release: publish a stable NLDesign release with downloadable assets

.coverage-baseline

@@ -0,0 +1 @@
+77.48

.editorconfig

@@ -0,0 +1,36 @@
+# https://editorconfig.org
+
+# SPDX-FileCopyrightText: 2019 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 4
+indent_style = tab
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.yml]
+indent_size = 2
+indent_style = space
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.svg]
+insert_final_newline = false
+
+[package*.json]
+indent_size = 2
+indent_style = space
+
+[build/psalm-baseline.xml]
+indent_size = 2
+indent_style = space
+
+[config/*config.php]
+indent_size = 2
+indent_style = space

.git-blame-ignore-revs

@@ -0,0 +1,16 @@
+# Revisions to skip in `git blame`.
+#
+# Enable locally, once:
+#   git config blame.ignoreRevsFile .git-blame-ignore-revs
+#
+# GitHub reads this file automatically. Your terminal does not, until you run
+# the line above.
+#
+# Only ever add commits that change formatting and NOTHING else. A commit listed
+# here becomes invisible to blame, so a behaviour change hidden inside one would
+# be very hard to find later.
+
+# style: reformat with nextcloud/coding-standard — whitespace only
+# The fleet-wide move from a PEAR-derived PHPCS ruleset (4 spaces, next-line
+# braces) to Nextcloud's own standard (tabs, same-line braces).
+8c0f6b88526fb3fc9d0c3a885b3392a20382c7e6

.githooks/pre-commit

@@ -0,0 +1,38 @@
+#!/bin/sh
+# Committed pre-commit hook (activated via `git config core.hooksPath .githooks`,
+# which `npm install` / `composer install` set automatically — see package.json
+# "prepare" and composer.json "post-install-cmd").
+#
+# Regenerates docs/features.json whenever staged changes touch openspec/specs/
+# or the features overlay, so the commercial capability list can never go
+# stale. CI (features-check / features-extract) only VERIFIES — generation
+# happens here, before the commit, never in the pipeline.
+#
+# Best-effort by design: any failure only warns and never blocks the commit —
+# the CI gate is the enforcement backstop.
+
+if git diff --cached --name-only | grep -qE "^openspec/(specs/|features\.overlay\.json)"; then
+  CACHE=".git/extract-features.py"
+  # Fetch the canonical script (single source of truth in ConductionNL/.github);
+  # fall back to a previously cached copy when offline.
+  curl -sf --max-time 10 \
+    https://raw.githubusercontent.com/ConductionNL/.github/main/scripts/extract-features.py \
+    -o "$CACHE" 2>/dev/null || true
+
+  if [ -f "$CACHE" ]; then
+    if command -v python3 >/dev/null 2>&1; then PY="python3";
+    elif command -v py >/dev/null 2>&1; then PY="py -3";
+    else PY="python"; fi
+
+    if $PY "$CACHE" --app-root . >/dev/null 2>&1; then
+      git add docs/features.json
+      echo "pre-commit: docs/features.json regenerated from openspec/specs/."
+    else
+      echo "pre-commit: WARNING — could not regenerate docs/features.json (python or pyyaml missing?). CI features-check will verify." >&2
+    fi
+  else
+    echo "pre-commit: WARNING — could not fetch extract-features.py (offline?). CI features-check will verify." >&2
+  fi
+fi
+
+exit 0

.github/docker-compose.ci.yml

@@ -0,0 +1,65 @@
+# Minimal docker-compose stack for the LIVE-NC CI gate (tests-live.yml).
+#
+# Brings up Postgres + a fresh Nextcloud. The app under test (and its
+# OpenRegister data backend) are NOT bind-mounted — the tests-live.yml
+# workflow deploys them into the named volume after install completes
+# (bind-mounting custom_apps subdirs at compose-up leaves /var/www/html/apps
+# unwritable and the NC installer bails with "Cannot write into apps
+# directory"). This file is therefore app-agnostic; it is a per-app copy of
+# openregister/.github/docker-compose.ci.yml so the live gate is self-contained
+# in each repo's CI checkout.
+#
+# Paths are relative to this file: `..` resolves to the repo root.
+#
+# SPDX-License-Identifier: EUPL-1.2
+# SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+
+volumes:
+  nextcloud-data:
+
+services:
+  db:
+    image: pgvector/pgvector:pg16
+    container_name: nldesign-ci-db
+    environment:
+      POSTGRES_DB: nextcloud
+      POSTGRES_USER: nextcloud
+      POSTGRES_PASSWORD: nextcloud
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U nextcloud -d nextcloud"]
+      interval: 5s
+      timeout: 5s
+      retries: 12
+
+  nextcloud:
+    # NC 32 — within every target app's info.xml min/max-version window and
+    # matches the openregister reference rig.
+    image: nextcloud:32-apache
+    container_name: nextcloud
+    user: root
+    restart: unless-stopped
+    ports:
+      - "8080:80"
+    depends_on:
+      db:
+        condition: service_healthy
+    volumes:
+      # Named volume only — let the official entrypoint fully bootstrap without
+      # bind-mount interference; the app + openregister are copied in by the
+      # workflow after install.
+      - nextcloud-data:/var/www/html:rw
+    environment:
+      POSTGRES_DB: nextcloud
+      POSTGRES_USER: nextcloud
+      POSTGRES_PASSWORD: nextcloud
+      POSTGRES_HOST: db
+      NEXTCLOUD_ADMIN_USER: admin
+      NEXTCLOUD_ADMIN_PASSWORD: admin
+      NEXTCLOUD_TRUSTED_DOMAINS: localhost nextcloud
+      PHP_MEMORY_LIMIT: 2G
+      PHP_UPLOAD_LIMIT: 1G
+      PHP_POST_MAX_SIZE: 1G
+
+networks:
+  default:
+    name: nldesign-ci-network

.github/workflows/branch-protection.yml

@@ -0,0 +1,11 @@
+name: Branch Protection
+
+on:
+  pull_request:
+    branches: [main, beta]
+
+permissions: {}
+
+jobs:
+  branch-protection:
+    uses: ConductionNL/.github/.github/workflows/branch-protection.yml@main