
            --harp --harp_frp_address "appapi-harp:8782" --harp_shared_key "some_very_secure_password" \
            --net=master_bridge --set-default
          docker exec nextcloud-docker sudo -u www-data php occ app_api:daemon:list
          docker exec nextcloud-docker ping -c 1 appapi-harp
          docker exec nextcloud-docker ping -c 1 nextcloud

      - name: Registering and enabling Skeleton ExApp
        run: |
          docker exec nextcloud-docker sudo -u www-data php occ app_api:app:register app-skeleton-python harp_proxy \
            --info-xml https://raw.githubusercontent.com/nextcloud/app-skeleton-python/main/appinfo/info.xml \
            --wait-finish

      - name: Docker inspect output
        if: always()
        run: docker inspect nc_app_app-skeleton-python

      - name: Disable ExApp
        run: |
          docker exec nextcloud-docker sudo -u www-data php occ app_api:app:disable app-skeleton-python

      - name: Copy NC log to host
        if: always()
        run: docker cp nextcloud-docker:/var/www/html/data/nextcloud.log nextcloud.log

      - name: Check logs
        run: |
          grep -q 'Hello from app-skeleton-python :)' nextcloud.log || error
          grep -q 'Bye bye from app-skeleton-python :(' nextcloud.log || error

      - name: Save app and HaRP container info & logs
        if: always()
        run: |
          docker inspect appapi-harp | json_pp > harp_bridge_container.json
          docker logs appapi-harp > harp_bridge_container.log 2>&1
          docker inspect nc_app_app-skeleton-python | json_pp > app_harp_bridge_container.json
          docker logs nc_app_app-skeleton-python > app_harp_bridge_container.log 2>&1
          # nginx
          docker logs nextcloud > nginx.log 2>&1

      - name: Unregister Skeleton & Daemon
        run: |
          docker exec nextcloud-docker sudo -u www-data php occ app_api:app:unregister app-skeleton-python
          docker exec nextcloud-docker sudo -u www-data php occ app_api:daemon:unregister harp_proxy

      - name: Show all logs
        if: always()
        run: tail -v -n +1 *container.json *.log

  nc-docker-harp-bridge-no-tls:
    runs-on: ubuntu-22.04
    name: NC In Julius Docker (HaRP-Bridge network-no FRP TLS)
    env:
      docker-image: ghcr.io/juliusknorr/nextcloud-dev-php83:master

    steps:
      - name: Set app env
        run: echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV

      - name: Checkout AppAPI
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Create containers
        run: |
          docker network create master_bridge
          docker run \
            -e HP_SHARED_KEY="some_very_secure_password" \
            -e HP_FRP_DISABLE_TLS="true" \
            -e NC_INSTANCE_URL="http://nextcloud" \
            -e HP_LOG_LEVEL="debug" \
            -v /var/run/docker.sock:/var/run/docker.sock \
            --net master_bridge --name appapi-harp -h appapi-harp \
            --restart unless-stopped \
            -d ghcr.io/nextcloud/nextcloud-appapi-harp:latest
          docker run --net master_bridge --name nextcloud-docker --rm -d ${{ env.docker-image }}

          sed -i 's/127\.0\.0\.1:8080/nextcloud-docker/' tests/simple-nginx-NOT-FOR-PRODUCTION.conf
          sed -i 's/127\.0\.0\.1:8780/appapi-harp:8780/' tests/simple-nginx-NOT-FOR-PRODUCTION.conf
          cat tests/simple-nginx-NOT-FOR-PRODUCTION.conf

          docker run --net master_bridge --name nextcloud --rm \
            -v $(pwd)/tests/simple-nginx-NOT-FOR-PRODUCTION.conf:/etc/nginx/conf.d/default.conf:ro \
            -d nginx

      - name: Wait for Nextcloud bootstrap
        run: |
          for i in $(seq 1 60); do
            if docker exec nextcloud-docker test -f /var/www/html/version.php 2>/dev/null; then
              echo "Nextcloud source ready after ${i}0s"
              break
            fi
            echo "Waiting for Nextcloud bootstrap... ($i/60)"
            sleep 10
          done
          docker exec nextcloud-docker test -f /var/www/html/version.php || (echo "Bootstrap timed out" && exit 1)

      - name: Install AppAPI
        run: |
          docker exec -w /var/www/html/apps nextcloud-docker git clone https://github.com/nextcloud/${{ env.APP_NAME }}.git
          docker exec -w /var/www/html/apps/${{ env.APP_NAME }} nextcloud-docker git fetch origin $GITHUB_REF
          docker exec -w /var/www/html/apps/${{ env.APP_NAME }} nextcloud-docker git checkout FETCH_HEAD
          docker exec nextcloud-docker sudo -u www-data php occ app:enable app_api
          docker exec nextcloud-docker sudo -u www-data php occ app_api:daemon:register \
            harp_proxy "Harp Proxy with DSP" "docker-install" "http" "appapi-harp:8780" "http://nextcloud" \
            --harp --harp_frp_address "appapi-harp:8782" --harp_shared_key "some_very_secure_password" \
            --net=master_bridge --set-default
          docker exec nextcloud-docker sudo -u www-data php occ app_api:daemon:list
          docker exec nextcloud-docker ping -c 1 appapi-harp
          docker exec nextcloud-docker ping -c 1 nextcloud

      - name: Registering and enabling Skeleton ExApp
        run: |
          docker exec nextcloud-docker sudo -u www-data php occ app_api:app:register app-skeleton-python harp_proxy \
            --info-xml https://raw.githubusercontent.com/nextcloud/app-skeleton-python/main/appinfo/info.xml \
            --wait-finish

      - name: Docker inspect output
        if: always()
        run: docker inspect nc_app_app-skeleton-python

      - name: Disable ExApp
        run: |
          docker exec nextcloud-docker sudo -u www-data php occ app_api:app:disable app-skeleton-python

      - name: Copy NC log to host
        if: always()
        run: docker cp nextcloud-docker:/var/www/html/data/nextcloud.log nextcloud.log

      - name: Check logs
        run: |
          grep -q 'Hello from app-skeleton-python :)' nextcloud.log || error
          grep -q 'Bye bye from app-skeleton-python :(' nextcloud.log || error

      - name: Save app and HaRP container info & logs
        if: always()
        run: |
          docker inspect appapi-harp | json_pp > harp_bridge_no_tls_container.json
          docker logs appapi-harp > harp_bridge_no_tls_container.log 2>&1
          docker inspect nc_app_app-skeleton-python | json_pp > app_harp_bridge_no_tls_container.json
          docker logs nc_app_app-skeleton-python > app_harp_bridge_no_tls_container.log 2>&1

      - name: Unregister Skeleton & Daemon
        run: |
          docker exec nextcloud-docker sudo -u www-data php occ app_api:app:unregister app-skeleton-python
          docker exec nextcloud-docker sudo -u www-data php occ app_api:daemon:unregister harp_proxy

      - name: Show all logs
        if: always()
        run: tail -v -n +1 *container.json *.log

  nc-host-harp-host:
    runs-on: ubuntu-22.04
    name: NC In Host (HaRP-Host network)

    services:
      postgres:
        image: ghcr.io/nextcloud/continuous-integration-postgres-14:latest # zizmor: ignore[unpinned-images]
        ports:
          - 4444:5432/tcp
        env:
          POSTGRES_USER: root
          POSTGRES_PASSWORD: rootpassword
          POSTGRES_DB: nextcloud
        options: --health-cmd pg_isready --health-interval 5s --health-timeout 2s --health-retries 5

    steps:
      - name: Set app env
        run: echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV

      - name: Checkout server
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          submodules: true
          repository: nextcloud/server
          ref: master

      - name: Checkout AppAPI
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          path: apps/${{ env.APP_NAME }}

      - name: Set up php 8.3
        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
        with:
          php-version: 8.3
          extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, pgsql, pdo_pgsql, redis
          coverage: none
          ini-file: development
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Check composer file existence
        id: check_composer
        uses: andstor/file-existence-action@558493d6c74bf472d87c84eab196434afc2fa029 # v2
        with:
          files: apps/${{ env.APP_NAME }}/composer.json

      - name: Set up dependencies
        if: steps.check_composer.outputs.files_exists == 'true'
        working-directory: apps/${{ env.APP_NAME }}
        run: composer i

      - name: Set up Nextcloud
        env:
          DB_PORT: 4444
        run: |
          mkdir data
          ./occ maintenance:install --verbose --database=pgsql --database-name=nextcloud --database-host=127.0.0.1 \
            --database-port=$DB_PORT --database-user=root --database-pass=rootpassword \
            --admin-user admin --admin-pass admin
          ./occ config:system:set loglevel --value=0 --type=integer
          ./occ config:system:set debug --value=true --type=boolean
          ./occ config:system:set overwrite.cli.url --value http://127.0.0.1 --type=string
          ./occ app:enable --force ${{ env.APP_NAME }}

      - name: Create HaRP container
        run: |
          cat apps/${{ env.APP_NAME }}/tests/simple-nginx-NOT-FOR-PRODUCTION.conf
          docker run \
            -e HP_SHARED_KEY="some_very_secure_password" \
            -e NC_INSTANCE_URL="http://127.0.0.1" \
            -e HP_LOG_LEVEL="debug" \
            -v /var/run/docker.sock:/var/run/docker.sock \
            --net host --name appapi-harp \
            --restart unless-stopped \
            -d ghcr.io/nextcloud/nextcloud-appapi-harp:latest
          docker run --net host --name nextcloud --rm \
            -v $(pwd)/apps/${{ env.APP_NAME }}/tests/simple-nginx-NOT-FOR-PRODUCTION.conf:/etc/nginx/conf.d/default.conf:ro \
            -d nginx

      - name: Test deploy
        run: |
          PHP_CLI_SERVER_WORKERS=2 php -S 127.0.0.1:8080 &
          ./occ app_api:daemon:register \
            harp_proxy "Harp Proxy with DSP" "docker-install" "http" "127.0.0.1:8780" "http://127.0.0.1" \
            --harp --harp_frp_address "127.0.0.1:8782" --harp_shared_key "some_very_secure_password" \
            --net host --set-default
          ./occ app_api:daemon:list

          ./occ app_api:app:register app-skeleton-python harp_proxy \
            --info-xml https://raw.githubusercontent.com/nextcloud/app-skeleton-python/main/appinfo/info.xml \
            --wait-finish
          ./occ app_api:app:disable app-skeleton-python

      - name: Check logs
        run: |
          grep -q 'Hello from app-skeleton-python :)' data/nextcloud.log || error
          grep -q 'Bye bye from app-skeleton-python :(' data/nextcloud.log || error

      - name: Save app and HaRP container info & logs
        if: always()
        run: |
          docker inspect appapi-harp | json_pp > harp_host_container.json
          docker logs appapi-harp > harp_host_container.log 2>&1
          docker inspect nc_app_app-skeleton-python | json_pp > app_host_container.json
          docker logs nc_app_app-skeleton-python > app_host_container.log 2>&1

      - name: Unregister Skeleton & Daemon
        run: |
          ./occ app_api:app:unregister app-skeleton-python
          ./occ app_api:daemon:unregister harp_proxy

      - name: Test OCC commands(docker)
        run: python3 apps/${{ env.APP_NAME }}/tests/test_occ_commands_docker.py

      - name: Show all logs
        if: always()
        run: tail -v -n +1 *container.json *.log data/nextcloud.log

  nc-host-manual-harp-host:
    runs-on: ubuntu-22.04
    name: NC In Host (Manual HaRP-Host network)

    services:
      postgres:
        image: ghcr.io/nextcloud/continuous-integration-postgres-14:latest # zizmor: ignore[unpinned-images]
        ports:
          - 4444:5432/tcp
        env:
          POSTGRES_USER: root
          POSTGRES_PASSWORD: rootpassword
          POSTGRES_DB: nextcloud
        options: --health-cmd pg_isready --health-interval 5s --health-timeout 2s --health-retries 5

    steps:
      - name: Set app env
        run: echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV

      - name: Checkout server
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          submodules: true
          repository: nextcloud/server
          ref: master

      - name: Checkout AppAPI
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          path: apps/${{ env.APP_NAME }}

      - name: Set up php 8.3
        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
        with:
          php-version: 8.3
          extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, pgsql, pdo_pgsql, redis
          coverage: none
          ini-file: development
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Check composer file existence
        id: check_composer
        uses: andstor/file-existence-action@558493d6c74bf472d87c84eab196434afc2fa029 # v2
        with:
          files: apps/${{ env.APP_NAME }}/composer.json

      - name: Set up dependencies
        if: steps.check_composer.outputs.files_exists == 'true'
        working-directory: apps/${{ env.APP_NAME }}
        run: composer i

      - name: Set up Nextcloud
        env:
          DB_PORT: 4444
          OC_PASS: password
        run: |
          mkdir data
          ./occ maintenance:install --verbose --database=pgsql --database-name=nextcloud --database-host=127.0.0.1 \
            --database-port=$DB_PORT --database-user=root --database-pass=rootpassword \
            --admin-user admin --admin-pass admin
          ./occ config:system:set loglevel --value=0 --type=integer
          ./occ config:system:set debug --value=true --type=boolean
          ./occ config:system:set overwrite.cli.url --value http://127.0.0.1 --type=string
          ./occ app:enable --force ${{ env.APP_NAME }}
          ./occ user:add --password-from-env usr

      - name: Create HaRP and app container
        run: |
          cat apps/${{ env.APP_NAME }}/tests/simple-nginx-NOT-FOR-PRODUCTION.conf
          docker run \
            -e HP_SHARED_KEY="some_very_secure_password" \
            -e NC_INSTANCE_URL="http://127.0.0.1" \
            -e HP_LOG_LEVEL="debug" \
            -v /var/run/docker.sock:/var/run/docker.sock \
            --net host --name appapi-harp \
            --restart unless-stopped \
            -d ghcr.io/nextcloud/nextcloud-appapi-harp:latest
          docker run --net host --name nextcloud --rm \
            -v $(pwd)/apps/${{ env.APP_NAME }}/tests/simple-nginx-NOT-FOR-PRODUCTION.conf:/etc/nginx/conf.d/default.conf:ro \
            -d nginx
          docker run --net host --name nc_app_app-skeleton-python \
            -e AA_VERSION=4.0.0 \
            -e APP_SECRET=12345 \
            -e APP_ID=app-skeleton-python \
            -e APP_DISPLAY_NAME="App Skeleton" \
            -e APP_VERSION=3.0.1 \
            -e APP_HOST=0.0.0.0 \
            -e APP_PORT=23000 \
            -e NEXTCLOUD_URL=http://127.0.0.1 \
            --rm -d ghcr.io/nextcloud/app-skeleton-python:latest

      - name: Test deploy
        run: |
          set -x
          PHP_CLI_SERVER_WORKERS=2 php -S 127.0.0.1:8080 &
          ./occ app_api:daemon:register \
            manual_install_harp "Harp Manual Install" "manual-install" "http" "127.0.0.1:8780" "http://127.0.0.1" \
            --net host --harp --harp_frp_address "127.0.0.1:8782" --harp_shared_key "some_very_secure_password"
          ./occ app_api:daemon:list

          ./occ app_api:app:register app-skeleton-python manual_install_harp \
            --json-info " \
              { \
                \"id\": \"app-skeleton-python\", \
                \"name\": \"App Skeleton\", \
                \"daemon_config_name\": \"manual_install_harp\", \
                \"version\": \"3.0.1\", \
                \"secret\": \"12345\", \
                \"port\": 23000, \
                \"routes\": [ \
                  { \
                    \"url\": \"^/public$\", \
                    \"verb\": \"GET\", \
                    \"access_level\": 0 \
                  }, \
                  { \
                    \"url\": \"^/user$\", \
                    \"verb\": \"GET\", \
                    \"access_level\": 1 \
                  }, \
                  { \
                    \"url\": \"^/admin$\", \
                    \"verb\": \"GET\", \
                    \"access_level\": 2 \
                  }, \
                  { \
                    \"url\": \"^/$\", \
                    \"verb\": \"GET\", \
                    \"access_level\": 1 \
                  }, \
                  { \
                    \"url\": \"^/ws$\", \
                    \"verb\": \"GET\", \
                    \"access_level\": 1 \
                  } \
                ] \
              }" \
            --wait-finish

          function test_req() {
            temp=$(mktemp)
            curl -i -o $temp -w "%{http_code}" $2 http://127.0.0.1/exapps/app-skeleton-python/$1 | grep -q "$3" || {
              echo "$1 :: $2 :: $3"
              cat $temp
              error
            }
            echo -e "\n\n-------------------------\n$1 :: $2 :: $3\n" | tee -a curl.log
            cat $temp | tee -a curl.log
          }

          test_req public "--" 200
          test_req public "-u usr:password" 200
          test_req public "-u admin:admin" 200

          test_req user "--" 403
          test_req user "-u usr:password" 200
          test_req user "-u admin:admin" 200

          test_req admin "--" 403
          test_req admin "-u usr:password" 403
          test_req admin "-u admin:admin" 200

          # clients get blacklisted for 5 bad requests for 5 minutes
          sleep 301

          test_req imaginary "--" 404
          test_req imaginary "-u usr:password" 404
          test_req imaginary "-u admin:admin" 404

          ./occ app_api:app:disable app-skeleton-python

      - name: Check logs
        run: |
          grep -q 'Hello from app-skeleton-python :)' data/nextcloud.log || error
          grep -q 'Bye bye from app-skeleton-python :(' data/nextcloud.log || error

      - name: Save app and HaRP container info & logs
        if: always()
        run: |
          docker inspect appapi-harp | json_pp > harp_host_container.json
          docker logs appapi-harp > harp_host_container.log 2>&1
          docker inspect nc_app_app-skeleton-python | json_pp > app_host_container.json
          docker logs nc_app_app-skeleton-python > app_host_container.log 2>&1

      - name: Unregister Skeleton & Daemon
        run: |
          ./occ app_api:app:unregister app-skeleton-python
          ./occ app_api:daemon:unregister manual_install_harp

      - name: Test OCC commands(docker)
        run: python3 apps/${{ env.APP_NAME }}/tests/test_occ_commands_docker.py

      - name: Show all logs
        if: always()
        run: tail -v -n +1 *container.json *.log data/nextcloud.log

  nc-update-preserves-deploy-options:
    runs-on: ubuntu-22.04
    name: Update preserves deploy options (Docker)
    # Regression test for https://github.com/nextcloud/app_api/issues/808
    # When two or more ExApps have rows in `ex_deploy_options`, the update flow
    # used to drop the target app's env vars because it read the unfiltered
    # options table. This job seeds a stray second row, bumps the skeleton's
    # version via a local info.xml, runs `app_api:app:update`, and asserts the
    # user-provided env vars are still set on the new container.

    services:
      postgres:
        image: ghcr.io/nextcloud/continuous-integration-postgres-14:latest # zizmor: ignore[unpinned-images]
        ports:
          - 4444:5432/tcp
        env:
          POSTGRES_USER: root
          POSTGRES_PASSWORD: rootpassword
          POSTGRES_DB: nextcloud
        options: --health-cmd pg_isready --health-interval 5s --health-timeout 2s --health-retries 5

    steps:
      - name: Set app env
        run: echo "APP_NAME=${GITHUB_REPOSITORY##*/}" >> $GITHUB_ENV

      - name: Checkout server
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          submodules: true
          repository: nextcloud/server
          ref: master

      - name: Checkout AppAPI
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          path: apps/${{ env.APP_NAME }}

      - name: Set up php
        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2
        with:
          php-version: '8.3'
          extensions: bz2, ctype, curl, dom, fileinfo, gd, iconv, intl, json, libxml, mbstring, openssl, pcntl, posix, session, simplexml, xmlreader, xmlwriter, zip, zlib, pgsql, pdo_pgsql
          coverage: none
          ini-file: development
          ini-values:
            apc.enabled=on, apc.enable_cli=on, disable_functions=
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Check composer file existence
        id: check_composer
        uses: andstor/file-existence-action@558493d6c74bf472d87c84eab196434afc2fa029 # v2
        with:
          files: apps/${{ env.APP_NAME }}/composer.json

      - name: Set up dependencies
        if: steps.check_composer.outputs.files_exists == 'true'
        working-directory: apps/${{ env.APP_NAME }}
        run: composer i

      - name: Set up Nextcloud
        env:
          DB_PORT: 4444
        run: |
          mkdir data
          ./occ maintenance:install --verbose --database=pgsql --database-name=nextcloud --database-host=127.0.0.1 \
            --database-port=$DB_PORT --database-user=root --database-pass=rootpassword \
            --admin-user admin --admin-pass admin
          ./occ config:system:set loglevel --value=0 --type=integer
          ./occ config:system:set debug --value=true --type=boolean
          ./occ app:enable --force ${{ env.APP_NAME }}

      - name: Register daemon & Skeleton v1 with user env vars
        run: |
          PHP_CLI_SERVER_WORKERS=2 php -S 127.0.0.1:8080 &
          ./occ app_api:daemon:register docker_local_sock Docker docker-install http /var/run/docker.sock http://127.0.0.1:8080/index.php
          ./occ app_api:app:register app-skeleton-python docker_local_sock \
            --info-xml https://raw.githubusercontent.com/nextcloud/app-skeleton-python/main/appinfo/info.xml \
            --env='TEST_ENV_2=user_provided_value'

      - name: Verify env vars on the freshly registered container
        run: |
          docker inspect --format '{{ json .Config.Env }}' nc_app_app-skeleton-python | grep -q '"TEST_ENV_1=0"' \
            || { echo "TEST_ENV_1 default missing after register"; exit 1; }
          docker inspect --format '{{ json .Config.Env }}' nc_app_app-skeleton-python | grep -q '"TEST_ENV_2=user_provided_value"' \
            || { echo "TEST_ENV_2 user value missing after register"; exit 1; }

      - name: Seed stray ex_deploy_options row for a second app
        # Without a second appid in the table, the Update.php bug from #808 is
        # latent: formatDeployOptions() with no $appId filter still produces
        # the single app's rows by luck. The `zz_` prefix ensures this stray row
        # iterates AFTER `app-skeleton-python`, so the last-wins flattening
        # actually clobbers the skeleton's env_vars entry.
        run: |
          php apps/${{ env.APP_NAME }}/tests/integration_helper.php \
            set-env zz_fake_second_app UNRELATED_VAR x

      - name: Build v2 info.xml with bumped version
        # Update.php:153 short-circuits when versions match; bumping to 999.0.0
        # forces the real update path to run without touching the image.
        run: |
          curl -sS https://raw.githubusercontent.com/nextcloud/app-skeleton-python/main/appinfo/info.xml \
            | sed 's#<version>[^<]*</version>#<version>999.0.0</version>#' > /tmp/info-v2.xml
          grep -q '<version>999.0.0</version>' /tmp/info-v2.xml || { echo "version bump failed"; exit 1; }

      - name: Update ExApp
        run: |
          ./occ app_api:app:update app-skeleton-python --info-xml /tmp/info-v2.xml --wait-finish

      - name: After update, TEST_ENV_1 default still present
        run: |
          docker inspect --format '{{ json .Config.Env }}' nc_app_app-skeleton-python | grep -q '"TEST_ENV_1=0"' \
            || { echo "#808 regression: TEST_ENV_1 lost on update"; exit 1; }

      - name: After update, TEST_ENV_2 user value still present
        run: |
          docker inspect --format '{{ json .Config.Env }}' nc_app_app-skeleton-python | grep -q '"TEST_ENV_2=user_provided_value"' \
            || { echo "#808 regression: user-provided TEST_ENV_2 lost on update"; exit 1; }

      - name: Save container info & logs
        if: always()
        run: |
          docker inspect nc_app_app-skeleton-python | json_pp > container.json
          docker logs nc_app_app-skeleton-python > container.log 2>&1

      - name: Unregister Skeleton & Daemon
        run: |
          ./occ app_api:app:unregister app-skeleton-python
          ./occ app_api:daemon:unregister docker_local_sock

      - name: Upload Container info
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: nc_update_preserves_deploy_options_container.json
          path: container.json
          if-no-files-found: warn

      - name: Upload Container logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: nc_update_preserves_deploy_options_container.log
          path: container.log
          if-no-files-found: warn

      - name: Upload NC logs
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: nc_update_preserves_deploy_options_nextcloud.log
          path: data/nextcloud.log
          if-no-files-found: warn

  tests-deploy-success:
    permissions:
      contents: none
    runs-on: ubuntu-22.04
    needs: [nc-host-app-docker, nc-docker-app-docker, nc-docker-dsp-http,
            nc-docker-dsp-https, nc-host-app-docker-redis, nc-host-network-host,
            nc-docker-harp-bridge, nc-docker-harp-bridge-no-tls, nc-host-harp-host,
            nc-host-manual-harp-host, nc-update-preserves-deploy-options]
    name: Tests-Deploy-OK
    steps:
      - run: echo "Tests-Deploy passed successfully"