Release: merge development into beta

.github/workflows/beta-release.yaml

@@ -8,6 +8,8 @@ on:
 jobs:
   release-management:
     runs-on: ubuntu-latest
+    # Observed fleet-wide: n=26 runs, max 0.7 min; bounded loosely at 45 min because a spurious release failure is expensive
+    timeout-minutes: 45
     steps:
 
       - name: Checkout Code

.github/workflows/branch-protection.yml

@@ -0,0 +1,11 @@
+name: Branch Protection
+
+on:
+  pull_request:
+    branches: [main, beta]
+
+permissions: {}
+
+jobs:
+  branch-protection:
+    uses: ConductionNL/.github/.github/workflows/branch-protection.yml@main

.github/workflows/build-exapp.yaml

@@ -0,0 +1,62 @@
+name: Build and Push ExApp Docker Image
+
+on:
+  push:
+    branches:
+      - main
+      - beta
+    tags:
+      - 'v*'
+  pull_request:
+    branches:
+      - main
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: conductionnl/openzaak-exapp
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    # No successful runs observed yet (multi-arch docker build); bounded loosely at 30 min
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/code-quality.yml

@@ -0,0 +1,46 @@
+name: Code Quality
+
+on:
+  push:
+    branches: [main, beta, development, feature/**, bugfix/**, hotfix/**]
+  pull_request:
+    types: [opened, reopened]
+    branches: [main, beta, development]
+  workflow_dispatch:
+
+concurrency:
+  group: quality-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+# Permission CEILING for the called quality pipeline. GitHub statically
+# validates the called workflow's declared job permissions against this
+# grant — even for jobs that are disabled — so it must cover the maximum
+# any nested job declares: journeydoc-capture (contents+actions write),
+# update-baseline / features-extract (contents write), and the Quality
+# Report PR comment (issues / pull-requests write).
+permissions:
+  contents: write
+  actions: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  quality:
+    if: github.event_name != 'push' || github.event.created != true
+    uses: ConductionNL/.github/.github/workflows/quality.yml@main
+    with:
+      app-name: openzaak
+      # composer.json pins config.platform.php to 8.3
+      php-version: "8.3"
+      # PHP-only ExApp: no package.json, so all npm-side checks are off
+      # (enable-npm gates the npm legs of security/license; enable-frontend
+      # gates Vue Quality and custom frontend checks).
+      enable-npm: false
+      enable-frontend: false
+      # The SBOM job invokes `composer CycloneDX:make-sbom`, which this repo
+      # does not ship — enable once cyclonedx/cyclonedx-php-composer is added
+      # to require-dev.
+      enable-sbom: false
+      # No openspec/specs and no docs/features.json yet — the features check
+      # would fail on every PR comparing "" against "[]".
+      enable-features-extract: false

.github/workflows/pull-request-from-branch-check.yaml

@@ -0,0 +1,34 @@
+name: Branch Protection
+
+on:
+  pull_request:
+    branches:
+      - main
+      - beta
+
+jobs:
+  check-branch:
+    runs-on: ubuntu-latest
+    # Observed fleet-wide: n=123 runs, max 0.1 min
+    timeout-minutes: 10
+    steps:
+      - name: Check branch
+        run: |
+          TARGET="${{ github.base_ref }}"
+          SOURCE="${{ github.head_ref }}"
+
+          if [[ "$TARGET" == "main" ]]; then
+            if [[ "$SOURCE" != "beta" ]] && ! [[ "$SOURCE" =~ ^hotfix ]]; then
+              echo "Error: Pull requests to main must come from 'beta' or a branch starting with 'hotfix'"
+              echo "Source branch: $SOURCE"
+              exit 1
+            fi
+          elif [[ "$TARGET" == "beta" ]]; then
+            if [[ "$SOURCE" != "development" ]] && ! [[ "$SOURCE" =~ ^hotfix ]]; then
+              echo "Error: Pull requests to beta must come from 'development' or a branch starting with 'hotfix'"
+              echo "Source branch: $SOURCE"
+              exit 1
+            fi
+          fi
+
+          echo "Branch check passed: $SOURCE -> $TARGET"

.github/workflows/pull-request-lint-check.yaml

@@ -0,0 +1,35 @@
+name: Lint Check
+
+on:
+  pull_request:
+    branches:
+      - development
+      - main
+
+jobs:
+  lint-check:
+    runs-on: ubuntu-latest
+    # Observed fleet-wide: n=176 runs, median 0.6 min, max 1.4 min
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Check for package.json
+        id: has_pkg
+        run: |
+          if [ -f package.json ]; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::No package.json found at repo root; lint-check is a no-op for this repo."
+          fi
+
+      - name: Install dependencies
+        if: steps.has_pkg.outputs.exists == 'true'
+        run: npm i
+
+      - name: Linting
+        if: steps.has_pkg.outputs.exists == 'true'
+        run: npm run lint

.github/workflows/push-development-to-beta.yaml

@@ -0,0 +1,46 @@
+name: Create PR to Beta
+
+permissions:
+  contents: write
+  pull-requests: write
+
+on:
+  push:
+    branches:
+      - development
+
+jobs:
+  create-pr:
+    runs-on: ubuntu-latest
+    # Observed fleet-wide: n=152 runs, max 5.6 min
+    timeout-minutes: 20
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Create or update PR to beta
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Check if beta branch exists
+          if ! git ls-remote --heads origin beta | grep -q beta; then
+            echo "Beta branch does not exist yet. Creating from development..."
+            git push origin origin/development:refs/heads/beta
+          fi
+
+          # Check if a PR already exists
+          EXISTING_PR=$(gh pr list --base beta --head development --state open --json number --jq '.[0].number' || echo "")
+
+          if [ -n "$EXISTING_PR" ] && [ "$EXISTING_PR" != "null" ]; then
+            echo "PR #$EXISTING_PR already exists, it will auto-update with new commits"
+          else
+            gh pr create \
+              --base beta \
+              --head development \
+              --title "Release: merge development into beta" \
+              --body "Automated PR to sync development changes to beta for beta release.
+
+          Merging this PR will trigger the beta release workflow."
+          fi

.github/workflows/release-workflow.yaml

@@ -15,6 +15,8 @@ on:
 jobs:
   release-management:
     runs-on: ubuntu-latest
+    # Observed fleet-wide: n=26 runs, max 0.7 min; bounded loosely at 45 min because a spurious release failure is expensive
+    timeout-minutes: 45
     steps:
 
       - name: Checkout Code