fix(security): refresh roave guard via web-token/jwt-library (unblocks stale advisories pin) #1215
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Code Quality | |
| on: | |
| push: | |
| branches: [main, beta, development, feature/**, bugfix/**, hotfix/**] | |
| pull_request: | |
| # `synchronize` — a push to an open PR — is what was missing. Without it the | |
| # quality suite runs ONCE, when the PR is opened, and every commit after | |
| # that is merged unchecked while the PR still shows the first run's green. | |
| # | |
| # Observed on this repo 2026-07-31: #2227 was opened, failed phpcs on | |
| # pre-existing debt, was fixed by a follow-up push, and the fix was never | |
| # verified by CI. #2228's only Code Quality run stayed pinned to its first | |
| # commit across a merge from development and two further commits, so its | |
| # checks were describing code that no longer existed. | |
| # | |
| # The branch list on `push:` does not cover the gap: it names `feature/**` | |
| # while the convention in practice is `feat/**` and `fix/**`, so most | |
| # branches get nothing there either. | |
| # | |
| # Cost is bounded by the `concurrency` block below — a new push cancels the | |
| # in-flight run for the same head ref rather than queueing beside it. | |
| # | |
| # hermiq's copy of this workflow omits `types:` entirely, which defaults to | |
| # [opened, synchronize, reopened]. This repo is the outlier. | |
| types: [opened, reopened, synchronize] | |
| branches: [main, beta, development] | |
| workflow_dispatch: | |
| concurrency: | |
| group: quality-${{ github.head_ref || github.ref_name }} | |
| cancel-in-progress: true | |
| # Permission CEILING for the called quality pipeline. GitHub statically | |
| # validates the called workflow's declared job permissions against this | |
| # grant — even for jobs that are disabled — so it must cover the maximum | |
| # any nested job declares: journeydoc-capture (contents+actions write), | |
| # update-baseline / features-extract (contents write), and the Quality | |
| # Report PR comment (issues / pull-requests write). | |
| permissions: | |
| contents: write | |
| actions: write | |
| issues: write | |
| pull-requests: write | |
| jobs: | |
| quality: | |
| if: github.event_name != 'push' || github.event.created != true | |
| uses: ConductionNL/.github/.github/workflows/quality.yml@main | |
| with: | |
| app-name: openregister | |
| php-version: "8.3" | |
| php-test-versions: '["8.3", "8.4"]' | |
| nextcloud-test-refs: '["stable32"]' | |
| enable-psalm: true | |
| enable-phpstan: true | |
| enable-phpmetrics: true | |
| enable-frontend: true | |
| enable-eslint: true | |
| enable-phpunit: true | |
| enable-newman: true | |
| # Playwright starts from a deliberately SMALL spec set rather than the | |
| # whole of tests/e2e (58 files, several of which write fixtures or shell | |
| # out to occ). A gate that is red on arrival is a gate nobody turns on — | |
| # which is how this repo ended up with an E2E job that had never | |
| # succeeded. The floor is green and it grows; see tests/e2e/ci/. | |
| enable-playwright: true | |
| playwright-test-path: tests/e2e/ci | |
| # The object-sharing specs need two non-admin accounts: sharing something | |
| # to yourself proves nothing, and task 4.0's whole point is that an OWNER | |
| # who is not an admin can set their own object's scope. | |
| # | |
| # Created with `occ`, NOT through `/ocs/v2.php/cloud/users`. The specs used | |
| # to provision them over OCS and that started returning 404 on this | |
| # instance — `provisioning_api` is shipped but optional, and an e2e suite | |
| # for object sharing should not go dark because a user-management app is | |
| # absent. `|| true` because the accounts persist across re-runs on the same | |
| # instance; the specs assert they can authenticate rather than assuming the | |
| # seed ran, so a genuinely failed seed still fails loudly. | |
| # | |
| # A SCRIPT, not an inline command, and the shell operators are why. The | |
| # shared workflow runs this through `eval <value>` UNQUOTED, so the outer | |
| # bash parses whatever it expands to and any metacharacter is parsed at the | |
| # wrong level. Measured, both wrong: | |
| # `( … ) && ( … )` -> "syntax error near unexpected token OC_PASS=…", and | |
| # the seed silently never ran. | |
| # `sh -c '… ; …'` -> no error, but the `;` still split at the OUTER level, | |
| # so only part of it ran inside the sh -c. | |
| # `bash <path>` is a single word with no metacharacters, so eval cannot | |
| # mis-parse it. Path is relative to `server/`, which the step cd's into. | |
| playwright-seed-command: bash apps/openregister/tests/e2e/ci/seed.sh | |
| enable-coverage-guard: true | |
| enable-sbom: true |