chore(ci): stop pinning hydra-gates — track the package at @main

[rubenvdlinde]

What changed

This PR started life as a pin bump (hydra-gates-ref: v1.3.0 -> v1.4.0). It now removes the hydra-gates-ref line entirely so this caller inherits the shared workflow's default.

       enable-hydra-gates: true
-      hydra-gates-ref: v1.4.0

enable-hydra-gates: true is unchanged. enable-axe remains unset. The comment block that justified the pin is replaced with a short note explaining why there is deliberately no pin.

Why

ConductionNL/.github/.github/workflows/quality.yml already defaults hydra-gates-ref to main, and this repo consumes quality.yml at @main. Overriding the input was the only thing holding the gates package still. Drop the override and both sides move together — a gate fix reaches this repo without a commit in this repo.

Bumping the pin is a treadmill: it works until the next fix lands upstream, and between bumps the repo is running whatever the gates package looked like on the day someone last remembered.

A pin is a silent expiry date on every upstream fix. We have paid for that twice:

• .github#159 — 22 repos sat pinned on v1.0.1, which predated the gate fixes. 16 gates were dead fleet-wide and every one of them reported PASS. A gate that never runs emits a tick identical to one that did, so nothing in any repo's CI history showed it.
• .github#173 — the shared side flipped a default at @main while the package stayed pinned per caller. Old pinned runners did not carry the coverage accounting the new default assumed, so they went red on gates they had no subject matter for.

The two failures are opposite shapes of the same split: shared workflow at @main, package pinned. Removing the pin closes both.

Rollback

• For everyone: revert on ConductionNL/.github main. One commit reaches the whole fleet — which is the point.
• For this repo only: set hydra-gates-ref: explicitly again, with a comment saying why this repo needs to hold still. The input is still honoured; it just is not the default posture.

Safety net

ConductionNL/.github#177 adds the resolve probe plus the gates package suite gating .github main, so a broken package cannot reach main unnoticed now that consumers track it.

[github-actions]

Quality Report — ConductionNL/hermiq @ f1d0539

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
check-manifest		✅
test-l10n		✅
composer			✅	✅ 117/117
npm			✅	✅ 744/744
PHPUnit					✅
Newman					✅
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-05 22:00 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/hermiq @ 7495764

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
check-manifest		✅
test-l10n		✅
composer			✅	✅ 117/117
npm			✅	✅ 744/744
PHPUnit					✅
Newman					✅
Playwright					✅
Hydra gates					❌

---

Quality workflow — 2026-08-06 05:55 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/hermiq @ 37bd70e

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
check-manifest		✅
test-l10n		✅
composer			✅	✅ 117/117
npm			✅	✅ 744/744
PHPUnit					❌
Newman					✅
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-06 08:05 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/hermiq @ 37bd70e

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
check-manifest		✅
test-l10n		✅
composer			✅	✅ 117/117
npm			✅	✅ 744/744
PHPUnit					❌
Newman					✅
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-06 08:30 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

Merging: Hydra Gates is GREEN; the one red job is unrelated and pre-existing

Hydra Gates: ALL 59 APPLICABLE GATES PASSED — and all 59 of them ran. Before this change it failed outright at the v1.3.0/v1.5.0 pin, so this is a strict improvement.

The remaining red job, PHPUnit (PHP 8.3, NC stable33), is not caused by this PR — which touches only .github/workflows/code-quality.yml. It fails with:

scripts/coverage-guard.php predates merge-base comparison. Update it from ConductionNL/.github before enabling the ratchet.

It was re-run to rule out flake and failed identically.

Separate finding: hermiq is the only repo in the fleet without the coverage-guard fix

The shared workflow floats on @main and requires the merge-base-aware scripts/coverage-guard.php. Every other repo has already adopted it — openbuild #137, pipelinq #716, scholiq #286, decidesk #415, portaliq #49, shillinq #448, hrmq #71, all merged. hermiq has no such PR, and scripts/coverage-guard.php on development contains zero merge-base references.

This is the same floating-caller / stale-callee shape as the gate pin itself, one layer over. It needs its own PR adopting the current coverage-guard.php from ConductionNL/.github; it is not fixed here because it has nothing to do with unpinning the gates.