ci: add the fleet-standard Code Quality pipeline (hrmq had none)

[rubenvdlinde]

What those existing runs actually were

hrmq had no .github/workflows/ directory at all — gh api .../contents/.github/workflows returns 404, and the Actions workflows API lists exactly two entries, both dynamic:

path	name
dynamic/github-code-scanning/codeql	CodeQL
dynamic/dependabot/dependabot-updates	Dependabot Updates

The runs named "Push on development" / "PR #64" / "Scheduled" are CodeQL default setup (event: dynamic), which names its runs after the trigger rather than the workflow. They look like an app pipeline in the run list and are not one. No PHPCS, PHPMD, Psalm, PHPStan, PHPUnit, ESLint, Stylelint, license, SBOM or E2E check has ever run against this repo, on any commit.

The caller

Modelled on nextcloud-app-template, cross-checked against larpingapp, with inputs tuned to what hrmq actually ships.

Enabled — and why each is satisfiable

input	evidence in the repo
enable-psalm	psalm.xml + psalm-baseline.xml, vimeo/psalm in require-dev
enable-phpstan	phpstan.neon + phpstan-baseline.neon + phpstan-bootstrap.php
enable-phpmd / enable-phpcs (defaults)	phpmd.xml + phpmd.baseline.xml; phpcs.xml
enable-phpmetrics	phpmetrics/phpmetrics in require-dev
enable-phpunit	phpunit.xml + tests/bootstrap.php; tests/Unit/ mirrors lib/ package-by-package
enable-frontend / enable-eslint / enable-stylelint	eslint.config.js, stylelint.config.js, lint + stylelint npm scripts
frontend-checks: ["check:manifest","check:widget-keys"]	two self-contained node validators that already existed with no runner
enable-playwright	playwright.config.ts + 2 specs under tests/e2e/spec-coverage/
enable-license-check, enable-sbom, enable-features-extract (defaults)	composer.json + package.json; cyclonedx/cyclonedx-php-composer already in require-dev

nextcloud-test-refs: stable31..33 — info.xml allows 28–34, but the floor that actually binds is nextcloud/ocp: ^31.0.

additional-apps: openregister@main — src/manifest.json declares "dependencies": ["openregister"], and nc-vue's CnAppRoot honours that at runtime: without it, the "Required apps are missing" gate renders instead of the router outlet and every shell assertion fails with "element(s) not found" while the app behaves exactly as designed. hrmq is also a thin client (Employee / EmploymentContract / PayrollRun / Payslip / WageTaxFiling are all OR objects), so core-journeys.spec.ts has nothing to seed against either. Pinned to main rather than development only because this is hrmq's first CI run and the foundation app should not be a moving confound while the baseline is read.

playwright-test-path left at its default tests/e2e. There is no config at that path, so the shared workflow falls back to the root playwright.config.ts — which is the intended one (testDir: './tests/e2e', one chromium project). The "Validate Playwright tests exist" step's find is recursive, so both specs under spec-coverage/ are counted. Setting the input without shipping a config there would change nothing except mislead the reader.

Deliberately NOT enabled

• enable-newman — no tests/integration/, no Postman collection anywhere. The job's own validation step hard-fails on a missing collection directory: a guaranteed red job with zero assertions.
• enable-hydra-gates — off on purpose, not by omission. Only 1 of 17 fleet repos sets it, and gate-7 (no-admin-idor) currently false-positives on ordinary responder delegation; that is being fixed separately in fix(hydra-gates): gate-7 follows delegation; gates 6/7 stop passing on an empty scope .github#149. Turning it on here would make hrmq's first-ever pipeline red for a reason that is not hrmq's.
• enable-axe — only consumed when hydra-gates is on (gate-33 reads tests/axe/report.json), so it would produce an artifact nothing reads. Also measured red against vanilla NC34 before any app is installed.
• enable-playwright-coverage — needs a defensible threshold; there is no measured V8 baseline for hrmq yet.
• enable-coverage-guard — the ratchet compares against a committed .coverage-baseline, which this repo does not have.
• enable-journeydoc-capture — per ADR-030 belongs in its own scheduled docs-capture.yml, not on every push.

Two repo fixes this pipeline required

tests/e2e/base-url.ts — GitHub Actions exemption from FORBIDDEN_HOSTS.
The file already anticipated that the shared workflow exports the instance as BASE_URL and accepted that name — but the value it exports is literally http://localhost:8080, which the guard immediately below it rejects. Enabling Playwright without this fix would have thrown from resolveBaseURL() at config-load time, before a single test ran, with an error blaming a shared dev container that does not exist on a runner. The guard's real question is "is this host disposable"; on a GitHub runner :8080 is the run's own php -S, created and destroyed with the job. GITHUB_ACTIONS is used rather than the far broader CI, which a developer may well export in a shell that can reach the real :8080.

docs/features.json — generated, not disabled.
enable-features-extract defaults to true and the file did not exist, so that gate would have been stale on arrival. Generated from the 55 specs under openspec/specs/ with the shared scripts/extract-features.py (52 features). hrmq can satisfy this gate — it had simply never been asked to.

Pre-flight measured locally

Against a clean npm ci at this commit, before enabling anything:

• check:manifest PASS (113 pages, schema 2.22.0)
• check:widget-keys PASS (all 11 keys resolve, incl. 2 via a real probe build)
• lint PASS · stylelint PASS
• extract-features.py --check PASS

⚠️ check:widget-keys first appeared to FAIL when run from a stale local checkout — a probe-build crash inside @nextcloud/webpack-vue-config. That was an artifact of the stale tree, not the code; it passes cleanly at this commit. Worth recording because it would have been an easy reason to wrongly drop the job.

Note on counting

This branch name does not match the push: trigger patterns (main, development, feature/**, bugfix/**, hotfix/**), so the PR run is the single measurement — no duplicate. Expect ~25 jobs; a startup_failure from a YAML error would report jobs.total_count = 0 and emit no contexts, which reads exactly like success in a rollup, so the job count is checked directly.

[github-actions]

Quality Report — ConductionNL/hrmq @ 1c76b70

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-widget-keys		✅
composer			✅	✅ 99/99
npm			✅	✅ 813/813
PHPUnit					❌
Newman					⏭️
Playwright					❌

---

Quality workflow — 2026-08-04 11:18 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

First run measured — run 30903169627

32 jobs emitted. Counted from actions/runs/.../jobs, not inferred from the rollup — a startup_failure would have reported jobs.total_count = 0 and emitted no contexts, which reads exactly like success. It did not; this is a real run.

22 success · 8 failure · 2 skipped (plus 6 further intentional skips inside that count).

result	jobs
✅ success (22)	PHP Quality ×6 (lint, phpcs, phpmd, psalm, phpstan, phpmetrics) · Vue Quality ×2 (eslint, stylelint) · Frontend Build · Frontend Tests (unit) · Frontend Check (check:manifest) · Frontend Check (check:widget-keys) · Security ×2 · License ×2 · Features Check
❌ failure (8)	PHPUnit ×6 (8.3/8.4 × stable31/32/33) · E2E Tests (Playwright) · Quality Report (rollup of the above)
⏭️ skipped	Integration Tests (Newman), Journeydoc Capture, Coverage Baseline Protection, Coverage Baseline Check, Hydra Gates — all deliberately off. Features Extract + SBOM are push-only and correctly skipped on a PR.

Every PHP and frontend static-analysis gate passed on hrmq's first exposure to CI. That is a genuinely good result for a repo that has never had any.

---

Failure 1 — PHPUnit ×6: a FALSE RED, now fixed (b0f894d)

981 tests, 4004 assertions, exactly 1 failure, identical on all six legs:

1) OCA\Hrmq\Tests\Unit\AppInfoTest::testInfoXmlIsWellFormedXml
appinfo/info.xml failed to parse via simplexml_load_file() - the same call
Nextcloud's app:enable uses, so this makes the app uninstallable.
Failed to load external entity because the resolver function returned null (line 0)

Nine seconds earlier, in the same job, occ app:enable hrmq printed hrmq 0.2.0 enabled. The test asserted the app was uninstallable immediately after the same job installed it. That contradiction is the tell — the failure was about the call, not the file.

Two facts, neither visible on a dev machine:

1. OC\App\InfoParser::parse() uses simplexml_load_string(file_get_contents($file)). It has never used simplexml_load_file() — so the test's stated premise ("the same call Nextcloud's app:enable uses") was factually wrong about which call that is.
2. tests/bootstrap.php requires the server's lib/base.php whenever a full checkout is present — always true under this workflow, where the app is mounted at server/apps/hrmq. base.php then calls libxml_set_external_entity_loader(static fn () => null). Under that loader simplexml_load_file() resolves even the primary document through the resolver and returns false for a perfectly valid file.

So the test passed for everyone locally (no server checkout → no hardening) and could only ever fail once CI existed. Reproduced under the same null loader:

simplexml_load_file()   => FALSE  "Failed to load external entity"
simplexml_load_string() => OK     (id=hrmq)

Fixed by mirroring InfoParser exactly. Positive control — under the same hardened loader the fixed parse still rejects the exact defect the docblock was written for:

real info.xml             => OK    (passes)
malformed (-- in comment) => FALSE (fails: "Double hyphen within comment")

Not a dead gate. No test disabled, no CI input weakened.

Fleet check: searched the org three independent ways (gh search code for simplexml_load_file / testInfoXmlIsWellFormedXml, enumeration of tests/Unit/ across all 75 PHP repos, and per-repo search across the 20 NC-app repos), with the known hrmq hit as a positive control first. hrmq is the only repo with this test. 17 other repos load base.php and run PHPUnit against a server checkout, so they are latent — nextcloud-app-template most of all, since it is the fleet's copy source.

---

Failure 2 — E2E (Playwright): RED, and legitimately so

68 failed, 2 passed, 10.1 min (cap is 45, so this is a real verdict, not a timeout, and not a cancellation).

Deliberately left enabled and left red. The job is not misconfigured and the suite is not broken — the CI instance is simply missing hrmq's data.

The suite diagnosed itself:

Could not resolve the hrmq Employee schema on http://localhost:8080 — none of
employee, Employee, hrmq_employee answered 200 on
.../apps/openregister/api/objects/hrmq/<schema>.
Is the hrmq register installed in OpenRegister?

It is not. occ app:enable hrmq exits 0, but the register import runs from lib/Repair/InitializeRegister.php — an IRepairStep, which has no user session, so OpenRegister's RBAC denies it and the step swallows the exception as a warning. Enable succeeds; nothing is imported.

The failure shape confirms it exactly. Every failing page redirects to the same place:

Expected substring: "/mijn/doelen"
Received string:    "/index.php/apps/hrmq/timesheets"

/timesheets is the default route. With no register, every schema-driven manifest page falls back to it. And the only browser test that passed is [index] Timesheets mounts at /timesheets — the one whose expected URL happens to be the fallback destination. (The other pass is manifest sanity, a pure in-process assertion with no browser.) So the two greens are not evidence the app works; they are what "everything falls back to the default" looks like from the outside.

Required follow-up, not a config tweak: hrmq needs a ci-seed.sh that performs the register import over the admin HTTP API and then verifies the register + schema slugs, wired in as playwright-seed-command — exactly the route larpingapp took for the identical IRepairStep/RBAC problem. That is real work and belongs in its own PR; tuning an input cannot fix it.

Two things I did not do, on purpose: I did not set enable-playwright: false, and I did not weaken the specs. A skipped E2E job reports skipped, which reads exactly like a job with nothing to complain about — strictly worse than a red one that names its cause.

[rubenvdlinde]

Correction to the tally above

I wrote "22 success · 8 failure · 2 skipped" in the previous comment. That was wrong — I tallied by hand instead of counting. The actual figures, from actions/runs/30903169627/jobs:

32 jobs — 17 success · 8 failure · 7 skipped.

The failure and skip lists in the table above were correct; the success count was not (17, not 22). The 7 skips are: Newman, Journeydoc Capture, Coverage Baseline Protection, Coverage Baseline Check, Hydra Gates (all deliberately off) plus Features Extract and SBOM (push-only, correctly skipped on a PR). Nothing else changes — the analysis of both failures stands.

[github-actions]

Quality Report — ConductionNL/hrmq @ a69253e

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-widget-keys		✅
composer			✅	✅ 99/99
npm			✅	✅ 813/813
PHPUnit					✅
Newman					⏭️
Playwright					❌

---

Quality workflow — 2026-08-04 11:34 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/hrmq @ 6d30da0

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-widget-keys		✅
composer			✅	✅ 99/99
npm			✅	✅ 813/813
PHPUnit					✅
Newman					⏭️
Playwright					❌

---

Quality workflow — 2026-08-04 14:48 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/hrmq @ 8ac2d81

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-widget-keys		✅
composer			✅	✅ 99/99
npm			✅	✅ 813/813
PHPUnit					✅
Newman					⏭️
Playwright					✅

---

Quality workflow — 2026-08-04 15:05 UTC

Download the full PDF report from the workflow artifacts.