Skip to content

Release: merge development into beta - #970

Open
github-actions[bot] wants to merge 15 commits into
betafrom
development
Open

Release: merge development into beta#970
github-actions[bot] wants to merge 15 commits into
betafrom
development

Conversation

@github-actions

@github-actions github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown
Contributor

Automated PR to sync development changes to beta for beta release.

Merging this PR will trigger the beta release workflow.

Reminder: Add a major, minor, or patch label to this PR to control the version bump. Default is patch.

github-actions Bot and others added 2 commits August 31, 2026 10:26
@github-actions
chore(release): sync beta back into development
101863e 
The 0.1.7-beta.20260831102459 release bumped the version on beta. Without this,
development stays behind beta and the next development -> beta promotion
conflicts on the version file.

Version files resolve to development's side, which is the higher line,
so this never moves a version backwards.
@rubenvdlinde Conduction Release Bot
fix(composer): declare ext-xsl so dependabot can resolve (#967)
90f4815 
Dependabot cannot propose composer updates for this app. Its updater fails
with:

  Your requirements could not be resolved to an installable set of packages.
    - edgedesign/phpqa[v1.27.0, ..., v1.27.2] require ext-xsl * ->
      it is missing from your system.

config.platform pins php 8.3 so composer resolves against a known PHP version,
but says nothing about extensions. edgedesign/phpqa requires ext-xsl and the
resolving environment does not have it, so the resolve fails before any bump
can be computed.

CI is unaffected, which is why this went unnoticed: composer install replays
the committed lock and never re-resolves, so the pipeline stays green while
dependabot -- which does re-resolve -- fails every time. The shared quality.yml
installs no xsl extension anywhere and never invokes phpqa.

Declaring ext-xsl beside the php pin makes resolution assume exactly what the
committed lockfile already assumes. Verified in a clean composer:2 container
without --ignore-platform-reqs: the same file fails without this line and
resolves (103 installs, lock written) with it.

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@rubenvdlinde
Merge pull request #969 from ConductionNL/sync/beta-to-development-0.…
8330cdb 
…1.7-beta.20260831102459

chore(release): sync beta back into development
@rubenvdlinde
chore(deps): take @conduction/nextcloud-vue 2.27.2 (#973)
3d3a74f 
Levels this app with the fleet. 2.27.2 adds two fixes the earlier 2.27.0 pin does
not carry:

  * headerless is no longer chromeless — a flat KPI card in a borderless wrapper
    had no card, border or background at all;
  * a stat `variant` paints from the `-text` tokens rather than the fill tokens,
    which failed WCAG AA at 1.08:1 as a foreground colour. The KPI colour
    cleanup converted hardcoded values to `variant`, so this is what makes those
    conversions contrast-safe.

Lockfile only, and npm pruned nothing.
@github-actions

github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/filinq @ 6b32f6d

Check PHP Vue Security License Tests
lint ⏭️
phpcs ⏭️
phpmd ⏭️
psalm ⏭️
phpstan ⏭️
phpmetrics ⏭️
eslint ⏭️
stylelint ⏭️
build ⏭️
composer ⏭️ ⏭️
npm ⏭️ ⏭️
app:check-code ⏭️
info.xml ⏭️
REUSE ⏭️
PHPUnit ❌
Newman ❌
Playwright ❌
Hydra gates ❌

Quality workflow — 2026-08-31 11:40 UTC

Download the full PDF report from the workflow artifacts.

@github-actions

github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/filinq @ 260e4d9

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
test ✅
test-unit ✅
check-manifest ✅
test-l10n ✅
format ✅
check-schema-l10n ✅
check-l10n-js ✅
composer ✅ ✅ 118/118
npm ✅ ✅ 631/631
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-08-31 12:39 UTC

Download the full PDF report from the workflow artifacts.

@github-actions
chore(release): 0.1.7-unstable.20260831114832 (#975)
398eaf9 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@github-actions

github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/filinq @ 3fa8230

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
test ✅
test-unit ✅
check-manifest ✅
test-l10n ✅
format ✅
check-schema-l10n ✅
check-l10n-js ✅
composer ✅ ✅ 118/118
npm ✅ ✅ 631/631
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-08-31 14:42 UTC

Download the full PDF report from the workflow artifacts.

rubenvdlinde and others added 2 commits August 31, 2026 18:14
@rubenvdlinde Conduction Release Bot
fix(deps): make the npm overrides follow their direct dependency (#977)
8d1ba39 
Dependabot cannot update these packages. Its npm updater fails with:

  npm error code EOVERRIDE
  npm error Override for <pkg> conflicts with direct dependency

The package is listed BOTH as a direct dependency and as a literal overrides
entry pinned to the same range. Dependabot bumps the direct dependency and
does not move the override, npm rejects the mismatched pair, and the update
is abandoned -- so these packages can never be updated, security advisories
included.

npm's self-reference is the idiom for exactly this: $<name> tells the
override to follow whatever the direct dependency resolves to, instead of a
range that has to be kept in lockstep by hand. This repo already uses it (see
the vue entry under @vue/test-utils).

Transitive consumers still get pinned to one version -- the direct
dependency's -- which is what the override was there to do. What changes is
that the pin tracks the dependency instead of duplicating it.

Verified in a clean container: bumping the direct dependency with the literal
override reproduces the EOVERRIDE above; with the self-reference the same
bump resolves.

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@rubenvdlinde Conduction Release Bot
chore(psalm): drop six suppressions whose bugs are already gone (#976)
2f8c900 
psalm-baseline.xml suppressed six InvalidArgument issues. None of them
still exist. Emptying the baseline and re-running Psalm reports "No errors
found", so every entry was outliving the code it described.

Three named registerEventListener in lib/AppInfo/Application.php, and that
method is not in the file any more. The other three named $statusCode in
AnonymizationController and PdfController, and those paths now type-check
on their own.

A baseline that suppresses nothing real is not neutral: it is a standing
invitation to add the next entry rather than fix the cause, and it hides
whether the count is going up or down. The file is kept, empty, so the
next genuine finding still has somewhere to be recorded deliberately.

Verified locally with the repo own vendor/bin/psalm 5.26.1 against
PHP 8.3: with the baseline emptied, 271 files analysed, no errors.

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@github-actions

github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/filinq @ 04710c0

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
test ✅
test-unit ✅
check-manifest ✅
test-l10n ✅
format ✅
check-schema-l10n ✅
check-l10n-js ✅
composer ✅ ✅ 118/118
npm ✅ ✅ 631/631
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ❌
Newman ✅
Playwright ❌
Hydra gates ❌

Quality workflow — 2026-08-31 16:28 UTC

Download the full PDF report from the workflow artifacts.

@github-actions

github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/filinq @ ed001f6

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
test ✅
test-unit ✅
check-manifest ✅
test-l10n ✅
format ✅
check-schema-l10n ✅
check-l10n-js ✅
composer ✅ ✅ 118/118
npm ✅ ✅ 631/631
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-08-31 16:51 UTC

Download the full PDF report from the workflow artifacts.

@github-actions
chore(release): 0.1.8-unstable.20260831162729 (#979)
357a40d 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@github-actions

github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/filinq @ 7048bc2

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
test ✅
test-unit ✅
check-manifest ✅
test-l10n ✅
format ✅
check-schema-l10n ✅
check-l10n-js ✅
composer ✅ ✅ 118/118
npm ✅ ✅ 631/631
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-08-31 20:47 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde
chore(register): retire the product schema, pipelinq owns it (#980)
dc7285d 
Three apps shipped a schema slugged `product`: decidiq, filinq and
pipelinq. Slugs are global on a shared OpenRegister and a bare relation
resolves by slug alone, so the copies could bind to each other. Pipelinq's
is the fleet's commercial catalog entry and keeps the slug.

Nothing in Filinq read this copy: zero references across src/ and lib/. The
schema, its register-list entry and its three mock seed objects go together.

Removing it from the descriptor is only half the job. ImportHandler unions
the freshly-imported schema ids into the register's existing list, so the
live row survives a descriptor deletion. Verified on the dev instance with
the new companion command:

  occ openregister:schemas:prune-retired --app filinq --slug product --apply
  -> product (id=21, app=filinq): 0 objects, referenced by 1 register(s)
     unlinked from register id=16 (filinq)
     DELETED (objects removed=0, table dropped=yes)

pipelinq's id 49 and decidiq's id 987 were untouched, which is the app
scoping doing its job.
@github-actions

github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/filinq @ b042d1d

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
test ✅
test-unit ✅
check-manifest ✅
test-l10n ✅
format ✅
check-schema-l10n ✅
check-l10n-js ✅
composer ✅ ✅ 118/118
npm ✅ ✅ 631/631
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-08-31 21:59 UTC

Download the full PDF report from the workflow artifacts.

@github-actions
chore(release): 0.1.9-unstable.20260831212416 (#981)
a31c683 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/filinq @ 0c2b449

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
test ✅
test-unit ✅
check-manifest ✅
test-l10n ✅
format ✅
check-schema-l10n ✅
check-l10n-js ✅
composer ✅ ✅ 118/118
npm ✅ ✅ 631/631
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-09-01 06:06 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde
chore(lint): let the linter see tests/ and scripts/ (#982)
e51b7ac 
`npm run lint` was `eslint src`, so two whole trees were never linted. Across
the fleet that hid roughly 3,900 errors, none of which any CI leg had shown.

Most of it was the config, not the code, and the same two defects were in
every app.

**scripts/ had no config block at all.** These are CommonJS Node CLI checkers,
and flat config defaults every `.js` to ESM with browser-ish globals, so eslint
read the CommonJS wrapper itself as undefined identifiers: `require`,
`process`, `__dirname`, `__filename`, `module`. A `scripts/**` block now
declares the environment. Declaring beats suppressing here: `no-undef` is the
rule that catches a genuinely misspelled identifier, and dozens of fake
findings would bury a real one. A second block covers `scripts/**/*.mjs`, which
is ESM and needs Node's globals without the CommonJS wrapper.

**The tests block applied a non-TypeScript-aware rule to TypeScript.** It named
`tests/**/*.ts` while setting the CORE `no-unused-vars`, which v9 deliberately
turns off for `.ts` in favour of the `@typescript-eslint` version. The core
rule reads the parameter names inside a function TYPE as bindings, so

    t?: (app: string, key: string) => string

reports `app` and `key` as unused variables, and every unused `catch (e)` in a
`.ts` spec reports twice. The block is split now: `.js`/`.mjs` on the core
rule, `.ts`/`.tsx` on the TypeScript one, same patterns on both.

Also: stale `eslint-disable` comments naming plugins eslint 10 no longer
registers, which are themselves errors ("Definition for rule ... was not
found"), and a rule that must not parse shell scripts.

The genuinely real findings were the useful part: dead locals, unused imports,
dead helper functions, unused `catch` bindings, extensionless relative imports,
and a handful of `== null` comparisons spelled out so they still match null AND
undefined.

Verified per app: `npm run lint` 0 errors over src + tests + scripts,
`prettier --check` clean, and the unit suite still green.
@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/filinq @ 3a1dfb7

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
test ✅
test-unit ✅
check-manifest ✅
test-l10n ✅
format ✅
check-schema-l10n ✅
check-l10n-js ✅
composer ✅ ✅ 118/118
npm ✅ ✅ 631/631
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-09-01 10:52 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde
fix(router): resolve deep links in both URL forms (#984)
b5d8d1a 
Nextcloud serves an app under both /apps/filinq/... and
/index.php/apps/filinq/..., but generateUrl() returns only the form the
instance is configured for. Used as the vue-router base, that means a visitor
arriving on the other form has a pathname the router cannot strip its base
from. No route matches, the catch-all takes over, and they land on the
dashboard with no error at all.

Measured live on learniq, which had the identical base, across all 282 of its
routes: /apps/learniq/courses resolved to Courses, and
/index.php/apps/learniq/courses resolved to the dashboard. Not one broken page,
every deep link in that URL form.

routerBase() derives the base from the pathname, so it always matches the URL
the visitor actually arrived on. openregister, opencatalogi, stackiq, larpinq,
zaakafhandelapp, pipelinq and keepiq already do exactly this.
@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/filinq @ aa17749

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
test ✅
test-unit ✅
check-manifest ✅
test-l10n ✅
format ✅
check-schema-l10n ✅
check-l10n-js ✅
composer ✅ ✅ 118/118
npm ✅ ✅ 631/631
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ❌

Quality workflow — 2026-09-01 19:35 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde
feat(signing): migrate the signing bridge off the retired approval su…
9388a8a 
…rface onto OR task sequences (#988)

openregister#3302 (flow-approval-consolidation) removes the four
ApprovalStep*Event classes, the ApprovalChain/ApprovalStep entities and
ApprovalService with no alias. The signing bridge now consumes the
published replacements (TaskTransitionedEvent to enabled,
TaskTerminalEvent committed, TaskSequenceCompletedEvent), registered by
FQN string literal, duck-typed so the app loads with OpenRegister older,
newer or absent. The Signer* events carry scalars, ownership moves from
chain slugs to the anchored signing-request object, and a
separate-process boot proof pins the load safety. Openspec change:
migrate-signing-to-or-tasks.
@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/filinq @ fba0650

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
test ✅
test-unit ✅
check-manifest ✅
test-l10n ✅
format ✅
check-schema-l10n ✅
check-l10n-js ✅
composer ✅ ✅ 118/118
npm ✅ ✅ 631/631
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-09-01 20:57 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde Conduction Release Bot
test: collect the unit tests filinq was never running, and fix the st…
b851e03 
…ub gap they hid (#990)

phpunit.xml collects tests/unit. A second tests/Unit existed beside it holding
Controller/SetupControllerTest.php and Service/DemoDataServiceTest.php. On a
case-sensitive filesystem those are different directories, so 12 tests have
never run in CI.

MOVING THEM ALONE WOULD HAVE TURNED DEVELOPMENT RED, which is the interesting
part. Six of the twelve error out:

  Trying to configure method "getAppPath" which cannot be configured because
  it does not exist, has not been specified, is final, or is static

tests/stubs/NextcloudStubs.php declares IAppManager with isInstalled,
isEnabledForUser, getAppVersion and getInstalledApps, and stops there. OCP's
real interface also declares getAppPath, which DemoDataServiceTest mocks. A
stub that is SHORTER than the interface it stands in for does not fail where
it is short: PHPUnit refuses to configure the missing method, and the test
errors far from the omission, reading as a broken test rather than a stub gap.

getAppPath added to the stub with OCP's signature. All 12 pass. The suite goes
from 1755 collected tests to 1767, with no failures.

Same defect found in larpinq (#669), where the uncollected directory held one
file and no stub gap.

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/filinq @ b429c1b

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
test ✅
test-unit ✅
check-manifest ✅
test-l10n ✅
format ✅
check-schema-l10n ✅
check-l10n-js ✅
composer ✅ ✅ 118/118
npm ✅ ✅ 631/631
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-09-01 22:25 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde Conduction Release Bot
Takes nextcloud-vue 2.31.1 so a hovered KPI tile stops drawing a card…
cb5ac4c 
… inside (#997)

its own card.

⚠️ THE CAUSE IS AN INSET, NOT A COMPONENT. A card widget renders `flush` and
then has its padding put BACK by the card-fit rule (`padding: 8px 14px`), so
the KPI sits inside the wrapper while the WRAPPER draws the border, radius
and background the user reads as "the card". The library's
`--clickable:hover` rule then drew a 2px border and a drop shadow on the KPI
itself, 8-14px in from the edge being hovered.

Measured live on dossiq, while genuinely hovered: the tile carried a 2px
rgb(0,103,158) border and its own shadow, inset 9px from the wrapper's top
and 15px from its left. A non-card-fit tile sits at 1px, so its border lands
on the wrapper's own edge and reads as one card. That inset is the whole
difference, which is why it looked app-specific and was not.

nextcloud-vue#932 moves the affordance to the wrapper. No layout change:
nothing moves, one card outlines. Verified in the browser with a real pointer
hover:

  before   inner 2px rgb(0,103,158) + shadow   wrapper grey, no shadow
  after    inner transparent, no shadow        wrapper rgb(0,103,158) + shadow

Every app with clickable stat, gauge or delta tiles had this. This bump is
one of the fleet sweep that clears it.

Dependency change only: package.json and the nextcloud-vue entry in
package-lock.json.

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/filinq @ 9effea5

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
test ✅
test-unit ✅
check-manifest ✅
test-l10n ✅
format ✅
check-schema-l10n ✅
check-l10n-js ✅
composer ✅ ✅ 118/118
npm ✅ ✅ 631/631
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-09-02 19:07 UTC

Download the full PDF report from the workflow artifacts.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bbrands02 bbrands02 Awaiting requested review from bbrands02 bbrands02 is a code owner
@rjzondervan rjzondervan Awaiting requested review from rjzondervan rjzondervan is a code owner
@WilcoLouwerse WilcoLouwerse Awaiting requested review from WilcoLouwerse WilcoLouwerse is a code owner
@SudoThijn SudoThijn Awaiting requested review from SudoThijn SudoThijn is a code owner
@remko48 remko48 Awaiting requested review from remko48 remko48 is a code owner
@rubenvdlinde rubenvdlinde Awaiting requested review from rubenvdlinde rubenvdlinde is a code owner
@Rem-Dam Rem-Dam Awaiting requested review from Rem-Dam Rem-Dam is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rubenvdlinde