fix(quality): scope the Migration phpmd exclusion to UnusedFormalParameter only

[rubenvdlinde]

What this fixes

Part of the fleet suppression audit (ConductionNL/.github#155). Tracked here by #2338.

openregister was the fleet's only repo whose <exclude-pattern>*/Migration/*</exclude-pattern>
actually worked — and that was the problem. A top-level exclude-pattern is applied by PDepend at
file-collection time, so it does not drop lib/Migration from one rule; it drops it from
every rule in the ruleset.

Measured on PHPMD 2.15.0 / PHP 8.4.22, that single line was silently swallowing 11 real
findings that had nothing to do with unused parameters:

rule	count
NPathComplexity	3
ElseExpression	3
StaticAccess	2
ExcessiveMethodLength	2
CyclomaticComplexity	1

The same file also carried a second <exclude-pattern>*Migration*</exclude-pattern> nested
inside the UnusedFormalParameter rule. PHPMD 2.15 honours exclude-patterns only as direct
children of <ruleset>; nested ones are parsed and discarded. That one was inert — it was the
top-level line doing all the work, for every rule.

The fix

phpmd.xml loses its top-level exclude-pattern and no longer declares UnusedFormalParameter.
A new sibling ruleset, phpmd-unusedparams.xml, holds that rule alone with its own top-level
exclude-pattern — so the lib/Migration exclusion now applies to exactly one rule, and every
other rule sees lib/Migration again.

composer phpmd runs both rulesets as separate legs, worst exit code winning; neither leg can
short-circuit the other:

"phpmd": "E=0; ./vendor/bin/phpmd lib text phpmd.xml --baseline-file phpmd.baseline.xml || E=$?; ./vendor/bin/phpmd lib text phpmd-unusedparams.xml --baseline-file phpmd.baseline.xml || E=$?; exit $E",

UnusedFormalParameter genuinely cannot apply to migrations: OCP\Migration\IMigrationStep
mandates changeSchema(IOutput $output, Closure $schemaClosure, array $options) and
preSchemaChange / postSchemaChange with the same three parameters. A step that needs none of
them still cannot drop them.

Retired suppressions

With the exclusion now scoped to the rule that needs it, every
@SuppressWarnings(PHPMD.UnusedFormalParameter) in lib/Migration/ is dead weight.
246 removed across 174 files (236 exact-match + 10 with a stray space before the paren, which
were never valid annotations in the first place). No suppression was added anywhere.

The 11 surfaced findings — all fixed

• Version1Date20260521120000.php — 2× ElseExpression. Extracted the two platform-specific
  index-drop paths into dropBareUuidIndexesPostgres() / dropBareUuidIndexesMysql() behind a
  dispatcher, and the platform-specific introspection query into
  queryTablesWithBareUuidIndex(). Same SQL, same order, same output messages.
• Version1Date20260524100000.php — NPathComplexity 256 + ExcessiveMethodLength 104.
  Five independent if (hasColumn) addColumn blocks became a spec list + one loop.
• Version1Date20260524130000.php — ExcessiveMethodLength 137. Column and index declarations
  extracted into addColumns() / addIndexes(), columns driven from a spec list.
• Version1Date20260525240000.php — NPathComplexity 256. Eight if (hasColumn) blocks →
  spec list + loop (the schema_id entry keeps its extra index).
• Version1Date20260614100000.php — CyclomaticComplexity 18 + NPathComplexity 131072.
  Fourteen if (hasColumn) blocks → spec list + loop.
• Version1Date20260706100000.php — 2× StaticAccess on \OCP\Server::get(). Now injects
  Psr\Container\ContainerInterface and resolves through it, which keeps the lazy resolution the
  original comment asks for (a DI failure during upgrade still degrades instead of aborting)
  while removing the static call. The unit test gains a container mock that throws, reproducing
  exactly the path it exercised before.
• Version1Date20260726000000.php — ElseExpression. Inverted to an early return.

All column-order, SQL text and IOutput messages are unchanged. No thresholds were relaxed and
no ternaries were introduced (Squiz.PHP.DisallowInlineIf).

Not in this PR

• phpmd.baseline.xml (517 entries) is untouched here; it is the subject of a follow-up.
• The 65 non-UnusedFormalParameter @SuppressWarnings still in lib/Migration/
  (36 ExcessiveMethodLength, 15 CyclomaticComplexity, 11 NPathComplexity, 2 StaticAccess,
  1 ExcessiveClassLength) were previously dead — the directory-wide exclusion made them
  unreachable. They are load-bearing from this PR onward. Burning them down belongs with the
  baseline work, not here.
• BUG: PDF→ODT anonymisation fallback (Path B) is unreachable in production — its tests construct the trigger themselves #2339 (the PdfTextReplacer $strict dead-parameter bug) is a real defect and is not
  touched by this PR. It lives outside lib/Migration, so it was never affected by the
  exclude-pattern either way.

Closes part of #2338.

[github-actions]

Quality Report — ConductionNL/openregister @ 359295e

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		❌
composer			✅	✅ 173/173
npm			✅	✅ 713/713
PHPUnit					✅
Newman					✅
Playwright					✅
Hydra gates					❌

---

Quality workflow — 2026-08-05 13:27 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/openregister @ 34c323f

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		❌
composer			✅	✅ 173/173
npm			✅	✅ 713/713
PHPUnit					✅
Newman					✅
Playwright					✅
Hydra gates					❌

---

Quality workflow — 2026-08-05 14:15 UTC

Download the full PDF report from the workflow artifacts.