fix(ci): least-privilege workflow permissions + drop a dead string replace — clears 10 CodeQL alerts #711
Triggered via pull request
August 19, 2026 20:39
rubenvdlinde
Status
Success
Total duration
2h 21m 15s
Artifacts
24
code-quality.yml
on: pull_request
Matrix: quality / security
quality
/
Nextcloud test matrix
14s
quality
/
Frontend Build
1m 44s
Matrix: quality / frontend-checks
Matrix: quality / license
Matrix: quality / php-quality
Matrix: quality / vue-quality
quality
/
Nextcloud API check (app:check-code)
quality
/
REUSE compliance
14s
quality
/
info.xml lint
1m 17s
quality
/
Frontend Tests (unit)
31s
quality
/
Coverage Baseline Protection
8s
quality
/
Features Check
10s
quality
/
Features Extract
Matrix: quality / phpunit
quality
/
Integration Tests (Newman)
quality
/
Journeydoc Capture (screenshots)
0s
quality
/
Quality Report
31s
Annotations
43 warnings and 1 notice
|
quality / REUSE compliance
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / REUSE compliance
REUSE reported findings. Not blocking yet — set reuse-blocking: true once this app ships a REUSE.toml and a LICENSES/ directory.
|
|
quality / Nextcloud test matrix
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, icewind1991/nextcloud-version-matrix@8a7bac6300b2f0f3100088b297995a229558ddba. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / Vue Quality (stylelint)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / PHP Quality (phpmetrics)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / Frontend Tests (unit)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / info.xml lint
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / Frontend Check (test:l10n)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / Frontend Check (format)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / PHP Quality (phpmd)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / PHP Quality (psalm)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / PHP Quality (phpstan)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / Vue Quality (eslint)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / Vue Quality (eslint):
src/components/PaginationComponent.vue#L272
Syntax error in namepath: page-size-changed
|
|
quality / Vue Quality (eslint):
src/components/PaginationComponent.vue#L256
The "page-changed" event has been triggered but not declared on `emits` option
|
|
quality / Vue Quality (eslint):
src/components/PaginationComponent.vue#L253
Syntax error in namepath: page-changed
|
|
quality / Vue Quality (eslint):
src/components/ContactpersonenList.vue#L700
Missing JSDoc @PARAM "contactpersoon" description
|
|
quality / Vue Quality (eslint):
src/components/ContactpersonenList.vue#L582
Missing JSDoc @PARAM "contactpersoon" description
|
|
quality / Vue Quality (eslint):
src/components/CollapsibleSection.vue#L228
Boolean prop should only be defaulted to false
|
|
quality / Vue Quality (eslint):
src/components/AlwaysVisibleSection.vue#L264
The "refresh" event has been triggered but not declared on `emits` option
|
|
quality / Vue Quality (eslint):
src/components/AlwaysVisibleSection.vue#L255
The "save" event has been triggered but not declared on `emits` option
|
|
quality / Vue Quality (eslint):
src/components/AlwaysVisibleSection.vue#L206
Boolean prop should only be defaulted to false
|
|
quality / Vue Quality (eslint):
src/App.vue#L252
Unexpected inline JSDoc tag. Did you mean to use {@nextcloud}, \@nextcloud, or `@nextcloud`?
|
|
quality / PHP Quality (lint)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / Features Check
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / PHP Quality (phpcs)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / License (composer)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / Security (composer)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / Frontend Check (check:vue-demi)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / Frontend Check (check:manifest)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / Coverage Baseline Protection
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / Security (npm)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / License (npm)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / Frontend Build
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / PHPUnit (PHP 8.4, NC stable34, pgsql)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / PHPUnit (PHP 8.4, NC stable32, pgsql)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / PHPUnit (PHP 8.3, NC stable33, pgsql)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / PHPUnit (PHP 8.3, NC stable32, pgsql)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / PHPUnit (PHP 8.3, NC stable34, pgsql)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / PHPUnit (PHP 8.4, NC stable33, pgsql)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / E2E Tests (Playwright)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/checkout@v4, actions/download-artifact@v4, actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / Hydra Gates
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / Quality Report
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@v4, actions/github-script@v7, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
quality / PHPUnit (PHP 8.3, NC stable34, pgsql)
scripts/coverage-guard.php predates --deletion-neutral, so deleting well-tested dead code will still read as a coverage drop. Copy the canonical version from ConductionNL/.github at quality-config/coverage-guard.php to pick it up.
|
Artifacts
Produced during runtime
| Name | Size | Digest | |
|---|---|---|---|
|
license-report-composer
|
4.21 KB |
sha256:ae9c8b48a33076ee19255d7cdd53d5ee0f39cb1194792ad3f1cea08c74b618ef
|
|
|
license-report-npm
|
14.7 KB |
sha256:a08d6c1d5b31ec7624de9840f892283117eb3fdd52fe41a8791da5a7a1d4b500
|
|
|
quality-report
|
28.8 KB |
sha256:074d035abc077ee74f7951e359ca6a554075489d554836964b0c47d81771e124
|
|
|
result-frontend-build
|
160 Bytes |
sha256:079db44ca06cf0315c9cf86bb55a79796c20814c08b93a5d07ec26487ccc663a
|
|
|
result-frontend-check-0
|
160 Bytes |
sha256:10568a981fba9f341c1fc80cceda74d81ee80c7eb5d4edcc3becd4da0ed2a649
|
|
|
result-frontend-check-1
|
160 Bytes |
sha256:66b4b4d0f5eefe9b68c981dfe3afb67c79ed5a1bb098ae8941df4aab021c7eb9
|
|
|
result-frontend-check-2
|
150 Bytes |
sha256:6f3216d898135f53a38310e9e2ce9564ea30a6b5fe7b89167cae3fc550c91a2b
|
|
|
result-frontend-check-3
|
144 Bytes |
sha256:6b1be7caf443e8341f0313e71e4a2fa010920e890ce09a5b4a9f2ce4f365f7db
|
|
|
result-frontend-tests
|
160 Bytes |
sha256:1d7c69a291221c8c8a50ae246b31a86811abf2a97823372c57f66e9533ae519c
|
|
|
result-hydra-gates
|
154 Bytes |
sha256:c6e26a1b0b1e2a6476ff4f8e0f0b69619e57f7f571c051273dc040399237eaff
|
|
|
result-info-xml
|
148 Bytes |
sha256:3af0ecdc73ad221c568bea48e8a3e399ebeca83a586b0438a43af85186c984d8
|
|
|
result-license-composer
|
148 Bytes |
sha256:6d13a704d2befb7305b660bc5a0b695b0115736458653e7fa799e0c3d03b979b
|
|
|
result-license-npm
|
138 Bytes |
sha256:249c3fb649b26f23fe8f54416a4011583791028380c2ee4123784eef763ffd35
|
|
|
result-php-quality-lint
|
140 Bytes |
sha256:e2fb679e3156f48c8b6fc63cda1a3415c94fc55b2d9eb8508261f197286da44e
|
|
|
result-php-quality-phpcs
|
142 Bytes |
sha256:c91b57cf620ab6d277636d6bf213548900729f9fcf1c2caded9bfe7928619c2a
|
|
|
result-php-quality-phpmd
|
142 Bytes |
sha256:6ecbfbcab1ae166e9f9be45883d2746e6f089788ae7f69763d575916185a527f
|
|
|
result-php-quality-phpmetrics
|
152 Bytes |
sha256:85ac9c0e44747889ba5673270b03329792d5aa4e085b7cae393978d459a6cefc
|
|
|
result-php-quality-phpstan
|
146 Bytes |
sha256:d8bab1a05b1758644830d0b64f6889383ed0c61294cfdfa0e5ab237d46d7c304
|
|
|
result-php-quality-psalm
|
142 Bytes |
sha256:9a1e30c507ae57688e40a42e780025b6eb1734227a9e319acbec5ec8b5fdcf92
|
|
|
result-reuse
|
142 Bytes |
sha256:ba4034bb013b35c4b80d95c967e769de42985cfcb725b07ee8fa9783f1ca5588
|
|
|
result-security-composer
|
148 Bytes |
sha256:3c103c74c5d5d607a0be7644198c5f97804156a3f80404ef401791103c2b40c7
|
|
|
result-security-npm
|
138 Bytes |
sha256:bb77b577ebb51ea61091200a50ce7c8f9b2ea5168169215e99ed174164fbc121
|
|
|
result-vue-quality-eslint
|
144 Bytes |
sha256:d04826313a601536a696d7c82214bb2f0b807cc86594ff8bad0afc911da57574
|
|
|
result-vue-quality-stylelint
|
150 Bytes |
sha256:0ac8c57bc3f38c17d9e369640e04aa06bd8cfc2d6da965aacb4ea179a4a40cec
|
|