Glossary

📖 Glossary

Every page here explains its own terms where it uses them. This one collects them in one place: each term with a short meaning and links to the pages that use it, each link landing on the section that uses it most. Use it as an index, too: search this page for a word and follow the links.

Tip

TL;DR: A few words carry most of it. The bootstrap stub is the one file an app commits; it loads the real Makefile from the per-machine cache. Every build step runs in a throwaway container. The keep model decides what ships, the stage holds it, the tarball packs it. Developer modules, fetched by make dev-init, add the App Store, workflow, analyser and integrity targets.

Term	What it means	Where
-j	make's parallel mode. make dist-signed and make release run their steps in order and need it off	Integrity signature
@nextcloud/vite-config	Nextcloud's shared vite configuration, the base most vite apps build on. It sets build.sourcemap	Build tools
@nextcloud/vue	Nextcloud's Vue component library. Imported by its root, it pulls the whole library into the build; lint-vue-imports asks for per-component entry points	Workflows · Bundle analysis
@nextcloud/webpack-vue-config	Nextcloud's shared webpack configuration for the common Vue setup	Build tools · Checkout audit
[m]	the mark in the help for a maintainer target, one that needs write access to the repository or the App Store signing key	Integrity signature · Target reference
__DIR__	PHP's constant for the directory of the current file. A path the shipped PHP builds from it names a directory the app reads at run time, which consistency-audit holds against the shipped file set	Checkout audit
AIO	Nextcloud All-in-One, the official container setup. ncmake deploys into it with make cp	Installation · Building and packaging · Step by step
ALL	ALL=1 on make cache-clean: remove every entry but a foreign one, the whole cache	Target reference
Alpine	a small Linux distribution. The official PHP images ncmake builds on are its cli-alpine variants	How ncmake understands your app · Per-app tuning
AMEND	make changelog AMEND=1: fold the new entries into the current commit; refused once it is pushed	Releasing
analyser	a report target from a developer module that reads the app and changes nothing: bundle-report and build-audit on the bundle, consistency-audit and build-verify on the checkout	Checkout audit · Bundle analysis · Build tools · Target reference · Per-app tuning · Why ncmake · AI assistant · Bundle report · How ncmake understands your app
analysis_image	the image for composer and psalm, composer:2 by default: current PHP, fully tooled	Per-app tuning · How ncmake understands your app
API	the interface programs talk to a service through, here GitHub's and the App Store's	App Store · Workflows · Per-app tuning · Workflow updater
App id	the <id> in appinfo/info.xml. It names the tarball and the installed directory, whatever the checkout directory is called	How ncmake understands your app · Installation · App Store · Checkout audit · Getting started · GitHub App · Integrity signature · Step by step
App Store	apps.nextcloud.com, where Nextcloud servers find and update apps. See App Store	App Store · Getting started · Integrity signature · Releasing · Checkout audit · Build tools · Target reference · Installation · Step by step · Why ncmake · AI assistant · Building and packaging · How ncmake understands your app
app-certificate-requests	the Nextcloud repository a CSR goes to as a pull request. Its merge issues the certificate	App Store
APP_ID	the placeholder for the app id in the install commands	Installation
appinfo/info.xml	the app's manifest: id, version, dependencies. ncmake reads its id, version and PHP floor from it	Checkout audit · How ncmake understands your app · Releasing · Why ncmake · Workflows · Installation · Building and packaging · Target reference
apps.json	the App Store's app list, which the read-only targets cache with ETag under build/cache/	App Store
apps/	the directory a Nextcloud server loads apps from, custom_apps in a setup such as AIO. TARGET names it	Installation · Building and packaging · Step by step
appstore_api-token	the App Store API token, kept in the certificate directory and used by register, publish and the queries	App Store
ARGS	the variable that passes arguments through to composer, npm or an analyser: make npm ARGS="run dev"	Checkout audit · Target reference · Bundle analysis · Building and packaging
artifact	a file a build produces, such as the release tarball under build/artifacts/dist/	Building and packaging · How ncmake understands your app · Installation · Step by step · Why ncmake · Workflows
author association	a commenter's relation to the repository. Only OWNER, MEMBER or COLLABORATOR can start the rebase comment	Workflow updater
autoloader	the PHP file that loads classes on demand. An app's composer/ holds its own, which the server loads in place of its fallback for lib/	Building and packaging · How ncmake understands your app
backport	a change carried from main to a maintenance line, as a pull request against stableX.Y. git cherry-pick -x records the original commit	Releasing
bare	RUNTIME=bare: run composer and npm from the host's PATH instead of a container	Checkout audit · How ncmake understands your app · Installation · Bundle analysis · Per-app tuning · Target reference · Why ncmake
barrel	a module that only re-exports others. Importing a package by its root goes through its barrel	Bundle analysis
bind mount	a host directory mounted into a container. On SELinux hosts it may need the :z label	How ncmake understands your app · Installation
block-unconventional-commits	a Nextcloud workflow template that fails a pull request whose commits do not follow Conventional Commits	Workflows · Step by step
BODY	BODY=<path> replaces the text below the bullets of the pull request make changelog opens	Releasing · Workflows
bootstrap stub	the dozen-line GNUmakefile an app commits. It fetches the real Makefile into the cache and includes it. See Getting started	Getting started · Workflows · AI assistant · Per-app tuning · Step by step · Why ncmake
branch protection	GitHub rules on a branch, such as changes only through pull requests, required checks and signed commits	Releasing · Workflow updater · Workflows · Checkout audit · GitHub App
branch-cleanup	the shipped workflow that deletes a merged pull request's branch. See Deleting merged branches	Deleting merged branches · Step by step · Workflows
build-audit	the analyser that names what in the checkout makes the bundle the size it is. See Bundle analysis	Bundle analysis · Build tools · Target reference · AI assistant · Bundle report · How ncmake understands your app · Per-app tuning · Step by step
build-verify	the analyser that checks whether committed build output comes from the source beside it. See Checkout audit	Checkout audit · Build tools · How ncmake understands your app · Integrity signature · Per-app tuning · Target reference · AI assistant · Step by step
build/	ncmake's generated working directory with the stage and the tarball. Never edited, never committed; make clean removes it	Getting started
build/cache/	where the App Store queries keep apps.json and integrity-check extracts a tarball	App Store · Integrity signature
bundle-report	the analyser that measures what a browser downloads per page. See Bundle analysis	Bundle analysis · Build tools · Target reference · AI assistant · Building and packaging · Bundle report · How ncmake understands your app · Per-app tuning · Step by step
bundler	the tool the build script runs to turn the frontend source into the shipped assets: webpack, vite, rspack, esbuild, rsbuild. See Build tools	Build tools · Bundle analysis · Checkout audit · Step by step · Target reference
bundler config	vite.config.*, webpack.config.* or rspack.config.*, or the file the build script passes with --config. ncmake reads it as text and never runs it. See Build tools	Build tools · Checkout audit · Bundle analysis · Target reference · Workflows
cache	the per-machine directory ~/.cache/ncmake/ holding the real Makefile, the modules, the analysers, the Node.js lines and the npm and corepack downloads, shared by every ncmake app. make cache-clean lists and removes its entries	Getting started · How ncmake understands your app · Target reference · App Store · Bundle analysis · Checkout audit · Per-app tuning · Step by step · Why ncmake · Workflows
cache-clean	lists the entries of the ncmake cache with size, last change and status and removes the ones picked; ALL=1 the whole cache, DRY=1 only lists	Target reference · How ncmake understands your app · Per-app tuning
ceiling	the newest PHP minor the server of <nextcloud max-version> runs on. php-compat checks the app on it, and a lower <php max-version> is a finding. A higher one raises it, but no further than the ceiling of master, and above that is a finding too. See Checkout audit	Checkout audit · Target reference · How ncmake understands your app
cert_dir	the certificate directory, ~/.nextcloud/certificates by default, with the app's key, certificate and API token	App Store · Per-app tuning
certificate	the App Store certificate for one app id, issued against a CSR	Integrity signature · App Store · Step by step · Per-app tuning · Target reference · How ncmake understands your app · Installation · Workflows
CERTIFICATE_CN	integrity-check: the certificate's CN is not the app id	Integrity signature
CERTIFICATE_MISMATCH	integrity-check: signed with a certificate other than the committed one	Integrity signature
changelog	CHANGELOG.md. make changelog writes its sections from Conventional Commits. See Releasing	Releasing · Checkout audit · Building and packaging · Target reference · Step by step · Why ncmake · App Store · Git tips · How ncmake understands your app · Per-app tuning
changelog-lint	the check that the App Store finds this release in CHANGELOG.md; make tag runs it. See Checkout audit	Checkout audit · Releasing · Target reference · Building and packaging · How ncmake understands your app · Per-app tuning
check-build	the check behind make dist that git-ignored build outputs such as js/ exist	AI assistant
chunk	a JavaScript file the bundler splits off, loaded by an entry or by a dynamic import	Bundle analysis · Build tools
CI	continuous integration: the checks GitHub Actions runs on pushes and pull requests. With CI set, a run removes no images afterwards	Workflows · Integrity signature · Why ncmake · Checkout audit · How ncmake understands your app · Target reference · Workflow updater · Bundle analysis · Getting started · GitHub PAT · Installation · Releasing
CLAUDE.md	an assistant's own project instructions, also AGENTS.md. Keep what is specific to the app there and leave ncmake to the skill file	AI assistant
clean	make clean: remove build/	Bundle analysis
Client ID	the public 20-character identifier of a GitHub App, which replaces the numeric App ID	GitHub App · Workflow updater
cliff.toml	a changelog configuration in the git-cliff format. An app's own cliff.toml replaces the built-in one	Releasing
CN	the common name in a certificate. In an app certificate it must be the app id	Integrity signature
COMMIT	COMMIT=1 on make changelog and the workflow targets: commit the result on an ncmake/ branch and print the push command	Workflows · Releasing · Deleting merged branches
commit.gpgsign	the git setting that signs every commit. COMMIT=1 signs from it, like make version	Workflows
composer	PHP's package manager. ncmake runs it in a container: make composer ARGS=...	How ncmake understands your app · Building and packaging · Checkout audit · Target reference · Why ncmake · Per-app tuning · Installation · Workflows · AI assistant · Releasing · Step by step · Workflow updater
composer.json	the PHP package manifest. Real runtime requirements in it make make build run composer	Checkout audit · Why ncmake · Building and packaging · How ncmake understands your app · Releasing · Workflows
composer.lock	the resolved PHP dependency versions. make version re-syncs it	Checkout audit
consistency-audit	the analyser that holds info.xml, composer.json and package.json against each other. See Checkout audit	Checkout audit · Target reference · AI assistant · Building and packaging · Getting started · How ncmake understands your app · Per-app tuning · Step by step
container	a throwaway, isolated process started from an image. Every composer and npm run is one, removed when it ends	Installation · How ncmake understands your app · Target reference · Checkout audit · Building and packaging · Per-app tuning · Step by step · Bundle analysis · Why ncmake · Releasing · Workflows · AI assistant
Containerfile	the recipe an image is built from. make php-containerfile prints the one of the PHP build image	How ncmake understands your app · Target reference
Conventional Commits	the commit subject convention type(scope): text (feat, fix, ...), from which the changelog is generated	Why ncmake · Releasing · Step by step
corepack	the Node tool that provides pnpm and yarn in the version the packageManager field of package.json names	How ncmake understands your app · Building and packaging · Checkout audit · Per-app tuning · Target reference
cp	make cp: deploy the staged app into a running container	Installation · Building and packaging · Getting started · Per-app tuning · Step by step · Why ncmake
create-pull-request	the GitHub Action (peter-evans/create-pull-request) the workflow updater opens its pull request with	Workflow updater
cron	the schedule line of a workflow. The workflow updater runs daily at 05:30 UTC	Workflow updater
CSR	certificate signing request. make csr creates the key and the request to submit to Nextcloud	App Store · Step by step · Target reference
CSS	the stylesheets of the frontend. The analysers look for them in css/ beside js/, and a page counts its entry's stylesheet. See Bundle analysis	Bundle analysis · Workflows · Build tools
DCO	Developer Certificate of Origin: the Signed-off-by line git commit -s adds, which ncmake's commits carry	GitHub App · Workflow updater · Workflows
default branch	the branch a repository opens on, main in ncmake apps. Scheduled and comment-triggered workflows run from it	Workflow updater · Workflows · Git tips · Releasing
delete-release	deletes one App Store release after showing the list and asking	App Store · Target reference
Dependabot	GitHub's dependency updater. With ncmake it keeps npm and Composer; the workflows belong to the workflow updater	Workflow updater · Why ncmake · GitHub App · Workflows
detached HEAD	a checkout of a commit instead of a branch. The guarded aliases stop on it	Git tips
dev-clean	removes the developer modules from the cache again	App Store · Integrity signature · Target reference · Workflows
dev-init	fetches the developer modules into the cache, once per machine	Target reference · App Store · Bundle analysis · Checkout audit · Integrity signature · Workflow updater · Workflows · Releasing · Step by step
developer module	an optional set of targets (App Store, workflows, analysers, integrity, gh) from mk/ in the ncmake repository, fetched by make dev-init	Target reference · App Store · Integrity signature · Workflows · AI assistant · Bundle analysis · Checkout audit · Step by step
DIR	DIR=<path> points integrity-sign or integrity-check at an existing tree in place of the stage	Integrity signature · Target reference
dist	make dist: stage the shipped file set and pack the release tarball	Building and packaging · Installation · Integrity signature · Checkout audit · Step by step · Target reference · Why ncmake · Workflows · App Store · Bundle analysis · How ncmake understands your app · Releasing
dist-clean	removes every git-ignored build output, for a build from scratch	Building and packaging · Checkout audit · Target reference
dist-signed	make dist-signed: a tarball with the integrity signature inside. See Integrity signature	Integrity signature · Target reference
docker	a container runtime. ncmake uses it when podman is absent, or with RUNTIME=docker	How ncmake understands your app · Installation · Per-app tuning · Target reference · Building and packaging · Why ncmake
Docker Hub	the default image registry, which allows the fewest anonymous pulls (100 per IPv4 address or IPv6 /64)	How ncmake understands your app
Docker Official Images	the images Docker publishes itself, such as php, composer and node	How ncmake understands your app
DRY	don't repeat yourself: each fact lives in one place and the rest is derived from it. On image-clean and cache-clean, DRY=1 only lists	Target reference · Why ncmake · Workflows
dynamic import	import() in the source: the code arrives when the page asks for it, not when the page opens	Bundle analysis
ECR Public	Amazon's public registry, ncmake's first source for the Docker Official Images	How ncmake understands your app
ENGINE	the container CLI for make cp, docker first, independent of RUNTIME	Building and packaging · Installation · Per-app tuning · Target reference
engines.node	the Node range in package.json. It picks the Node line for every npm run, and consistency-audit reports one that admits only end-of-life lines, no released line or no LTS line	How ncmake understands your app · Checkout audit · Per-app tuning
entry	a built file no other file imports, the start of a page	Bundle analysis · Target reference · Workflows
EOL	end of life: a version that gets no more updates. The newest end-of-life Nextcloud sets ncmake's lowest build PHP	How ncmake understands your app · Checkout audit · Per-app tuning
esbuild	a bundler written in Go. See Build tools	Build tools
ESM	ECMAScript modules, files that load each other through import. Only in ESM output can the analysers follow the import graph	Build tools · Bundle analysis · Checkout audit · Workflows
ETag	the HTTP tag that lets the cache ask whether a file changed without downloading it again	App Store · Getting started · Bundle analysis · Checkout audit · Workflows
ExcludeFileByNameFilterIterator	the server class that names the files the integrity check ignores, such as .DS_Store and Thumbs.db	Integrity signature
EXTRA_FILE	integrity-check: the tree has a file the signature does not cover	Integrity signature
fast-forward	moving a branch ahead to a newer commit without a merge commit	Git tips
fetch.prune	the git setting that makes every fetch drop the remote-tracking refs of deleted branches	Git tips
FILE_MISSING	integrity-check: the signature covers a file the tree does not have	Integrity signature
finding	one result of an analyser, marked [!] (worth changing), [i] (worth knowing) or [ok] (looked for, nothing found). See Bundle analysis	Bundle analysis · Checkout audit · Releasing · Build tools · Target reference · Why ncmake
fine-grained token	a PAT limited to chosen repositories and permissions, with an expiry date; preferred over the account-wide classic kind	GitHub PAT · GitHub App
floor	the PHP make build resolves against: <php min-version>, raised to the floor of the newest end-of-life Nextcloud major	Checkout audit · How ncmake understands your app · Building and packaging · Per-app tuning · Releasing · Target reference
force-with-lease	git push --force-with-lease, a force push that refuses when the remote moved since your last fetch. See Git tips	Git tips
fork	a copy of a repository under another account. A pull request from a fork never has its branch deleted	Deleting merged branches
GH	make publish GH=1: take the GitHub release asset URL of the current version, for you to confirm	App Store · Step by step
gh-install	installs the GitHub CLI from its official package source, for the detected package manager	Target reference · Workflows
ghcr.io	GitHub's container registry, where ncmake publishes its PHP build image	How ncmake understands your app · Checkout audit · Per-app tuning · Target reference
git alias	a short name for a longer git command. See Git tips	Git tips · Build tools
GitHub App	the identity the workflow updater authenticates with, so its commits are verified. See GitHub App	GitHub App · Workflow updater · GitHub PAT · Step by step
GitHub CLI (gh)	GitHub's command line tool. make gh-install sets it up; GH=1 and PR=1 use it	App Store · Target reference · Workflows · Getting started · GitHub PAT · Installation · Step by step
github-actions ecosystem	Dependabot's updater for workflow files. Run together with the workflow updater, the two fight over the same files	Workflow updater · Why ncmake
github-actions[bot]	the identity commits and pull requests made with GITHUB_TOKEN show up as	GitHub PAT
GITHUB_TOKEN	the token GitHub mints for each workflow run; it cannot change workflow files. As GITHUB_TOKEN or GH_TOKEN in the environment it also raises the GitHub API limit from 60 to 5000 requests an hour	GitHub PAT · GitHub App · Workflow updater · Integrity signature · Workflows
.gitignore	tells git which files to leave out. ncmake reads it to tell built js/ and vendor/ from committed ones	How ncmake understands your app · Getting started · Why ncmake
glob import	an import of every file a pattern matches: import.meta.glob in vite, require.context in webpack and rspack	Build tools · Checkout audit
GNUmakefile	the file name GNU make reads first, before makefile and Makefile. The bootstrap stub is committed under it	Getting started · Step by step · Checkout audit · AI assistant
GPG	the signing tool behind signed tags and commits. make tag creates a signed tag	Integrity signature · Releasing · Why ncmake
gzip	the compression a web server applies on the wire. The analysers give page sizes gzip-compressed	Build tools
hashed file name	a file name with a content hash in it, such as app-3f9c1a2b.mjs. build-verify pairs two such names by their content	Checkout audit
head branch	the branch a pull request merges from. GitHub's "Automatically delete head branches" removes it after the merge. See Deleting merged branches	Deleting merged branches · Workflow updater · Step by step · Workflows
help	make help: every target with the detected app, version and certificate status. make help-<target> explains one target in depth	App Store · Bundle analysis · Installation · Integrity signature · Target reference · Workflows · AI assistant · Checkout audit · Step by step
image	the template a container starts from, such as the PHP, Node or composer image	How ncmake understands your app · Target reference · Per-app tuning · Checkout audit · Building and packaging · AI assistant · Integrity signature · Step by step · Why ncmake
image-clean	removes container images: the ones ncmake pulled (OWN=1), superseded ones (OLD=1); DRY=1 only lists them	How ncmake understands your app · Target reference · Per-app tuning
image-setup	make image-setup: show for each container CLI where ncmake keeps its image record	Target reference · How ncmake understands your app
image-sources	the list in the ncmake repository of which registries to try per image, in order	How ncmake understands your app · Per-app tuning
IMAGE_CHECK_MIN	minutes between two update checks of an image, default 1440	How ncmake understands your app · Per-app tuning
IMAGE_IDLE_MIN	minutes without an ncmake run after which the images ncmake pulled are removed, default 10	How ncmake understands your app · Per-app tuning · Target reference
IMAGE_SOURCES	a file of your own that lists the registries per image, used in place of ncmake's core/image-sources	How ncmake understands your app · Per-app tuning
images.txt	ncmake's record of the images it uses, pulled or found on the host, with when it last used and checked each. It is state, not cache	How ncmake understands your app · Target reference
import graph	which file imports which. From each entry the analysers follow the static imports to everything the page loads. See Bundle analysis	Bundle analysis · Build tools · Workflows
integrity signature	appinfo/signature.json, the per-file hash list a Nextcloud server checks an installed app against. See Integrity signature	Integrity signature · Target reference · App Store · Building and packaging · Releasing · Step by step · Why ncmake · Per-app tuning · Workflows
integrity-check	holds a tree against its signature.json. Needs no key and runs in CI	Integrity signature · Target reference · Workflows
integrity-enable	copies the App Store certificate to .ncmake/certificate.crt. Committed, it marks the app as signed	Integrity signature · Target reference · Step by step
integrity-gist-drop	deletes the signature's secret gist. make publish runs it once the store accepted the release	Integrity signature · Target reference
integrity-sign	writes appinfo/signature.json into the staged tree, or into DIR=<path>	Integrity signature · Target reference
integrity-tag	the signature step make tag runs; not called by hand	Integrity signature · Target reference
integrity:check-app	the occ command with which a server checks one app's signature. integrity:sign-app signs, and needs the app installed on a server	Integrity signature
INVALID_HASH	integrity-check: the file is there and its content differs	Integrity signature
INVALID_SIGNATURE	integrity-check: the signature does not match the hashes in the file	Integrity signature
JavaScript	the language of an app's frontend. The bundler writes it to js/, and the analysers measure it per page	Workflows · Build tools
js/	the directory an app's built JavaScript conventionally goes to. Git-ignored, it is a build output	Checkout audit · Bundle analysis · Build tools · How ncmake understands your app · Building and packaging · Getting started
JSON	JSON=<file> on an analyser target: print the report and write the JSON of ARGS=--json to <file>, from the same run	Target reference · Bundle analysis · Checkout audit
KEEP	KEEP=1 keeps the images ncmake pulled: the run starts no idle clean-up	How ncmake understands your app · Per-app tuning
Keep a Changelog	the changelog format whose groups make changelog follows: Added, Changed, Deprecated, Removed, Fixed, Security	Releasing
keep model	shipping an allowlist of runtime paths instead of the tree minus an exclude list. See Building and packaging	Building and packaging · Why ncmake · Integrity signature · AI assistant · Getting started · Installation · Workflows
keep_extra	the ncmake.mk variable that adds paths to the shipped set. consistency-audit names the line for a directory the app reads at run time and the set leaves out	Building and packaging · Per-app tuning · Checkout audit
krankerl	the established Rust CLI for packaging and publishing Nextcloud apps. See Why ncmake	Why ncmake
LC_ALL=C	runs a command in the untranslated C locale, so its output reads the same in every language	Git tips
lib_node_image	the image the analysers run in, ncmake-node with the newest LTS line by default. The build steps of build-verify run on the Node line of node_image	Checkout audit · How ncmake understands your app · Per-app tuning
linkTo	the @nextcloud/router function that resolves a file below the root of an app. One with the app id names a directory the frontend loads at run time, which consistency-audit holds against the shipped file set	Checkout audit
lint-eslint	a Nextcloud workflow template for apps with a frontend	Workflows · Step by step
lint-info-xml	a Nextcloud workflow template the ncmake reference apps install	Workflows · Step by step
lint-php	the Nextcloud template that derives its PHP matrix from info.xml and runs composer run lint	Workflows · Step by step
lint-php-cs	a Nextcloud workflow template the ncmake reference apps install	Step by step · Workflows
lint-php-syntax	the shipped workflow that runs php -l on a version matrix, for any repository. Its check to require is php-lint-summary	Workflows
lint-shell	the shipped workflow that runs shellcheck over every tracked shell script	Workflows · Step by step
lint-vue-imports	the shipped workflow that fails a pull request importing @nextcloud/vue by its root	Workflows · Bundle analysis · Step by step
lint-web	the shipped workflow that runs ESLint, Stylelint and html-validate over the JavaScript, CSS and HTML of a repository without a package.json	Workflows
list-for-author	every App Store app by one author	App Store · Target reference
list-releases	the app's published releases on the App Store	App Store · Target reference
list-releases-full	the app's published releases as the full store entry	App Store · Target reference
lock file	package-lock.json, pnpm-lock.yaml, yarn.lock or composer.lock: the exact resolved dependency versions. Which one exists picks npm, pnpm or yarn	Workflows · Building and packaging · How ncmake understands your app · Step by step · Why ncmake · Integrity signature · Releasing · Checkout audit
LTS	long-term support: a release line maintained for longer. The build Node is the newest LTS line engines.node allows that is not end of life	Checkout audit · How ncmake understands your app · Per-app tuning
maintenance line	an older release line (X.Y) that still gets fixes, on its own stableX.Y branch. See Releasing	Releasing · Step by step · Why ncmake · Workflows
make	the build tool every ncmake target runs through	Build tools · Installation · Bundle analysis · Getting started · Step by step · Target reference · Why ncmake
Makefile	the file of make rules. ncmake's is core/Makefile, which the stub loads from the cache	Getting started · AI assistant · Workflows · Per-app tuning · Why ncmake · App Store · Checkout audit · How ncmake understands your app · Integrity signature
matrix	a job run once per value, such as per PHP version. Its job names change with the values, so the summary job is the one to require	Workflows
max-version	<php max-version> and <nextcloud max-version> in info.xml: the highest PHP and Nextcloud an app declares. consistency-audit holds the Nextcloud one against the newest released major plus one and against master	Checkout audit · Releasing · Target reference
median	the middle value of a sorted series, which a single outlier does not shift. Build tools gives medians per tool	Build tools
migration	a database change an app ships. The disable and enable cycle of OCC=1 runs the pending ones	Installation · Building and packaging · Getting started
min-version	<php min-version> in info.xml, the PHP floor the build resolves against	Checkout audit · How ncmake understands your app · Building and packaging · Per-app tuning
mirror	a registry that serves copies of another one's images. ncmake pulls the Docker Official Images from ECR Public and mirror.gcr.io before Docker Hub	How ncmake understands your app
MIT	the license of ncmake	Workflows · Why ncmake
NCMAKE	the path of the core Makefile to include. Pointed at a local file, it runs an uncommitted change	Per-app tuning
ncmake-node	ncmake's Node image, published for amd64 and arm64: Debian slim with git, the compiler node-gyp needs, the distutils of setuptools for a node-gyp before 10, and Yarn 1, but no Node. The Node line, the official build from nodejs.org, is mounted into it at /usr/local	How ncmake understands your app · Per-app tuning
ncmake-php	ncmake's PHP build image, published for amd64 and arm64 for every PHP minor from the floor up to the ceiling of Nextcloud master. Built on the host as localhost/ncmake-php when it cannot be pulled. For every minor above that ceiling it is published as ncmake-php:<minor>-next, from the release or the newest alpha, beta or RC, which php-compat runs apart from the range	Checkout audit · How ncmake understands your app · Target reference · Per-app tuning
ncmake-signature	the line in the tag message with the id of the signature's gist, covered by the tag's GPG signature	Integrity signature
.ncmake-workflows.json	the lock file of the workflow manager: source, upstream sha and hash of every managed workflow	Workflows · Step by step · Workflow updater
ncmake.inputs	the label with the fingerprint of a locally built PHP image's inputs. The image is built again only when one of them changes	How ncmake understands your app
ncmake.mk	the optional per-app file with single variable overrides. See Per-app tuning	Per-app tuning · How ncmake understands your app · AI assistant · Building and packaging · Why ncmake · Workflows · App Store · Checkout audit
ncmake/ branch	the prefix of every branch ncmake opens: ncmake/release/X.Y.Z, ncmake/ci/..., ncmake/docs/changelog	Workflows · Releasing · Workflow updater · Deleting merged branches
.ncmake/certificate.crt	the committed public certificate that marks an app as signed and pins the certificate every verification is held against	Integrity signature · Per-app tuning · Step by step · Target reference · Workflows
NCMAKE_DIR	the cache location: $XDG_CACHE_HOME/ncmake, else ~/.cache/ncmake	Per-app tuning
NCMAKE_REF	pins ncmake to a branch or tag, in the stub or on the command line	Getting started · Per-app tuning · Workflows · AI assistant · App Store · Why ncmake
NCMAKE_TTL_MIN	minutes between two update checks of the cached Makefile, default 1440	Getting started · Per-app tuning
NCMAKE_UPDATER_CLIENT_ID	the repository secret with the workflow updater's GitHub App Client ID. See GitHub App	GitHub App · Workflow updater
NCMAKE_UPDATER_PRIVATE_KEY	the repository secret with the full .pem of the workflow updater's GitHub App. See GitHub App	GitHub App · Workflow updater
nextcloud-version-matrix	the action a Nextcloud template computes its PHP matrix with, from info.xml at run time	Workflows
.nextcloudignore	an optional exclude list that trims within the shipped file set	Why ncmake · Building and packaging · Integrity signature · Per-app tuning · Workflows
nightly	the App Store channel that keeps one development build per app: NIGHTLY=1	App Store · Checkout audit · Releasing
NO_CHANGELOG_LINT	make tag NO_CHANGELOG_LINT=1: tag without the changelog check	Checkout audit · Releasing
NO_COLOR	turns off the colors of make help	Target reference
Node	the JavaScript runtime npm runs on, in the version engines.node allows	Checkout audit · How ncmake understands your app · Per-app tuning · Installation · Target reference · Bundle analysis · Why ncmake · Build tools · Building and packaging · Workflows
Node.js release schedule	the start, LTS and end date of every Node line, from schedule.json in nodejs/Release. ncmake picks the build Node from it, and consistency-audit holds engines.node against it	Checkout audit · How ncmake understands your app · Target reference
node_build_cmd	the frontend build command, auto-detected. Set empty in ncmake.mk, it skips the npm build	Per-app tuning
node_image	the image npm runs in, ncmake-node by default, with the Node line engines.node picks	Per-app tuning · Checkout audit · How ncmake understands your app
node_modules/	npm's install directory. Git-ignored, it is a build output that make dist-clean removes	Workflows · Building and packaging · How ncmake understands your app
non-esm	the finding for webpack and rspack output, whose files load each other through the webpack runtime: each counts as one file, its inside unseen. See Build tools	Build tools
npm	Node's package manager. ncmake runs it in a container: make npm ARGS=...	How ncmake understands your app · Building and packaging · Build tools · Why ncmake · Checkout audit · Per-app tuning · Target reference · Installation · Step by step · Workflow updater · Workflows
npm cache	where npm keeps the tarballs it downloads; ncmake mounts it, and the corepack downloads, from npm/ and corepack/ of the cache into every Node container, so each tarball is downloaded once per host	How ncmake understands your app · Per-app tuning · Target reference
npm ci	installs exactly what package-lock.json records; pnpm and yarn have their frozen-lockfile install in its place. make build runs it before the build script	Build tools · Building and packaging · How ncmake understands your app · Workflows
npm-shrinkwrap.json	an npm lock file under another name. Like package-lock.json, it makes the build run npm ci	Building and packaging
.nvmrc	a file naming the app's Node version. consistency-audit holds it against package.json and the installed workflows	Integrity signature · Checkout audit
OCC	OCC=1 on rsync and cp: disable the app, copy, fix ownership and enable it again through Nextcloud's occ	Installation · Integrity signature · Per-app tuning · Building and packaging · Step by step · App Store · Getting started · Releasing
origin	the git remote a clone came from. ncmake reads the repository URL and its owner from it	Git tips · Workflows · Releasing
output directory	where the bundler writes: build.outDir in a vite config, output.path in webpack and rspack, else js/ and css/. build-verify compares what is there	Build tools · Checkout audit · Bundle analysis
package-lock.json	npm's lock file	Building and packaging · How ncmake understands your app
package.json	the Node package manifest. A build script in it makes make build run npm	Workflows · Checkout audit · Why ncmake · Building and packaging · Bundle analysis · How ncmake understands your app · Target reference · Releasing
packageManager	the field in package.json that names the pnpm or yarn version corepack provides	Building and packaging · How ncmake understands your app
page	in the analysers: an entry plus its stylesheet, what one addScript and addStyle load in a browser	Bundle analysis · Build tools · GitHub App · Checkout audit · GitHub PAT · Releasing · Step by step · Deleting merged branches · Why ncmake · App Store · Building and packaging · Getting started · Git tips · Installation · Integrity signature · Target reference
PAT	personal access token, the alternative to a GitHub App. See GitHub PAT	GitHub PAT · GitHub App · Workflows
PEM	the text form of a certificate or key, between -----BEGIN and -----END lines	GitHub App · Integrity signature
PHP	the variable `PHP=min	max: maxruns composer onanalysis_image, minonphp_image, the build floor. make buildalways usesmin`
php -l	PHP's syntax check. php-compat and lint-php-syntax run it over the PHP files	Checkout audit · Workflows
PHP extension	a compiled PHP module, named ext-<name> in composer.json. consistency-audit holds the required ones against the <lib> entries in info.xml	Checkout audit · How ncmake understands your app
php-compat	the analyser that checks the app against the PHP versions its servers run. See Checkout audit	Checkout audit · Target reference · How ncmake understands your app · Per-app tuning · Step by step
php_base_image	the official PHP image a local php_image is built from	Per-app tuning
php_build_cmd	the PHP build command, auto-detected. Set empty in ncmake.mk, it skips the PHP build	Per-app tuning
php_extensions	the PHP extensions compiled into php_image. One the published image lacks makes ncmake build the image locally	How ncmake understands your app · Per-app tuning · Target reference
php_image	the build image, ghcr.io/ernolf/ncmake-php:<min>: the PHP floor with the extensions a Nextcloud server offers. See Per-app tuning	Per-app tuning · How ncmake understands your app
PHP_VERSIONS	the repository variable with the PHP versions lint-php-syntax checks; a .php-version file comes next, then the default 8.2 8.4	Workflows
phpunit	the Nextcloud workflow templates for apps with PHPUnit tests, such as phpunit-mariadb	Workflows
pinning	fixing ncmake to a tag with NCMAKE_REF	Getting started · AI assistant · Why ncmake
placeholder	a stand-in for a value: $default-branch in a workflow template, filled in at install; APP_ID and <version> in the install commands	Workflows · Installation · Build tools
pnpm	an npm alternative, used when the app has pnpm-lock.yaml	Building and packaging · How ncmake understands your app · Build tools · Step by step
podman	a daemonless container runtime, ncmake's first choice	Installation · How ncmake understands your app · Per-app tuning · Target reference · Why ncmake · Workflows
post-install-cmd	a composer script that runs after the install, where an app moves dependencies into a prefixed namespace under lib/Vendor	Building and packaging
PR	PR=1: implies COMMIT=1, then pushes the branch and opens the pull request through gh	Workflows · Releasing · Step by step · Deleting merged branches · Target reference
pre-release	a version such as 1.2.0-rc.1, released through the same steps as any other. See Releasing	Releasing · App Store · Checkout audit · Step by step · Why ncmake
private key	the secret half of a key pair: <app_id>.key signs for the App Store, a GitHub App's .pem mints its tokens. Never committed	GitHub App · App Store · Workflow updater
psalm	a static analyser for PHP: make psalm	Building and packaging · Target reference · How ncmake understands your app · Per-app tuning · Workflows · Step by step
psalm-matrix	a Nextcloud workflow template that runs psalm in CI	Workflows · Step by step
publish	make publish: sign the bytes a release URL serves and register them with the App Store	App Store · Integrity signature · Target reference · AI assistant · Releasing · Step by step · Why ncmake
publishing rules	the App Store's rules for an app. consistency-audit checks the two that info.xml decides: no <nextcloud max-version> beyond the newest released major plus one, and no Nextcloud in the app name	Checkout audit
pull.ff	pull.ff only: git pull only fast-forwards, and stops when the local branch has commits of its own	Git tips
push.autoSetupRemote	the git setting that makes the first push of a new branch set its upstream without -u	Git tips
rate limit	the GitHub API budget: 60 requests an hour anonymously, 5000 with a token	GitHub PAT · How ncmake understands your app · Workflows
ratings	the app's App Store ratings	App Store · Target reference
rebase comment	@ncmake-updater rebase on the updater's pull request, which rebuilds it on the current default branch. See Workflow updater	Workflow updater
register	make register: register the app id and its certificate with the App Store, once	App Store · Step by step
registry	a server that hands out container images, such as Docker Hub, ECR Public or ghcr.io. image-sources lists which ones to try	How ncmake understands your app · Per-app tuning · Target reference
release	make release: dist plus sign in one step	App Store · How ncmake understands your app · Integrity signature · Releasing · Workflows
release branch	ncmake/release/X.Y.Z, the branch make version opens for the bump and the changelog	Releasing · Step by step · Deleting merged branches · Git tips · Why ncmake
release gate	a check a release has to pass. Through the integrity signature, a runner build that does not reproduce stops the release	Integrity signature
release.yml	the shipped workflow that builds the tarball and attaches it to a GitHub release	Why ncmake · Workflows · Workflow updater
remote-tracking ref	git's local record of a remote branch, such as origin/main. --prune drops those of deleted branches	Git tips
Renovate	a dependency updater like Dependabot	GitHub App
reproducible build	a build that yields the same bytes from the same source every time. Lock files, .nvmrc and pinned images keep it so; build-verify tests it, and the integrity signature depends on it	Building and packaging · Checkout audit · Integrity signature
required check	a CI job that branch protection makes a merge wait for. For a matrix, require its summary job	Checkout audit · Workflows · Releasing
resolve.alias	the bundler setting that maps a name to a directory. build-verify reads it to tell source files from build output	Build tools · Checkout audit
REUSE	the FSFE standard for declaring the license of every file. make reuse checks it	Workflows · Target reference · Building and packaging · How ncmake understands your app · Releasing · Why ncmake
root certificate	Nextcloud's resources/codesigning/root.crt, against which the server checks that an app certificate was issued by Nextcloud	Integrity signature
rootless	a container runtime run by an ordinary user, without root	How ncmake understands your app · Installation · Per-app tuning · Target reference
RSA-PSS	the signature scheme of signature.json. At salt length 0 it is deterministic, so openssl and occ produce the same bytes	Integrity signature
rsbuild	a build tool on top of rspack. See Build tools	Build tools
rspack	a webpack-compatible bundler written in Rust. See Build tools	Build tools · Checkout audit
rsync	make rsync: deploy the staged app to an apps/ directory, local or over ssh	Installation · Building and packaging · Per-app tuning · Target reference · Getting started · Step by step · Integrity signature · Why ncmake · Workflows
runner	the machine a GitHub Actions job runs on	Integrity signature · Workflows · Workflow updater · App Store · Target reference
runner label	the name a job picks its runner by. ubuntu-latest-low exists only in the nextcloud org, so elsewhere the manager rewrites it to ubuntu-latest (wf_runner_org, wf_runner_rewrite)	Workflows
RUNTIME	selects the container runtime: podman, docker, docker-rootless or bare	Installation · How ncmake understands your app · Checkout audit · Per-app tuning · AI assistant · Bundle analysis · Target reference · Why ncmake
scratch tree	the git repository with the tracked files outside the app in which build-verify installs and builds, removed afterwards	Checkout audit · Target reference
secret	an encrypted value in a repository's settings that workflows read as secrets.NAME, masked in the logs. See GitHub PAT	GitHub PAT · GitHub App · Integrity signature · Workflows · Workflow updater
secret gist	a gist that anyone with its id can read and nobody can find. It carries signature.json from make tag to the release runner	Integrity signature · App Store · Target reference · Workflows
self-update	make self-update: fetch the newest Makefile now instead of at the next check	Getting started · AI assistant · Target reference
SELinux	the Linux security module on Fedora and RHEL that may block bind mounts	How ncmake understands your app · Installation
sha512	the hash signature.json records for every file	Integrity signature
sidecar	a <file>.license next to a file that cannot carry a license header, as REUSE defines it. A kept file ships with its sidecar	Workflows · Building and packaging · Checkout audit
sign	make sign: sign the built tarball for the App Store	App Store · Integrity signature · Releasing
signature.json	see integrity signature	Integrity signature · App Store · Building and packaging · Releasing · Step by step · Target reference · Workflows
SKILL.md	the instruction file that teaches an AI assistant ncmake; make skill-install installs it. See AI assistant	AI assistant · Step by step · Target reference
skill_dir	where make skill-install puts the skill file, ~/.claude/skills/ncmake/ by default	AI assistant
source map	a .map file linking built code back to its source. The analysers charge bytes to packages through it	Bundle analysis · Build tools · Checkout audit
SPDX	the standard license identifiers, such as MIT or CC0-1.0, that license headers name	Workflows
stable branch	stableX.Y, the branch of a maintenance line; make stable-branch opens it	Releasing · Step by step · Target reference · Workflows
stage	build/stage/<app_id>/, exactly the shipped file set, the source of dist, rsync and cp	Integrity signature · Building and packaging · Step by step · Why ncmake · Git tips · Target reference · Workflows
stale files	files of an older version left behind when a tarball is extracted over it. rsync and cp replace the directory whole and leave none	Installation
submodule	a git repository nested in the app. build-verify copies an initialized one like the app's own source; git submodule update --init fetches it	Checkout audit
tag	make tag: create and push the signed vX.Y.Z tag on main	Releasing · Integrity signature · Checkout audit · Target reference · Step by step · AI assistant · Git tips
tarball	the .tar.gz that a release ships and the App Store downloads	Installation · Integrity signature · App Store · Workflows · Building and packaging · Getting started · How ncmake understands your app · Releasing · Step by step · Target reference · Checkout audit · Why ncmake
TARBALL	TARBALL=<file> points integrity-check at a packed release	Integrity signature · Target reference
TARGET	the parent apps/ directory for rsync and cp; the app directory is appended	Installation · Step by step · Target reference · Building and packaging
target	a job make runs, named after it: make build, make dist. See Target reference	Target reference · Installation · Bundle analysis · Checkout audit · App Store · Integrity signature · Step by step · AI assistant · Workflows · Building and packaging · Getting started · How ncmake understands your app · Per-app tuning · Build tools · Releasing
token	a key automation authenticates with, carrying who acts and what is allowed. See GitHub PAT	GitHub PAT · GitHub App · App Store · Workflow updater · Deleting merged branches · Integrity signature · Per-app tuning · Workflows
Transifex	the translation platform the Nextcloud bot syncs app translations from	Releasing
translated changelog	CHANGELOG.<code>.md, a changelog in one language, which the App Store reads next to CHANGELOG.md. Written by hand	Building and packaging · Checkout audit · Releasing · Target reference
tree shaking	the bundler leaving out the code nothing uses. What it keeps of a whole library is its decision, not the app's	Workflows
TTL	time to live: how long a cached file counts as current before it is checked again	App Store · Bundle analysis · Checkout audit · Workflows
.tx/backport	the list on main of the release lines the Transifex bot syncs as well, one branch per line	Releasing
.tx/config	the Transifex configuration of an app whose translations the Nextcloud bot syncs	Releasing
Unreleased	the ## [Unreleased] section of the changelog, which collects entries between releases	Releasing · Checkout audit · Step by step
UNRELEASED	make changelog UNRELEASED=1: write under ## [Unreleased] despite a pending version bump	Releasing
update channel	which releases a server offers. A version with a - reaches only the beta, daily and git channels, or occ app:update --allow-unstable	App Store · Releasing
Update with rebase	GitHub's button that rebases a pull request. Its commits carry no signature, so the updater's pull request takes the rebase comment instead	Workflow updater
upstream	where something comes from: the ncmake repository for the cached Makefile, the source of a managed workflow, the remote branch a local one tracks	Workflows · Workflow updater · Git tips · Per-app tuning · Step by step · Why ncmake · App Store · Getting started · Target reference
URL	make publish URL=...: the tarball URL, without a prompt	App Store
vendor/	composer's install directory. Git-ignored, it is a build output	Checkout audit · Building and packaging · How ncmake understands your app · Workflows · Getting started · Integrity signature · Per-app tuning
verified commit	a commit GitHub shows as signed. Branch protection can require it; the workflow updater's commits are signed by its GitHub App	GitHub App · Workflow updater
version	make version: bump the version everywhere on a new release branch	Releasing · Step by step · App Store · Deleting merged branches · Getting started · Git tips · Why ncmake · Workflows
version.php	the file that states a Nextcloud server's version. consistency-audit reads it from nextcloud/server master for the major developed there	Checkout audit
version_compare	PHP's version order, which puts 1.2.0-rc.1 before 1.2.0. make version validates the new version against it	Releasing
versioncheck.php	the file in a Nextcloud server that states the PHP versions it runs on	Checkout audit
vite	a frontend bundler, the base of @nextcloud/vite-config. See Build tools	Build tools · Bundle analysis · Checkout audit
Vue	the frontend framework of Nextcloud, with its component library @nextcloud/vue	Workflows · Build tools · Bundle analysis · Checkout audit · Step by step
W	names the workflows for make workflows-install, comma or space separated	Workflows · Workflow updater · Releasing · Step by step · Target reference
wall-clock	elapsed real time, as a stopwatch measures it. The build and install times on Build tools are wall-clock times on one machine	Build tools
web_user	the user the web server runs as, www-data by default; OCC=1 hands the app to it	Installation · Per-app tuning · Building and packaging · Integrity signature
webpack	the long-standing frontend bundler, the base of @nextcloud/webpack-vue-config. See Build tools	Build tools · Checkout audit · Bundle analysis
webpack runtime	the loader webpack and rspack put into their output (webpackChunk, __webpack_require__) in place of import. The analysers cannot see into it	Build tools
wf_lock_license	wf_lock_license and wf_lock_copyright: license and copyright line of the workflow lock file's sidecar, CC0-1.0 by default	Workflows
workflow	a GitHub Actions file under .github/workflows/. See Workflows	Workflows · Workflow updater · GitHub PAT · GitHub App · Step by step · Releasing · Why ncmake · Integrity signature · Target reference · Deleting merged branches · Bundle analysis · App Store · AI assistant · Getting started · How ncmake understands your app · Checkout audit · Git tips
workflow manager	the developer module that installs and updates CI workflows from their sources and records them in the lock file. See Workflows	Workflows · AI assistant · Bundle analysis · Workflow updater
workflow source	where the manager takes workflows from: ncmake, its own, and nextcloud, the nextcloud/.github templates. ncmake wins a name collision	Workflows · AI assistant · Workflow updater
workflow status	the state workflows-list shows per workflow: installed, update available, modified, missing, unmanaged or gone upstream. See Workflows	Workflows
workflow template	a workflow from nextcloud/.github. Largely self-configuring, so one file works in every app	Workflows
workflow-updater	the shipped workflow that keeps the managed workflows current through a pull request. See Workflow updater	Workflow updater · Workflows · GitHub App · GitHub PAT · Step by step · Why ncmake · Deleting merged branches · Releasing
workflow_dispatch	the trigger that lets a workflow be run by hand from the Actions tab	Workflow updater · Workflows
workflows-install	installs the named workflows from their upstream source	Workflows · Workflow updater · Deleting merged branches · Releasing · Step by step · Target reference
workflows-list	lists every available workflow with its status	Workflows · Step by step · Target reference
workflows-update	brings every managed workflow to its upstream state, skipping locally modified ones	Workflows · Workflow updater · Releasing · Target reference
X.Y.Z	a version as major.minor.patch; its tag is vX.Y.Z	Releasing · Step by step · Checkout audit · Deleting merged branches · Git tips
XDG	the base directory variables XDG_CACHE_HOME and XDG_STATE_HOME that the cache and the image record follow	How ncmake understands your app · Per-app tuning · Target reference
xmllint	the libxml2 tool ncmake reads info.xml with when it is installed; without it, python3 reads the file	Target reference
yarn	an npm alternative, used when the app has yarn.lock, and provided through corepack. Yarn 1 is in ncmake-node besides, for a build script that calls yarn without a yarn.lock	How ncmake understands your app · Building and packaging · Build tools · Step by step