feat: GHA MVP

.github/actions/ocis-setup/action.yml

@@ -0,0 +1,226 @@
+name: ocis-setup
+description: Start an oCIS instance with optional services (antivirus, email, tika, ociswrapper)
+
+inputs:
+  ocis-version:
+    description: oCIS release version (e.g. 8.0.1) or "latest" — ignored when ocis-binary is set
+    required: false
+    default: latest
+  ocis-binary:
+    description: Path to a pre-built oCIS binary; skips download when provided
+    required: false
+    default: ""
+  admin-password:
+    description: Admin user password
+    required: false
+    default: admin
+  log-level:
+    description: oCIS log level
+    required: false
+    default: error
+  demo-users:
+    description: Create demo users (IDM_CREATE_DEMO_USERS=true)
+    required: false
+    default: "false"
+  wrapper:
+    description: Start ociswrapper on :5200 for dynamic reconfiguration
+    required: false
+    default: "true"
+  tika:
+    description: Start Apache Tika on :9998 for full-text search
+    required: false
+    default: "false"
+  email:
+    description: Start Mailpit SMTP (:1025) and API (:8025)
+    required: false
+    default: "false"
+  antivirus:
+    description: Start ClamAV on :3310 and enable postprocessing
+    required: false
+    default: "false"
+  extra-server-env:
+    description: JSON object of additional env vars to pass to the oCIS server
+    required: false
+    default: "{}"
+
+outputs:
+  ocis-url:
+    description: oCIS instance URL
+    value: https://localhost:9200
+
+runs:
+  using: composite
+  steps:
+    # -------------------------------------------------------------------------
+    # 1. Install oCIS binary (skip when a pre-built binary is provided)
+    # -------------------------------------------------------------------------
+    - name: Install oCIS binary from release
+      if: inputs.ocis-binary == ''
+      shell: bash
+      env:
+        OCIS_VERSION: ${{ inputs.ocis-version }}
+      run: ${{ github.action_path }}/scripts/install-ocis.sh
+
+    - name: Use pre-built oCIS binary
+      if: inputs.ocis-binary != ''
+      shell: bash
+      run: |
+        sudo cp "${{ inputs.ocis-binary }}" /usr/local/bin/ocis
+        sudo chmod +x /usr/local/bin/ocis
+        echo "Using pre-built oCIS: $(ocis --version 2>&1 | head -1)"
+
+    # -------------------------------------------------------------------------
+    # 2. Build ociswrapper (always — it is always used as the process launcher)
+    # -------------------------------------------------------------------------
+    - name: Build ociswrapper from source (when using release binary)
+      if: inputs.ocis-binary == ''
+      shell: bash
+      env:
+        OCIS_VERSION: ${{ inputs.ocis-version }}
+      run: ${{ github.action_path }}/scripts/install-wrapper.sh
+
+    - name: Build ociswrapper from local source (when using pre-built binary)
+      if: inputs.ocis-binary != ''
+      shell: bash
+      working-directory: ${{ github.workspace }}/tests/ociswrapper
+      run: |
+        if command -v ociswrapper &>/dev/null; then
+          echo "ociswrapper already installed: $(ociswrapper --version 2>&1 | head -1)"
+        else
+          GOWORK=off go build -o /tmp/ociswrapper .
+          sudo mv /tmp/ociswrapper /usr/local/bin/ociswrapper
+          echo "ociswrapper built from local source."
+        fi
+
+    # -------------------------------------------------------------------------
+    # 3. Optional services
+    # -------------------------------------------------------------------------
+    - name: Start Mailpit (email)
+      if: inputs.email == 'true'
+      shell: bash
+      run: |
+        docker run -d --name mailpit --network host axllent/mailpit:v1.22.3
+        timeout 60 bash -c 'until curl -sf http://localhost:8025/api/v1/messages; do sleep 1; done'
+        echo "mailpit ready."
+
+    - name: Start ClamAV (antivirus)
+      if: inputs.antivirus == 'true'
+      shell: bash
+      run: |
+        docker run -d --name clamav --network host owncloudci/clamavd
+        echo "Waiting for ClamAV on :3310 (may take up to 5 min for virus DB download)..."
+        timeout 300 bash -c '
+          while true; do
+            if (echo "" | nc -z localhost 3310) 2>/dev/null || \
+               python3 -c "import socket,sys; s=socket.create_connection((\"localhost\",3310),2); s.close()" 2>/dev/null; then
+              break
+            fi
+            sleep 2
+          done
+        '
+        echo "clamav ready."
+
+    - name: Start Tika (full-text search)
+      if: inputs.tika == 'true'
+      shell: bash
+      run: |
+        docker run -d --name tika --network host apache/tika:3.2.2.0-full
+        timeout 120 bash -c 'until curl -sf http://localhost:9998; do sleep 2; done'
+        echo "tika ready."
+
+    # -------------------------------------------------------------------------
+    # 4. Install test-runner dependencies (must happen before oCIS starts —
+    #    apt-get pulls in libcurl4-openssl-dev which replaces the system libcurl
+    #    and would kill the running oCIS process if installed afterwards)
+    # -------------------------------------------------------------------------
+    - name: Install libcurl 8.12.0 build dependencies
+      shell: bash
+      run: |
+        sudo apt-get update -qq
+        sudo NEEDRESTART_MODE=a apt-get install -y \
+          libssl-dev libnghttp2-dev libpsl-dev libldap-dev libssh-dev zlib1g-dev libvips-dev
+
+    - name: Cache libcurl 8.12.0
+      id: cache-libcurl
+      uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+      with:
+        path: /opt/libcurl
+        key: libcurl-8.12.0-${{ runner.os }}
+
+    - name: Compile libcurl 8.12.0 from source
+      if: steps.cache-libcurl.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        cd /tmp
+        curl -sLO https://curl.se/download/curl-8.12.0.tar.gz
+        tar xzf curl-8.12.0.tar.gz
+        cd curl-8.12.0
+        ./configure --with-ssl --with-zlib --with-nghttp2 --prefix=/opt/libcurl \
+          --enable-versioned-symbols --silent
+        make -j$(nproc) --silent
+        sudo make install --silent
+
+    - name: Restore libcurl ldconfig
+      shell: bash
+      run: |
+        echo "/opt/libcurl/lib" | sudo tee /etc/ld.so.conf.d/libcurl-8.conf
+        sudo ldconfig
+        /opt/libcurl/bin/curl --version | head -1
+        php -r '
+          $v = curl_version()["version"];
+          echo "PHP curl: $v\n";
+          if (version_compare($v, "8.12.0", "<")) {
+            fwrite(STDERR, "FATAL: PHP sees libcurl $v, need >= 8.12.0\n");
+            exit(1);
+          }
+        '
+
+    - name: Install Composer dependencies
+      shell: bash
+      working-directory: ${{ github.workspace }}
+      run: |
+        COMPOSER_NO_INTERACTION=1 COMPOSER_NO_AUDIT=1 composer install --no-progress
+        COMPOSER_NO_INTERACTION=1 COMPOSER_NO_AUDIT=1 \
+          composer bin behat install --no-progress
+
+    # -------------------------------------------------------------------------
+    # 6. Init oCIS + copy config files
+    # -------------------------------------------------------------------------
+    - name: Init oCIS
+      shell: bash
+      env:
+        OCIS_ACTION_PATH: ${{ github.action_path }}
+      run: ${{ github.action_path }}/scripts/init-ocis.sh
+
+    # -------------------------------------------------------------------------
+    # 7. Start oCIS via ociswrapper
+    # -------------------------------------------------------------------------
+    - name: Start oCIS
+      shell: bash
+      env:
+        ADMIN_PASSWORD: ${{ inputs.admin-password }}
+        LOG_LEVEL: ${{ inputs.log-level }}
+        DEMO_USERS: ${{ inputs.demo-users }}
+        ANTIVIRUS_ENABLED: ${{ inputs.antivirus }}
+        EMAIL_ENABLED: ${{ inputs.email }}
+        TIKA_ENABLED: ${{ inputs.tika }}
+        EXTRA_SERVER_ENV: ${{ inputs.extra-server-env }}
+        OCIS_REPO_ROOT: ${{ github.workspace }}
+      run: ${{ github.action_path }}/scripts/start-ocis.sh
+
+    # -------------------------------------------------------------------------
+    # 8. Wait for oCIS to be healthy
+    # -------------------------------------------------------------------------
+    - name: Wait for oCIS
+      shell: bash
+      run: |
+        echo "Waiting for oCIS at https://localhost:9200..."
+        timeout 300 bash -c '
+          until curl -sk -uadmin:admin https://localhost:9200/graph/v1.0/users/admin \
+                -w "%{http_code}" -o /dev/null 2>/dev/null | grep -q "200"; do
+            sleep 2
+          done
+        ' || (echo "=== oCIS failed to start ===" && \
+               cat /tmp/ocis-server.log 2>/dev/null | tail -50 && exit 1)
+        echo "ocis ready."
+

.github/actions/ocis-setup/config/app-registry.yaml

@@ -0,0 +1,9 @@
+app_registry:
+  mimetypes:
+    - mime_type: application/vnd.oasis.opendocument.text
+      extension: odt
+      name: OpenDocument
+      description: OpenDocument text document
+      icon: ""
+      default_app: FakeOffice
+      allow_creation: true

.github/actions/ocis-setup/scripts/init-ocis.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Initialize oCIS config directory and copy required config files.
+# OCIS_ACTION_PATH: path to the action directory (contains config/)
+# The action is used from within a repo checkout so GITHUB_WORKSPACE is set.
+
+CONFIG_DIR="${HOME}/.ocis/config"
+mkdir -p "$CONFIG_DIR"
+
+ocis init --insecure true
+
+# app-registry.yaml: bundled with this action so it works without a repo checkout
+cp "${OCIS_ACTION_PATH}/config/app-registry.yaml" "${CONFIG_DIR}/app-registry.yaml"
+
+echo "oCIS config initialized at ${CONFIG_DIR}"

.github/actions/ocis-setup/scripts/install-ocis.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# OCIS_VERSION: "latest" or a specific version like "8.0.1"
+VERSION="${OCIS_VERSION:-latest}"
+
+if [[ "$VERSION" == "latest" ]]; then
+  VERSION=$(curl -s https://api.github.com/repos/owncloud/ocis/releases/latest \
+    | python3 -c "import sys,json; print(json.load(sys.stdin)['tag_name'].lstrip('v'))")
+fi
+
+# Write resolved version so install-wrapper.sh uses the same tag without a second API call.
+echo "$VERSION" > /tmp/ocis-resolved-version
+
+echo "Installing oCIS $VERSION..."
+ARCH=$(uname -m)
+case "$ARCH" in
+  x86_64)  ARCH_SUFFIX="amd64" ;;
+  aarch64) ARCH_SUFFIX="arm64" ;;
+  *)       echo "Unsupported arch: $ARCH"; exit 1 ;;
+esac
+
+BASE_URL="https://github.com/owncloud/ocis/releases/download/v${VERSION}"
+BINARY="ocis-${VERSION}-linux-${ARCH_SUFFIX}"
+
+curl -sLo /tmp/ocis "${BASE_URL}/${BINARY}"
+curl -sLo /tmp/ocis.sha256 "${BASE_URL}/${BINARY}.sha256"
+
+# sha256 file contains "HASH  filename" — rewrite to match our local path
+HASH=$(awk '{print $1}' /tmp/ocis.sha256)
+echo "${HASH}  /tmp/ocis" | sha256sum -c -
+
+chmod +x /tmp/ocis
+sudo mv /tmp/ocis /usr/local/bin/ocis
+
+echo "oCIS $(ocis --version 2>&1 | head -1) installed."

.github/actions/ocis-setup/scripts/install-wrapper.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# ociswrapper is not published as a release artifact.
+# Sparse-clone only tests/ociswrapper/ from the matching tag and build it.
+VERSION="${OCIS_VERSION:-latest}"
+
+if [[ "$VERSION" == "latest" ]]; then
+  if [[ -f /tmp/ocis-resolved-version ]]; then
+    VERSION=$(cat /tmp/ocis-resolved-version)
+  else
+    VERSION=$(curl -s https://api.github.com/repos/owncloud/ocis/releases/latest \
+      | python3 -c "import sys,json; print(json.load(sys.stdin)['tag_name'].lstrip('v'))")
+  fi
+fi
+
+CLONE_DIR="/tmp/ocis-src-wrapper"
+rm -rf "$CLONE_DIR"
+
+echo "Sparse-cloning ociswrapper from tag v${VERSION}..."
+git clone --depth=1 --filter=blob:none --sparse \
+  --branch "v${VERSION}" \
+  https://github.com/owncloud/ocis.git "$CLONE_DIR"
+
+cd "$CLONE_DIR"
+git sparse-checkout set tests/ociswrapper
+
+cd tests/ociswrapper
+echo "Building ociswrapper..."
+GOWORK=off go build -o /tmp/ociswrapper .
+sudo mv /tmp/ociswrapper /usr/local/bin/ociswrapper
+
+echo "ociswrapper installed at $(which ociswrapper)"
+rm -rf "$CLONE_DIR"