fix(ci): unblock the pipeline — resync package-lock, and use the real app id (E2E has never run)

[rubenvdlinde]

Two independent one-word defects, stacked, kept most of this repo's CI dark. enable-playwright: true was already set — the toggle was never the problem.

1. package.json / package-lock.json out of sync

npm error code EUSAGE
npm error Missing: picomatch@4.0.5 from lock file

Exactly one package. rollup-plugin-license carries a nested fdir@6.4.3 whose optional peer is picomatch@^3 || ^4; the hoisted node_modules/picomatch is 2.3.2, so that peer needs its own nested entry and the lockfile had none. npm install --package-lock-only adds precisely that one entry — 15 lines, no other resolution moves.

Two things kept it invisible:

• npm 11 tolerates it; npm 10 does not. A dev box on a current node installs cleanly; CI reads .nvmrc (node 20 → npm 10) and fails. Same commit, opposite verdict.
• The blast radius was not the npm jobs. The shared workflow's Playwright and PHPUnit jobs carry needs.security.result != 'failure', and Security (npm) begins with npm ci — so a one-line lockfile gap deleted them. They reported skipped, which the Quality Report renders identically to a pass, and the 15 spec files under tests/e2e/ had never executed in CI. Vue Quality (eslint + stylelint), Frontend Build, Frontend Tests (unit) and License (npm) all died on the same npm ci.

2. app-name was the repo name, not the Nextcloud app id

With Security (npm) green, PHPUnit and E2E ran for the first time — and both died in under 80 seconds on one line (measured, run 31031058500):

php occ app:enable app-versions
App not found

The shared workflow checks the app out into server/apps/<app-name> and enables <app-name>. Nextcloud requires that directory to be named after the id in appinfo/info.xml — app_versions, with an underscore — while the repository is app-versions, with a hyphen. The app was never enabled and no test was ever collected.

This is the second dead layer under the same tarpaulin: the jobs that would have reported the wrong app id are exactly the ones the security gate had already deleted, so it looked like a green pipeline.

Follow-up, deliberately not changed here because this PR cannot measure it: release-beta.yml and release-stable.yml pass the same hyphenated app-name, and the shared release workflow uses it both as the top-level directory inside the release tarball and as the App Store registration identifier that gets signed. Both of those also want the app id.

Two findings the newly-live jobs reported

• stylelint: word-break: break-word is deprecated → overflow-wrap: break-word, in the two components the lint actually covers.
• docs/features.json was stale against openspec/specs/ — it listed 1 of 10 features, and that one with an outdated summary. Regenerated with the shared extract-features.py, which is what Features Check verifies.

What is deliberately NOT in this PR

An earlier commit here quoted the stylelint globs. That is a real finding — unquoted, the shell (no globstar) expands src/**/*.vue to src/*/*.vue, matching src/components/ but not src/App.vue, so the largest component in the app has never been linted. But fixing it forces edits to App.vue, and App.vue in the diff pulls in three diff-scoped Hydra a11y gates that pass vacuously on any PR that does not touch it:

[gate-38] skip-link               FAIL — 1 root component
[gate-40] form-label-association  FAIL — 5 inputs
[gate-45] prefers-reduced-motion  FAIL — 1 <style> block

Two of those want judgement a CI-unblocking PR should not be making:

• gate-40 is a false positive on 4 of its 5 findings. Those inputs are each wrapped in a <label> carrying visible text — implicit association, valid HTML and valid WCAG. The gate's regex simply cannot see a wrapping label across a multi-line <input>. "Fixing" them with aria-label would override the visible label and regress SC 2.5.3 (Label in Name). Only the version-filter input (placeholder, no label) is a genuine defect.
• gate-38 wants a skip link on App.vue, which renders inside Nextcloud's admin settings page — a surface that already carries core's own skip link.

So the stylelint scope returns to exactly what it was and the debt is recorded for a follow-up. #124 measured the same four gates (38/40/43/45) as inherited whole-tree debt at both v1.0.1 and v1.3.0 — same conclusion. Nothing is skipped, waived, excluded or continue-on-error'd. No @conduction/nextcloud-vue pin exists in this repo to touch.

Verified locally (node 20.20.2 / npm 10.9.8 — CI's pair)

Reproduced the EUSAGE first on the same node, so the two arms are known to differ.

check	result
npm ci	exit 0
npm audit --audit-level=critical --omit=dev	exit 0
npm run build	162 modules, bundle emitted
npm run lint	0 errors (25 pre-existing jsdoc warnings)
npm run stylelint	0 errors
npm run test	58 passed / 11 files
extract-features.py --check	clean
run-hydra-gates.sh --scope-to-diff	clean on this diff

Known, unrelated, NOT fixed here

SBOM fails with There are no commands defined in the "CycloneDX" namespace — this repo has no cyclonedx-php-composer in composer.json. Independent of the lockfile, and that job only runs on pushes to main/beta/development, so it does not appear on a PR at all.

[github-actions]

Quality Report — ConductionNL/app-versions @ 6b68d70

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
composer			✅	✅ 17/17
npm			✅	✅ 282/282
PHPUnit					❌
Newman					⏭️
Playwright					❌
Hydra gates					❌

---

Quality workflow — 2026-08-05 17:44 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/app-versions @ e8f70e9

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
composer			✅	✅ 17/17
npm			✅	✅ 282/282
PHPUnit					❌
Newman					⏭️
Playwright					❌
Hydra gates					❌

---

Quality workflow — 2026-08-05 18:30 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/app-versions @ 9f36248

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
composer			✅	✅ 17/17
npm			✅	✅ 282/282
PHPUnit					❌
Newman					⏭️
Playwright					❌
Hydra gates					✅

---

Quality workflow — 2026-08-05 18:50 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/app-versions @ f31df02

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	❌
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
composer			✅	✅ 17/17
npm			✅	✅ 282/282
PHPUnit					❌
Newman					⏭️
Playwright					❌
Hydra gates					✅

---

Quality workflow — 2026-08-05 19:46 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

Closing as superseded, and it would regress the app-id rename if merged.

Its stated purpose is done. The title is "unblock the pipeline — resync package-lock", and development's Code Quality is green (today 10:15). Nothing is blocked.

Its migration is already on development. Version1004Date20260725120000.php exists there.

Merging it now would undo work. This branch predates app-versions → versioniq, so its Vue components still call t('app_versions', …) where development calls t('versioniq', …):

-  {{ t('versioniq', 'Changes in this range') }}
+  {{ t('app_versions', 'Changes in this range') }}

The branch carries 55 app_versions references in src/App.vue alone against development's 5. A translation key is namespaced by the app id, so re-pointing those at the retired id does not fail loudly — the lookup misses and the UI silently renders untranslated. That is the whole class of defect the rename sweep existed to remove.

The one part not obviously superseded is docs/features.json (+65). If that content is still wanted it should be re-applied on top of current development, where it can be written against the current app id, rather than dragged in behind a 19-day-old lockfile resync.