chore(ci): stop pinning hydra-gates — track the package at @main

[rubenvdlinde]

What

Deletes the hydra-gates-ref: line from .github/workflows/code-quality.yml. Nothing replaces it — the input's default in the shared workflow is already main, so removing the override is the whole change.

enable-hydra-gates is untouched. enable-axe is untouched.

Why not just keep (or bump) the pin

This repo consumes ConductionNL/.github/.github/workflows/quality.yml @main. Pinning the gates package to a tag while consuming the workflow at @main splits the two halves apart: the runner moves with upstream, the package it runs does not. We have now been bitten by that split from both directions.

• Falsely green — .github#159. All 22 repos were pinned to v1.0.1, which predated the fixes that made the gates actually execute. 16 gates were dead fleet-wide and every one of them reported PASS. A check that did not run looks exactly like one that passed.
• Falsely red — .github#173. A default was flipped at .github main and reached those same old pinned runners, which had no accounting to honour it with, so they went red on gates they had no subject matter for.

Bumping the pin fixes neither — it just resets the clock and guarantees the same two failures on the next release. Unpinned, both sides move together and a gate fix reaches this repo without a commit in this repo.

The pin-justifying comment block (the version history, the reproducibility argument) is replaced with a short note saying why there is deliberately no ref here. The rationale for having the gates on at all is kept.

Rollback and escape hatch

• For everyone: revert on ConductionNL/.github main. One commit, whole fleet.
• For this one repo: set hydra-gates-ref: explicitly again with a comment saying why. The input is still honoured — this PR removes an override, not a capability.

Safety net

ConductionNL/.github#177 adds a resolve probe plus the gates package test suite gating .github main, so a gates change that would not resolve, or that would break the runner, is caught before it can reach @main consumers like this one.

Verification

• grep -n "hydra-gates" .github/workflows/code-quality.yml — no hydra-gates-ref: key remains.
• yaml.safe_load on the workflow parses clean.

[github-actions]

Quality Report — ConductionNL/procest @ 416ac6f

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue3-compile		✅
test-l10n		✅
composer			✅	✅ 100/100
npm			✅	✅ 550/550
PHPUnit					✅
Newman					⏭️
Playwright					✅
Hydra gates					❌

---

Quality workflow — 2026-08-06 06:11 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/procest @ 218af7d

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue3-compile		✅
test-l10n		✅
composer			✅	✅ 100/100
npm			✅	✅ 550/550
PHPUnit					✅
Newman					⏭️
Playwright					✅
Hydra gates					❌

---

Quality workflow — 2026-08-06 06:48 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/procest @ 218af7d

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue3-compile		✅
test-l10n		✅
composer			✅	✅ 100/100
npm			✅	✅ 550/550
PHPUnit					✅
Newman					⏭️
Playwright					✅
Hydra gates					❌

---

Quality workflow — 2026-08-06 07:27 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/procest @ 92f1056

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue3-compile		✅
test-l10n		✅
composer			✅	✅ 100/100
npm			✅	✅ 550/550
PHPUnit					✅
Newman					⏭️
Playwright					❌
Hydra gates					❌

---

Quality workflow — 2026-08-06 08:19 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

Hydra Gates is RED here on a genuine finding — not on this change

Hydra Gates fails on exactly one gate: gate-64 apphost-autoload-prelude (ADR-040). Everything else passes. This is a real finding and is being landed rather than silenced — no re-pin, no baseline, no continue-on-error.

Finding: lib/AppInfo/Registrar/AppHostRegistrar.php:33 has use OCA\OpenRegister\AppHost\Bootstrap; but nothing under lib/AppInfo/ registers OpenRegister's autoloader first.

Severity: LATENT. Apps register in sorted order — getEnabledApps() sorts, then Coordinator::registerApps() calls registerAutoloading() and register() one app at a time, so every app's register() runs before the PSR-4 prefix of every alphabetically-later app exists.

Why it is not a regression from this PR: the failure is pre-existing, and unpinning did not introduce it — it made it visible. Measured against this repo's own baseline, Hydra Gates was already red before this change.

The fix (ADR-040 prelude, called before any OCA\OpenRegister\… reference including a class_exists() probe):

$p = \OCP\Server::get(\OCP\App\IAppManager::class)->getAppPath('openregister');
\OC_App::registerAutoloading('openregister', $p);

wrapped in try/catch (\Throwable). doriath has a reference implementation in lib/AppInfo/OpenRegisterAutoloader.php. This is left as a separate change so it gets its own review rather than riding along on a CI-config PR.

[github-actions]

Quality Report — ConductionNL/procest @ 92f1056

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue3-compile		✅
test-l10n		✅
composer			✅	✅ 100/100
npm			✅	✅ 550/550
PHPUnit					✅
Newman					⏭️
Playwright					✅
Hydra gates					❌

---

Quality workflow — 2026-08-06 08:45 UTC

Download the full PDF report from the workflow artifacts.