Skip to content

chore(release): sync beta back into development - #456

Closed
github-actions[bot] wants to merge 30 commits into
developmentfrom
sync/beta-to-development-1.0.19-beta.20260830165605
Closed

chore(release): sync beta back into development#456
github-actions[bot] wants to merge 30 commits into
developmentfrom
sync/beta-to-development-1.0.19-beta.20260830165605

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

Opened by the release workflow after publishing 1.0.19-beta.20260830165605 from beta.

A release commits a version bump onto the branch it ran from. Without carrying
that back, development falls behind beta, and since both branches then
changed the version file independently, the next development -> beta
promotion conflicts on it — every time.

Version files are resolved to development's side, the higher line, so this
cannot move a version backwards. Any other conflict stops the workflow instead
of being resolved automatically.

Merge this, do not squash. A squash copies the files and discards the
relationship: the merge base would not move and the next promotion would
conflict exactly as before. A 0-file diff here is normal and is not a no-op —
recording the ancestry is the whole point.

rubenvdlinde and others added 30 commits March 5, 2026 11:22
chore: Merge development into main
… updates (#37)

Bumps the npm_and_yarn group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.14` |
| [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` |
| [picomatch](https://github.com/micromatch/picomatch) | `4.0.3` | `4.0.4` |
| [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` |
| [postcss](https://github.com/postcss/postcss) | `7.0.39` | `8.5.12` |
| [ajv](https://github.com/ajv-validator/ajv) | `6.12.6` | `6.15.0` |
| [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.2` |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.11` | `1.16.0` |
| [lodash](https://github.com/lodash/lodash) | `4.17.23` | `4.18.1` |
| [serialize-javascript](https://github.com/yahoo/serialize-javascript) | `6.0.2` | `removed` |

Bumps the npm_and_yarn group with 9 updates in the /docusaurus directory:

| Package | From | To |
| --- | --- | --- |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.14` |
| [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` |
| [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` |
| [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.12` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.3.1` | `3.4.1` |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.11` | `1.16.0` |
| [lodash](https://github.com/lodash/lodash) | `4.17.23` | `4.18.1` |
| [path-to-regexp](https://github.com/pillarjs/path-to-regexp) | `0.1.12` | `0.1.13` |
| [svgo](https://github.com/svg/svgo) | `3.3.2` | `3.3.3` |



Updates `brace-expansion` from 1.1.12 to 1.1.14
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.14)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Updates `picomatch` from 4.0.3 to 4.0.4
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.3...4.0.4)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.3...4.0.4)

Updates `postcss` from 7.0.39 to 8.5.12
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@7.0.39...8.5.12)

Updates `ajv` from 6.12.6 to 6.15.0
- [Release notes](https://github.com/ajv-validator/ajv/releases)
- [Commits](ajv-validator/ajv@v6.12.6...v6.15.0)

Updates `axios` from 1.13.4 to 1.15.2
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.13.4...v1.15.2)

Updates `dompurify` from 3.3.1 to 3.4.1
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.3.1...3.4.1)

Updates `flatted` from 3.3.3 to 3.4.2
- [Commits](WebReflection/flatted@v3.3.3...v3.4.2)

Updates `follow-redirects` from 1.15.11 to 1.16.0
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0)

Updates `immutable` from 5.1.4 to 5.1.5
- [Release notes](https://github.com/immutable-js/immutable-js/releases)
- [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md)
- [Commits](immutable-js/immutable-js@v5.1.4...v5.1.5)

Updates `lodash` from 4.17.23 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

Updates `path-to-regexp` from 0.1.12 to 0.1.13
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md)
- [Commits](pillarjs/path-to-regexp@v0.1.12...v.0.1.13)

Updates `qs` from 6.14.1 to 6.14.2
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.1...v6.14.2)

Removes `serialize-javascript`

Updates `webpack-dev-server` from 4.15.2 to 5.2.3
- [Release notes](https://github.com/webpack/webpack-dev-server/releases)
- [Changelog](https://github.com/webpack/webpack-dev-server/blob/main/CHANGELOG.md)
- [Commits](webpack/webpack-dev-server@v4.15.2...v5.2.3)

Updates `brace-expansion` from 1.1.12 to 1.1.14
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.14)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.5)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.3...4.0.4)

Updates `postcss` from 8.5.6 to 8.5.12
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@7.0.39...8.5.12)

Updates `dompurify` from 3.3.1 to 3.4.1
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.3.1...3.4.1)

Updates `follow-redirects` from 1.15.11 to 1.16.0
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0)

Updates `lodash` from 4.17.23 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

Updates `path-to-regexp` from 0.1.12 to 0.1.13
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md)
- [Commits](pillarjs/path-to-regexp@v0.1.12...v.0.1.13)

Updates `svgo` from 3.3.2 to 3.3.3
- [Release notes](https://github.com/svg/svgo/releases)
- [Commits](svg/svgo@v3.3.2...v3.3.3)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.14
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ajv
  dependency-version: 6.15.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-version: 1.15.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-version: 3.4.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: flatted
  dependency-version: 3.4.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: immutable
  dependency-version: 5.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: path-to-regexp
  dependency-version: 0.1.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.14.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: serialize-javascript
  dependency-version: 
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: webpack-dev-server
  dependency-version: 5.2.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.14
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.12
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-version: 3.4.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: path-to-regexp
  dependency-version: 0.1.13
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: svgo
  dependency-version: 3.3.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the npm_and_yarn group with 1 update in the /docusaurus directory: [lodash-es](https://github.com/lodash/lodash).


Updates `lodash-es` from 4.17.23 to 4.18.1
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

---
updated-dependencies:
- dependency-name: lodash-es
  dependency-version: 4.18.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…ile)

173 commits from beta. Three conflicts resolved:

- appinfo/info.xml: take beta's version + license
  (1.0.3-unstable.4 + EUPL-1.2 — main was 1.0.2 + agpl,
  the EUPL-1.2 transition happened on the development line
  weeks ago).
- package.json: take beta's full devDependency set
  (vitest + @vue/test-utils + @vitejs/plugin-vue2 +
  @nextcloud/webpack-vue-config@^5.5.0). Main's
  webpack-vue-config@^7.0.2 (from dependabot #69) had peer
  conflicts with beta's locked webpack-cli, so a clean
  install couldn't satisfy both. Conservative choice:
  keep beta's known-good build chain; re-bump
  webpack-vue-config to v7 in a follow-up PR with proper
  peer-dep upgrades.
- package-lock.json: take beta's lockfile then
  `npm install` to regenerate against the merged
  package.json. Result: 1521 packages installed
  cleanly (1 deprecation warning for eslint@8.57.1,
  same as on beta).

Closes the 173-commit gap that built up while beta was
moving forward — most notably brings the npm audit fix
(#81 — clears all 6 high-severity vulnerabilities), the
phpcs/phpstan/eslint fixes (#75/#79/#90), the dashboard
sharing + widget feature batch (#44#68), and the
@nextcloud/vue → @conduction/nextcloud-vue swap (#71)
into the stable branch.
Release: merge beta into main (1.0.3-unstable.4) — manual conflict resolution
- Declare missing @nextcloud/webpack-vue-config@5 build peers as
  devDependencies (webpack, webpack-cli, @babel/core, babel-loader,
  css-loader, sass, sass-loader, style-loader,
  node-polyfill-webpack-plugin) so 'npm run build' no longer fails with
  'webpack: not found'. Regenerate package-lock.json so 'npm ci' is in
  sync (CI runs plain npm ci).
- Add .forgejo/workflows/release-stable.yml and release-beta.yml so
  Codeberg/Forgejo actually fires the release on a main push (Forgejo
  only reads .forgejo/.gitea, not .github) — previously zero stable runs
  ever fired on main.
- Point .github release workflows at the live org (ConductionNL ->
  Conduction).

App store id (mydash) and the active-development notice (en+nl) are
unchanged.
…keep mydash store id + dev-notice

Take development's full modern tree onto main via an ours-merge + read-tree,
then layer the Vue-2.7 build fix (overrides: @vueuse/core@^10.11.1, pinia@^2.1.7)
and re-insert the conduction.nl dev-notice (en/nl) into appinfo/info.xml.
App id remains 'mydash'. .forgejo release-stable/release-beta workflows kept as-is.
Promotes the beta line (kiosk mode, spend-analytics widget, dashboard
quotas, AppHost observability, de/fr/es/it l10n parity, Vue 2.7 dep
hardening) to main for the stable App Store release.

Union-merge, no regression:
- Kept App Store id=mydash and workflow app-name=mydash / cname
  mydash.conduction.nl (main's deliberate fixes; beta had launchpad).
- Kept main's active-development dev-notice (17 June 2026) and the
  Forgejo CI fixes that enable the stable release.
- Resolved package.json/lock to the tight Vue 2.7 pins (pinia ~2.1.7,
  @vueuse/core ~10.11.1).
Brings the 31-remaining-locale l10n completion to the stable line so the
l10n-parity gate is green for all 36 required European locales. Union
merge preserves App Store id=mydash, workflow app-name=mydash, cname
mydash.conduction.nl, dev-notice, and the tight Vue 2.7 pins.
Brings the node:20-alpine container fix to the stable line so the
l10n-parity gate runs and goes green on main (36/36 European locales).
The pre-merge-check-strict / quality-gates job now runs and passes
(php:8.3-cli + node + xsl + precompiled exts; phpcs/phpmd/spec/phpstan
all green; gate-27 publish->publishDashboard rename). First green run.
The fleet timeout sweep bounded the development branches; main carries an
older, separate copy of these workflows that was missed. Add job-level
timeout-minutes so a hung runner fails fast instead of burning the full
6-hour GitHub default.

Bounds are deliberately loose relative to observed durations: a timeout
that fires under normal contention turns a slow run into a phantom defect.
The goal is to catch a hang, not to enforce speed.

Jobs that call a reusable workflow via uses: are untouched - GitHub rejects
timeout-minutes on such a job and the whole file becomes a startup_failure.
Those are bounded at source in ConductionNL/.github.

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
…, release path dead) (#37)

* ci: point shared-workflow callers at ConductionNL, not the non-existent Conduction org

All 8 reusable-workflow callers on main referenced `Conduction/.github`.
That org does not exist (`GET /repos/Conduction/.github` -> 404), so every
one of them ended in `startup_failure` with ZERO jobs -- including
release-stable.yml, which means launchpad had no working release path on
main at all. Pre-existing since 44ca662.

Three defects, all already fixed on development and never forward-ported:

1. Org typo, 8 callers: Conduction/.github -> ConductionNL/.github.
2. openspec-sync and issue-triage additionally pinned
   @feature/openspec-project-sync, a branch that does not exist on
   ConductionNL/.github (404). Fixing only the org would have left these
   two still failing to resolve. Retargeted to @main, where both callees
   exist and accept the same inputs.
3. app-name was `mydash` in 5 callers, copied in when the centralized
   workflows were adopted (bd55fde). appinfo/info.xml declares
   `launchpad`. The shared release workflow uses app-name as the tarball's
   top-level directory AND as the App Store registration id, so a
   now-working release would have published launchpad under mydash's
   identity. cname likewise corrected to launchpad.conduction.nl, matching
   docs/docusaurus.config.js.

Deliberately NOT ported from development: the Playwright / additional-apps
/ newman-seed enablement in code-quality.yml. That is a behaviour change
that belongs in the development -> beta -> main flow, not a hotfix.

.forgejo/ is untouched -- on Codeberg the org really is `Conduction`.

* ci: regenerate docs/features.json from openspec/specs/ [skip ci]

---------

Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
* chore: raise Nextcloud floor to 32

* chore(ci): pin nextcloud-test-refs to stable32 only
Dependabot reads its config from the DEFAULT branch (main here), whose
copy carried no target-branch - so every PR was opened against main
where branch-protection rejects it. This is development's file verbatim.
main held 28 commit(s) beta did not. Merged with -s ours: beta's
tree is kept BYTE FOR BYTE and only the ancestry is recorded, so the
beta -> main promotion stops conflicting on files where beta is simply
newer.

Not brought over -- beta is hundreds of commits ahead of main, so these
are the OLDER copies, and several are dead Forgejo/Codeberg CI that
development deliberately removed:

  .forgejo/workflows/release-beta.yml .forgejo/workflows/release-stable.yml .github/dependabot.yml .github/workflows/branch-policy.yml .github/workflows/branch-protection.yml .github/workflows/code-quality.yml .github/workflows/documentation.yml .github/workflows/issue-triage.yml .github/workflows/openspec-sync.yml .github/workflows/release-beta.yml .github/workflows/release-stable.yml .github/workflows/sync-to-beta.yml appinfo/info.xml docs/features.json
The 1.0.19-beta.20260830165605 release bumped the version on beta. Without this,
development stays behind beta and the next development -> beta promotion
conflicts on the version file.

Version files resolve to development's side, which is the higher line,
so this never moves a version backwards.
@github-actions
github-actions Bot enabled auto-merge August 30, 2026 16:58
@rubenvdlinde

Copy link
Copy Markdown
Contributor

Superseded. fleet-back-merge.yml could not merge these while it waited for green on branches red for unrelated reasons, so one accumulated per run (107 open across the fleet). ConductionNL/.github#648 removed that wait, and the sweep that followed carried and merged the same ancestry immediately. This pull request changes zero files, so closing it loses nothing: the ancestry it recorded is already on the branch.

auto-merge was automatically disabled August 30, 2026 17:53

Pull request was closed

@rubenvdlinde
rubenvdlinde deleted the sync/beta-to-development-1.0.19-beta.20260830165605 branch August 30, 2026 17:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants