chore: sync canonical root configs + mechanical phpmd cleanup

[rubenvdlinde]

Summary

Pilot of the fleetwide root-config consolidation (template + 17 PHP apps). Drops per-app phpcs/phpmd/psalm/phpstan extensions in favour of the canonical from nextcloud-app-template, then cleans the mechanical phpmd violations unmasked by the sync.

Tracking: decidesk#242 for the architectural follow-ups.

Config changes

• phpcs.xml — sync canonical (adds SpecTagSniff/NoLegacyServerAccessorsSniff wiring, ignore_warnings_on_exit, vendor-bin/ + lib/Resources/template/ excludes, lineLimit 150). Preserves Decidesk description string.
• phpmd.xml — byte-canonical (preserves Decidesk ruleset name).
• psalm.xml — sync canonical (adds CalendarEventService + 16 other OCP/OR referencedClass entries fleetwide-promoted in nextcloud-app-template#49).
• phpstan.neon — sync canonical (adds includes phpstan-baseline.neon, Doctrine\DBAL + broader OC\ + OCA\DAV\ + OCP stub-gap ignoreErrors, vendor-bin/ + lib/Resources/template/ excludePaths).
• phpstan-baseline.neon — NEW. Captures the 5 tracked phpstan errors remaining after canonical sync. All tracked in Lint debt cleanup post-canonical-sync (Phase 2 pilot) #242 for source-level cleanup.
• phpcs-custom-sniffs/.../NoLegacyServerAccessorsSniff.php — NEW, copied from canonical so it can be referenced by the synced phpcs.xml.

Source changes — 60 mechanical phpmd fixes across 12 service files

• 38 MissingImport — add `use Exception;` / `use DateTimeImmutable;` / `use InvalidArgumentException;` / `use RuntimeException;` / `use Throwable;` / `use DateTimeInterface;` at the top of each file and replace `\Foo` references with the short name.
• 15 ElseExpression — refactor `if/else` into pre-assign default + conditional override (preserves behaviour, no `else` keyword left). Same semantics as the previous ternaries, without violating `Squiz.PHP.DisallowInlineIf`.
• 3 UnusedLocalVariable — drop the variable assignment, keep the side-effect call where it exists (input validation).
• 3 UnusedFormalParameter — annotate with `@SuppressWarnings(PHPMD.UnusedFormalParameter)` matching existing patterns in lib/AppInfo and lib/Mcp where the parameter is part of a required interface signature.
• 1 @psalm-suppress UnusedReturnValue on `ensureDraftMinutes()` with comment noting current callsites only need the side effect.

Quality gate status

Gate	Before sync	After sync + fixes
phpcs	0	0 ✅
psalm	0	0 ✅
phpstan	0 (with per-app suppressions)	0 unmatched ✅ (5 baselined per #242)
phpmd	0 (with per-app suppressions)	28 architectural 🔴 (tracked #242)

phpmd does not support a native baseline file, so its CI gate stays red until #242 closes. This is the agreed-upon tracked-debt pattern for the fleet: per-app validation deviations are forbidden, but a tracked GitHub issue with a removal plan is acceptable.

The 1 `BooleanArgumentFlag` violation (`VotingService::closeVotingRound`'s `bool $anonymise` parameter) was left for #242 because it changes a public method signature.

Test plan

• phpcs: 0 violations.
• psalm: 0 errors.
• phpstan: 0 unmatched errors (5 baselined per Lint debt cleanup post-canonical-sync (Phase 2 pilot) #242).
• phpmd: 28 violations remaining — see Lint debt cleanup post-canonical-sync (Phase 2 pilot) #242. CI gate intentionally red.
• PHPUnit suite green (no logic changes; if a test fails, the mechanical refactor likely broke a side-effect — flag and inspect).

[github-actions]

Quality Report — ConductionNL/decidesk @ 970f72f

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	❌
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			❌	✅ 100/100
npm			✅	✅ 475/475
PHPUnit					⏭️
Newman					⏭️
Playwright					⏭️

---

Quality workflow — 2026-05-21 20:09 UTC

Download the full PDF report from the workflow artifacts.