Skip to content

Release: merge development into beta - #599

Merged
rubenvdlinde merged 22 commits into
betafrom
development
Aug 30, 2026
Merged

Release: merge development into beta#599
rubenvdlinde merged 22 commits into
betafrom
development

Conversation

@github-actions

@github-actions github-actions Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

Automated PR to sync development changes to beta for beta release.

Merging this PR will trigger the beta release workflow.

Reminder: Add a major, minor, or patch label to this PR to control the version bump. Default is patch.

@rubenvdlinde Conduction Release Bot
fix(deps): development cannot npm install (#596)
ea9491a 
* fix(deps): development cannot npm install

A bare `npm install` on development fails with ERESOLVE. The quality
suites pass because they install with --legacy-peer-deps, which accepts a
tree only npm-with-an-existing-lock can produce, never one a fresh clone
can.

npm reports one conflict at a time, so this had to be peeled layer by
layer. Every layer is the same shape: a bump landed past what a toolchain
package's peer range allows.

  @babel/core                        ^8.0.1 -> ^7.22.9
  @babel/preset-env                  ^8.0.2 -> ^7.22.9
  gridstack                          ^13.2.0 -> ^12.6.0
  postcss-html                       ^2.0.0 -> ^1.0.0
  stylelint-config-html              ^2.0.0 -> ^1.1.0
  stylelint-config-recommended-vue   ^2.0.0 -> ^1.6.1
  webpack-cli                        ^7.2.2 -> ^6.0.1

@babel/preset-env 8 requires @babel/core ^8.0.0 while
@nextcloud/webpack-vue-config@7.0.4 requires ^7.22.9 -- no version
satisfies both, so the babel pins revert together. Moving one alone is
what produced the deadlock, and is why the babel-8 dependabot PRs cannot
land individually.

gridstack is pinned to ^12.6.0 so development installs now.
ConductionNL/nextcloud-vue#801 widens that peer to accept 13 (measured:
identical build and 6752 passing tests on both majors); dependabot can
raise it again once 2.20.0 publishes.

Verified with no --legacy-peer-deps: npm install rc=0 (was ERESOLVE),
build rc=0, lint rc=0, stylelint rc=0.

* fix(deps): rebase the lock on development's, not a from-scratch resolve

The previous commit deleted package-lock.json before installing. That
turns a five-package pin into a full re-resolution: on pipelinq it moved
172 package versions, added 64 and removed 132, when five were intended.

One of those unintended moves broke boot. dexie went 4.4.4 -> 4.4.5, and
@conduction/nextcloud-vue's published dist BUNDLES its own dexie copy, so
the app loaded two and Dexie throws at module load:

  pageerror: Two different versions of Dexie loaded in the same app:
             4.4.5 and 4.4.4

The E2E boot gate caught it -- "the bundle loaded but rendered nothing" --
while build, lint, stylelint and unit tests were all green. A passing
build says nothing about whether the app mounts.

Starting from development's lock and letting npm move only what the
manifest forces cuts the change to 85/17/46 and leaves dexie alone.

Control: development's own E2E run is 309 passed / 1 failed with no
dexie pageerror and no boot-gate failure, so the breakage was mine.

---------

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@rubenvdlinde Conduction Release Bot
chore(deps): bump @conduction/nextcloud-vue to ^2.20.0 (#601)
9564278 
Rebuilt on current development rather than merged, because #596
("development cannot npm install") landed while the first attempt was in
CI and rewrote both package.json and package-lock.json. Resolving a
lockfile conflict by hand produces a tree neither side generated; a
fresh install from the fixed baseline produces one npm did.

#596 also explains the E2E failure the earlier attempt hit. I had been
weighing flake against a 2.17->2.19 regression, and it was neither: the
install itself was broken on development, which is what #596 fixed.
Worth stating because the first attempt's evidence pointed away from a
regression already - no commit touched CnAiCompanion/CnAiInput.vue
between the two tags, and `cn-ai-input-dictation-error` was
byte-identical in both - but "not that" is not the same as knowing what.

#596 left the pin at ^2.17.0, so the bump is still needed.

Now ^2.20.0 rather than ^2.19.0: 2.20.0 published while this was in
flight and is the current latest. It carries the named index sources
(`entitySource`) and the `flow` page type, which is what lets hermiq
drop its custom flow pages in a follow-up.

Control build against the regenerated lock: webpack compiles, 26
artifacts.

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@github-actions

github-actions Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/hermiq @ f850f6e

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-specs ✅
check-manifest ✅
test-l10n ✅
format ✅
check-l10n-js ✅
check-schema-l10n ✅
composer ✅ ✅ 123/123
npm ✅ ✅ 742/742
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-08-27 16:45 UTC

Download the full PDF report from the workflow artifacts.

@github-actions

github-actions Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/hermiq @ 7b7288e

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-specs ✅
check-manifest ✅
test-l10n ✅
format ✅
check-l10n-js ✅
check-schema-l10n ✅
composer ✅ ✅ 123/123
npm ✅ ✅ 742/742
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-08-27 20:15 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde Conduction Release Bot
chore(deps): hydra-gates 1.10, so the E2E skip-discipline gate can run (
e70e17a 
#608)

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/hermiq @ 377a7b8

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-specs ✅
check-manifest ✅
test-l10n ✅
format ✅
check-l10n-js ✅
check-schema-l10n ✅
composer ✅ ✅ 123/123
npm ✅ ✅ 742/742
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-08-28 08:45 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde
fix(ci): a push to development must reach a verdict here too (#609)
b985bf2 
.github#597 set cancel-in-progress on the shared quality.yml, but a
caller-level concurrency cancels the whole run before the called
workflows setting can apply -- so that fix reached only the apps that
declare no concurrency of their own.

Measured 2026-08-28 over push runs on development since #597 merged:

    caller silent          0 of 11 cancelled
    caller says true       7 of 13 cancelled  (54%)

This repo is in the second group. pull_request keeps cancelling, where
superseding really is correct.
@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/hermiq @ 70e1036

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-specs ✅
check-manifest ✅
test-l10n ✅
format ✅
check-l10n-js ✅
check-schema-l10n ✅
composer ✅ ✅ 123/123
npm ✅ ✅ 742/742
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-08-28 10:00 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde Conduction Release Bot
refactor(flow): drop the forked flow frontend and the model it descri…
55405b7 
…bed (#606)

* refactor(flow): drop the forked flow frontend and the model it described

Hermiq had a parallel flow authoring frontend: its own canvas (FlowBuilder),
sidebar, list, editor store, branch store, API client and four modals -
8,159 lines beside the shared one. It imported CnGraphCanvas, the raw drawing
widget, but not CnFlowDetail, so it reused the geometry and reimplemented
everything above it.

src/store/store.js already quoted the rule this breaks: 'No other app SHALL own
a flow store, a flow controller, or a flow execution service' (flow-storage/
spec.md). The comment was written to explain why there is no agentflow OBJECT
store, while src/api/flows.js and src/store/flowEditor.js sat next to it doing
exactly what the sentence forbids.

The justification for the fork was a model that no longer exists. The manifest
said 'a node is a PLACE and carries no config, an edge is the STEP that runs'.
or-flow-action-nodes INVERTED that: a node is the action, holding step type and
config, and an edge is sequence. Hermiq's own backend already agrees -
HermiqAgentNode::execute(array $items, array $config, array $context), whose
docblock calls $config 'The step configuration'. The frontend kept describing
the pre-inversion world, and had already drifted from it once: the builder read
the old shape and rendered 'No step type' onto all 16 lines of a healthy flow
while the engine ran it correctly.

So the fork is removed rather than repaired:

  FlowIndex, FlowIndexLegacyRedirect  custom -> index + config.entitySource
  FlowDetail, FlowDetailLegacyRedirect  custom -> flow

The sidebar is now the SHARED CnFlowSidebar, registered from the library, so the
only flow component this app still registers is the one the manifest names.

What hermiq keeps is the supported extension point, which it was already using
correctly: lib/Flow/HermiqAgentNode, HermiqWorkloadNode and
HermiqWorkloadCollectNode, registered on OpenRegister's RegisterFlowNodesEvent.
The app provides nodes; it does not provide an editor.

Tests: flow-branches and flow-trigger-count evaluated the fork's own source
files off disk and have no subject left. flow-builder-dialect and flow-canvas
asserted the shared canvas's rendering, which is nc-vue's to prove. The
survivors keep what is hermiq's: flow-seed (install-time seeding, via the
OpenRegister API), flow-execution (the engine runs a flow, and a save must not
disarm it - retargeted to the shared toolbar), and manifest-pages.

Two comments in dashboard-and-agents each described the model as it had just
stopped being; both are corrected, and the fixme there is re-explained rather
than quietly greened - its cause moved but it still cannot pass, because a
named source's row actions MERGE with the built-ins and so cannot express
'exactly one action'.

Verified: check:manifest and check:manifest-v2 PASS against schema 2.26.0,
webpack build exits 0 (which is what proves no dangling imports survive),
eslint clean on both changed source files, and unchanged error counts on the
three touched specs (3/5/6, all pre-existing, measured in place).

* fix(ci): check:specs still chained the two specs this branch deleted

Two things the branch broke and local checks did not catch, because I ran
check:manifest, eslint and the build rather than the command CI runs.

1. package.json's check:specs still chained check:flow-branches and
   check:flow-trigger-count. Their spec files are deleted, so the chain died
   with MODULE_NOT_FOUND before reaching anything real.

2. tests/registry.spec.js evaluates registry.js by rewriting its imports into
   stubs, and the pattern only matched DEFAULT imports:
     /import\s+(\w+)\s+from\s+.../
   \w+ cannot match '{ CnFlowSidebar }', so the first NAMED import in the file
   survived the rewrite and vm.runInNewContext rejected the whole file with
   'Cannot use import statement outside a module' — a parse error naming
   neither the import nor the line. There were no named imports until the
   registry started importing a shared component instead of declaring its own.
   The evaluator now stubs both forms.

Verified by running the exact CI command, npm run check:specs, which now exits
0. That is the check that would have caught both before the push.

* style(tests): prettier the named-import stub in registry.spec.js

The stub itself is load-bearing and stays: registry.js now imports a SHARED
component (`import { CnFlowSidebar } from '@conduction/nextcloud-vue'`) instead
of declaring its own, and this spec's rewriter only handled DEFAULT imports.
A named import survived the rewrite intact and vm.runInNewContext rejected the
whole file with 'Cannot use import statement outside a module' — a parse error
naming neither the import nor the line.

Verified by mutation: deleting the named-import branch reproduces that exact
error, and restoring it is byte-identical.

Only the formatting was wrong, which is what `prettier --check` caught.

* chore(deps): bump @conduction/nextcloud-vue to ^2.21.0

This PR replaces hermiq's forked flow frontend with the shared `index` and
`flow` page types, and those need 2.21.0: 2.20 declares a named index source's
columns, create button and row actions without reading them.

The LOCK is the part that matters — CI installs with `npm ci`, so the caret
alone changes nothing about what actually installs.

2.21.0 is also what makes the shared CnFlowSidebar this PR registers resolve to
the same version the canvas comes from.

---------

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/hermiq @ 798dd54

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-specs ✅
check-manifest ✅
test-l10n ✅
format ✅
check-l10n-js ✅
check-schema-l10n ✅
composer ✅ ✅ 123/123
npm ✅ ✅ 742/742
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-08-28 12:16 UTC

Download the full PDF report from the workflow artifacts.

Conduction Release Bot and others added 2 commits August 28, 2026 14:47
Conduction Release Bot
feat(walkthrough): show where flows live, without making anyone build…
984d9e0 
… one

hermiq ships a flows surface (`FlowIndex`, routed at /flows and reachable
from the settings menu) and its tour never mentioned it, so the automation
was discoverable only to someone who already knew it was there.

Found by widening gate 70's flows-page predicate: it matched only
`type: "flows"`, which exactly one fleet app declares. hermiq ships its
surface as an ordinary `type: "index"` page, so the gate reported NOT
APPLICABLE and read as covered while covering nothing here.

The step is `optional` with `allowManualNext`: showing where flows are
edited must not become "author an automation before you may finish the
tour".

It targets `FlowIndex` — the ROUTE, which is what `data-cn-route` carries
and what CnWalkthrough resolves. Targeting the menu id would look right in
review and resolve to nothing at runtime, and an optional step whose target
is absent is SKIPPED silently. hermiq's lock is already at 2.21.0, the
release that put `data-cn-route` on CnAppNav's settings loop (#811), so the
anchor exists.

The three strings are added to l10n/en.json and nl.json by hand: hermiq's
own `test:l10n` does not read src/manifest.json — it reports OK with all
three missing — so gate-101 in CI is the only thing that would catch it.

Verified: gate-70 0 findings, gate-96 rc=0, test:l10n OK, check:l10n-js rc=0.
@rubenvdlinde
Merge pull request #613 from ConductionNL/chore/walkthrough-flows-stop
8629dcc 
feat(walkthrough): show where flows live, without making anyone build one
@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/hermiq @ 58a5a86

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-specs ✅
check-manifest ✅
test-l10n ✅
format ✅
check-l10n-js ✅
check-schema-l10n ✅
composer ✅ ✅ 123/123
npm ✅ ✅ 742/742
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-08-28 13:05 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde Conduction Release Bot
docs: add a local demo environment (#615)
fa7df52 
Adds `hermiq-compose.yaml` and a setup page describing it.

The compose brings up Postgres and Nextcloud, installs openregister (required),
thematiq and integriq (optional) and hermiq from release tarballs, and enables
them in dependency order. Nothing is bind-mounted: Nextcloud installs an app by
deleting its directory and extracting an archive over it, so pointing that at a
checkout deletes the working tree — measured on a development machine on
2026-08-27, where an app-store update fired on a container restart and removed
every top-level file including .git.

Release tarballs rather than a clone for a second reason: a tarball is a
complete app carrying vendor/ and the built js/, and an app with no vendor/
does not fail loudly — it warns once and keeps loading, so it looks installed
while every service needing a dependency is absent.

The openregister dependency is not declared in appinfo/info.xml — no app in the
fleet declares an <app> dependency — so the compose encodes what the manifest
does not.

Verified: docker compose config parses and interpolates; the same generated
file was booted end to end for portaliq, which produced 17 registers, 86
schemas and 13 magic tables for its own register, with the portal content API
returning a real site rather than an empty shell.

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/hermiq @ 89cc00b

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-specs ✅
check-manifest ✅
test-l10n ✅
format ✅
check-l10n-js ✅
check-schema-l10n ✅
composer ✅ ✅ 123/123
npm ✅ ✅ 742/742
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-08-28 14:11 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde Conduction Release Bot
docs: make the demo verification command actually pass (#617)
dcafef7 
Two defects, both measured against a booted demo rather than inferred from
the code.

The verification step told you to run

  curl -s -o /dev/null -w '%{http_code}' http://localhost:PORT/apps/APP/

and described a pass. That request is unauthenticated, and a Nextcloud app
page requires a login, so it prints 401 on a perfectly healthy demo. A reader
following the page would conclude the demo was broken. The command now sends
the demo credentials and says in words that a bare 401 is expected.

Thematiq additionally has no app route at all — it declares
<admin-section>theming</admin-section> — so /apps/thematiq/ answers 404 even
authenticated. Its page now opens Settings -> Administration -> Theming.

Verified on two booted demos: the corrected commands return 200.

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/hermiq @ 5794a00

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-specs ✅
check-manifest ✅
test-l10n ✅
format ✅
check-l10n-js ✅
check-schema-l10n ✅
composer ✅ ✅ 123/123
npm ✅ ✅ 742/742
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-08-28 18:48 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde Conduction Release Bot
feat(setup): hermiq offers demo data, and declares the register that …
263ccb3 
…holds it (#619)

* feat(setup): hermiq offers demo data, and declares the register that holds it

hermiq was the last app with a setup wizard and no demo-data step. It could not
simply be added: the generator needs a DECLARED register to attach objects to,
and hermiq declared none.

WHAT WAS MISSING. lib/Settings/hermiq_register.json defined 30 schemas under
components.schemas and no components.registers anywhere in lib/ - while 10
manifest pages and 5 frontend stores bind register 'hermiq'. The register
demonstrably exists at runtime (E2E queries api/objects/hermiq/agent and
passes), so this is a descriptor that never declared what the app already uses.

The block lists the 30 schemas by SLUG, matching dossiq's shape. It deliberately
omits folder and tablePrefix: RegisterMapper::updateFromArray() calls hydrate(),
which sets only the keys present, so omitting them leaves whatever a register
that already exists is carrying. Declaring them would overwrite live values this
file cannot see.

THE DATASET is generated, not written - 90 objects across 30 schemas, every
value derived from the schema that validates it. --check passes all 30.

THE STEP is optional and its outcome is recorded either way. 'skip-demo-data'
writes demo_data_decided just as installing does, because since
nextcloud-vue 2.21 an OUTSTANDING OPTIONAL step is enough to open the wizard
over every page (nextcloud-vue#806) - a step that can never be marked done is a
dialog that never closes. That is the same defect buildiq is failing 37 E2E
specs on right now.

Verified: manifest validates against schema 2.26.0, gate-100 PASS, both PHP
files lint clean.

* fix(tests): validate-register skips mock descriptors

The generated mock matches this script's `*_register.json` sweep, but every
rule below the entry point checks SCHEMA DEFINITIONS — and a `type: mock`
descriptor deliberately carries none.

generate_mock_register.py stopped emitting components.schemas because it
duplicated the app's own definitions and broke their uniqueness tests. So the
two checks became mutually unsatisfiable: the generator must not write the
block, and this script demanded it.

The demo data is not left unchecked — generate_mock_register.py --check
re-validates every object against the schema that will accept it, which is a
stronger statement than 'the file has a schemas key'.

* style(php): the class carries its @SPEC, and the new dependency its @PARAM

phpcs found two things in the previous commit: DemoDataService declared @SPEC
in the FILE docblock but not on the class, which is where the tag is read from,
and SetupController's new constructor argument had no @PARAM line.

Verified: phpcs, phpmd, phpstan and psalm all clean on both files.

* fix(demo-data): canonical icons, no em-dash, and the Dutch keys

Three gate findings from the previous push, all in artefacts I generated:

gate-60 icon-vocabulary — the mock carried 'Voorbeeld Icon 1..3'. The generator
DOES emit canonical icons: it imports check_icon_vocabulary from its own
directory and reads schemas/semantic-icons.json. I had run a standalone copy of
the script with neither sibling present, so the lookup hit its
'except Exception: registered = None' and fell back to plain strings, silently.
Regenerated with the script in its own package: BookOpenVariantOutline,
MapMarkerPath, ViewDashboardOutline.

gate-96 manifest-copy-style — my step body used em-dashes, which voice.md
section 8 forbids. Rewritten without them.

gate-102 manifest-l10n-coverage — the step's title and body had no nl.json key,
so a Dutch user would read them in English. Added both.

The l10n edit is 2 insertions and no deletions: a first attempt reformatted the
whole file (sort_keys plus a different indent, 410 lines changed) and was
reverted in favour of a text insert proven against the same change applied
structurally.

* chore(l10n): rebuild the browser catalogue for the two new keys

check:l10n-js compares l10n/nl.json against l10n/nl.js and reported the
catalogue stale. The generated file is 2 insertions, matching the 2 keys added
to nl.json.

Worth noting the pairing: nl.json alone is not enough, because the browser
reads nl.js. Adding a translation without rebuilding leaves the string
untranslated at runtime while the source file says otherwise.

---------

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@github-actions

github-actions Bot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/hermiq @ fdd4d9c

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-specs ✅
check-manifest ✅
test-l10n ✅
format ✅
check-l10n-js ✅
check-schema-l10n ✅
composer ✅ ✅ 123/123
npm ✅ ✅ 742/742
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-08-28 19:41 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde Conduction Release Bot
chore(deps): @conduction/nextcloud-vue 2.21.0 -> 2.22.1 (#621)
f5e44b4 
2.22.1 carries the theme app-id fix (nextcloud-vue#840). CnAppRoot calls
useScopedTheme() with no slug, so this app resolved theme tokens, the
token-set catalogue and the contrast check through a hardcoded 'nldesign'
app id. thematiq is renaming to 'thematiq', and every path in that
composable degrades to default styling by design — so once a renamed build
is installed this app would render unthemed with nothing in any log.

The LOCK is what moves here. A caret range alone changes nothing, because
npm ci installs what package-lock.json pins.

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@github-actions

github-actions Bot commented Aug 29, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/hermiq @ eb6a47f

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-specs ✅
check-manifest ✅
test-l10n ✅
format ✅
check-l10n-js ✅
check-schema-l10n ✅
composer ✅ ✅ 123/123
npm ✅ ✅ 742/742
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ❌
Hydra gates ✅

Quality workflow — 2026-08-29 10:31 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde Conduction Release Bot
test(e2e): seed the walkthrough marker so the tour cannot intercept c…
746b454 
…licks (#624)

@conduction/nextcloud-vue 2.22.x made the product walkthrough actually open.
A `placement: "center"` welcome step used to be parked in `_pendingAutoTour`
and never shown; the library now correctly starts it on any route. Its
`cn-walkthrough__dim--full` layer is a `role="dialog" aria-modal="true"`
overlay, so every spec that clicks behind it times out, and
`getByRole('dialog').first()` resolves to the dim layer rather than the
modal under test.

The marker is per USER, not per test, so leaving it unseeded also makes the
suite order-dependent: whichever spec runs first wears the tour.

Seeds the same marker dossiq's global-setup already seeds, with a sentinel
above any real app version so the tour composes to an empty step set.

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@github-actions

github-actions Bot commented Aug 29, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/hermiq @ b459d92

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-specs ✅
check-manifest ✅
test-l10n ✅
format ✅
check-l10n-js ✅
check-schema-l10n ✅
composer ✅ ✅ 123/123
npm ✅ ✅ 742/742
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-08-29 12:45 UTC

Download the full PDF report from the workflow artifacts.

github-actions Bot and others added 9 commits August 29, 2026 15:09
@github-actions
chore(release): 0.1.34-unstable.20260829121059 (#625)
2e82c6a 
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@rubenvdlinde Conduction Release Bot
ci(docs): publish from development, and retire the old hostname (#623)
2feb56c 
Two independent faults, either of which alone stops the docs site updating.

TRIGGER. This listened on a branch called `documentation`. Nobody has pushed
to one since 2026-05-25, so every docs change merged to `development` passed
review and published nothing.

SECRETS. A reusable workflow receives no secrets by default. With none mapped,
the callee's publish step finds CF_API_TOKEN empty and skips itself on its own
guard, and the run finishes GREEN having changed nothing. Fixing only the
trigger would have produced exactly that.

The worker name is now pinned. Deriving it is the documented way to get a green
run that reaches nobody: wrangler creates the derived worker and publishes
there while the custom domains keep routing to the real one.

Where the app was renamed, `canonical-host` turns the retired hostname from a
second live copy of every page into a 301 to the same path on the current one.

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
Conduction Release Bot
ci(docs): redeploy so the custom domain is actually requested (.githu…
934fc8f 
…b#638)
@rubenvdlinde
chore(deps): @conduction/nextcloud-vue 2.22.1 -> 2.24.1 (#628)
72eb53d
@rubenvdlinde Conduction Release Bot
chore(deps): @conduction/nextcloud-vue 2.24.1 -> 2.24.2 (#630)
580f0ab 
Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@dependabot
build(deps-dev): bump typescript from 5.9.3 to 7.0.2 (#574)
0168789 
Bumps [typescript](https://github.com/microsoft/TypeScript) from 5.9.3 to 7.0.2.
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.3...v7.0.2)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@rubenvdlinde
chore(sync): carry beta back into development
71d4c12 
beta held 5 commits development did not. The only content difference was
appinfo/info.xml, resolved to development's side so the version never
moves backwards.

A 0-file merge is the correct outcome here: the content had already
reached development by other routes. Recording the ancestry IS the
payload — without it the merge base never moves and the next
development -> beta promotion conflicts on the version file exactly as
before.
@rubenvdlinde
Merge pull request #634 from ConductionNL/sync/beta-to-development-20…
a988489 
…2608300837

chore(sync): carry beta back into development
@rubenvdlinde Conduction Release Bot
fix(deps): revert typescript to 5.9.3 and hold back TS 7 majors (#632)
8534633 
#574 bumped typescript 5.9.3 -> 7.0.2 and was merged into development over
three red checks. Those checks were red for a reason that no code change in
this app can address.

typescript-eslint refuses to load under TS 7. It is not a peer-range warning
that npm can be talked out of, it is an explicit guard at the top of
typescript-eslint/dist/index.js:

    if (versionMajor >= 7) { throw new Error('typescript-eslint does not
    support TS 7.0.'); }

Every published version agrees: 8.68.0 (latest) and 8.68.1-alpha.6 (canary)
both declare peerDependencies typescript ">=4.8.4 <6.1.0". There is no
version, stable or pre-release, that lints this app under TS 7. Upstream
tracks TS >= 7.1 support in typescript-eslint#10940.

Measured rather than assumed: on 580f0ab (the commit before the bump)
`npm run lint` exits 0 with 53 warnings and 0 errors; on 0168789 it exits 2
before linting a single file. The failure is not pre-existing, it arrived
with the bump. With this revert lint is back to exit 0 / 53 warnings and
`npm run build` compiles clean.

The dependabot ignore is what stops this from simply happening again next
week. Without it the identical PR reopens on the next weekly run, still red,
still unfixable. It is scoped to major updates only, so 5.x patches and
minors keep flowing, and it carries the upstream issue link so it is obvious
when it can be lifted.

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@github-actions

github-actions Bot commented Aug 30, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/hermiq @ 980490f

Check PHP Vue Security License Tests
lint ⏭️
phpcs ⏭️
phpmd ⏭️
psalm ⏭️
phpstan ⏭️
phpmetrics ⏭️
eslint ⏭️
stylelint ⏭️
build ⏭️
composer ⏭️ ⏭️
npm ⏭️ ⏭️
app:check-code ⏭️
info.xml ⏭️
REUSE ⏭️
PHPUnit ❌
Newman ❌
Playwright ❌
Hydra gates ❌

Quality workflow — 2026-08-30 09:10 UTC

Download the full PDF report from the workflow artifacts.

@github-actions

github-actions Bot commented Aug 30, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/hermiq @ a4f118f

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-specs ✅
check-manifest ✅
test-l10n ✅
format ✅
check-l10n-js ✅
check-schema-l10n ✅
composer ✅ ✅ 123/123
npm ✅ ✅ 742/742
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ✅
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-08-30 10:16 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde
rubenvdlinde merged commit 1bfe0e6 into beta Aug 30, 2026
99 of 100 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@SudoThijn SudoThijn Awaiting requested review from SudoThijn SudoThijn is a code owner
@remko48 remko48 Awaiting requested review from remko48 remko48 is a code owner
@rubenvdlinde rubenvdlinde Awaiting requested review from rubenvdlinde rubenvdlinde is a code owner
@rjzondervan rjzondervan Awaiting requested review from rjzondervan rjzondervan is a code owner
@Rem-Dam Rem-Dam Awaiting requested review from Rem-Dam Rem-Dam is a code owner
@WilcoLouwerse WilcoLouwerse Awaiting requested review from WilcoLouwerse WilcoLouwerse is a code owner
@bbrands02 bbrands02 Awaiting requested review from bbrands02 bbrands02 is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rubenvdlinde