Release: merge development into beta - #11
Open
github-actions[bot] wants to merge 35 commits into
Open
Conversation
Convert from PHP Nextcloud app to ExApp with Docker-based deployment. Add standardized CI/CD workflows for unstable release, dev-to-beta PR creation, branch protection, and lint checks. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Enforce that PRs to main can only come from beta or hotfix branches, and PRs to beta can only come from development or hotfix branches. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: Add controller config, fix entrypoint and heartbeat - Add controller.toml with minimal OpenTalk controller configuration - Update Dockerfile to include controller.toml and fix APP_PORT default - Switch entrypoint from uvicorn to python3 ex_app/lib/main.py - Return HTTP 200 from heartbeat during init wait instead of 503 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: Add PHPCS/PHPMD/Psalm quality tooling Add phpcs.xml, phpmd.xml, psalm.xml, custom NamedParametersSniff, and update composer.json with quality dependencies. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Replace existing license (Apache-2.0/AGPL) with EUPL-1.2 across all metadata files: LICENSE, appinfo/info.xml, composer.json, package.json. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The Nextcloud App Store schema does not accept EUPL-1.2 as a valid licence value, causing all release uploads to fail with HTTP 400. Revert to 'agpl' which is in the accepted set. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…loading Enable seamless OpenTalk video conferencing inside a Nextcloud iframe by pre-loading Keycloak tokens server-side, bypassing CSP-blocked OIDC redirects. Adds token proxy endpoint, TCP proxy for OIDC issuer consistency, and comprehensive architecture documentation with Mermaid diagrams. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
feat: Keycloak SSO iframe integration
Aligns the composer platform pin with the runtime constraint
('require.php' bumped to ^8.3 fleet-wide yesterday). Keeps composer's
resolver consistent — it'll pick package versions assuming PHP 8.3 is
the target runtime, which matches what the container (PHP 8.3.30) and
CI matrices already use.
Part of the fleet-wide PHP 8.3 sweep.
Brings the composer require.php constraint in line with the runtime the container + CI already use (PHP 8.3). Drops formal support for PHP 8.1 and 8.2. Several vendor packages (e.g. azjezz/psl@4.3.0) use PHP 8.3 typed class constants, making the codebase functionally 8.3-only already. Part of the fleet-wide PHP 8.3 sweep.
…ling (#10) Aligns appinfo/info.xml with the fleet canonical: - <php min-version="8.3"> — matches the composer require.php constraint (^8.3 fleet-wide) - <nextcloud min-version="28" max-version="34"> — converge the fleet on one NC support range - <licence>agpl</licence> — fix the casing/value drift (fleet had agpl / eupl / EUPL-1.2 / AGPL-3.0-or-later — 4 spellings). Stays on "agpl" workaround per the EUPL store-listing pattern; switch to "EUPL-1.2" once NC 34 is the fleet floor (ConductionNL/.github#98). Per-app fields (<id>, <name>, <description>, <version>, etc.) are preserved. Drift surfaced in https://github.com/ConductionNL/nextcloud-app-template/blob/development/docs/fleet-drift-deeper.md#4-appinfoinfoxml--significant-drift
NC renders SVGs via Imagick where stroke-based icons with currentColor are invisible. Replace stroke-only video icon with filled path using fill: #fff CSS class.
…alization' (#2) from chore/licence-eupl into development
Nextcloud 34's app-management page inlines the raw app.svg and recolors it via 'fill: currentcolor' on the <svg> element. A fill carried on <path>/<style>/class beats the inherited value, so the icon rendered white-on-white and vanished from the list. Moving the fill to the <svg> element lets Nextcloud recolor the icon; visuals are unchanged everywhere the icon is shown on a dark/colored surface.
…t' (#3) from fix/app-icon-svg-level-fill into development
Makes psalm/phpstan/phpmd real gates instead of always exiting 0.
test:unit and test:all ended in ./vendor/bin/phpunit --colors=always || echo 'No PHP test suite in this repo ... skipping...' so phpunit's exit status was discarded unconditionally. The message was true today (this repo is a Python ExApp wrapper with no PHP test suite) but the mechanism was not conditional on it: any real test failure, now or after a test suite is added, would have been swallowed the same way. Replaced with a guard on the actual precondition, so an absent suite is a visible stated fact and a present-but-failing suite fails the gate: if [ -f phpunit.xml ] || [ -f phpunit.xml.dist ]; then ./vendor/bin/phpunit --colors=always; else echo 'SKIPPED: no phpunit.xml ...'; fi Positive control, measured on this tree in a PHP 8.3.32 container with a freshly installed vendor/, injecting a phpunit.xml plus one deliberately failing test: old composer.json + failing test -> check:strict exit 0 (swallowed) new composer.json + failing test -> check:strict exit 1, naming test:all new composer.json, test removed -> check:strict exit 0, loud SKIPPED Tooling only.
Wires the repo to the ConductionNL/.github reusable workflows so the two org-required check contexts are reported on every PR.
…paced code (#18) Every Conduction repo enables rulesets/design.xml/DevelopmentCodeFragment, and it has never reported anything in any of them. The cause is a config gap, not a phpmd bug: PDepend resolves an unqualified call inside a namespaced file to the current-namespace-qualified image, so `var_dump($x)` written inside `namespace OCA\MyApp\Service;` reaches the rule as `OCA\MyApp\Service\var_dump` and never matches the `unwanted-functions` list. All of our production PHP is namespaced, so with the default the rule is dead. The rule's own `ignore-namespaces` property is the switch. This mirrors the configuration already merged in openregister (ConductionNL/openregister#2286). Proof, phpmd 2.15.0 / PHP 8.3.32, against this repo's own phpmd.xml: namespaced probe class calling var_dump() -> exit 2, DevelopmentCodeFragment same class with the call removed -> exit 0, no finding Before the change the identical namespaced probe exited 0. Blast radius on this repo: measured 0 new findings over the scanned path on the base branch, with a per-run positive control (dropping the namespaced probe into the same extracted tree does produce exit 2, so the zero is a true zero). Nothing is baselined or suppressed here. Note: this repo does not run the shared quality workflow, so phpmd is not executed in CI here. This change fixes `composer check:strict` when run locally and stops the broken configuration propagating; it does not by itself add a CI gate.
contents: read plus the issues/pull-requests write the Quality Report PR comment needs (resolves CodeQL actions/missing-workflow-permissions).
The caller's permissions block is a static ceiling for every job in the called quality.yml — including disabled ones — so it must cover the widest declared grant (journeydoc/update-baseline/features-extract need contents/actions write; the Quality Report comment needs issues/pull-requests write). Also satisfies CodeQL actions/missing-workflow-permissions and cancels superseded runs.
All 7 CI jobs ran unbounded, so a hung runner could burn the full 6-hour GitHub default before failing. Each job now carries a timeout-minutes sibling of runs-on, sized from observed fleet-wide durations (successful + failed executions, skipped excluded): - lint-check (15): n=176, median 0.6 min, max 1.4 min - check-branch (10): n=123, max 0.1 min - create-pr (20): n=152, max 5.6 min - release-management (45): n=26, max 0.7 min - bounded loosely because a spurious release failure is expensive - build (30): no observed runs; docker build Bounds are deliberately loose: a timeout that fires under normal runner contention turns a slow run into a phantom defect. Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
ci: align workflows with fleet standard (ConductionNL/.github)
…epo with no PHP tests (#21) This is a Python ExApp with no phpunit.xml and no PHP test suite. The test:unit/test:all scripts echoed SKIPPED and exited 0, and the check chains counted that as a passing test leg. Removed; the check chains now state plainly that they are static analysis only.
…niff @license tag The tag read `@license <eupl-url> EUPL-1.2` — URL first, SPDX identifier second. Hydra gate-28 (license-triangle) reads the licence with `awk '{print $3}'`, i.e. the FIRST token after @license, so this shape resolves to the URL and compares unequal to composer.json's "EUPL-1.2". Swapped to the fleet shape: * @license EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12 The licence named is unchanged — this is a field-order fix, not a relicence. Note: this repo has no lib/ directory, so gate-28 examines zero files here and its PASS is vacuous. Verified against a synthetic control that the URL-first shape does fail gate-28 when the same file sits under lib/. Static analysis (lint, phpcs, phpmd, psalm, phpstan) clean before and after. This repo has no test suite.
…tion-2026-08-05 chore(license): put the SPDX identifier first in the NamedParametersSniff @license tag
This repo does not set nextcloud-test-refs, so it inherits the shared default of [stable31, stable32]. min-version is enforced at install time, so a 32 floor makes occ app:enable refuse on stable31 and the e2e seed fails with "is not installed or enabled". The premise for the 32 floor is also gone: openregister#2372 removed every eager reference to its ContextChat provider, so that class is only loaded behind interface_exists() guards, and openregister#2380 restored its own 28 floor on that evidence.
`nextcloud/ocp` is the API-surface stub that static analysis reads. It was
pinned at `^31.0` while `appinfo/info.xml` declares support up to Nextcloud
34 — a major BELOW the declared minimum. Psalm and PHPStan were therefore
analysing this app against Nextcloud 31: nothing added in 32/33/34 was
visible to them, and — the part that actually bites — nothing REMOVED in
32/33/34 could be reported either.
That is exactly why the NC 34 removal of `\OC::$server` needed a
hand-written PHPCS sniff in this fleet. The type checker was looking at
NC 31, where `\OC::$server` still exists, so it had nothing to complain
about. A stub pinned below the declared maximum does not make the analysis
lenient — it makes it blind in the one direction that matters for a version
bump.
Changes:
- composer.json: nextcloud/ocp `^31.0` -> `^34.0`
- appinfo/info.xml: `<nextcloud min-version="30" max-version="34"/>` ->
`min-version="32"`
- composer.lock regenerated: nextcloud/ocp v31.0.9 -> v34.0.2
The lock regeneration is not optional and it is the single thing that broke
the equivalent rollout on the core apps. Changing `composer.json` alone
makes `composer install` exit 4 with "package nextcloud/ocp is in the lock
file as v31.0.9 but that does not satisfy your constraint ^34.0", and every
PHP job fails before a single tool runs.
Verified on this branch, both arms measured:
- stale-lock control (composer.json ^31.0 + lock v34.0.2):
`composer install --dry-run` exits 4 with exactly that message.
- this branch: `composer install --dry-run` exits 0, 0 constraint conflicts.
- `composer.lock` read back: nextcloud/ocp = v34.0.2.
`nextcloud/ocp` v34 adds `psr/http-client` and `psr/http-message` to the
lock; that is the whole of the rest of the lock diff.
No `nextcloud-test-refs` change. This repo is a Python ExApp: there is no
`lib/`, no PHP application source at all (the only PHP in the tree is
`analysis-bootstrap.php` and `phpcs-custom-sniffs/`), no `phpunit.xml` and
no `tests/`. `enable-phpunit` defaults to false in the shared workflow and
this repo does not set it, so the PHPUnit matrix — the only consumer of
`nextcloud-test-refs`, along with the newman / playwright / journeydoc jobs
which are likewise off — never runs. Setting the input here would be dead
configuration, so it is deliberately left absent.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated PR to sync development changes to beta for beta release.
Merging this PR will trigger the beta release workflow.