chore: raise Nextcloud floor to 32 (PHP 8.3) on main

[rubenvdlinde]

Raises the Nextcloud floor on main from 29 to 32. PHP floor was already 8.3 and is unchanged. max-version="34" is preserved unchanged.

This repo declares <app>openregister</app> in appinfo/info.xml, so the governing rule below binds it directly.

Why

Product directive from the PO (Ruben): the fleet standardises on Nextcloud 32 so it can require PHP 8.3 — "we want php 8.3 so going for min version nc 32 fleet wide is a good thing."

The governing rule (openconnector#1172 / openconnector#1173): an app's min-version must be >= the max of every <app> dependency's floor, or the App Store advertises a range the app cannot deliver — the dependency refuses to install and the app is non-functional there.

Re-measured on this branch's date with an XML parser (not grep): openregister@development appinfo/info.xml declares nextcloud min-version="32" max-version="34" and php min-version="8.3" (openregister#2384).

Shape

Floor-only PR opened directly against main. Reason: main trails development by 188–5206 commits across this fleet, so a development -> main merge would be a full release, not a floor fix.

Measurement note: appinfo/info.xml in these repos contains literal Nextcloud-dependency examples inside XML comments, so all before/after values here were read with xml.etree.ElementTree, never grep. The added comment is deliberately prose only — it contains no XML element syntax, because floor guards count raw regex matches of the nextcloud element across the whole file including comments, and a quoted example would trip as a second contradictory declaration. Validated before push: file parses as XML, and <nextcloud\b[^>]*> matches exactly once.

Why stable31 leaves the matrix in the same PR

The floor is enforced at install time, so occ app:enable refuses on NC 31. The shared workflow runs app-enable as || echo "::warning::...", so that refusal is only a warning — the job continues without its data layer and dies ~70s later on missing schemas, which reads like an app/migration fault rather than an unsatisfiable dependency. Order matters too: the newman / playwright / journeydoc jobs check the server out at fromJSON(inputs.nextcloud-test-refs)[0].

CI leg changed

.github/workflows/code-quality.yml omitted nextcloud-test-refs entirely, so it silently inherited the shared workflow's default. Verified directly against ConductionNL/.github@main .github/workflows/quality.yml, line 24: default: '["stable31", "stable32"]'. This PR adds an explicit nextcloud-test-refs: '["stable32"]'.

The pre-existing comment in that workflow mentioning stable31/stable32 is prose, not the input — it has been updated to stay truthful, but it was never what set the matrix.

[github-actions]

Quality Report — ConductionNL/launchpad @ 51dd931

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	❌
phpmd	❌
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		❌
stylelint		❌
build		✅
composer			❌	✅ 100/100
npm			✅	✅ 416/416
PHPUnit					❌
Newman					❌
Playwright					⏭️
Hydra gates					⏭️

---

Quality workflow — 2026-08-08 16:08 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

Merge-gate evidence (names, not counts).

Baseline: I dispatched Code Quality on main at head 9a695aec to get a fresh baseline (run 31266087291), rather than relying on the last push-triggered run.

main failing job names:

Integration Tests (Newman)
PHP Quality (phpcs)
PHP Quality (phpmd)
PHPUnit (PHP 8.3, NC stable31)
PHPUnit (PHP 8.3, NC stable32)
PHPUnit (PHP 8.4, NC stable31)
PHPUnit (PHP 8.4, NC stable32)
Security (composer)
Vue Quality (eslint)
Vue Quality (stylelint)

This PR failing job names:

Integration Tests (Newman)
PHP Quality (phpcs)
PHP Quality (phpmd)
PHPUnit (PHP 8.3, NC stable32)
PHPUnit (PHP 8.4, NC stable32)
Security (composer)
Vue Quality (eslint)
Vue Quality (stylelint)

Strict subset — and strictly smaller: the two NC stable31 legs are gone, which is exactly the intended effect of this PR. No new failure name is introduced. Quality Report is a pure aggregator and is excluded from the comparison on both sides.

Not a subset, and called out rather than glossed: Branch Policy Check and check / check-branch fail with "Branch chore/nc-floor-32-main is not allowed to merge into main. Only beta and hotfix/* branches can be merged into main." That is a shape gate, not repo debt — it cannot pass for any floor-only branch, and it never appears in a main baseline because it is pull_request-scoped. Merging past it is a deliberate, recorded exception for a metadata-only floor fix, taken because main trails development by thousands of commits and the alternative (beta -> main) would be a full release.