Release: merge development into beta

.github/workflows/code-quality.yml

@@ -46,6 +46,7 @@ on:
 
 jobs:
   quality:
+    if: (github.event_name != 'pull_request' || github.head_ref != 'development')
     uses: ConductionNL/.github/.github/workflows/quality.yml@main
     with:
       # MUST equal <id>versioniq</id> in appinfo/info.xml, character for

appinfo/info.xml

@@ -7,7 +7,7 @@
 	<description>> ⚠️ **Active development — not for production use yet.** This app is under active development. Although it may carry a stable release status, **please do not use it in production environments before 12 June 2026.** See [conduction.nl/apps](https://conduction.nl/apps) for release planning and what this app does.
 
 Versioniq gives Nextcloud administrators the ability to roll back apps to previous versions or install specific newer versions. Essential for debugging, testing compatibility, and recovering from broken updates.</description>
-	<version>1.4.5-unstable.20260831045210</version>
+	<version>1.4.7-unstable.20260831193354</version>
 	<licence>EUPL-1.2</licence>
 	<author mail="info@conduction.nl" homepage="https://conduction.nl">Conduction B.V.</author>
 	<namespace>Versioniq</namespace>

eslint.config.mjs

@@ -144,11 +144,32 @@ export default [
 			'no-console': 'off',
 			'n/no-process-exit': 'off',
 			'n/hashbang': 'off',
-			// `_` / `__` as a deliberate throwaway binding — `catch (_)`, a
-			// discarded destructuring slot. Narrow on purpose: the pattern matches
-			// UNDERSCORES ONLY, so a real name that happens to start with `_` is
-			// still reported. v9 drives plain `.js` through the CORE rule (the
-			// `@typescript-eslint` swap is per-file-type), so it is set here.
+			// Tests import devDependencies by definition; this rule is about what
+			// ships in the published package, which tests/ never does.
+			'n/no-unpublished-import': 'off',
+		},
+	},
+
+	{
+		// `_` / `__` as a deliberate throwaway binding — `catch (_)`, a discarded
+		// destructuring slot. Narrow on purpose: the pattern matches UNDERSCORES
+		// ONLY, so a real name that happens to start with `_` is still reported.
+		//
+		// 🔴 `.js` / `.mjs` ONLY, NOT `.ts`. The CORE rule is not TypeScript-aware:
+		// applied to a `.ts` file it reads the parameter NAMES inside a function
+		// TYPE as bindings and reports them unused. Measured on humaniq —
+		//
+		//   t?: (app: string, key: string) => string
+		//
+		// produced four `no-unused-vars` errors for `app` and `key`, which are
+		// documentation, not variables. The same mis-scoping made every unused
+		// `catch (e)` in a `.ts` spec report TWICE, once per rule.
+		//
+		// v9 already turns the core rule off for `.ts` and drives
+		// `@typescript-eslint/no-unused-vars` instead; naming `.ts` here switched
+		// it back on. TypeScript files are handled by the block below.
+		files: ['tests/**/*.js', 'tests/**/*.mjs'],
+		rules: {
 			'no-unused-vars': [
 				'error',
 				{
@@ -165,12 +186,116 @@ export default [
 					ignoreRestSiblings: true,
 				},
 			],
-			// Tests import devDependencies by definition; this rule is about what
-			// ships in the published package, which tests/ never does.
-			'n/no-unpublished-import': 'off',
 		},
 	},
 
+	{
+		// The TypeScript half of the block above. Same intent, same patterns, on
+		// the rule that actually understands the language: it knows a name inside
+		// a function type is not a binding, so type annotations stay quiet while a
+		// genuinely dead local is still reported.
+		files: ['tests/**/*.ts', 'tests/**/*.tsx'],
+		rules: {
+			'@typescript-eslint/no-unused-vars': [
+				'error',
+				{
+					varsIgnorePattern: '^_+$',
+					caughtErrors: 'all',
+					caughtErrorsIgnorePattern: '^_+$',
+					argsIgnorePattern: '^_',
+					ignoreRestSiblings: true,
+				},
+			],
+		},
+	},
+
+	{
+		// 🔴 Node-side CLI tooling under `scripts/`, which is COMMONJS. Flat
+		// config defaults every `.js` to ESM with browser-ish globals, so without
+		// this block eslint reports the CommonJS wrapper itself as undefined
+		// identifiers. Measured on this app: 52 of the 233 errors under
+		// `tests/` + `scripts/` were `no-undef`, ALL of them in `scripts/`, and
+		// all five names were the environment rather than a typo — `process` 23,
+		// `require` 20, `__dirname` 6, `__filename` 2, `module` 1.
+		//
+		// This is describing the environment, not relaxing a rule, and it is the
+		// same argument the test-globals block below makes: declaring them keeps
+		// `no-undef` able to do its real job, which is catching a genuinely
+		// misspelled identifier. Suppressing the rule instead would bury that.
+		//
+		// `no-console` is off because printing its report is what a CLI checker
+		// is FOR.
+		//
+		// 🔴 NO `n/*` ENTRIES HERE, DELIBERATELY. `eslint-plugin-n` is NOT
+		// registered for these files under eslint 10 + @nextcloud/eslint-config
+		// 9, so `'n/no-process-exit': 'off'` would be dead config that reads as
+		// if it were doing something. Measured both ways on this app: 0 `n/`
+		// findings with the entries and 0 without.
+		//
+		// What DID report was the opposite — four `scripts/*.js` carried
+		// `/* eslint-disable n/no-process-exit */` and `/* eslint-disable
+		// n/shebang */` left over from the eslintrc era, and an inline disable
+		// naming an unregistered plugin is itself an error ("Definition for rule
+		// 'n/shebang' was not found"). Those 8 comments are removed; do not add
+		// `n/*` rules back to replace them.
+		//
+		// ⚠️ `.js` and `.cjs` ONLY. A `scripts/*.mjs` is genuinely ESM and must
+		// keep the default `sourceType`, or `import` stops parsing there.
+		files: ['scripts/**/*.js', 'scripts/**/*.cjs'],
+		languageOptions: {
+			sourceType: 'commonjs',
+			globals: {
+				require: 'readonly',
+				module: 'writable',
+				exports: 'writable',
+				process: 'readonly',
+				__dirname: 'readonly',
+				__filename: 'readonly',
+				console: 'readonly',
+				Buffer: 'readonly',
+				global: 'readonly',
+				URL: 'readonly',
+				TextEncoder: 'readonly',
+				TextDecoder: 'readonly',
+			},
+		},
+		rules: {
+			'no-console': 'off',
+		},
+	},
+
+	{
+		// The ESM half of the block above. A `scripts/*.mjs` is genuinely a module
+		// and must keep the default `sourceType`, so it gets Node's globals but
+		// none of the CommonJS wrapper. Measured: `process` reported undefined 2x
+		// in hermiq's generate-opengemeenten-icons.mjs and 4x in openregister's
+		// l10n/runtime-check.mjs, which the `.js`/`.cjs` block deliberately does
+		// not match.
+		files: ['scripts/**/*.mjs', 'tests/**/*.mjs'],
+		languageOptions: {
+			globals: {
+				process: 'readonly',
+				console: 'readonly',
+				Buffer: 'readonly',
+				global: 'readonly',
+				URL: 'readonly',
+				TextEncoder: 'readonly',
+				TextDecoder: 'readonly',
+			},
+		},
+		rules: {
+			'no-console': 'off',
+		},
+	},
+
+	{
+		// eslint must not try to PARSE a shell script. `tests/e2e/seed.test.sh`
+		// matches the `**/*.test.*` glob some presets use, and eslint then reads
+		// it as JavaScript and reports "Parsing error: Unexpected character" —
+		// a finding about a file it should never have opened.
+		ignores: ['**/*.sh', '**/*.bash'],
+	},
+
 	{
 		// Test globals. Several apps keep their spec files INSIDE `src/`, which the
 		// lint script scans, and neither `@nextcloud/eslint-config` nor the runner

lib/Service/Source/AppStoreSource.php

@@ -16,6 +16,7 @@
 use OCA\Versioniq\AppInfo\Application;
 use OCA\Versioniq\Service\Advisory\AdvisorySourceInterface;
 use OCP\Http\Client\IClientService;
+use OCP\IAppConfig;
 use OCP\IConfig;
 use OCP\L10N\IFactory;
 use Throwable;
@@ -60,6 +61,7 @@ class AppStoreSource implements SourceInterface, AdvisorySourceInterface {
 	public function __construct(
 		private IClientService $clientService,
 		private IConfig $config,
+		private IAppConfig $appConfig,
 		private IFactory $l10nFactory,
 	) {
 	}
@@ -243,7 +245,7 @@ private function fetchAppPayload(string $appId): ?array {
 	 */
 	private function readCachedPayload(string $appId, bool $ignoreTtl): ?array {
 		if (!$ignoreTtl) {
-			$cachedAt = (int)$this->config->getAppValue(
+			$cachedAt = (int)$this->appConfig->getValueString(
 				Application::APP_ID,
 				self::PAYLOAD_CACHE_TS_PREFIX . $appId,
 				'0',
@@ -253,7 +255,7 @@ private function readCachedPayload(string $appId, bool $ignoreTtl): ?array {
 			}
 		}
 
-		$raw = $this->config->getAppValue(Application::APP_ID, self::PAYLOAD_CACHE_PREFIX . $appId, '');
+		$raw = $this->appConfig->getValueString(Application::APP_ID, self::PAYLOAD_CACHE_PREFIX . $appId, '');
 		if ($raw === '') {
 			return null;
 		}
@@ -276,12 +278,12 @@ private function readCachedPayload(string $appId, bool $ignoreTtl): ?array {
 	 */
 	private function writeCachedPayload(string $appId, array $payload): void {
 		try {
-			$this->config->setAppValue(
+			$this->appConfig->setValueString(
 				Application::APP_ID,
 				self::PAYLOAD_CACHE_PREFIX . $appId,
 				json_encode($payload, JSON_THROW_ON_ERROR),
 			);
-			$this->config->setAppValue(
+			$this->appConfig->setValueString(
 				Application::APP_ID,
 				self::PAYLOAD_CACHE_TS_PREFIX . $appId,
 				(string)time(),
@@ -302,7 +304,7 @@ private function writeCachedPayload(string $appId, array $payload): void {
 	 */
 	private function apiBase(): string {
 		/** @var string|null $raw */
-		$raw = $this->config->getAppValue(Application::APP_ID, 'appstore.api_base', '');
+		$raw = $this->appConfig->getValueString(Application::APP_ID, 'appstore.api_base', '');
 		$override = trim((string)$raw);
 
 		return rtrim($override !== '' ? $override : self::DEFAULT_API_BASE, '/');

lib/Service/Source/ForgeRegistry.php

@@ -14,7 +14,7 @@
 
 use InvalidArgumentException;
 use OCA\Versioniq\AppInfo\Application;
-use OCP\IConfig;
+use OCP\IAppConfig;
 
 /**
  * Holds the known git forges. Adding a forge is a config entry here, not a new
@@ -55,17 +55,17 @@ class ForgeRegistry {
 	private array $forges;
 
 	public function __construct(
-		private IConfig $config,
+		private IAppConfig $appConfig,
 	) {
 		$this->forges = [];
 		foreach (self::DEFAULTS as $id => $d) {
 			$this->forges[$id] = new Forge(
 				$id,
-				$this->baseUrl($id, 'api_base', (string)$d['api']),
-				$this->baseUrl($id, 'web_base', (string)$d['web']),
-				(string)$d['scheme'],
-				(bool)$d['exposesScopeHeader'],
-				(string)$d['tokenCreateUrl'],
+				$this->baseUrl($id, 'api_base', $d['api']),
+				$this->baseUrl($id, 'web_base', $d['web']),
+				$d['scheme'],
+				$d['exposesScopeHeader'],
+				$d['tokenCreateUrl'],
 			);
 		}
 	}
@@ -77,7 +77,7 @@ public function __construct(
 	 */
 	private function baseUrl(string $forgeId, string $key, string $default): string {
 		/** @var string|null $raw */
-		$raw = $this->config->getAppValue(Application::APP_ID, 'forge.' . $forgeId . '.' . $key, '');
+		$raw = $this->appConfig->getValueString(Application::APP_ID, 'forge.' . $forgeId . '.' . $key, '');
 		$override = trim((string)$raw);
 
 		return rtrim($override !== '' ? $override : $default, '/');

lib/Service/Source/ForgeReleaseSource.php

@@ -176,8 +176,15 @@ public function listAdvisories(string $appId, SourceBinding $binding): array {
 		}
 
 		$advisories = [];
+		// `releases` is present on every ok:true branch of performFetch, but the
+		// union narrows to optional keys through useToken's generic, so Psalm
+		// sees `releases?:` and a possible null. Reading it defensively is
+		// cheaper than a baseline entry and is correct either way: a body that
+		// arrives without the key yields no advisories rather than a
+		// foreach-over-null warning.
+		$releases = ($result['releases'] ?? []);
 		/** @var mixed $entry */
-		foreach ($result['releases'] as $entry) {
+		foreach ($releases as $entry) {
 			if (!is_array($entry)) {
 				continue;
 			}

openapi.json

@@ -2,7 +2,7 @@
     "openapi": "3.0.3",
     "info": {
         "title": "versioniq",
-        "version": "1.4.5-unstable.20260831045210",
+        "version": "1.4.7-unstable.20260831193354",
         "description": "Install any earlier or newer version of already installed Nextcloud apps",
         "license": {
             "name": "EUPL-1.2"

package.json

@@ -6,7 +6,7 @@
   "scripts": {
     "build": "vite build",
     "dev": "vite --mode development build",
-    "lint": "eslint src",
+    "lint": "eslint src tests scripts",
     "stylelint": "stylelint \"src/**/*.{vue,scss,css}\"",
     "watch": "vite --mode development build --watch",
     "test": "vitest run",