Release: merge development into beta

.coverage-baseline

@@ -0,0 +1 @@
+77.48

.editorconfig

@@ -0,0 +1,36 @@
+# https://editorconfig.org
+
+# SPDX-FileCopyrightText: 2019 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 4
+indent_style = tab
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.yml]
+indent_size = 2
+indent_style = space
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.svg]
+insert_final_newline = false
+
+[package*.json]
+indent_size = 2
+indent_style = space
+
+[build/psalm-baseline.xml]
+indent_size = 2
+indent_style = space
+
+[config/*config.php]
+indent_size = 2
+indent_style = space

.forgejo/workflows/app-tests.yml

@@ -0,0 +1,34 @@
+# app-tests.yml — nldesign caller for the reusable feature-test workflow.
+#
+# Runs the PHASE-5 testing layers on every PR to the protected branches.
+# phpunit-unit + l10n-check HARD-GATE; e2e/newman are scaffolded and opt-in
+# (run-e2e / run-newman) until the NC service container is wired (see tests.yml
+# TODOs). Additive — sits alongside the existing release/quality workflows.
+
+name: app-tests
+
+on:
+  pull_request:
+    branches:
+      - development
+      - main
+      - beta
+  workflow_dispatch:
+    inputs:
+      run-e2e:
+        type: boolean
+        default: false
+      run-newman:
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  tests:
+    uses: ./.forgejo/workflows/tests.yml
+    with:
+      app-id: nldesign
+      run-e2e: ${{ github.event.inputs.run-e2e == 'true' }}
+      run-newman: ${{ github.event.inputs.run-newman == 'true' }}

.forgejo/workflows/tests.yml

@@ -0,0 +1,283 @@
+# tests.yml — reusable feature-test workflow for Conduction NC apps.
+#
+# PHASE-5 CI enforcement: runs the testing layers we built so a PR can't go
+# green while a feature is broken. This is a `workflow_call` reusable: a thin
+# per-app caller (app-tests.yml) invokes it with the app id. Copy the pair
+# (this file + app-tests.yml) into any sibling app to roll the pattern out —
+# the only per-app knob is `app-id`.
+#
+# Layers, and what gates today:
+#   • phpunit-unit  — HARD GATE. tests/Unit + tests/unit via phpunit-unit.xml.
+#                     The bootstrap runs standalone (vendor OCP stubs, no NC),
+#                     so this needs no service container.
+#   • l10n-check    — HARD GATE. tests/l10n/check-l10n.js asserts every
+#                     t('<app>', '...') / n(...) source string is present in
+#                     l10n/en.json (the i18n-extraction-drift guard). Also runs
+#                     tests/l10n/check-l10n-completeness.js, which asserts every
+#                     en.json key is present (as a key — untranslated is fine,
+#                     MISSING is not) in every other l10n/*.json locale file,
+#                     so a locale can never silently drift behind en.json.
+#                     Pure Node, no NC.
+#   • e2e-deep      — SCAFFOLDED (non-gating). Playwright tests/e2e/workflows/
+#                     need a live, seeded NC. See the TODO in that job.
+#   • newman        — SCAFFOLDED (non-gating). tests/integration Postman
+#                     collections via run-newman.sh need a live NC. See TODO.
+#
+# Runner labels + reusable `uses:` forms follow the fleet convention
+# (codeberg-small / short Conduction/.github@main form). Additive — does not
+# touch pre-merge-check-strict.yaml or any release workflow.
+
+name: tests
+
+on:
+  workflow_call:
+    inputs:
+      app-id:
+        description: "App id (matches package.json name + composer namespace)."
+        required: true
+        type: string
+      php-version:
+        required: false
+        type: string
+        default: "8.3"
+      node-version:
+        required: false
+        type: string
+        default: "20"
+      unit-gating:
+        description: "Fail the workflow on unit-test failures. Set false for apps whose tests/Unit suite is not yet green on baseline (e.g. openregister — see TESTING-CI-ROLLOUT.md)."
+        required: false
+        type: boolean
+        default: true
+      run-e2e:
+        description: "Run the scaffolded deep-e2e job (needs NC service — see TODO)."
+        required: false
+        type: boolean
+        default: false
+      run-newman:
+        description: "Run the scaffolded Newman job (needs NC service — see TODO)."
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  # ---------------------------------------------------------------------------
+  # HARD GATE 1 — PHPUnit unit suite (no NC needed; vendor OCP stubs).
+  # ---------------------------------------------------------------------------
+  phpunit-unit:
+    name: PHPUnit unit (${{ inputs.app-id }})
+    runs-on: codeberg-medium
+    container:
+      image: php:8.3-cli
+    steps:
+      - name: Install base tooling
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends \
+            git curl ca-certificates gnupg jq unzip zip \
+            libzip-dev libpng-dev python3
+          # Node is required by actions/checkout@v4 (a JS action) which runs
+          # inside this php:8.3-cli container; the stock image ships no node.
+          curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+          apt-get install -y --no-install-recommends nodejs
+          docker-php-ext-install -j"$(nproc)" zip gd
+          curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
+
+      - name: Checkout
+        uses: https://github.com/actions/checkout@v4
+
+      - name: Install composer deps
+        run: composer install --no-interaction --no-progress --prefer-dist --ignore-platform-reqs
+
+      - name: Run unit suite (phpunit-unit.xml)
+        # unit-gating=false reports failures without failing the job, for apps
+        # carrying pre-existing tests/Unit debt (see TESTING-CI-ROLLOUT.md).
+        continue-on-error: false
+        run: ./vendor/bin/phpunit --configuration phpunit-unit.xml --no-coverage --colors=never
+
+  # ---------------------------------------------------------------------------
+  # HARD GATE 2 — l10n extraction-drift check (no NC needed; pure Node).
+  # ---------------------------------------------------------------------------
+  l10n-check:
+    name: l10n extraction check (${{ inputs.app-id }})
+    runs-on: codeberg-medium
+    container:
+      image: node:${{ inputs.node-version }}
+    steps:
+      - name: Checkout
+        uses: https://github.com/actions/checkout@v4
+
+      - name: Assert every t() source string is in l10n/en.json
+        run: node tests/l10n/check-l10n.js
+
+      - name: Assert every l10n/*.json locale has every en.json key
+        run: node tests/l10n/check-l10n-completeness.js
+
+  # ---------------------------------------------------------------------------
+  # HARD GATE 3 — frontend unit suite (Vitest, OFFLINE; no NC needed).
+  #
+  # Runs the pure-logic Vitest suite under tests/vitest/** (Pinia store
+  # state transitions, util/formatter calc, form-validation mappers, and any
+  # offline component mounts). These need no DOM/NC runtime — @nextcloud/* and
+  # @conduction/nextcloud-vue are aliased to deterministic stubs in
+  # vitest.config.js. Always gating.
+  # ---------------------------------------------------------------------------
+  frontend-unit:
+    name: Frontend unit (Vitest — ${{ inputs.app-id }})
+    runs-on: codeberg-medium
+    container:
+      image: node:${{ inputs.node-version }}
+    steps:
+      - name: Checkout
+        uses: https://github.com/actions/checkout@v4
+
+      - name: Install npm deps
+        run: npm ci --legacy-peer-deps || npm install --legacy-peer-deps
+
+      - name: Run Vitest unit suite
+        run: npm run test:unit
+
+  # ---------------------------------------------------------------------------
+  # COVERAGE GATE A — PHPUnit COVERAGE RATCHET (PCOV clover line coverage).
+  # Fails a PR that drops backend coverage below tests/.coverage-baseline.json
+  # `phpunit` minus tolerance. Inherits continue-on-error from unit-gating so a
+  # red unit suite records-but-does-not-block. Seeds on first --update run when
+  # the baseline is null. See TESTING-CI-ROLLOUT.md "Coverage ratchet".
+  # ---------------------------------------------------------------------------
+  phpunit-coverage-ratchet:
+    name: PHPUnit coverage ratchet (${{ inputs.app-id }})
+    runs-on: codeberg-medium
+    container:
+      image: php:8.3-cli
+    continue-on-error: false
+    steps:
+      - name: Install base tooling
+        run: |
+          apt-get update
+          apt-get install -y --no-install-recommends \
+            git curl ca-certificates gnupg jq unzip zip \
+            libzip-dev libpng-dev python3
+          # Node is required by actions/checkout@v4 (a JS action) which runs
+          # inside this php:8.3-cli container; the stock image ships no node.
+          curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+          apt-get install -y --no-install-recommends nodejs
+          docker-php-ext-install -j"$(nproc)" zip gd
+          curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
+
+      - name: Checkout
+        uses: https://github.com/actions/checkout@v4
+
+      - name: Ensure a coverage driver (PCOV)
+        run: |
+          if ! php -m | grep -qiE 'pcov|xdebug'; then
+            (pecl install pcov && docker-php-ext-enable pcov) \
+              || echo "WARN: could not install pcov — coverage step may report no driver"
+          fi
+          php -m | grep -qiE 'pcov|xdebug' && echo "coverage driver: present" \
+            || echo "coverage driver: ABSENT (ratchet will no-op; see TESTING-CI-ROLLOUT.md)"
+
+      - name: Install composer deps
+        run: composer install --no-interaction --no-progress --prefer-dist --ignore-platform-reqs
+
+      - name: Run unit suite WITH coverage (clover)
+        run: |
+          php -d pcov.enabled=1 -d pcov.directory=lib \
+            ./vendor/bin/phpunit --configuration phpunit-unit.xml \
+            --coverage-clover coverage/clover.xml --colors=never || true
+          test -f coverage/clover.xml || { echo "no clover.xml (driver absent?) — skipping ratchet"; exit 0; }
+
+      - name: Coverage ratchet (fail on drop)
+        run: |
+          test -f coverage/clover.xml || exit 0
+          bash tests/coverage-ratchet.sh phpunit coverage/clover.xml
+
+  # ---------------------------------------------------------------------------
+  # COVERAGE GATE B — FRONTEND COVERAGE RATCHET (Vitest v8, src/** line coverage).
+  # Fails a PR that drops frontend coverage below baseline `vitest` minus
+  # tolerance. Seeds on first --update run when the baseline is null.
+  # ---------------------------------------------------------------------------
+  frontend-coverage-ratchet:
+    name: Frontend coverage ratchet (${{ inputs.app-id }})
+    runs-on: codeberg-medium
+    container:
+      image: node:${{ inputs.node-version }}
+    steps:
+      - name: Checkout
+        uses: https://github.com/actions/checkout@v4
+
+      - name: Install npm deps (+ coverage-v8)
+        run: |
+          npm ci --legacy-peer-deps || npm install --legacy-peer-deps
+          VITEST_VER="$(node -e "console.log(require('./node_modules/vitest/package.json').version)")"
+          npm install --no-save --legacy-peer-deps "@vitest/coverage-v8@${VITEST_VER}"
+
+      - name: Run Vitest coverage + ratchet (honors each app's own --coverage.include)
+        run: |
+          # Use the app's OWN coverage script so its per-app --coverage.include is
+          # honored (apps keep frontend JS under src/** OR js/**; hardcoding src/**
+          # here makes js/**-based apps measure 0 files -> "Unknown" -> ratchet exit 2).
+          if npm run 2>/dev/null | grep -qE '(^|[[:space:]])test:coverage-ratchet([[:space:]]|$)'; then
+            npm run test:coverage-ratchet
+          elif npm run 2>/dev/null | grep -qE '(^|[[:space:]])test:coverage([[:space:]]|$)'; then
+            npm run test:coverage
+            test -f coverage-vitest/coverage-summary.json \
+              && bash tests/coverage-ratchet.sh vitest coverage-vitest/coverage-summary.json \
+              || { echo "no coverage-summary.json — vitest coverage unavailable; skipping ratchet"; exit 0; }
+          else
+            echo "no frontend coverage script for this app; skipping ratchet"; exit 0
+          fi
+
+  # ---------------------------------------------------------------------------
+  # SCAFFOLD — deep e2e (Playwright tests/e2e/workflows/). Opt-in via run-e2e.
+  #
+  # TODO(nc-in-ci): wire a live Nextcloud before flipping this to gating:
+  #   1. Boot db + NC (openregister ships .github/docker-compose.ci.yml; add a
+  #      sibling compose for feature apps, or reuse the OR stack + enable this
+  #      app + its OR register/schema fixtures).
+  #   2. Deploy the working tree into custom_apps/<app-id> and `occ app:enable`
+  #      <app-id> (+ openregister, the data backend).
+  #   3. Seed the deep-e2e fixtures (tests/e2e/workflows/*fixture*.ts seed the
+  #      OR objects each workflow asserts on).
+  #   4. `npx playwright install --with-deps chromium` then
+  #      `npm run test:e2e -- tests/e2e/workflows`.
+  # Until then this job documents the command and is non-gating.
+  # ---------------------------------------------------------------------------
+  e2e-deep:
+    name: Deep e2e (scaffold — needs NC)
+    if: ${{ inputs.run-e2e }}
+    runs-on: docker
+    steps:
+      - name: Checkout
+        uses: https://github.com/actions/checkout@v4
+
+      - name: TODO — boot seeded NC, then run deep e2e
+        run: |
+          echo "Deep e2e requires a live, seeded Nextcloud (see job header TODO)."
+          echo "Local: npm ci && npm run test:e2e:install && npm run test:e2e -- tests/e2e/workflows"
+          echo "Skipping in CI until the NC service container is wired."
+
+  # ---------------------------------------------------------------------------
+  # SCAFFOLD — Newman API-contract (tests/integration/*.postman_collection.json).
+  # Opt-in via run-newman.
+  #
+  # TODO(nc-in-ci): same live-NC prerequisite as e2e-deep. The runner script
+  # (tests/integration/run-newman.sh) is collection-self-seeding and runnable
+  # locally today: `bash tests/integration/run-newman.sh`. openregister uses
+  # the orchestrator at tests/newman/run-all.sh instead.
+  # ---------------------------------------------------------------------------
+  newman:
+    name: Newman API contract (scaffold — needs NC)
+    if: ${{ inputs.run-newman }}
+    runs-on: docker
+    steps:
+      - name: Checkout
+        uses: https://github.com/actions/checkout@v4
+
+      - name: TODO — boot NC, then run Newman
+        run: |
+          echo "Newman requires a live Nextcloud serving the app (see job header TODO)."
+          echo "Local: bash tests/integration/run-newman.sh   # OR: bash tests/newman/run-all.sh"
+          echo "Skipping in CI until the NC service container is wired."

.git-blame-ignore-revs

@@ -0,0 +1,16 @@
+# Revisions to skip in `git blame`.
+#
+# Enable locally, once:
+#   git config blame.ignoreRevsFile .git-blame-ignore-revs
+#
+# GitHub reads this file automatically. Your terminal does not, until you run
+# the line above.
+#
+# Only ever add commits that change formatting and NOTHING else. A commit listed
+# here becomes invisible to blame, so a behaviour change hidden inside one would
+# be very hard to find later.
+
+# style: reformat with nextcloud/coding-standard — whitespace only
+# The fleet-wide move from a PEAR-derived PHPCS ruleset (4 spaces, next-line
+# braces) to Nextcloud's own standard (tabs, same-line braces).
+8c0f6b88526fb3fc9d0c3a885b3392a20382c7e6