chore: raise Nextcloud floor to 32 (PHP 8.3) on main

[rubenvdlinde]

Raises the Nextcloud floor on main from 31 to 32. PHP floor was already 8.3 and is unchanged. max-version="34" is preserved unchanged.

Note: main's floor was 31, not 28. development is already at 32; grep-based readings of this file have produced false 28 readings today because of the commented-out examples it carries.

Why

Product directive from the PO (Ruben): the fleet standardises on Nextcloud 32 so it can require PHP 8.3 — "we want php 8.3 so going for min version nc 32 fleet wide is a good thing."

The governing rule (openconnector#1172 / openconnector#1173): an app's min-version must be >= the max of every <app> dependency's floor, or the App Store advertises a range the app cannot deliver — the dependency refuses to install and the app is non-functional there.

Re-measured on this branch's date with an XML parser (not grep): openregister@development appinfo/info.xml declares nextcloud min-version="32" max-version="34" and php min-version="8.3" (openregister#2384).

Shape

Floor-only PR opened directly against main. Reason: main trails development by 188–5206 commits across this fleet, so a development -> main merge would be a full release, not a floor fix.

Measurement note: appinfo/info.xml in these repos contains literal Nextcloud-dependency examples inside XML comments, so all before/after values here were read with xml.etree.ElementTree, never grep. The added comment is deliberately prose only — it contains no XML element syntax, because floor guards count raw regex matches of the nextcloud element across the whole file including comments, and a quoted example would trip as a second contradictory declaration. Validated before push: file parses as XML, and <nextcloud\b[^>]*> matches exactly once.

Why stable31 leaves the matrix in the same PR

The floor is enforced at install time, so occ app:enable refuses on NC 31. The shared workflow runs app-enable as || echo "::warning::...", so that refusal is only a warning — the job continues without its data layer and dies ~70s later on missing schemas, which reads like an app/migration fault rather than an unsatisfiable dependency. Order matters too: the newman / playwright / journeydoc jobs check the server out at fromJSON(inputs.nextcloud-test-refs)[0].

CI leg changed

.github/workflows/code-quality.yml: nextcloud-test-refs: '["stable31", "stable32"]' -> '["stable32"]' (verified present on main at line 17 before the edit).

[github-actions]

Quality Report — ConductionNL/doriath @ 9caa9ca

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
composer			❌	✅ 102/102
npm			✅	✅ 309/309
PHPUnit					❌
Newman					❌
Playwright					⏭️
Hydra gates					⏭️

---

Quality workflow — 2026-08-08 16:10 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

Merge-gate evidence (names, not counts).

Baseline: I dispatched a fresh Code Quality run on main at head b40073a6 — run 31266088908.

I did not use the push-triggered run at the same sha (31253824326), because in that run PHPUnit and Newman are skipped with their job names still showing the unexpanded PHPUnit (PHP ${{ matrix.php-version }}, NC ${{ matrix.nextcloud-ref }}) template — the matrix never expanded. A skipped job is no verdict, not a pass, and treating it as one would have made this PR look like it introduced four PHPUnit failures that are in fact already on main.

main failing job names (fresh dispatch):

Integration Tests (Newman)
PHPUnit (PHP 8.3, NC stable31)
PHPUnit (PHP 8.3, NC stable32)
PHPUnit (PHP 8.4, NC stable31)
PHPUnit (PHP 8.4, NC stable32)
Security (composer)

This PR failing job names:

Integration Tests (Newman)
PHPUnit (PHP 8.3, NC stable32)
PHPUnit (PHP 8.4, NC stable32)
Security (composer)

Strict subset, and strictly smaller: both NC stable31 legs are gone, which is the intended effect of this PR. No new failure name. Quality Report is a pure aggregator and is excluded on both sides.

The one extra, called out rather than glossed: branch-protection / check-branch fails with "Only beta and hotfix/* branches can be merged into main." That is a shape gate, not repo debt — it cannot pass for any floor-only branch and never appears in a main baseline because it is pull_request-scoped. Merging past it is a deliberate, recorded exception for a metadata-only floor fix; main trails development by thousands of commits, so the beta -> main route would be a full release.