[AndyScherzinger]

Adds .github/workflows/release-relay.yml, copied unchanged from https://github.com/nextcloud/.github/blob/1db6742a7ef8e7429f418ab58546dd229e2c66b6/workflow-templates/release-relay.yml

On a published release in the nextcloud-releases mirror it dispatches an app-tagged event to the release relay. The job is guarded by github.repository_owner == 'nextcloud-releases', so it never runs in this repository.

🤖 AI (if applicable)

• The content of this PR was partly or fully generated using AI

[tcitworld]

@AndyScherzinger May I ask what this is used for?

[AndyScherzinger]

Hi @tcitworld

yes of course 👍

For starters when a release is published in the nextcloud-releases mirror, it notifies the release relay, which triggers a scan of exactly that release. It never runs in this repository and changes nothing about development or the release process here.

So what this action does is being a trigger, so when you do a release and push a tag to the nextcloud-releases org, it triggers a forward of that fact to another action which than can execute further things on the meta data provided. In this case and for starters it allows to be notified about a release, fetch the tag and its repo info and scan the application for security aspects, like vulnerable dependencies or later maybe also for malicious code or else.

For now it is just a trigger to we can later on implement checks for apps that get published through the org's publishing action and configured keys.