Release: merge development into beta

.github/CODEOWNERS

@@ -0,0 +1,36 @@
+# CODEOWNERS — auto-request reviewers based on path domain.
+# Last-match-wins; broad rules first, specific overrides below.
+# Created 2026-05-03 from the OR-abstraction audit follow-up.
+
+# Default: every named codeowner reviews unmatched paths.
+*                       @rubenvdlinde @rjzondervan @Rem-Dam @remko48 @WilcoLouwerse @bbrands02 @SudoThijn
+
+# Backend (PHP) — services, controllers, mappers, db, migration, etc.
+lib/                    @bbrands02 @rjzondervan @WilcoLouwerse
+appinfo/                @bbrands02 @rjzondervan @WilcoLouwerse
+**/*.php                @bbrands02 @rjzondervan @WilcoLouwerse
+phpcs.xml               @bbrands02 @rjzondervan @WilcoLouwerse
+phpmd.xml               @bbrands02 @rjzondervan @WilcoLouwerse
+phpstan.neon            @bbrands02 @rjzondervan @WilcoLouwerse
+phpstan-baseline.neon   @bbrands02 @rjzondervan @WilcoLouwerse
+phpmd.baseline.xml      @bbrands02 @rjzondervan @WilcoLouwerse
+composer.json           @bbrands02 @rjzondervan @WilcoLouwerse
+composer.lock           @bbrands02 @rjzondervan @WilcoLouwerse
+
+# Frontend (Vue / TS / JS) — components, stores, pages, build config.
+src/                    @SudoThijn @remko48
+**/*.vue                @SudoThijn @remko48
+**/*.ts                 @SudoThijn @remko48
+**/*.js                 @SudoThijn @remko48
+package.json            @SudoThijn @remko48
+package-lock.json       @SudoThijn @remko48
+jest.config.js          @SudoThijn @remko48
+playwright.config.ts    @SudoThijn @remko48
+webpack.config.js       @SudoThijn @remko48
+babel.config.js         @SudoThijn @remko48
+
+# Specs / docs / ADRs / openspec.
+openspec/               @rubenvdlinde @Rem-Dam
+docs/                   @rubenvdlinde @Rem-Dam
+**/*.md                 @rubenvdlinde @Rem-Dam
+README.md               @rubenvdlinde @Rem-Dam

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 1
+      include:
+        - "*"
+      exclude:
+        - "@conduction/*"

.github/workflows/branch-protection.yml

@@ -5,6 +5,6 @@ on:
     branches: [main, beta]
 
 jobs:
-  protect:
+  check:
     uses: ConductionNL/.github/.github/workflows/branch-protection.yml@main
-    secrets: inherit
+    secrets: inherit

.github/workflows/code-quality.yml

@@ -14,7 +14,7 @@ jobs:
       app-name: app-template
       php-version: "8.3"
       php-test-versions: '["8.3", "8.4"]'
-      nextcloud-test-refs: '["stable31", "stable32"]'
+      nextcloud-test-refs: '["stable31", "stable32", "stable33"]'
       enable-psalm: true
       enable-phpstan: true
       enable-phpmetrics: true

.github/workflows/documentation.yml

@@ -10,4 +10,4 @@ jobs:
   deploy:
     uses: ConductionNL/.github/.github/workflows/documentation.yml@main
     with:
-      cname: app-template.app
+      cname: app-template.conduction.nl

.github/workflows/spec-validation.yml

@@ -0,0 +1,40 @@
+name: Spec Validation
+
+# Validates the OpenRegister register seed (lib/Settings/*_register.json) and the
+# CnAppRoot manifest (src/manifest.json) on every push and PR:
+#   - check:json-strict — strict JSON parse, rejects duplicate keys + appendOnly
+#     nested in x-openregister (the silent-data-loss class of bug a bad JSON merge
+#     produces — see the scholiq Wave-2 incident)
+#   - check:manifest     — Ajv validation against @conduction/nextcloud-vue's
+#     app-manifest.schema.json (catches invented page/widget/action shapes)
+#   - check:register     — structural checks: schema shape, slug uniqueness,
+#     lifecycle `requires:` → PHP class exists, "schema looks clobbered" heuristic
+#
+# To make these BLOCK a merge, add the "Spec Validation / validate" check to the
+# branch-protection ruleset's required-status-checks list (org settings).
+
+on:
+  push:
+    branches: [main, master, development, beta, 'feature/**', 'bugfix/**', 'hotfix/**', 'chore/**', 'fix/**', 'spec/**']
+  pull_request:
+    branches: [main, master, development, beta]
+  workflow_dispatch:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci --no-audit --no-fund
+
+      - name: Validate specs (json-strict + manifest + register)
+        run: npm run check:specs

.gitignore

@@ -1,7 +1,7 @@
 /.idea/
 /*.iml
 *.Identifier
-.phphunit.result.cache
+.phpunit.result.cache
 
 /vendor/
 /vendor-bin/*/vendor/
@@ -59,11 +59,6 @@ phpqa_output.log
 simple-solr-test.php
 test-solr-connection.php
 
-# Files with unusual extensions or no extensions that could be mistakes
-**/PR *
-**/adds *
-**/implements *
-
 phpqa/
 
 # Docker AI models (too large for git)
@@ -76,6 +71,20 @@ docker/dolphin/models/
 /docusaurus/node_modules/
 /docusaurus/build/
 /docusaurus/.docusaurus/
+
+# Docusaurus documentation site (docs/) — build artefacts only; sources are tracked
+/docs/node_modules/
+/docs/build/
+/docs/.docusaurus/
+/docs/.cache-loader/
+/docs/i18n/nl/
+
+# Playwright (tests/e2e/) — reports, traces, and captured outputs are not committed
+/tests/e2e/playwright-report/
+/tests/e2e/test-results/
+/test-results/
+/playwright-report/
+
 # Test screenshots — images generated by browser test commands (test-app, run-test-scenario)
 # Only images are ignored; markdown reports and scenario files are kept in git.
 test-results/**/*.png
@@ -88,3 +97,8 @@ openspec/test-site-results/**/*.jpg
 openspec/test-site-results/**/*.jpeg
 openspec/test-site-results/**/*.gif
 openspec/test-site-results/**/*.webp
+
+# SBOM is published as release asset (see SECURITY.md), not stored in repo
+sbom.cdx.json
+bom-php.cdx.json
+bom-npm.cdx.json

.npmrc

@@ -0,0 +1,5 @@
+# Supply-chain hardening: reject any npm package published less than
+# 24h ago. Compromised first-party-Conduction packages are excluded via
+# Dependabot cooldown (.github/dependabot.yml); for fresh @conduction/*
+# releases, override per-install with `npm install --min-release-age=0`.
+min-release-age=1