fix(quality): raise .coverage-baseline to the value actually measured on development

[rubenvdlinde]

What

Raises .coverage-baseline from 52.88 to 61.39, closing the
Coverage Baseline Check failure on development.

Why the first value was wrong — and it is a trap worth writing down

.coverage-baseline was introduced yesterday at 52.88, taken from
clover.xml in the most recent coverage-report artifact at the time. That
was the mistake: coverage-report is uploaded by every run that has PHPUnit
enabled, on any branch, and "the latest artifact" was a pull_request run of
a different branch with a different app/matrix combination.

The statement universes make it obvious in hindsight:

source	statements	covered	ratio
the artifact I read (a PR run of another branch)	10 961	5 796	52.88%
run 30925515438, push, development, sha 2a660aac	16 778	10 300	61.39%

Same repo, same day, 5 817 more statements — not a coverage change, a
different measurement. Picking an artifact by name and recency reads whatever
ran most recently anywhere, and nothing about the file says which branch it came
from.

The gate caught this on its first ever execution, which is exactly what it is
for: it hard-failed with measured coverage has improved past it rather than
letting a too-low ratchet sit there permanently under-protecting the repo.

The value here is read from the coverage-report artifact of the push run on
development at the current head sha — verified by
.workflow_run.head_branch and .workflow_run.head_sha, not by recency.

Note on the error message you will have seen

The failing job says to commit "the recomputed value (attached as the
coverage-baseline artifact of this run)". That artifact does not exist —
.coverage-baseline is a dotfile and actions/upload-artifact@v4 skips hidden
files by default, warning instead of failing. Fixed fleet-wide in
ConductionNL/.github#156. The number here therefore comes from the clover file
coverage-guard.php itself parses.

Coverage Baseline Protection accepts any value that does not LOWER the
baseline, so this raise passes the PR-side gate.

[github-actions]

Quality Report — ConductionNL/docudesk @ d203806

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
test		✅
test-unit		✅
check-manifest		✅
test-l10n		✅
composer			✅	✅ 114/114
npm			✅	✅ 647/647
PHPUnit					✅
Newman					❌
Playwright					✅

---

Quality workflow — 2026-08-04 19:31 UTC

Download the full PDF report from the workflow artifacts.