Merge remote-tracking branch 'origin/development' into ci/enable-shared-e2e

# Conflicts:
#	.github/workflows/code-quality.yml

Author: rubenvdlinde

.githooks/pre-commit

@@ -0,0 +1,38 @@
+#!/bin/sh
+# Committed pre-commit hook (activated via `git config core.hooksPath .githooks`,
+# which `npm install` / `composer install` set automatically — see package.json
+# "prepare" and composer.json "post-install-cmd").
+#
+# Regenerates docs/features.json whenever staged changes touch openspec/specs/
+# or the features overlay, so the commercial capability list can never go
+# stale. CI (features-check / features-extract) only VERIFIES — generation
+# happens here, before the commit, never in the pipeline.
+#
+# Best-effort by design: any failure only warns and never blocks the commit —
+# the CI gate is the enforcement backstop.
+
+if git diff --cached --name-only | grep -qE "^openspec/(specs/|features\.overlay\.json)"; then
+  CACHE=".git/extract-features.py"
+  # Fetch the canonical script (single source of truth in ConductionNL/.github);
+  # fall back to a previously cached copy when offline.
+  curl -sf --max-time 10 \
+    https://raw.githubusercontent.com/ConductionNL/.github/main/scripts/extract-features.py \
+    -o "$CACHE" 2>/dev/null || true
+
+  if [ -f "$CACHE" ]; then
+    if command -v python3 >/dev/null 2>&1; then PY="python3";
+    elif command -v py >/dev/null 2>&1; then PY="py -3";
+    else PY="python"; fi
+
+    if $PY "$CACHE" --app-root . >/dev/null 2>&1; then
+      git add docs/features.json
+      echo "pre-commit: docs/features.json regenerated from openspec/specs/."
+    else
+      echo "pre-commit: WARNING — could not regenerate docs/features.json (python or pyyaml missing?). CI features-check will verify." >&2
+    fi
+  else
+    echo "pre-commit: WARNING — could not fetch extract-features.py (offline?). CI features-check will verify." >&2
+  fi
+fi
+
+exit 0

.github/workflows/code-quality.yml

@@ -22,22 +22,21 @@ concurrency:
   group: quality-${{ github.head_ref || github.ref_name }}
   cancel-in-progress: true
 
-# Union of two intents, both of which are load-bearing:
+# Permission CEILING for the called quality pipeline. GitHub statically
+# validates the called workflow's declared job permissions against this
+# grant — even for jobs that are disabled — so it must cover the maximum any
+# nested job declares: journeydoc-capture (contents+actions write),
+# update-baseline / features-extract (contents write), SBOM (packages read),
+# and the Quality Report PR comment (issues / pull-requests write).
 #
-#  * `issues: write` + `pull-requests: write` come from development's
-#    least-privilege pass (#257) — the Quality Report job posts a sticky PR
-#    comment and cannot without them.
-#  * `contents: write` + `actions: write` + `packages: read` are required by
-#    jobs the called workflow declares (coverage-baseline update, journeydoc
-#    capture, SBOM). A caller cannot grant a reusable workflow more than it
-#    holds itself, so capping those at `read` makes the whole call fail to
-#    START: zero jobs, no annotations — indistinguishable from "nothing to
-#    run". `development` at cb101f1 shows exactly that, two `startup_failure`
-#    runs in a row.
+# A caller cannot grant a reusable workflow more than it holds itself, so
+# capping any of these at `read` makes the whole call fail to START: zero jobs,
+# no annotations — indistinguishable from "nothing to run". `development` at
+# cb101f1 shows exactly that, two `startup_failure` runs in a row.
 #
-# Keeping only development's block would therefore trade a posted comment for a
-# pipeline that never starts. Keeping only this branch's would silently drop
-# the comment. Both are kept.
+# This block is the UNION of both branches' grants, which agreed on every entry
+# except `packages: read`. Dropping development's half would silently lose the
+# PR comment; dropping this branch's half would stop the pipeline starting.
 permissions:
   contents: write
   actions: write

composer.json

@@ -66,6 +66,9 @@
 			"@quality:phpmd-score",
 			"@quality:psalm-score",
 			"@quality:phpstan-score"
+		],
+		"post-install-cmd": [
+			"git config core.hooksPath .githooks || true"
 		]
 	},
 	"config": {

package.json

@@ -21,7 +21,8 @@
     "check:json-strict": "node tests/validate-json-strict.js",
     "check:specs": "npm run check:json-strict && npm run check:manifest && npm run check:register",
     "seed:e2e": "node tests/e2e/seed-example-data.mjs",
-    "test:js-unit": "node --test tests/unit-js/*.test.mjs"
+    "test:js-unit": "node --test tests/unit-js/*.test.mjs",
+    "prepare": "git config core.hooksPath .githooks || true"
   },
   "browserslist": [
     "extends @nextcloud/browserslist-config"