feat: OpenSpec implementation

.github/workflows/sbom.yml

@@ -0,0 +1,91 @@
+name: SBOM
+
+on:
+  push:
+    branches: [main, development, feature/**, bugfix/**, hotfix/**]
+  pull_request:
+    branches: [main, development]
+
+jobs:
+  sbom:
+    runs-on: ubuntu-latest
+    name: "SBOM Generation & Validation"
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref || github.ref_name }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: "8.3"
+          extensions: mbstring, intl, zip, gd, curl, xml, json
+          tools: composer:v2
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Cache Composer dependencies
+        uses: actions/cache@v4
+        with:
+          path: vendor
+          key: ${{ runner.os }}-composer-${{ hashFiles('composer.lock') }}
+          restore-keys: ${{ runner.os }}-composer-
+
+      - name: Install Composer dependencies
+        run: composer install --no-progress --prefer-dist --optimize-autoloader
+
+      - name: Generate PHP SBOM
+        run: composer CycloneDX:make-sbom --output-format=JSON --output-file=bom-php.cdx.json --spec-version=1.5 --omit=dev --omit=plugin
+
+      - name: Install npm dependencies
+        run: npm ci
+
+      - name: Generate npm SBOM
+        run: npx @cyclonedx/cyclonedx-npm --output-file bom-npm.cdx.json --spec-version 1.5 --omit dev
+
+      - name: Merge PHP + npm SBOMs
+        run: |
+          jq -s '.[0] * {components: ([.[].components[]?] | unique_by(.purl // .name))}' bom-php.cdx.json bom-npm.cdx.json > sbom.cdx.json
+
+      - name: Install Grype
+        uses: anchore/scan-action/download-grype@v5
+
+      - name: CVE scan SBOM
+        run: grype sbom:sbom.cdx.json --fail-on critical
+
+      - name: Composer audit
+        run: composer audit --format=json || true
+
+      - name: npm audit
+        run: npm audit --audit-level=critical
+
+      - name: Commit SBOM
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add sbom.cdx.json
+          if git diff --cached --quiet; then
+            echo "No SBOM changes to commit"
+          else
+            git commit -m "chore: update SBOM"
+            git push
+          fi
+
+      - name: Upload SBOM artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom-openconnector
+          path: sbom.cdx.json
+          retention-days: 90
+
+      - name: Attach SBOM to release
+        if: ${{ startsWith(github.ref, 'refs/tags/') }}
+        uses: softprops/action-gh-release@v2
+        with:
+          files: sbom.cdx.json

README.md

@@ -242,6 +242,12 @@ npm run test            # Jest unit tests
 | Data | PostgreSQL, MySQL 8.0+, or SQLite |
 | Quality | PHPCS, PHPMD, phpmetrics, Psalm, PHPStan, ESLint, Stylelint, Jest |
 
+## Support
+
+For support, contact us at [support@conduction.nl](mailto:support@conduction.nl).
+
+For a Service Level Agreement (SLA), contact [sales@conduction.nl](mailto:sales@conduction.nl).
+
 ## Documentation
 
 Full documentation is available at **[conductionnl.github.io/openconnector](https://conductionnl.github.io/openconnector/)**

appinfo/info.xml

@@ -12,6 +12,7 @@ The OpenConnector Nextcloud app provides a ESB-framework to work together in an
 - 📰 Send cloud events
 - 🆓 Map and translate API calls
 
+**Support:** For support, contact support@conduction.nl. For a Service Level Agreement (SLA), contact sales@conduction.nl.
     ]]></description>
 	<version>0.2.8</version>
 	<licence>agpl</licence>

appinfo/routes.php

@@ -14,6 +14,11 @@
 	],
 	'routes' => [
 		['name' => 'dashboard#page', 'url' => '/', 'verb' => 'GET'],
+
+		// Metrics and health
+		['name' => 'metrics#index', 'url' => '/api/metrics', 'verb' => 'GET'],
+		['name' => 'health#index', 'url' => '/api/health', 'verb' => 'GET'],
+
 		['name' => 'dashboard#index', 'url' => '/api/dashboard', 'verb' => 'GET'],
 		['name' => 'dashboard#getCallStats', 'url' => '/api/dashboard/callstats', 'verb' => 'GET'],
 		['name' => 'dashboard#getJobStats', 'url' => '/api/dashboard/jobstats', 'verb' => 'GET'],
@@ -116,5 +121,7 @@
 		['name' => 'ui#cloudEventsEventsId', 'url' => '/cloud-events/events/{id}', 'verb' => 'GET'],
 		['name' => 'ui#cloudEventsLogs', 'url' => '/cloud-events/logs', 'verb' => 'GET'],
 		['name' => 'ui#import', 'url' => '/import', 'verb' => 'GET'],
+		// SPA catch-all — serves the Vue app for any frontend route (history mode routing)
+		['name' => 'dashboard#page', 'url' => '/{path}', 'verb' => 'GET', 'requirements' => ['path' => '.+'], 'defaults' => ['path' => '']],
 	],
 ];

composer.json

@@ -95,12 +95,15 @@
 		"phpunit/phpunit": "^10.5",
 		"roave/security-advisories": "dev-latest",
 		"squizlabs/php_codesniffer": "^3.9",
+		"cyclonedx/cyclonedx-php-composer": "^6.2",
 		"vimeo/psalm": "^5.26"
 	},
 	"config": {
 		"allow-plugins": {
 			"bamarni/composer-bin-plugin": true,
 			"php-http/discovery": true,
+			"cyclonedx/cyclonedx-php-composer": true,
+			"phpro/grumphp": true,
 			"dealerdirect/phpcodesniffer-composer-installer": true
 		},
 		"optimize-autoloader": true,