chore(quality): drive procest to 0 phpcs + phpstan + psalm; baseline phpmd; REUSE.toml

[rubenvdlinde]

Summary

Drives the procest quality gates to zero on phpcs, phpstan, and psalm; baselines phpmd's 287 pre-existing architectural findings; adds a repo-level REUSE.toml.

Gate counts (before → after)

Gate	Before	After
phpcs	0	0
phpmd	287 findings	0 new (287 baselined)
psalm	24 errors	0
phpstan	48 errors	0

Real bug fixes

• lib/Controller/CaseDefinitionController.php:127,159 — getUploadedFile() null-guard switched to is_array() (real NC impl returns array\|null, OCP stub docblock is wrong).
• lib/Service/AppointmentService.php:250-252 — dropped redundant ?? '' on non-nullable getConfigValue(); explicit empty-string fallback for the backend type.
• lib/Service/MilestoneService.php:141-145 — deleted dead else branch; the early return on empty $definitions above guarantees $total > 0.
• lib/Middleware/TenantMiddleware.php:77 — removed invalid @throws \OCP\AppFramework\Http\Response (not a Throwable).
• lib/Controller/StufController.php:418 — added @phpstan-param Http::STATUS_* narrowing to satisfy DataDisplayResponse's literal-union status code.

Structural addition

• lib/Service/SettingsService.php — added getObjectService(): ?object pass-through that lazy-resolves OCA\OpenRegister\Service\ObjectService from the DI container. Eliminates ~20 phpstan/psalm "undefined method" errors across 5 services that already had null-checked call sites. Mirrors the loadConfiguration() pattern for ConfigurationService — OpenRegister is an optional runtime dependency, so the class cannot be type-hinted directly in the constructor.

Suppressions (each with an inline reason)

phpstan.neon

• IRequest::getContent() / IRequest::setParameter() — exist in NC Request impl but missing from nextcloud/ocp interface stub.
• IMessage::attachFile() — implemented in NC Mail\Message, not on OCP stub.
• method_exists('OC_Util', 'getVersionString') — version-compat check guarded by method_exists().
• Property ... never read, only written — DI-held services kept for future handlers / constructor-signature stability (pre-existing architectural pattern).
• Constant ... is unused — documented defaults kept for config export.
• Strict comparison ... always evaluate to false — getUploadedFile() stub drift (keeps runtime null guard).

psalm.xml

• OC_Util (UndefinedClass) — version-compat check.
• DOMNode::getElementsByTagName (UndefinedMethod) — DOMNode narrows to DOMElement at runtime; psalm can't track the downcast.
• UnusedParam in lib/Service/ — interface-contract params and planned-feature hooks kept for API stability.

REUSE.toml

Declares SPDX copyright/licence for:

• PHP / JS / Vue / CSS / SCSS / shell — EUPL-1.2.
• JSON / YAML / XML / Markdown / images / l10n / locked files — CC0-1.0.

No individual PHP files touched — per ADR-014, licence is expressed via @author/@copyright/@license docblocks in PHP, not SPDX header lines.

phpmd baseline

composer phpmd now runs with --baseline-file phpmd.baseline.xml; the 287 pre-existing findings (159 ElseExpression, 93 MissingImport, 32 Avoid*, 3 Remove*) are architectural debt not addressed in this PR. Future violations will fail the gate.

Commits

1. chore(quality): phpcbf auto-fixes (1147 violations) — and 8 follow-up phpcs commits (already on branch)
2. fix(quality): add SettingsService::getObjectService() pass-through
3. fix(quality): real phpstan bug fixes across controllers and services
4. chore(quality): phpstan/psalm framework-drift suppressions with reasons
5. chore(quality): phpmd baseline for pre-existing architectural findings
6. chore(licence): add REUSE.toml for repo-level REUSE compliance

Test plan

• composer phpcs → 0 errors
• composer phpmd → 0 new findings
• composer psalm → "No errors found"
• composer phpstan → "No errors"
• composer check:strict passes end-to-end

[github-actions]

Quality Report — ConductionNL/procest @ 43c01b5

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		❌
stylelint		❌
composer			✅	✅ 100/100
npm			❌	❌
PHPUnit					⏭️
Newman					⏭️
Playwright					⏭️

---

Quality workflow — 2026-04-20 08:15 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/procest @ 9f29935

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	❌
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		❌
stylelint		❌
composer			✅	✅ 100/100
npm			❌	❌
PHPUnit					⏭️
Newman					⏭️
Playwright					⏭️

---

Quality workflow — 2026-04-20 08:35 UTC

Download the full PDF report from the workflow artifacts.