Skip to content

Release: merge development into beta - #582

Open
github-actions[bot] wants to merge 79 commits into
betafrom
development
Open

Release: merge development into beta#582
github-actions[bot] wants to merge 79 commits into
betafrom
development

Conversation

@github-actions

@github-actions github-actions Bot commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

Automated PR to sync development changes to beta for beta release.

Merging this PR will trigger the beta release workflow.

Reminder: Add a major, minor, or patch label to this PR to control the version bump. Default is patch.

rubenvdlinde and others added 7 commits August 18, 2026 15:57
@rubenvdlinde
docs(openspec): change proposals — adopt-integration-leaves mcp-full-…
24212bd 
…action-surface

Artifacts only. Every task box is unticked; nothing here is wired to anything
yet, and each change is picked up by `/opsx-apply` when it is scheduled.

Committed because these were sitting UNTRACKED in the shared checkout across ten
apps at once. An untracked directory is one file-sweep away from being swept
into an unrelated commit and one branch switch away from being lost, and these
carry the design reasoning rather than just a title.
@github-actions
chore(release): 0.1.141-unstable.20260820130046 [skip ci]
95ff8c3
@rubenvdlinde
Merge pull request #580 from ConductionNL/release/v0.1.141-unstable.2…
98333a5 
…0260820130046

chore(release): 0.1.141-unstable.20260820130046
@github-actions
chore(release): 0.1.141-unstable.20260820201847 [skip ci]
35a943c
@rubenvdlinde
Merge pull request #583 from ConductionNL/release/v0.1.141-unstable.2…
3539cb0 
…0260820201847

chore(release): 0.1.141-unstable.20260820201847
@github-actions
chore(release): 0.1.141-unstable.20260820203911 [skip ci]
6a2d172
@rubenvdlinde
Merge pull request #584 from ConductionNL/release/v0.1.141-unstable.2…
b7cb07a 
…0260820203911

chore(release): 0.1.141-unstable.20260820203911
@github-actions

github-actions Bot commented Aug 20, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/softwarecatalog @ f609b08

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-manifest ✅
check-vue-demi ✅
test-l10n ✅
format ✅
composer ✅ ✅ 130/130
npm ✅ ✅ 704/704
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ❌
Newman ⏭️
Playwright ❌
Hydra gates ❌

Quality workflow — 2026-08-20 20:56 UTC

Download the full PDF report from the workflow artifacts.

@github-actions

github-actions Bot commented Aug 20, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/softwarecatalog @ 8f9cf86

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-manifest ✅
check-vue-demi ✅
test-l10n ✅
format ✅
composer ✅ ✅ 130/130
npm ✅ ✅ 704/704
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ❌
Newman ⏭️
Playwright ❌
Hydra gates ❌

Quality workflow — 2026-08-20 21:21 UTC

Download the full PDF report from the workflow artifacts.

github-actions Bot and others added 3 commits August 20, 2026 21:22
@github-actions
chore(release): 0.1.141-unstable.20260820212102 [skip ci]
743ba4b
@rubenvdlinde
fix(manifest): process and audit fields are no longer editable inputs
4f03776 
`CnObjectDataWidget.editable` defaults to TRUE, so every property named in a
data widget's `include` list becomes a text box the user can type into. That
put lifecycle state and audit stamps — `status`, `lifecycle`, `submittedAt`,
`approvedBy`, `openedAt`, `closedAt`, `publishedAt`, `enactedAt` — in front of
users as editable fields.

These are written by the backend when a transition lands (`TransitionEngine`
stamps them through `saveObject()`), so an input for them is a control that
can only ever fail or confuse: the guarded path is the lifecycle buttons, and
`LifecycleValidationListener` rejects anything that is not a legal transition.

Locked with per-field `overrides.<field>.editable: false` rather than
`editable: false` on the widget: these panels mix process state with fields
the user legitimately edits, and a blanket lock would make those read-only
too.

NOT fixed here: widgets that declare no `include` at all render EVERY schema
property, and enumerating their fields in the manifest would drift the moment
the schema changes. 52 such widgets fleet-wide expose 124 process fields.
Closing those needs a server-side "system-owned" marker, which OpenRegister
does not have — `readOnly:true` has no bypass for backend callers and would
break the transition that writes the field. Filed as
ConductionNL/openregister#2644.

Inserted textually, one compact line per widget, so the diff is the change and
nothing else: a full JSON re-serialisation reflowed hand-compacted lines and
turned this into thousands of lines of churn. A verifier re-parses both files
and asserts the only structural difference is the added overrides, and that no
non-process field was locked.
@rubenvdlinde
Merge pull request #586 from ConductionNL/release/v0.1.141-unstable.2…
609d9b2 
…0260820212102

chore(release): 0.1.141-unstable.20260820212102
@github-actions

github-actions Bot commented Aug 20, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/softwarecatalog @ 3a5e68d

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-manifest ✅
check-vue-demi ✅
test-l10n ✅
format ✅
composer ✅ ✅ 130/130
npm ✅ ✅ 704/704
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ❌
Newman ⏭️
Playwright ❌
Hydra gates ❌

Quality workflow — 2026-08-20 21:43 UTC

Download the full PDF report from the workflow artifacts.

@github-actions

github-actions Bot commented Aug 20, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/softwarecatalog @ e3893f6

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-manifest ✅
check-vue-demi ✅
test-l10n ✅
format ✅
composer ✅ ✅ 130/130
npm ✅ ✅ 704/704
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ❌
Newman ⏭️
Playwright ❌
Hydra gates ❌

Quality workflow — 2026-08-20 22:05 UTC

Download the full PDF report from the workflow artifacts.

github-actions Bot and others added 3 commits August 20, 2026 22:06
@github-actions
chore(release): 0.1.141-unstable.20260820220515 [skip ci]
9a6e9e5
@rubenvdlinde
Merge pull request #589 from ConductionNL/release/v0.1.141-unstable.2…
54c4b8a 
…0260820220515

chore(release): 0.1.141-unstable.20260820220515
@rubenvdlinde
Merge pull request #587 from ConductionNL/fix/lock-process-fields
fc64d96 
fix(manifest): process and audit fields are no longer editable inputs
@github-actions

github-actions Bot commented Aug 20, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/softwarecatalog @ 2e01b6c

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-manifest ✅
check-vue-demi ✅
test-l10n ✅
format ✅
composer ✅ ✅ 130/130
npm ✅ ✅ 704/704
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ❌
Newman ⏭️
Playwright ❌
Hydra gates ❌

Quality workflow — 2026-08-20 22:32 UTC

Download the full PDF report from the workflow artifacts.

@github-actions

github-actions Bot commented Aug 20, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/softwarecatalog @ b6409bc

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-manifest ✅
check-vue-demi ✅
test-l10n ✅
format ✅
composer ✅ ✅ 130/130
npm ✅ ✅ 704/704
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ❌
Newman ⏭️
Playwright ❌
Hydra gates ❌

Quality workflow — 2026-08-20 22:49 UTC

Download the full PDF report from the workflow artifacts.

@github-actions

github-actions Bot commented Aug 20, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/softwarecatalog @ d6341b5

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-manifest ✅
check-vue-demi ✅
test-l10n ✅
format ✅
composer ✅ ✅ 130/130
npm ✅ ✅ 704/704
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ❌
Newman ⏭️
Playwright ❌
Hydra gates ❌

Quality workflow — 2026-08-20 23:11 UTC

Download the full PDF report from the workflow artifacts.

rubenvdlinde and others added 2 commits August 21, 2026 01:11
@rubenvdlinde
build(deps-dev): move the whole stylelint family to 17 as one upgrade
c74a3a9 
stylelint 15.11.0 -> 17.14.1 with every package that peers on it:

  @nextcloud/stylelint-config           ^2.4.0  -> ^3.2.2
  stylelint-config-recommended-scss    ^13.1.0  -> ^17.0.1
  stylelint-config-recommended-vue      ^1.6.1  -> ^2.0.0
  postcss-html                          ^1.8.1  -> ^2.0.0
  stylelint-config-html                (absent) -> ^2.0.0

None can move alone: vue-config@2 peers 'postcss-html ^2.0.0' and
'stylelint-config-html >=2.0.0'; postcss-html@2 breaks vue-config@1.6.1's own
'^1.0.0' peer; scss-config@17 peers 'stylelint ^17'. @nextcloud/stylelint-config
is the member that decides it — v2.4.0 still declares indentation /
string-quotes / number-leading-zero / selector-list-comma-newline-after, all
removed in stylelint 16.

Then 10 real errors, in 4 files:
  8x  word-break: break-word  -> overflow-wrap: break-word
  1x  word-wrap: break-word   -> overflow-wrap: break-word
  1x  clip: rect(0,0,0,0)     -> clip-path: inset(50%)

Fixed by hand, NOT with --fix. The autofix also rewrites the 86 advisory
csstools/use-logical warnings (text-align: left -> start, padding-left ->
padding-inline-start, ...) across 28 files. Those change how the UI lays out
under RTL and have nothing to do with this bump; openbuild, scholiq and hermiq
all carry the same warnings unfixed. A dependency upgrade should not smuggle in
a directional-CSS change.

Result: 10 errors -> 0, exit 0. The 86 warnings are unchanged and non-blocking.
@github-actions
chore(release): 0.1.141-unstable.20260820231107 [skip ci]
4f75670
@github-actions

github-actions Bot commented Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/softwarecatalog @ 1797436

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-manifest ✅
check-vue-demi ✅
test-l10n ✅
format ✅
composer ✅ ✅ 130/130
npm ✅ ✅ 703/703
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ❌
Newman ⏭️
Playwright ❌
Hydra gates ❌

Quality workflow — 2026-08-21 04:17 UTC

Download the full PDF report from the workflow artifacts.

@github-actions

github-actions Bot commented Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/softwarecatalog @ 2623764

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-manifest ✅
check-vue-demi ✅
test-l10n ✅
format ✅
composer ✅ ✅ 130/130
npm ✅ ✅ 703/703
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ❌
Newman ⏭️
Playwright ❌
Hydra gates ❌

Quality workflow — 2026-08-21 04:29 UTC

Download the full PDF report from the workflow artifacts.

@github-actions

github-actions Bot commented Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/softwarecatalog @ 1e94088

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-manifest ✅
check-vue-demi ✅
test-l10n ✅
format ✅
composer ✅ ✅ 130/130
npm ✅ ✅ 703/703
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ❌
Newman ⏭️
Playwright ❌
Hydra gates ❌

Quality workflow — 2026-08-21 04:46 UTC

Download the full PDF report from the workflow artifacts.

@github-actions

github-actions Bot commented Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/softwarecatalog @ de4d652

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-manifest ✅
check-vue-demi ✅
test-l10n ✅
format ✅
composer ✅ ✅ 130/130
npm ✅ ✅ 703/703
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ❌
Newman ⏭️
Playwright ❌
Hydra gates ❌

Quality workflow — 2026-08-21 05:08 UTC

Download the full PDF report from the workflow artifacts.

@github-actions

github-actions Bot commented Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/softwarecatalog @ d3e23b4

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-manifest ✅
check-vue-demi ✅
test-l10n ✅
format ✅
composer ✅ ✅ 130/130
npm ✅ ✅ 703/703
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ❌
Newman ⏭️
Playwright ❌
Hydra gates ❌

Quality workflow — 2026-08-21 05:25 UTC

Download the full PDF report from the workflow artifacts.

@github-actions

github-actions Bot commented Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/softwarecatalog @ 1e8f46b

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-manifest ✅
check-vue-demi ✅
test-l10n ✅
format ✅
composer ✅ ✅ 130/130
npm ✅ ✅ 703/703
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ❌
Newman ⏭️
Playwright ❌
Hydra gates ❌

Quality workflow — 2026-08-21 05:37 UTC

Download the full PDF report from the workflow artifacts.

@github-actions

github-actions Bot commented Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/softwarecatalog @ 998c6c3

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-manifest ✅
check-vue-demi ✅
test-l10n ✅
format ✅
composer ✅ ✅ 130/130
npm ✅ ✅ 703/703
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ❌
Newman ⏭️
Playwright ❌
Hydra gates ❌

Quality workflow — 2026-08-21 05:57 UTC

Download the full PDF report from the workflow artifacts.

@github-actions

github-actions Bot commented Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/softwarecatalog @ 550d4c3

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-manifest ✅
check-vue-demi ✅
test-l10n ✅
format ✅
composer ✅ ✅ 130/130
npm ✅ ✅ 703/703
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ⏭️
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-08-21 06:36 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde @github-actions
chore(deps): refresh the shared Conduction locks (#692)
bcece50 
hydra-gates v1.8.1 -> v1.8.2
nc-vue      2.8.2 -> 2.9.2

Lock-only: both packages are already declared with caret ranges that
permit these versions, so nothing about what this app ACCEPTS changes
- only what it currently resolves to. Opened by the weekly fleet
shared-dependency bump, because a lock nobody re-resolves is a pin
nobody chose.

Merging is gated by this repository's own suite, deliberately: taking
hydra-gates v1.8.1 added patchObject() to a published interface, which
is a load-time fatal for any concrete double that implements it without
the method. CI is the only thing that can tell a safe bump from that.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@github-actions

github-actions Bot commented Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/softwarecatalog @ 55e0d54

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-manifest ✅
check-vue-demi ✅
test-l10n ✅
format ✅
composer ✅ ✅ 130/130
npm ✅ ✅ 703/703
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ⏭️
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-08-21 12:33 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde @github-actions
chore(deps): refresh the shared Conduction locks (#694)
3f6beb9 
hydra-gates v1.8.2 -> v1.8.2
nc-vue      2.9.2 -> 2.10.1

Lock-only: both packages are already declared with caret ranges that
permit these versions, so nothing about what this app ACCEPTS changes
- only what it currently resolves to. Opened by the weekly fleet
shared-dependency bump, because a lock nobody re-resolves is a pin
nobody chose.

Merging is gated by this repository's own suite, deliberately: taking
hydra-gates v1.8.1 added patchObject() to a published interface, which
is a load-time fatal for any concrete double that implements it without
the method. CI is the only thing that can tell a safe bump from that.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@github-actions

github-actions Bot commented Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/softwarecatalog @ 4301058

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-manifest ✅
check-vue-demi ✅
test-l10n ✅
format ✅
composer ✅ ✅ 130/130
npm ✅ ✅ 703/703
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ⏭️
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-08-21 14:39 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde Conduction Release Bot
fix(tests): opt into the OpenRegister contract — fixes 130 standalone…
646c301 
… unit errors (#696)

Prepares this app for ConductionNL/.github#531, which drops
`OCA\OpenRegister\Contract\` from conduction/hydra-gates' RUNTIME psr-4
autoload. That prefix is LONGER than openregister's own `OCA\OpenRegister\` ->
`lib/`, and PSR-4 is longest-prefix-wins, so whichever app's autoloader
registers first defines OpenRegister's contract for the whole process.

IT ALSO FIXES A LIVE PROBLEM HERE, WHICH THE OTHER APPS IN THIS SWEEP DID NOT
HAVE. tests/bootstrap-unit.php registers its OpenRegister stubs through a manual
spl_autoload_register prefix map covering `OCA\OpenRegister\Db\` and
`...\Service\`. Neither covers `...\Contract\`, so the standalone unit suite was
already failing on it:

  before   Tests: 715, Assertions: 2573, Errors: 131, Failures: 1, Skipped: 25
  after    Tests: 715, Assertions: 2993, Errors: 1,   Failures: 0, Skipped: 24

The single remaining error is unrelated — Symfony\Component\HttpFoundation\
HeaderUtils is absent from the standalone environment, reached via OCP's
DownloadResponse.

Added to BOTH bootstraps deliberately: phpunit.xml loads tests/bootstrap.php and
phpunit-unit.xml loads tests/bootstrap-unit.php, and both reach code that needs
the contract. The full phpunit.xml path cannot be measured outside a Nextcloud
tree (its bootstrap fatals on `Class "OC_App" not found`), so that half is
verified by CI rather than locally, and is a no-op there while the prefix still
exists.

interface_exists() is order-independent: it asks whether the interface is
RESOLVABLE rather than who registered first. Appending a fallback autoloader
does not work, because spl_autoload_register appends relative to registration
order and that order across independently loaded apps is what nobody controls.

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@github-actions

github-actions Bot commented Aug 22, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/stackiq @ c666581

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-manifest ✅
check-vue-demi ✅
test-l10n ✅
format ✅
composer ✅ ✅ 130/130
npm ✅ ✅ 703/703
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ⏭️
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-08-22 00:35 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde Conduction Release Bot
chore(quality): migrate to PHPStan 2 — 35 findings to zero, plus a mi…
53692a1 
…ssing-manager bug (#697)

* chore(quality): migrate to PHPStan 2 — 35 findings to zero, plus a real bug

Bumps `phpstan/phpstan` to ^2.0 and `conduction/hydra-gates` to ^1.8.2,
and clears every finding the new major surfaces.

## A missing manager was never detected

ContactPersonHandler::setUserManager():

    $user    = $this->_userManager->get($username);
    $manager = $this->_userManager->get($managerUsername);

    if ($user === null || $manager === false) { ...warn and return... }

IUserManager::get() returns `?IUser` — it signals "no such user" with
NULL and never returns false. So the second half of that guard could
never fire: calling setUserManager() with a manager username that does
not exist skipped the warning entirely and carried on as if the manager
were real. Fixed to `=== null`.

PHPStan found it from the other end: inside that branch `$user !== null`
was reported as always FALSE, because the only reachable way in was the
first clause.

## Dead guards (28)

Mostly in the ArchiMate import/export pair, which are near-copies of each
other, so nearly every finding came in twos:

- `self::PERFORMANCE_OPTIMIZATIONS['memory_cleanup'] !== false` and
  `['parallel_processing'] === true` — both are class constants set to
  true, so neither was ever conditional.
- `$identifier !== false`, `$versionId !== false`, `$refCompId !== false`,
  `$amefKey !== false` — all strings; none can be false.
- `is_array($sectionData) === false` — the parameter is declared `array`,
  so PHP rejects anything else at the call boundary first.
- `isset($statistics[$sectionKey]) === false` — the branch above pins
  $sectionKey to a key $statistics always has.
- `if ($section !== 'omschrijving')` with the comment "Skip summary
  section itself" — `omschrijving` is assigned to $statistics on the line
  AFTER the loop, so the loop can never see it.
- `method_exists($this->archiMateService, '...Optimized')` — the method
  is declared on the class.
- Several `isset() && !== null` pairs and non-nullable-entity null tests.

## One scoped ignore

OrganizationSyncService's `if ($contactObject !== null)` is provably true
— the code a few lines above already dereferences $contactObject
unconditionally. It is left in place because the block it wraps is 243
lines: removing the `if` is a pure re-indentation of a quarter of the
method, a large review-hostile diff for zero behaviour change. The
comment says so and marks it for the next real edit to that method.

## Verification

phpstan 0, phpcs clean, phpmd clean.

PHPUnit is NOT part of this evidence: the bootstrap requires a booted
Nextcloud (`Class "OC_App" not found`) and cannot run standalone. Checked
that this is pre-existing by stashing every change in this commit and
re-running — byte-identical failure. CI runs the suite inside the
container.

* style(quality): satisfy phpcs on the comments this branch added

CI's phpcs step runs `--warning-severity=0`, and it failed on every one
of the three PRat in this series for the same reason: comments I wrote.

Two sniffs:

- Squiz.Commenting.InlineComment.NotCapital — many of my new comments
  open with a lowercase function name ("// find() throws rather than
  ..."). Rephrased so the first word is a real capitalised word.
- Generic.Commenting.DocComment.TagsNotGrouped — the `@param-out` tags I
  added were interleaved between `@param` tags, splitting the group.
  Moved below the last `@param`. One of those inserts had also orphaned a
  continuation line off the `@param` above it; that is rejoined.

Where PHPStan genuinely needs a `/** @var */` inline doc-block (which
Squiz.Commenting.InlineComment.DocBlock rejects), the line now carries a
targeted `phpcs:ignore` naming that sniff and saying why, rather than
dropping the annotation and leaving the type wrong.

I should have caught this locally. I did run phpcs, but with
`--report=summary | tail -3`, which prints only the timing line — so I
read an empty tail as "clean" when the error count was two lines above
the cut. Re-verified here with CI's exact invocation.

---------

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@github-actions

github-actions Bot commented Aug 22, 2026

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/stackiq @ b3a5223

Check PHP Vue Security License Tests
lint ✅
phpcs ✅
phpmd ✅
psalm ✅
phpstan ✅
phpmetrics ✅
eslint ✅
stylelint ✅
build ✅
check-manifest ✅
check-vue-demi ✅
test-l10n ✅
format ✅
composer ✅ ✅ 130/130
npm ✅ ✅ 703/703
app:check-code ⏭️
info.xml ✅
REUSE ❌
PHPUnit ✅
Newman ⏭️
Playwright ✅
Hydra gates ✅

Quality workflow — 2026-08-22 01:09 UTC

Download the full PDF report from the workflow artifacts.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rubenvdlinde