feat(ci): automate supported Nextcloud image discovery and publication

.docker/app/Dockerfile

@@ -25,6 +25,7 @@ RUN set -eux; \
 FROM ${NEXTCLOUD_SOURCE} AS runtime
 
 RUN apt-get update \
+    && apt-get upgrade -y \
     && apt-get install -y --no-install-recommends \
         locales \
         poppler-utils \

.env.example

@@ -1,4 +1,4 @@
-NEXTCLOUD_VERSION=34-fpm
+NEXTCLOUD_VERSION=35-fpm
 
 VIRTUAL_HOST=
 LETSENCRYPT_HOST=

.github/actions/build-and-scan/action.yml

@@ -1,13 +1,18 @@
-name: Build, scan, and validate runtime images
-description: Build and scan both runtime images, then run app image acceptance tests
+name: Build, scan, and validate image
+description: Build either a Nextcloud FPM runtime or its independent web image
 inputs:
-  nextcloud_version:
-    description: Nextcloud version passed to the app image build
+  component:
+    description: Either app or web
     required: true
+  nextcloud_version:
+    description: Official Nextcloud release tag for app builds (e.g. 35.0.2-fpm)
+    required: false
+    default: ''
 runs:
   using: composite
   steps:
     - name: Setup Bats
+      if: inputs.component == 'app'
       uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
       with:
         support-install: false
@@ -24,6 +29,7 @@ runs:
       uses: docker/setup-buildx-action@v3
 
     - name: Build app image (linux/amd64)
+      if: inputs.component == 'app'
       uses: docker/build-push-action@v6
       with:
         context: .docker/app
@@ -32,10 +38,11 @@ runs:
         build-args: |
           NEXTCLOUD_BASE_IMAGE=nextcloud:${{ inputs.nextcloud_version }}
         tags: scan/app:amd64
-        cache-from: type=gha
-        cache-to: type=gha,mode=max
+        cache-from: type=gha,scope=app-${{ inputs.nextcloud_version }}-amd64
+        cache-to: type=gha,mode=max,scope=app-${{ inputs.nextcloud_version }}-amd64
 
     - name: Build app image (linux/arm64)
+      if: inputs.component == 'app'
       uses: docker/build-push-action@v6
       with:
         context: .docker/app
@@ -44,28 +51,30 @@ runs:
         build-args: |
           NEXTCLOUD_BASE_IMAGE=nextcloud:${{ inputs.nextcloud_version }}
         tags: scan/app:arm64
-        cache-from: type=gha
-        cache-to: type=gha,mode=max
+        cache-from: type=gha,scope=app-${{ inputs.nextcloud_version }}-arm64
+        cache-to: type=gha,mode=max,scope=app-${{ inputs.nextcloud_version }}-arm64
 
     - name: Build web image (linux/amd64)
+      if: inputs.component == 'web'
       uses: docker/build-push-action@v6
       with:
         context: .docker/web
         platforms: linux/amd64
         load: true
         tags: scan/web:amd64
-        cache-from: type=gha
-        cache-to: type=gha,mode=max
+        cache-from: type=gha,scope=web-amd64
+        cache-to: type=gha,mode=max,scope=web-amd64
 
     - name: Build web image (linux/arm64)
+      if: inputs.component == 'web'
       uses: docker/build-push-action@v6
       with:
         context: .docker/web
         platforms: linux/arm64
         load: true
         tags: scan/web:arm64
-        cache-from: type=gha
-        cache-to: type=gha,mode=max
+        cache-from: type=gha,scope=web-arm64
+        cache-to: type=gha,mode=max,scope=web-arm64
 
     - name: Install Trivy
       uses: aquasecurity/setup-trivy@81e514348e19b6112ce2a7e3ecbafe19c1e1f567 # v0.3.1
@@ -74,22 +83,31 @@ runs:
         version: v0.75.0
         cache: true
 
-    - name: Scan runtime images
+    - name: Scan app image
+      if: inputs.component == 'app'
       shell: bash
       run: |
         bash scripts/scan-images.sh \
           'app@linux/amd64=scan/app:amd64' \
-          'app@linux/arm64=scan/app:arm64' \
+          'app@linux/arm64=scan/app:arm64'
+
+    - name: Scan web image
+      if: inputs.component == 'web'
+      shell: bash
+      run: |
+        bash scripts/scan-images.sh \
           'web@linux/amd64=scan/web:amd64' \
           'web@linux/arm64=scan/web:arm64'
 
     - name: Runtime acceptance app image (linux/amd64)
+      if: inputs.component == 'app'
       shell: bash
       env:
         APP_IMAGE: scan/app:amd64
       run: bats tests/app-image.bats
 
     - name: Runtime acceptance app image (linux/arm64)
+      if: inputs.component == 'app'
       shell: bash
       env:
         APP_IMAGE: scan/app:arm64

.github/nextcloud-supported.json

@@ -0,0 +1,21 @@
+{
+  "schema_version": 1,
+  "source": "https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule",
+  "versions": [
+    {
+      "major": 33,
+      "release": "33.0.10",
+      "eol": "2027-02"
+    },
+    {
+      "major": 34,
+      "release": "34.0.5",
+      "eol": "2027-06"
+    },
+    {
+      "major": 35,
+      "release": "35.0.2",
+      "eol": "2027-09"
+    }
+  ]
+}

.github/workflows/discover-nextcloud-versions.yml

@@ -0,0 +1,74 @@
+name: Discover maintained Nextcloud versions
+
+on:
+  schedule:
+    - cron: '21 5,17 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+  actions: write
+
+concurrency:
+  group: nextcloud-wiki-discovery
+  cancel-in-progress: false
+
+jobs:
+  discover:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout reviewed branch
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Setup Bats
+        uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
+        with:
+          support-install: false
+          assert-install: false
+          detik-install: false
+          file-install: false
+
+      - name: Test wiki parser and publication policy
+        run: make test-ci-scripts
+
+      - name: ShellCheck version discovery
+        run: shellcheck scripts/nextcloud-versions.sh
+
+      - name: Discover and verify maintained versions
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: bash scripts/nextcloud-versions.sh discover
+
+      - name: Propose reviewed manifest update
+        id: pull_request
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          add-paths: .github/nextcloud-supported.json
+          branch: automation/nextcloud-supported-versions
+          delete-branch: true
+          signoff: true
+          sign-commits: true
+          commit-message: 'chore(ci): synchronize maintained Nextcloud versions'
+          title: 'chore(ci): synchronize maintained Nextcloud versions'
+          body: |
+            Sync the reviewed Nextcloud version manifest with the upstream
+            Maintenance and Release Schedule wiki.
+
+            The discovery job requires official stable release artifacts and
+            amd64/arm64 FPM images. Review version additions/removals, patch
+            upgrades and EOL transitions before merging. Do not auto-merge.
+
+            The source is the upstream server wiki. This PR does not publish
+            any Docker images.
+          labels: dependencies
+
+      # GITHUB_TOKEN pushes do not automatically trigger push/PR workflows.
+      # workflow_dispatch does trigger; publishing is forbidden off main.
+      - name: Validate generated PR branch
+        if: contains(fromJSON('["created","updated"]'), steps.pull_request.outputs.pull-request-operation)
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh workflow run docker-image.yml --repo "$GITHUB_REPOSITORY" --ref automation/nextcloud-supported-versions