Set up complete CI quality pipeline and app scaffold#3
Merged
Conversation
… ls, git, and common info commands
- Replace @typescript-eslint/eslint-plugin@^8.x with ^7.18.0 to satisfy peer dependency chain from @nextcloud/eslint-config via @vue/eslint-config-typescript - Add @typescript-eslint/parser@^7.18.0 and eslint-plugin-vue@^9.21.1 explicitly so transitive peer deps are hoisted to top-level node_modules (required by ESLint v8) - Add vue-eslint-parser@^9.4.3 explicitly to ensure it is hoisted and discoverable - Add stylelint.config.js to prevent stylelint picking up parent-directory config - Regenerate package-lock.json with correct dependency resolution
CI requires phpunit.xml or phpunit-unit.xml when enable-phpunit is true. Adds both config files, bootstrap files, and a placeholder unit test.
Provides a starting structure for API integration tests. Enable in CI by setting enable-newman: true in code-quality.yml.
The register() method is part of the IBootstrap interface contract. Like boot(), its $context parameter is intentionally unused in the template since it serves as a placeholder for app-specific registrations.
All three can now be tested locally: - phpmetrics: runs via composer phpmetrics locally - phpunit: runs via docker exec against the Nextcloud container (XDEBUG_MODE=coverage to avoid runner warning / non-zero exit) - newman: runs via npx newman against http://nextcloud.local
…in_password) CI workflow passes base_url/admin_user/admin_password but the collection used baseUrl/username/password. Mismatched names caused Newman to silently fall back to the collection default of http://localhost (port 80), which nothing answers in CI — resulting in ECONNREFUSED. Also updates default base_url to http://localhost:8080 to match the PHP built-in server CI starts for Newman tests.
…fold Add appspec/openspec scaffold, dev tooling, and CI-ready test infrastructure
…l CVE libxmljs2 <= 0.35.0 has a critical type confusion vulnerability (GHSA-78h3-pg4x-j8cv / CVE-2024-34394). The dependency is pulled in transitively by @cyclonedx/cyclonedx-npm (the SBOM generator). No patched release of the tool itself is available yet. Adding an npm overrides entry to force libxmljs2 to 0.37.0 (the patched version) is the standard npm approach for resolving transitive dependency vulnerabilities while keeping the consuming package unchanged.
WilcoLouwerse
changed the title
rjzondervan
approved these changes
Mar 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
appspec/andopenspec/scaffold directories with README templates, feature specs, ADR structure, and roadmap for spec-driven developmentphpmetrics,phpunit, andnewmanin CI; add PHPUnit config files (phpunit.xml,phpunit-unit.xml), bootstrap files, and a placeholder unit testbase_url,admin_user,admin_password) to match CI workflow expectationscomposer.lockandpackage-lock.jsonto ensure reproducible installs in CI; resolve npm peer dependency conflicts (TypeScript ESLint 7.x, vue-eslint-parser hoisting)Application.php, PHPMDUnusedFormalParametersuppression forregister()interface stubpull-request-lint-check.yamlworkflow to satisfy org branch protection rulesetlibxmljs2to0.37.0via npmoverrides(GHSA-78h3-pg4x-j8cv, pulled in by@cyclonedx/cyclonedx-npm)Checks
npm audit --audit-level=criticalpasses (no criticals after libxmljs2 override)Test plan