Merge pull request #197 from ConductionNL/development

Release: merge development into beta

Author: rubenvdlinde

.coverage-baseline

@@ -0,0 +1 @@
+13.01

.editorconfig

@@ -0,0 +1,36 @@
+# https://editorconfig.org
+
+# SPDX-FileCopyrightText: 2019 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 4
+indent_style = tab
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.yml]
+indent_size = 2
+indent_style = space
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.svg]
+insert_final_newline = false
+
+[package*.json]
+indent_size = 2
+indent_style = space
+
+[build/psalm-baseline.xml]
+indent_size = 2
+indent_style = space
+
+[config/*config.php]
+indent_size = 2
+indent_style = space

.forgejo/workflows/pre-merge-check-strict.yaml

@@ -32,6 +32,10 @@ jobs:
           apt-get install -y --no-install-recommends \
             git curl ca-certificates gnupg jq unzip zip \
             libzip-dev libpng-dev python3
+          # Node is required by actions/checkout@v4 (a JS action) which runs
+          # inside this php:8.3-cli container; the stock image ships no node.
+          curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+          apt-get install -y --no-install-recommends nodejs
           docker-php-ext-install -j"$(nproc)" zip gd
           curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
 

.forgejo/workflows/tests.yml

@@ -75,6 +75,10 @@ jobs:
           apt-get install -y --no-install-recommends \
             git curl ca-certificates gnupg jq unzip zip \
             libzip-dev libpng-dev python3
+          # Node is required by actions/checkout@v4 (a JS action) which runs
+          # inside this php:8.3-cli container; the stock image ships no node.
+          curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+          apt-get install -y --no-install-recommends nodejs
           docker-php-ext-install -j"$(nproc)" zip gd
           curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
 
@@ -149,6 +153,10 @@ jobs:
           apt-get install -y --no-install-recommends \
             git curl ca-certificates gnupg jq unzip zip \
             libzip-dev libpng-dev python3
+          # Node is required by actions/checkout@v4 (a JS action) which runs
+          # inside this php:8.3-cli container; the stock image ships no node.
+          curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+          apt-get install -y --no-install-recommends nodejs
           docker-php-ext-install -j"$(nproc)" zip gd
           curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
 

.git-blame-ignore-revs

@@ -1,2 +1,16 @@
-# Retrofit annotation commit (opsx-annotate, 2026-05-24)
-e7a6be7bfd26417b65dbca481ff0468821434f61
+# Revisions to skip in `git blame`.
+#
+# Enable locally, once:
+#   git config blame.ignoreRevsFile .git-blame-ignore-revs
+#
+# GitHub reads this file automatically. Your terminal does not, until you run
+# the line above.
+#
+# Only ever add commits that change formatting and NOTHING else. A commit listed
+# here becomes invisible to blame, so a behaviour change hidden inside one would
+# be very hard to find later.
+
+# style: reformat with nextcloud/coding-standard — whitespace only
+# The fleet-wide move from a PEAR-derived PHPCS ruleset (4 spaces, next-line
+# braces) to Nextcloud's own standard (tabs, same-line braces).
+a78e00aa9f0e963156dc4c58277776c783837a2d

.github/dependabot.yml

@@ -1,7 +1,36 @@
 version: 2
+
+# ⚠️ `target-branch: development` is load-bearing, not cosmetic.
+#
+# Without it Dependabot targets the repository DEFAULT branch, which is `main`.
+# `main` is currently **729 commits behind `development`** and carries an
+# entirely different lockfile, so the PRs Dependabot raised there were:
+#
+#   • measured against a tree nobody develops on — the open alerts claimed
+#     5 critical / 51 high, while `development` actually had 1 critical /
+#     2 high (npm) and ZERO composer advisories; and
+#   • ungated — `code-quality.yml` on `main` is a stale, self-contained
+#     workflow, and PRs #368 and #369 collected **no check runs at all**
+#     beyond a neutral CodeQL. A dependency PR that nothing builds is exactly
+#     how this fleet previously shipped an unbuildable image for two months.
+#
+# Pointing Dependabot at `development` puts its PRs in front of the real
+# shared quality workflow (build, unit tests, SBOM, licence and audit legs).
+#
+# Trade-off, stated explicitly: GitHub only raises Dependabot SECURITY updates
+# against the default branch, so setting `target-branch` converts these to
+# VERSION updates. That is a net gain here — a version update on `development`
+# is verified and mergeable, whereas a security update on `main` was neither.
+# The alert list itself still tracks `main` and will only shrink as
+# `development` is released forward.
+#
+# Matches the fleet convention already in place on nldesign, decidesk,
+# openbuild, procest and shillinq.
+
 updates:
   - package-ecosystem: "npm"
     directory: "/"
+    target-branch: "development"
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 10
@@ -11,3 +40,34 @@ updates:
         - "*"
       exclude:
         - "@conduction/*"
+
+  # composer had no entry at all, so the only composer PRs this repo ever saw
+  # were security updates against `main` (e.g. #369, which bumped twig to
+  # 3.27.0 — a version `development` already had).
+  #
+  # default-days corrected 1 -> 2 and exclude added: this entry had a cooldown
+  # window but no first-party exclusion, so a fresh conduction/* release would
+  # have waited the same one day as any third-party package instead of being
+  # exempt — the fleet-wide floor gate-93 (composer-cooldown-config) enforces
+  # is 2 days plus a conduction/* exclude, matching the npm entry above's
+  # exclude and the fleet's `conduction/hydra-gates` / `conduction/coding-standard`
+  # first-party dependencies.
+  - package-ecosystem: "composer"
+    directory: "/"
+    target-branch: "development"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 2
+      include:
+        - "*"
+      exclude:
+        - "conduction/*"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    target-branch: "development"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5

.github/workflows/branch-protection.yml

@@ -8,4 +8,10 @@ on:
 
 jobs:
   protect:
-    uses: Conduction/.github/.github/workflows/branch-protection.yml@main
+    # The callee's `check-branch` job is a single bash comparison of
+    # `github.base_ref` against `github.head_ref` — no checkout, no network, no
+    # API call. It needs nothing, so it gets nothing. `{}` is an explicit empty
+    # grant, which is what satisfies actions/missing-workflow-permissions; an
+    # ABSENT block means "whatever the repo default is", which is the finding.
+    permissions: {}
+    uses: ConductionNL/.github/.github/workflows/branch-protection.yml@main