From caa150640a304c23cbb9c239f15eba534a53a068 Mon Sep 17 00:00:00 2001
From: Remko <remko@conduction.nl>
Date: Mon, 3 Aug 2026 09:54:35 +0200
Subject: [PATCH 1/3] ci: onboard onto fleet-standard CI workflows

Wires the repo to the ConductionNL/.github reusable workflows so the
two org-required check contexts are reported on every PR.
---
 .github/workflows/branch-protection.yml | 11 ++++++++
 .github/workflows/code-quality.yml      | 34 +++++++++++++++++++++++++
 2 files changed, 45 insertions(+)
 create mode 100644 .github/workflows/branch-protection.yml
 create mode 100644 .github/workflows/code-quality.yml

diff --git a/.github/workflows/branch-protection.yml b/.github/workflows/branch-protection.yml
new file mode 100644
index 0000000..7ef08ce
--- /dev/null
+++ b/.github/workflows/branch-protection.yml
@@ -0,0 +1,11 @@
+name: Branch Protection
+
+on:
+  pull_request:
+    branches: [main, beta]
+
+permissions: {}
+
+jobs:
+  branch-protection:
+    uses: ConductionNL/.github/.github/workflows/branch-protection.yml@main
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
new file mode 100644
index 0000000..e88a23e
--- /dev/null
+++ b/.github/workflows/code-quality.yml
@@ -0,0 +1,34 @@
+name: Code Quality
+
+on:
+  push:
+    branches: [main, beta, development, feature/**, bugfix/**, hotfix/**]
+  pull_request:
+    types: [opened, reopened]
+    branches: [main, beta, development]
+  workflow_dispatch:
+
+concurrency:
+  group: quality-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    if: github.event_name != 'push' || github.event.created != true
+    uses: ConductionNL/.github/.github/workflows/quality.yml@main
+    with:
+      app-name: opentalk
+      # composer.json pins config.platform.php to 8.3
+      php-version: "8.3"
+      # PHP-only ExApp: no package.json, so all npm-side checks are off
+      # (enable-npm gates the npm legs of security/license; enable-frontend
+      # gates Vue Quality and custom frontend checks).
+      enable-npm: false
+      enable-frontend: false
+      # The SBOM job invokes `composer CycloneDX:make-sbom`, which this repo
+      # does not ship — enable once cyclonedx/cyclonedx-php-composer is added
+      # to require-dev.
+      enable-sbom: false
+      # No openspec/specs and no docs/features.json yet — the features check
+      # would fail on every PR comparing "" against "[]".
+      enable-features-extract: false

From 4e05053b00b864ae6283baabd13867c3e9a296be Mon Sep 17 00:00:00 2001
From: Remko <remko@conduction.nl>
Date: Mon, 3 Aug 2026 11:47:08 +0200
Subject: [PATCH 2/3] ci(quality): add least-privilege permissions block

contents: read plus the issues/pull-requests write the Quality Report
PR comment needs (resolves CodeQL actions/missing-workflow-permissions).
---
 .github/workflows/code-quality.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
index e88a23e..34c19a2 100644
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -12,6 +12,14 @@ concurrency:
   group: quality-${{ github.head_ref || github.ref_name }}
   cancel-in-progress: true
 
+# Least privilege for the called quality pipeline: the Quality Report job
+# posts a sticky PR comment (issues/pull-requests write); everything else
+# only reads the checkout.
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
 jobs:
   quality:
     if: github.event_name != 'push' || github.event.created != true

From f571ffc8bd0f2323a1bceb30f94898543e0c4b83 Mon Sep 17 00:00:00 2001
From: Remko <remko@conduction.nl>
Date: Mon, 3 Aug 2026 13:33:17 +0200
Subject: [PATCH 3/3] ci(quality): add explicit permission ceiling and
 concurrency group
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The caller's permissions block is a static ceiling for every job in
the called quality.yml — including disabled ones — so it must cover
the widest declared grant (journeydoc/update-baseline/features-extract
need contents/actions write; the Quality Report comment needs
issues/pull-requests write). Also satisfies CodeQL
actions/missing-workflow-permissions and cancels superseded runs.
---
 .github/workflows/code-quality.yml | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
index 34c19a2..1330004 100644
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -12,11 +12,15 @@ concurrency:
   group: quality-${{ github.head_ref || github.ref_name }}
   cancel-in-progress: true
 
-# Least privilege for the called quality pipeline: the Quality Report job
-# posts a sticky PR comment (issues/pull-requests write); everything else
-# only reads the checkout.
+# Permission CEILING for the called quality pipeline. GitHub statically
+# validates the called workflow's declared job permissions against this
+# grant — even for jobs that are disabled — so it must cover the maximum
+# any nested job declares: journeydoc-capture (contents+actions write),
+# update-baseline / features-extract (contents write), and the Quality
+# Report PR comment (issues / pull-requests write).
 permissions:
-  contents: read
+  contents: write
+  actions: write
   issues: write
   pull-requests: write