ci: fix unwanted workflow skip in the cron pipelines (#2117)

* ci: run workflow if not found in the list

Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com>

* ci: suffix event in cache key to separate cron and push pipelines

Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com>

* ci: prefix test workflow with test

Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com>

* ci: create empty cache dir for unit tests

Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com>

---------

Signed-off-by: Saw-jan <saw.jan.grg3e@gmail.com>

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## [4.0.3](https://github.com/opencloud-eu/opencloud/releases/tag/v4.0.3) - 2026-02-05
+
+### ❤️ Thanks to all contributors! ❤️
+
+@aduffeck
+
+### 🐛 Bug Fixes
+
+- Bump reva 2.40.3 [[#2275](https://github.com/opencloud-eu/opencloud/pull/2275)]
+
 ## [4.0.2](https://github.com/opencloud-eu/opencloud/releases/tag/v4.0.2) - 2026-02-05
 
 ### ❤️ Thanks to all contributors! ❤️

go.mod

@@ -64,7 +64,7 @@ require (
 	github.com/open-policy-agent/opa v1.10.1
 	github.com/opencloud-eu/icap-client v0.0.0-20250930132611-28a2afe62d89
 	github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20250724122329-41ba6b191e76
-	github.com/opencloud-eu/reva/v2 v2.40.2
+	github.com/opencloud-eu/reva/v2 v2.40.3
 	github.com/opensearch-project/opensearch-go/v4 v4.5.0
 	github.com/orcaman/concurrent-map v1.0.0
 	github.com/pkg/errors v0.9.1

go.sum

@@ -963,8 +963,8 @@ github.com/opencloud-eu/inotifywaitgo v0.0.0-20251111171128-a390bae3c5e9 h1:dIft
 github.com/opencloud-eu/inotifywaitgo v0.0.0-20251111171128-a390bae3c5e9/go.mod h1:JWyDC6H+5oZRdUJUgKuaye+8Ph5hEs6HVzVoPKzWSGI=
 github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20250724122329-41ba6b191e76 h1:vD/EdfDUrv4omSFjrinT8Mvf+8D7f9g4vgQ2oiDrVUI=
 github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20250724122329-41ba6b191e76/go.mod h1:pzatilMEHZFT3qV7C/X3MqOa3NlRQuYhlRhZTL+hN6Q=
-github.com/opencloud-eu/reva/v2 v2.40.2 h1:rsgOkwA6MwReuwu7RvhWh675PJEQhLWrTOew5OSpR/E=
-github.com/opencloud-eu/reva/v2 v2.40.2/go.mod h1:DGH08n2mvtsQLkt8o15FV6m51FwSJJGhjR8Ty+iIJww=
+github.com/opencloud-eu/reva/v2 v2.40.3 h1:gFiBzI/Mq10zekZXvAXOGWRPzTjzHVhBt5W1B5JJMnE=
+github.com/opencloud-eu/reva/v2 v2.40.3/go.mod h1:DGH08n2mvtsQLkt8o15FV6m51FwSJJGhjR8Ty+iIJww=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=

pkg/version/version.go

@@ -34,7 +34,7 @@ var (
 	// LatestTag is the latest released version plus the dev meta version.
 	// Will be overwritten by the release pipeline
 	// Needs a manual change for every tagged release
-	LatestTag = "4.0.1+dev"
+	LatestTag = "4.0.3+dev"
 
 	// Date indicates the build date.
 	// This has been removed, it looks like you can only replace static strings with recent go versions

tests/config/woodpecker/evaluate_pipeline.js

@@ -0,0 +1,102 @@
+const fs = require("fs");
+
+const CI_REPO_NAME = process.env.CI_REPO_NAME;
+const CI_COMMIT_SHA = process.env.CI_COMMIT_SHA;
+const CI_WORKFLOW_NAME = process.env.CI_WORKFLOW_NAME;
+const CI_PIPELINE_EVENT = process.env.CI_PIPELINE_EVENT;
+
+const opencloudBuildWorkflow = "build-opencloud-for-testing";
+const webCacheWorkflows = ["cache-web", "cache-web-pnpm", "cache-browsers"];
+
+const INFO_URL = `https://s3.ci.opencloud.eu/public/${CI_REPO_NAME}/pipelines/${CI_COMMIT_SHA}-${CI_PIPELINE_EVENT}/pipeline_info.json`;
+
+function getWorkflowNames(workflows) {
+  const allWorkflows = [];
+  for (const workflow of workflows) {
+    allWorkflows.push(workflow.name);
+  }
+  return allWorkflows;
+}
+
+function getFailedWorkflows(workflows) {
+  const failedWorkflows = [];
+  for (const workflow of workflows) {
+    if (workflow.state !== "success") {
+      failedWorkflows.push(workflow.name);
+    }
+  }
+  return failedWorkflows;
+}
+
+function hasFailingTestWorkflow(failedWorkflows) {
+  for (const workflowName of failedWorkflows) {
+    if (workflowName.startsWith("test-")) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function hasFailingE2eTestWorkflow(failedWorkflows) {
+  for (const workflowName of failedWorkflows) {
+    if (workflowName.startsWith("test-e2e-")) {
+      return true;
+    }
+  }
+  return false;
+}
+
+async function main() {
+  const infoResponse = await fetch(INFO_URL);
+  if (infoResponse.status === 404) {
+    console.log("[INFO] No matching previous pipeline found. Continue...");
+    process.exit(0);
+  } else if (!infoResponse.ok) {
+    console.error(
+      "[ERROR] Failed to fetch previous pipeline info:" +
+        `\n  URL: ${INFO_URL}\n  Status: ${infoResponse.status}`
+    );
+    process.exit(1);
+  }
+  const info = await infoResponse.json();
+  console.log(info);
+
+  if (info.status === "success") {
+    console.log(
+      "[INFO] All workflows passed in previous pipeline. Full restart. Continue..."
+    );
+    process.exit(0);
+  }
+
+  const allWorkflows = getWorkflowNames(info.workflows);
+  const failedWorkflows = getFailedWorkflows(info.workflows);
+
+  // NOTE: implement for test pipelines only for now
+  // // run the build workflow if any test workflow has failed
+  // if (
+  //   CI_WORKFLOW_NAME === opencloudBuildWorkflow &&
+  //   hasFailingTestWorkflow(failedWorkflows)
+  // ) {
+  //   process.exit(0);
+  // }
+
+  // // run the web cache workflows if any e2e test workflow has failed
+  // if (
+  //   webCacheWorkflows.includes(CI_WORKFLOW_NAME) &&
+  //   hasFailingE2eTestWorkflow(failedWorkflows)
+  // ) {
+  //   process.exit(0);
+  // }
+
+  if (!allWorkflows.includes(CI_WORKFLOW_NAME)) {
+    process.exit(0);
+  }
+  if (!failedWorkflows.includes(CI_WORKFLOW_NAME)) {
+    console.log("[INFO] Workflow passed in previous pipeline. Skip...");
+    fs.appendFileSync(".woodpecker.env", "SKIP_WORKFLOW=true\n");
+    process.exit(0);
+  }
+  console.log("[INFO] Restarting previously failed workflow. Continue...");
+}
+
+main();

tests/config/woodpecker/upload_pipeline_info.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+
+set -e
+
+CACHE_KEY="$PUBLIC_BUCKET/$CI_REPO_NAME/pipelines/$CI_COMMIT_SHA-$CI_PIPELINE_EVENT"
+
+mc alias set s3 $MC_HOST $AWS_ACCESS_KEY_ID $AWS_SECRET_ACCESS_KEY
+
+# check previous pipeline
+URL="https://s3.ci.opencloud.eu/$CACHE_KEY/prev_pipeline"
+status=$(curl -s -o prev_pipeline "$URL" -w '%{http_code}')
+
+if [ "$status" == "200" ];
+then
+    source prev_pipeline
+    REPO_ID=$(printf '%s' "$CI_PIPELINE_URL" | sed 's|.*/repos/\([0-9]*\)/.*|\1|')
+    p_status=$(curl -s -o pipeline_info.json "$CI_SYSTEM_URL/api/repos/$REPO_ID/pipelines/$PREV_PIPELINE_NUMBER" -w "%{http_code}")
+    if [ "$p_status" != "200" ];
+    then
+        echo -e "[ERROR] Failed to fetch previous pipeline info.\n  URL: $CI_SYSTEM_URL/api/repos/$REPO_ID/pipelines/$PREV_PIPELINE_NUMBER\n  Status: $p_status"
+        exit 1
+    fi
+    # update previous pipeline info
+    mc cp -a pipeline_info.json "s3/$CACHE_KEY/"
+fi
+
+# upload current pipeline number for the next pipeline
+echo "PREV_PIPELINE_NUMBER=$CI_PIPELINE_NUMBER" > prev_pipeline
+mc cp -a prev_pipeline "s3/$CACHE_KEY/"

vendor/github.com/opencloud-eu/reva/v2/internal/grpc/interceptors/auth/scope.go

@@ -21,6 +21,7 @@ package auth
 import (
 	"context"
 	"fmt"
+	"path/filepath"
 	"strings"
 	"time"
 
@@ -298,8 +299,11 @@ func checkIfNestedResource(ctx context.Context, ref *provider.Reference, parent
 		return false, statuspkg.NewErrorFromCode(pathResp.Status.Code, "auth interceptor")
 	}
 	childPath := pathResp.Path
-
-	return strings.HasPrefix(childPath, parentPath), nil
+	rel, err := filepath.Rel(parentPath, childPath)
+	if err != nil {
+		return false, err
+	}
+	return !strings.HasPrefix(rel, ".."), nil
 }
 
 func extractRefFromListProvidersReq(v *registry.ListStorageProvidersRequest) (*provider.Reference, bool) {

vendor/modules.txt

@@ -1370,7 +1370,7 @@ github.com/opencloud-eu/icap-client
 # github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20250724122329-41ba6b191e76
 ## explicit; go 1.18
 github.com/opencloud-eu/libre-graph-api-go
-# github.com/opencloud-eu/reva/v2 v2.40.2
+# github.com/opencloud-eu/reva/v2 v2.40.3
 ## explicit; go 1.24.1
 github.com/opencloud-eu/reva/v2/cmd/revad/internal/grace
 github.com/opencloud-eu/reva/v2/cmd/revad/runtime