chore(ci): stop pinning hydra-gates — track the package at @main

[rubenvdlinde]

What

Deletes the hydra-gates-ref: line from .github/workflows/code-quality.yml. Nothing replaces it — the input's default in the shared workflow is already main, so removing the override is the whole change.

enable-hydra-gates is untouched. enable-axe is untouched.

Why not just keep (or bump) the pin

This repo consumes ConductionNL/.github/.github/workflows/quality.yml @main. Pinning the gates package to a tag while consuming the workflow at @main splits the two halves apart: the runner moves with upstream, the package it runs does not. We have now been bitten by that split from both directions.

• Falsely green — .github#159. All 22 repos were pinned to v1.0.1, which predated the fixes that made the gates actually execute. 16 gates were dead fleet-wide and every one of them reported PASS. A check that did not run looks exactly like one that passed.
• Falsely red — .github#173. A default was flipped at .github main and reached those same old pinned runners, which had no accounting to honour it with, so they went red on gates they had no subject matter for.

Bumping the pin fixes neither — it just resets the clock and guarantees the same two failures on the next release. Unpinned, both sides move together and a gate fix reaches this repo without a commit in this repo.

The pin-justifying comment block (the version history, the reproducibility argument) is replaced with a short note saying why there is deliberately no ref here. The rationale for having the gates on at all is kept.

Rollback and escape hatch

• For everyone: revert on ConductionNL/.github main. One commit, whole fleet.
• For this one repo: set hydra-gates-ref: explicitly again with a comment saying why. The input is still honoured — this PR removes an override, not a capability.

Safety net

ConductionNL/.github#177 adds a resolve probe plus the gates package test suite gating .github main, so a gates change that would not resolve, or that would break the runner, is caught before it can reach @main consumers like this one.

Verification

• grep -n "hydra-gates" .github/workflows/code-quality.yml — no hydra-gates-ref: key remains.
• yaml.safe_load on the workflow parses clean.

[github-actions]

Quality Report — ConductionNL/portaliq @ 7369ce9

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
check-manifest		❌
composer			✅	✅ 100/100
npm			✅	✅ 871/871
PHPUnit					✅
Newman					✅
Playwright					✅
Hydra gates					❌

---

Quality workflow — 2026-08-06 05:47 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/portaliq @ 7369ce9

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
check-manifest		❌
composer			✅	✅ 100/100
npm			✅	✅ 871/871
PHPUnit					✅
Newman					✅
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-06 07:28 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/portaliq @ 46e1846

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
check-manifest		❌
composer			✅	✅ 100/100
npm			✅	✅ 871/871
PHPUnit					✅
Newman					✅
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-06 08:06 UTC

Download the full PDF report from the workflow artifacts.