Skip to content

Release: merge development into beta - #285

Open
github-actions[bot] wants to merge 16 commits into
betafrom
development
Open

Release: merge development into beta#285
github-actions[bot] wants to merge 16 commits into
betafrom
development

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

Automated PR to sync development changes to beta for beta release.

Merging this PR will trigger the beta release workflow.

Reminder: Add a major, minor, or patch label to this PR to control the version bump. Default is patch.

#42 dropped this caller on 2026-08-04, and its reasoning was sound: every run
in the workflow's history was a startup failure reporting `jobs=0` — an
unresolvable reusable workflow, so no log, no step, no verdict, just a
permanently red branch. As that PR put it, a permanently-red workflow is worse
than an absent one, because the next genuine failure lands on an already-red
branch and cannot be told apart from the standing noise.

That argument was right. The condition behind it is gone.

1. THE UNRESOLVABLE REF WAS ALREADY FIXED — one day earlier. 9a695ae landed on
   `main` on 2026-08-03: "fix all 8 shared-workflow callers on main (wrong
   org)". The repair and the removal crossed in mid-air: `main` got the fix,
   `development` got the deletion, and since main sits 345 commits behind
   development the two branches never met. Both changes look correct in
   isolation; together they left the app with a working caller on the branch
   that does not trigger it and no caller on the branch that does.

2. IT HAS NOW BEEN OBSERVED WORKING. Dispatched against main on 2026-08-21,
   this exact caller ran to success and created 12 OpenSpec issues — the first
   non-zero result this workflow has ever produced. The file added here is
   byte-identical to that copy apart from comments.

ON THE EXPIRED TOKEN. #42 and openregister#2111 both attributed the failure to
an expired project-board PAT. That is not what was blocking it here: launchpad
has no PROJECT_TOKEN secret at all, and the run above succeeded regardless.
PROJECT_TOKEN is for the project BOARD; the issues are written with the
workflow's own github.token. The line is kept so board sync starts working by
itself if a token is ever added, and is inert while the secret is absent.

WHY DEVELOPMENT AND NOT ONLY MAIN. The push trigger watches `development`, and
GitHub reads the workflow file from the branch being pushed. With the file only
on main that trigger can never fire — which is why today's sync had to be
kicked by hand with an explicit `--ref main`, and why it covered only main's 16
changes while development's 28 stayed unsynced.

Related: ConductionNL/.github#529 fixed a separate defect in the shared
workflow that was killing sync runs fleet-wide — a hardcoded label description
of 153 characters against GitHub's 100-character limit, which failed the whole
run rather than just that label.

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
npm audit: 15 findings (2 critical, 2 high) -> 9, none above moderate.

  vitest 1 -> 3          the critical: the Vitest UI server let an arbitrary
                         file be read while listening
  @cyclonedx/cyclonedx-npm 4 -> 5   the high: shell injection via an
                         unsanitised argument

@vitest/ui and @vitest/coverage-v8 move with vitest, not after it. `@vitest/ui`
peers vitest at an EXACT version ("1.6.1"), so bumping vitest alone fails to
resolve and nothing changes — the audit numbers stay identical and it reads
like the bump did not take.

cyclonedx goes to 5, not 6, deliberately. The advisory range is
`>=2.1.0 <5.0.0`, so 5 already fixes it, while 6 treats a non-clean `npm ls` as
fatal — and this fleet's stylelint chain cannot produce a clean one:
stylelint-config-recommended-vue@1.6.1 peers postcss-html@^1 while its own
stylelint-config-html@2 requires ^2. Choosing 6 would trade a passing SBOM job
for a failing one to fix an advisory that 5 already closes.

Verified: 63 test files / 682 tests pass on vitest 3, lint OK, check:manifest
Ajv PASS.

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@github-actions

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/launchpad @ 5372909

Check PHP Vue Security License Tests
lint
phpcs
phpmd
psalm
phpstan
phpmetrics
eslint
stylelint
build
check-manifest
format
composer ✅ 104/104
npm ✅ 525/525
app:check-code ⏭️
info.xml
REUSE
PHPUnit
Newman
Playwright
Hydra gates

Quality workflow — 2026-08-21 10:00 UTC

Download the full PDF report from the workflow artifacts.

@github-actions

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/launchpad @ a9b4f17

Check PHP Vue Security License Tests
lint
phpcs
phpmd
psalm
phpstan
phpmetrics
eslint
stylelint
build
check-manifest
format
composer ✅ 104/104
npm ✅ 525/525
app:check-code ⏭️
info.xml
REUSE
PHPUnit
Newman
Playwright
Hydra gates

Quality workflow — 2026-08-21 10:18 UTC

Download the full PDF report from the workflow artifacts.

* chore(deps): refresh the shared Conduction locks

hydra-gates v1.8.1 -> v1.8.2
nc-vue      2.8.2 -> 2.9.2

Lock-only: both packages are already declared with caret ranges that
permit these versions, so nothing about what this app ACCEPTS changes
- only what it currently resolves to. Opened by the weekly fleet
shared-dependency bump, because a lock nobody re-resolves is a pin
nobody chose.

Merging is gated by this repository's own suite, deliberately: taking
hydra-gates v1.8.1 added patchObject() to a published interface, which
is a load-time fatal for any concrete double that implements it without
the method. CI is the only thing that can tell a safe bump from that.

* chore(deps): nc-vue 2.9.2 -> 2.10.1

2.9.2/2.10.0 carry a CnDashboardPage regression: an `object-table` dashboard
widget canonicalised to `table` and rendered the wrong component
(ConductionNL/nextcloud-vue#722). 2.10.1 is the fix.

Lock-only; added 0, removed 0, dev-flag changes 0.

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@github-actions

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/launchpad @ 6350329

Check PHP Vue Security License Tests
lint
phpcs
phpmd
psalm
phpstan
phpmetrics
eslint
stylelint
build
check-manifest
format
composer ✅ 104/104
npm ✅ 525/525
app:check-code ⏭️
info.xml
REUSE
PHPUnit
Newman
Playwright
Hydra gates

Quality workflow — 2026-08-21 14:47 UTC

Download the full PDF report from the workflow artifacts.

The group suffixed only pushes, leaving workflow_dispatch sharing
quality-development with the Sync-to-Beta PR (whose head_ref IS development
and which re-triggers on every merge). A dispatched run was therefore
cancelled by it — measured on shillinq: dispatch 32487948678 cancelled by
pull_request run 32490160836.

This blocks the fleet gate-drift sweep (.github#523), which dispatches per
app with --ref development because schedule: cannot choose a branch. Under
the old group those runs report neither pass nor fail.

Adopts hermiq's form verbatim, already live there.
@github-actions

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/launchpad @ c71ef10

Check PHP Vue Security License Tests
lint
phpcs
phpmd
psalm
phpstan
phpmetrics
eslint
stylelint
build
check-manifest
format
composer ✅ 104/104
npm ✅ 525/525
app:check-code ⏭️
info.xml
REUSE
PHPUnit
Newman
Playwright
Hydra gates

Quality workflow — 2026-08-21 15:42 UTC

Download the full PDF report from the workflow artifacts.

phpstan/phpstan         ^1.10  -> ^2.0
    conduction/hydra-gates  ^1.0   -> ^1.8.2

Fifteen errors. Twelve were redundant checks, two were type-honesty, one is a
deliberate design decision that now needs stating.

Redundant checks (12)
---------------------
**`isset($x) === true && $x !== null` x9** in DemoShowcasesService. `isset()` is
already false for null, so the second arm can never be false. Dropped, with the
reason recorded once at the first site.

**`is_array($content) === true`** in HealthPingService — `getContentArray()` is
declared `: array` and already returns `[]` when the column is null, so both the
check and its `return []` fallback were unreachable.

**`array_values($failedUrls)`** in NewsWidgetService — already a list.

**`$attribute instanceof DOMAttr`** in SvgSanitiser — `DOMElement::$attributes`
is a DOMNamedNodeMap of DOMAttr. The loop KEEPS copying into a plain array,
because the caller mutates attributes while iterating and mutating a live
DOMNamedNodeMap mid-loop skips nodes; only the always-true filter went.

Type honesty (2)
----------------
`ManifestController::foldInto()`'s by-ref `&$seen` / `&$dashboards` are documented
`array<string, …>`, but the key type WIDENS on write: PHP coerces a canonical
numeric string array key to an integer, so a dashboard identity of `"42"` lands
under the int key `42`. Added `@param-out` (the fix PHPStan itself suggests) with
the reason. Dedupe still works — lookups coerce identically; only code testing
`is_string()` on the key would be misled.

A deliberate soft dependency, now scoped (1)
---------------------------------------------
`HealthController` takes OpenRegister's ManifestLoader and HealthCheckExecutor as
`?object` ON PURPOSE — its own docblock says why: "a parameter TYPE is also a
compile-time reference to a class that may not exist". That is the soft
dependency working as intended, and the cost is that `$this->executor->execute()`
returns mixed, so the JSONResponse payload built from `$result->checks` "contains
unresolvable type". PHPStan 2 raises this where PHPStan 1 did not.

Typing the parameters to satisfy it would reintroduce the hard dependency the
design avoids, so it gets an ignore scoped to that one file and identifier —
not an app-wide silence. Same shape as the existing OCP-stub ignores already in
this config.

Verified locally
----------------
  phpstan   No errors (was 15)
  phpcs     exit 0
  psalm     No errors found
  phpmd     exit 0
  phpunit   OK — 1575 tests, 4049 assertions

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@github-actions

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/launchpad @ ed315ca

Check PHP Vue Security License Tests
lint
phpcs
phpmd
psalm
phpstan
phpmetrics
eslint
stylelint
build
check-manifest
format
composer ✅ 104/104
npm ✅ 525/525
app:check-code ⏭️
info.xml
REUSE
PHPUnit
Newman
Playwright
Hydra gates

Quality workflow — 2026-08-21 16:38 UTC

Download the full PDF report from the workflow artifacts.

* chore(deps): refresh the shared Conduction locks

hydra-gates v1.8.2 -> v1.9.0
nc-vue      2.10.1 -> 2.11.1

Lock-only: both packages are already declared with caret ranges that
permit these versions, so nothing about what this app ACCEPTS changes
- only what it currently resolves to. Opened by the weekly fleet
shared-dependency bump, because a lock nobody re-resolves is a pin
nobody chose.

Merging is gated by this repository's own suite, deliberately: taking
hydra-gates v1.8.1 added patchObject() to a published interface, which
is a load-time fatal for any concrete double that implements it without
the method. CI is the only thing that can tell a safe bump from that.

* fix(metadata): point shipped URLs at GitHub, not the retired Codeberg host

gate-94 (retired-git-host-metadata, ConductionNL/.github#546) flags the shipped
URLs in this app's metadata — website, bugs, repository and screenshots — as
pointing at codeberg.org. GitHub is the only host.

Two things changed together, and only one of them is the host:

    codeberg.org/Conduction/launchpad  ->  github.com/ConductionNL/launchpad

The Codeberg URLs still carried the app's PRE-RENAME name. Swapping only the
host would have produced github.com/ConductionNL/launchpad, which resolves today
purely because GitHub redirects a renamed repo — and stops the moment anyone
creates a repo at the old path.

Screenshots move to raw.githubusercontent.com rather than a github.com/raw
redirect, and every one was fetched rather than assumed: HTTP 200 each. A green
gate with dead image URLs would be worse than the finding it silenced.

Not caused by this branch's lock bump — gate-94 landed at 02:18 UTC, after this
app's last development run, so the PR runs are simply the first measured against
it. Pre-existing debt, newly visible.

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@github-actions

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/launchpad @ 77418df

Check PHP Vue Security License Tests
lint
phpcs
phpmd
psalm
phpstan
phpmetrics
eslint
stylelint
build
check-manifest
format
composer ✅ 104/104
npm ✅ 525/525
app:check-code ⏭️
info.xml
REUSE
PHPUnit
Newman
Playwright
Hydra gates

Quality workflow — 2026-08-22 08:55 UTC

Download the full PDF report from the workflow artifacts.

* test(l10n): ratchet the untranslated schema strings

Every string inside a form comes from the OpenRegister schema, not from the
manifest: `fieldsFromSchema()` runs a property `title` and `description`
through the injected `cnTranslate`, which CnAppRoot binds to THIS app's id. So
a schema title is a key in THIS catalogue — and when the key is absent, `t()`
hands the source string back and the field renders in English inside an
otherwise translated form. Nothing errors, and no existing check looks.

Measured across the fleet on 2026-08-23: 30,459 schema strings had no
catalogue key. Far too much to translate in one pass, and the descriptions
need rewriting for the person filling in the form before translating them is
even worth doing — humaniq's own pass rewrote 592 of 739 before a word was
translated.

So this is a RATCHET, not a gate: it records how many strings are currently
uncovered and fails only when that number GROWS. The debt is measured and
cannot expand, while burning it down stays an ordinary PR. Same shape as the
JSDoc baseline in @conduction/nextcloud-vue.

Counted: schema titles, property titles, property descriptions, and the VALUES
of `x-enum-labels`. NOT counted: enum values themselves (stored contract
values, several non-English by design, never rendered once a property declares
its labels) and `x-notes` (engineering rationale, never rendered).

Verified must-fail: adding one untranslated title takes the count past the
baseline and exits 1, naming the file and property and the command that lists
what is uncovered.

Lower the baseline as strings get translated:
  npm run check:schema-l10n -- --update

* fix(l10n): the baseline file is not a locale catalogue; format for this repo

Two things the fleet CI caught.

`build-l10n-js.js` discovers locales by globbing `l10n/*.json`, which now also
matches `l10n/.schema-l10n-baseline.json` — the ratchet's own state file, kept
there so prettier ignores it. The generator read it as a locale named
`.schema-l10n-baseline` and exited 1 for having no `translations`. Dotfiles are
never locale catalogues, so it skips them.

Also prettier-normalised both scripts to this repo's config; several apps run a
format check over scripts/.

---------

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@github-actions

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/launchpad @ 4f89cde

Check PHP Vue Security License Tests
lint
phpcs
phpmd
psalm
phpstan
phpmetrics
eslint
stylelint
build
check-manifest
format
check-schema-l10n
composer ✅ 104/104
npm ✅ 525/525
app:check-code ⏭️
info.xml
REUSE
PHPUnit
Newman
Playwright
Hydra gates

Quality workflow — 2026-08-23 22:10 UTC

Download the full PDF report from the workflow artifacts.

rubenvdlinde and others added 2 commits August 24, 2026 09:17
hydra-gates v1.9.0 -> v1.9.0
nc-vue      2.11.1 -> 2.15.0

Lock-only: both packages are already declared with caret ranges that
permit these versions, so nothing about what this app ACCEPTS changes
- only what it currently resolves to. Opened by the weekly fleet
shared-dependency bump, because a lock nobody re-resolves is a pin
nobody chose.

Merging is gated by this repository's own suite, deliberately: taking
hydra-gates v1.8.1 added patchObject() to a published interface, which
is a load-time fatal for any concrete double that implements it without
the method. CI is the only thing that can tell a safe bump from that.

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@github-actions

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/launchpad @ 810d12b

Check PHP Vue Security License Tests
lint
phpcs
phpmd
psalm
phpstan
phpmetrics
eslint
stylelint
build
check-manifest
format
check-schema-l10n
composer ✅ 104/104
npm ✅ 538/538
app:check-code ⏭️
info.xml
REUSE
PHPUnit
Newman
Playwright
Hydra gates

Quality workflow — 2026-08-24 08:26 UTC

Download the full PDF report from the workflow artifacts.

GitHub is the only host for this org. Codeberg was a mirror and is no
longer used, including for issue tracking, so these URLs were dead.

Changes (both target `nextcloud-vue`, whose slug did NOT change in the
fleet rename — only the host and org were wrong):
- docs/features/widgets.md: 3 links to the shared `@conduction/nextcloud-vue`
  repo -> github.com/ConductionNL/nextcloud-vue
- src/manifest.json: `$schema` `/raw/branch/main/` -> `/raw/main/`

Deliberately NOT rewritten — the 21 archived Hydra run records
(openspec/changes/archive/*/hydra.json), each carrying
`"repo": "https://codeberg.org/Conduction/launchpad"`:

These are immutable historical pipeline records, and each pairs that
`repo` field with an `"issue"` NUMBER from the Codeberg era (5-39 across
20 of the 21 records). Codeberg issue numbers do NOT correspond to GitHub
issue numbers. Repointing `repo` at GitHub while leaving those numbers in
place would make every record silently assert a REAL BUT UNRELATED GitHub
issue -- the same hazard as rewriting an issue URL's host, just split
across two fields. Left intact as Codeberg-era records.

Also left for a human decision:
- .forgejo/workflows/*.yml (3 files) -- Forgejo CI config, including a
  `CODEBERG_TOKEN` secret reference in release-stable.yml
- docs/migration/widget-library-to-ncvue.md -- prose describing the
  historical "publish a beta via Codeberg CI" step, not a link

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
@github-actions

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/launchpad @ 63844ca

Check PHP Vue Security License Tests
lint
phpcs
phpmd
psalm
phpstan
phpmetrics
eslint
stylelint
build
check-manifest
format
check-schema-l10n
composer ✅ 104/104
npm ✅ 538/538
app:check-code ⏭️
info.xml
REUSE
PHPUnit
Newman
Playwright
Hydra gates

Quality workflow — 2026-08-24 17:00 UTC

Download the full PDF report from the workflow artifacts.

This repository's only issue forms lived under `.forgejo/issue_template/`.
GitHub is the fleet's only host, so those forms are invisible to everyone
filing an issue here.

Two approved fleet changes make this urgent:

1. `.forgejo/` is being removed fleet-wide. Without this port that removal
   would delete the only issue forms this repo has, leaving contributors
   with a blank issue box.
2. The shared library's `DEFAULT_FORGE` moves from `codeberg` to `github`.
   The in-product "Request a feature" deep-link then targets a GitHub Issue
   Form named exactly `feature-request.yml`. If that file is absent GitHub
   silently drops every pre-filled field instead of erroring, so the app
   context (app, page, surface, object, spec-ref) would be lost without a
   single visible failure.

Copies all four templates to `.github/ISSUE_TEMPLATE/`, keeping the
filenames identical. `.forgejo/` is deliberately left untouched; its removal
is a separate later change.

Conversion is lossless: Forgejo's issue-template schema is derived from
GitHub's, and every construct used here (markdown/input/textarea/dropdown
blocks, `render: shell`, `validations.required`, `labels`, `assignees`,
`title`) is valid GitHub issue-form syntax. Nothing was dropped or reworded.
The top-level `type: "Feature"` in feature-request.yml was verified against
the ConductionNL org issue types, where "Feature" exists and is enabled.

No `config.yml` was added: `.forgejo/issue_template/` has no equivalent.
@github-actions

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/launchpad @ 56e598f

Check PHP Vue Security License Tests
lint
phpcs
phpmd
psalm
phpstan
phpmetrics
eslint
stylelint
build
check-manifest
format
check-schema-l10n
composer ✅ 104/104
npm ✅ 538/538
app:check-code ⏭️
info.xml
REUSE
PHPUnit
Newman
Playwright
Hydra gates

Quality workflow — 2026-08-24 19:14 UTC

Download the full PDF report from the workflow artifacts.

GitHub is the only host this organisation publishes to. No local checkout has
a Codeberg git remote, so nothing is pushed there and no workflow under
.forgejo/ has ever run for this repository.

Issue templates: the 4 templates under `.forgejo/issue_template/` were
already ported to `.github/ISSUE_TEMPLATE/` and were verified present there
before deletion (including `feature-request.yml`, which the in-product
"Request a feature" deep-link targets by that exact filename).

Release workflows: the deleted `.forgejo/workflows/` release jobs
(release-beta.yml release-stable.yml ) are superseded by
`.github/workflows/release.yml`, which is the live release path for this
repository.

.github/workflows/ is untouched — that is the live CI. Any CODEBERG_TOKEN
reference lived only inside the deleted files and goes with them.

Removes 9 file(s) under .forgejo/.
@github-actions

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/launchpad @ 91cbe99

Check PHP Vue Security License Tests
lint
phpcs
phpmd
psalm
phpstan
phpmetrics
eslint
stylelint
build
check-manifest
format
check-schema-l10n
composer ✅ 104/104
npm ✅ 538/538
app:check-code ⏭️
info.xml
REUSE
PHPUnit
Newman
Playwright
Hydra gates

Quality workflow — 2026-08-24 22:08 UTC

Download the full PDF report from the workflow artifacts.

github-actions Bot and others added 2 commits August 25, 2026 08:55
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
… and development (#339)

The event suffix applied only when ref_name was main or development, so on every
other branch push and pull_request computed the SAME group and
cancel-in-progress made them kill each other — contradicting the comment above
it, which already says push, dispatch and schedule each get their own lane.

Reachable since the push allow-list widened on 2026-08-14 to include feat/**,
fix/**, perf/**, refactor/** and chore/**: those branches now get both a push
run and a pull_request run for one commit.

quality / Quality Report is a needs:-gated aggregator that reports FAILURE when
its dependencies are cancelled, so this shows up as a red gate on a PR that was
never evaluated, and re-running collides the same way.

Already applied to openregister, integriq and pipelinq, where cancellations went
to zero. See ConductionNL/.github#563.
@github-actions

Copy link
Copy Markdown
Contributor Author

Quality Report — ConductionNL/launchpad @ 7902b37

Check PHP Vue Security License Tests
lint
phpcs
phpmd
psalm
phpstan
phpmetrics
eslint
stylelint
build
check-manifest
format
check-schema-l10n
composer ✅ 104/104
npm ✅ 538/538
app:check-code ⏭️
info.xml
REUSE
PHPUnit
Newman
Playwright
Hydra gates

Quality workflow — 2026-08-25 10:09 UTC

Download the full PDF report from the workflow artifacts.

github-actions Bot and others added 2 commits August 25, 2026 15:47
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Part of the 2026-08-25 fleet structure audit (ADR-100 Decision 2: the
repository root is a closed set; generated files are never tracked).

Ignore rules added: .stale/ /.e2e-state/ .phpunit.cache

`.stale/` was missing from ALL 19 fleet repos and is the one that
matters most operationally: agent scratch there grew unbounded and
filled the dev disk once already.

Refs ConductionNL/hydra ADR-100.

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant