🐛 Detect GitHub CLI and Nextcloud release workflows

checks/fileparser/github_workflow.go

@@ -452,6 +452,26 @@ func stepsMatch(stepToMatch *JobMatcherStep, step *actionlint.Step) bool {
 // IsPackagingWorkflow checks for a packaging workflow.
 func IsPackagingWorkflow(workflow *actionlint.Workflow, fp string) (JobMatchResult, bool) {
 	jobMatchers := []JobMatcher{
+		{
+			// GitHub CLI release commands publish release artifacts without a
+			// third-party action.
+			Steps: []*JobMatcherStep{
+				{
+					Run: `\bgh[[:space:]]+release[[:space:]]+(create|upload|edit)\b`,
+				},
+			},
+			LogText: "candidate GitHub release publishing workflow using gh",
+		},
+		{
+			// The official Nextcloud App Store release API publishes an app
+			// archive outside the package-manager-specific matchers below.
+			Steps: []*JobMatcherStep{
+				{
+					Run: `https://apps\.nextcloud\.com/api/v1/apps/releases\b`,
+				},
+			},
+			LogText: "candidate Nextcloud App Store publishing workflow",
+		},
 		{
 			Steps: []*JobMatcherStep{
 				{

checks/fileparser/github_workflow_test.go

@@ -1004,6 +1004,21 @@ func TestIsPackagingWorkflow(t *testing.T) {
 			filename: "../testdata/.github/workflows/github-workflow-packaging-elixir.yaml",
 			expected: true,
 		},
+		{
+			name:     "github cli release",
+			filename: "../testdata/.github/workflows/github-workflow-packaging-github-cli.yaml",
+			expected: true,
+		},
+		{
+			name:     "nextcloud app store release",
+			filename: "../testdata/.github/workflows/github-workflow-packaging-nextcloud.yaml",
+			expected: true,
+		},
+		{
+			name:     "github cli release view only",
+			filename: "../testdata/.github/workflows/github-workflow-packaging-github-cli-view.yaml",
+			expected: false,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {

checks/testdata/.github/workflows/github-workflow-packaging-github-cli-view.yaml

@@ -0,0 +1,11 @@
+name: Release inspection
+
+on:
+  workflow_dispatch:
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Inspect release
+        run: gh release view "v1.0.0"

checks/testdata/.github/workflows/github-workflow-packaging-github-cli.yaml

@@ -0,0 +1,11 @@
+name: Release
+
+on:
+  workflow_dispatch:
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Publish release
+        run: gh release create "v1.0.0" dist/example.tar.gz

checks/testdata/.github/workflows/github-workflow-packaging-nextcloud.yaml

@@ -0,0 +1,13 @@
+name: Release
+
+on:
+  workflow_dispatch:
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Publish to Nextcloud App Store
+        run: |
+          curl --fail --request POST \
+            https://apps.nextcloud.com/api/v1/apps/releases