fix(3rdparty): Add a CI job to check 3rdparty integrity

Signed-off-by: Joas Schilling <coding@schilljs.com>

1 files changed, 53 insertions, 0 deletions

diff --git a/.github/workflows/block-outdated-3rdparty.yml b/.github/workflows/block-outdated-3rdparty.yml
new file mode 100644
index 00000000000..e43981afac0
--- /dev/null
+++ b/.github/workflows/block-outdated-3rdparty.yml
@@ -0,0 +1,53 @@
+name: Block merging with outdated 3rdparty/
+
+on:
+  pull_request:
+    types: [opened, ready_for_review, reopened, synchronize]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: block-outdated-3rdparty-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  block-outdated-3rdparty:
+    name: Block merging with outdated 3rdparty/
+
+    runs-on: ubuntu-latest-low
+
+    steps:
+      - name: Check requirement
+        uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1
+        id: changes
+        continue-on-error: true
+        with:
+          filters: |
+            src:
+              - '3rdparty'
+              - 'version.php'
+
+      - name: Checkout
+        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+
+      - name: 3rdparty commit hash on current branch
+        id: actual
+        run: |
+          echo "commit=$(git submodule status | grep ' 3rdparty' | egrep -o '[a-f0-9]{40}')" >> "$GITHUB_OUTPUT"
+
+      - name: Last 3rdparty commit on target branch
+        id: target
+        run: |
+          echo "commit=$(git ls-remote https://github.com/nextcloud/3rdparty ${{ github.base_ref }} | awk '{ print $1}')" >> "$GITHUB_OUTPUT"
+
+      - name: Compare if 3rdparty commits are different
+        run: |
+          echo '3rdparty/ seems to not point to the last commit of the dedicated branch:'
+          echo "Branch has: ${{ steps.actual.outputs.commit }}"
+          echo "${{ github.base_ref }} has: ${{ steps.target.outputs.commit }}"
+
+      - name: Fail if 3rdparty commits are different
+        if: ${{ steps.changes.outputs.src != 'false' && steps.actual.outputs.commit != steps.target.outputs.commit }}
+        run: |
+          exit 1