Release: merge development into beta

.coverage-baseline

@@ -1 +1 @@
-49.47
+80.00

.github/sig-floor.json

@@ -0,0 +1,40 @@
+{
+ "about": "SIG 4-star checks this app meets and must keep meeting (gate 123, sig-floor). Generated by check_sig_floor.py write; raised by the workflow, never lowered by hand.",
+ "schema": 1,
+ "profile": "four-star",
+ "tools": {
+  "lizard": "1.24.3"
+ },
+ "unit_reader": 2,
+ "measured_at": "9080e1fa1847f34da7d39925e3f7422eb8afbd7b",
+ "checks": [
+  "javascript duplication",
+  "javascript unit_complexity >10",
+  "javascript unit_complexity >25",
+  "javascript unit_complexity >5",
+  "javascript unit_interfacing >2",
+  "javascript unit_interfacing >4",
+  "javascript unit_interfacing >6",
+  "javascript unit_size >15",
+  "javascript unit_size >30",
+  "javascript unit_size >60",
+  "php module_coupling >10",
+  "php module_coupling >20",
+  "php module_coupling >50",
+  "php unit_complexity >10",
+  "php unit_complexity >25",
+  "php unit_interfacing >4",
+  "php unit_interfacing >6",
+  "php unit_size >60",
+  "vue duplication",
+  "vue unit_complexity >10",
+  "vue unit_complexity >25",
+  "vue unit_complexity >5",
+  "vue unit_interfacing >2",
+  "vue unit_interfacing >4",
+  "vue unit_interfacing >6",
+  "vue unit_size >15",
+  "vue unit_size >30",
+  "vue unit_size >60"
+ ]
+}

.github/workflows/branch-policy.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [main, beta, development]
 
+permissions:
+  contents: read
+
 jobs:
   check-source-branch:
     name: Branch Policy Check

.github/workflows/code-quality.yml

@@ -154,29 +154,9 @@ jobs:
     with:
       app-name: launchpad
       php-version: "8.3"
-      # Pinned, because the shared workflow's DEFAULT is '["stable31", "stable32"]'
-      # and stable31 CANNOT WORK here. `additional-apps` below installs
-      # openregister, which declares min-version="32" (its
-      # lib/ContextChat/ContentProvider.php implements
-      # OCP\ContextChat\IContentProvider, absent from core before NC32). On NC31
-      # `occ app:enable openregister` fails with
-      #   App "Open Register" cannot be installed because it is not compatible
-      #   with this version of the server.
-      # and the run continues anyway, because that failure is only a ::warning::.
-      # Every /apps/openregister/... call then returns Nextcloud's HTML 404 page.
-      #
-      # Order matters as much as membership: newman, playwright and
-      # journeydoc-capture all check out `fromJSON(nextcloud-test-refs)[0]` as
-      # their single server, so with the inherited default those three jobs ran
-      # entirely on the version openregister cannot load.
-      #
-      # THE LIST IS THE WHOLE DECLARED RANGE. This comment previously said
-      # "launchpad's own appinfo/info.xml floor stays at 29 … the NC32 constraint
-      # here is a property of the CI fixture, not of launchpad's code" — that is
-      # no longer true of the file it describes. info.xml on this branch declares
-      # <nextcloud min-version="32" max-version="34"/>, so 32 is the app's own
-      # floor, not a fixture artefact, and 32, 33 and 34 each get a leg.
-      nextcloud-test-refs: '["stable34", "stable32", "stable33"]'
+      # nextcloud-test-refs is deliberately not set: the shared quality.yml
+      # derives the Nextcloud matrix from appinfo/info.xml (min-version 32 to
+      # max-version 35), so the tested range follows the declared range.
       enable-psalm: true
       enable-phpstan: true
       enable-phpmetrics: true
@@ -377,6 +357,15 @@ jobs:
       # deliberate). Floating both halves keeps caller and callee in step,
       # which is the only configuration in which a pinned path cannot expire.
       enable-hydra-gates: true
+      # Gate 122 (SIG unit ratchet) blocks: a unit this change adds or makes
+      # worse must stay at NLOC 60, McCabe 10 and at most 4 parameters, and a
+      # new duplicated fragment of 6+ lines fails. Units the change does not
+      # touch, or touches without making worse, are inherited and do not count.
+      hydra-gates-sig-blocking: true
+      # Maintainability floor: no rating in .maintainability-floor.json may drop
+      # more than 0.01 against the merge base (pull request) or below the
+      # committed floor (push). The floor is raised after improving merges.
+      enable-maintainability-floor: true
       # ── Cost controls (see ConductionNL/.github#596, #599) ───────────────
       # Run PHPUnit and Playwright only when the diff could change their
       # verdict. Fails safe TOWARDS running: an unreadable diff, a force-push,

.github/workflows/documentation.yml

@@ -12,8 +12,14 @@ on:
   pull_request:
     branches: [development]
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
+    permissions:
+      contents: write
+      packages: write
     uses: ConductionNL/.github/.github/workflows/documentation.yml@main
     # A reusable workflow receives NO secrets by default. Without this block the
     # callee's publish step finds CF_API_TOKEN empty, skips itself on its own

.github/workflows/issue-triage.yml

@@ -10,8 +10,14 @@ on:
         type: boolean
         default: true
 
+permissions:
+  contents: read
+
 jobs:
   triage:
+    permissions:
+      issues: write
+      contents: read
     uses: ConductionNL/.github/.github/workflows/issue-triage.yml@main
     with:
       app-name: launchpad

.github/workflows/openspec-sync.yml

@@ -42,8 +42,14 @@ on:
     paths: ['openspec/**']
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   sync:
+    permissions:
+      issues: write
+      contents: read
     uses: ConductionNL/.github/.github/workflows/openspec-sync.yml@main
     with:
       app-name: launchpad

.github/workflows/release.yml

@@ -27,9 +27,15 @@ concurrency:
   group: release-${{ github.ref_name }}
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 jobs:
   unstable:
     if: github.ref == 'refs/heads/development'
+    permissions:
+      contents: write
+      pull-requests: write
     uses: ConductionNL/.github/.github/workflows/release.yml@main
     with:
       release-type: unstable
@@ -38,6 +44,9 @@ jobs:
 
   beta:
     if: github.ref == 'refs/heads/beta'
+    permissions:
+      contents: write
+      pull-requests: write
     uses: ConductionNL/.github/.github/workflows/release.yml@main
     with:
       release-type: beta
@@ -46,6 +55,9 @@ jobs:
 
   stable:
     if: github.ref == 'refs/heads/main'
+    permissions:
+      contents: write
+      pull-requests: write
     uses: ConductionNL/.github/.github/workflows/release.yml@main
     with:
       release-type: stable

.github/workflows/scorecard.yml

@@ -0,0 +1,52 @@
+# SPDX-FileCopyrightText: 2026 Conduction B.V. <info@conduction.nl>
+# SPDX-License-Identifier: EUPL-1.2
+
+# OpenSSF Scorecard: rates this repository's supply-chain practices and
+# publishes the result to the public Scorecard API and the Security tab.
+name: Scorecard supply-chain security
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: '30 4 * * 1'
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Upload the results to code scanning.
+      security-events: write
+      # Publish the results and get a badge (OIDC token for the Scorecard API).
+      id-token: write
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - name: Upload to code scanning
+        uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
+        with:
+          sarif_file: results.sarif

.github/workflows/sync-to-beta.yml

@@ -5,6 +5,12 @@ on:
     branches:
       - development
 
+permissions:
+  contents: read
+
 jobs:
   sync:
+    permissions:
+      contents: write
+      pull-requests: write
     uses: ConductionNL/.github/.github/workflows/sync-to-beta.yml@main

.gitignore

@@ -62,8 +62,7 @@ Thumbs.db
 /custom_apps/
 /config/
 
-# SBOM is published as release asset (see SECURITY.md), not stored in repo
-sbom.cdx.json
+# Intermediate SBOM files. The merged sbom.cdx.json at the root is committed.
 bom-php.cdx.json
 bom-npm.cdx.json
 

.gitleaks.toml

@@ -0,0 +1,55 @@
+# gitleaks configuration: the default rules, plus allowlists for findings
+# that are not secrets. Each allowlist names the exact files and only the
+# rules that fire there, so anything else in those files is still reported.
+
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = "Documentation examples: the default admin:admin login of the local development and demo containers."
+targetRules = ["curl-auth-user"]
+paths = [
+  '''(^|/)docs/Installation/demo\-environment\.md$''',
+]
+
+[[allowlists]]
+description = "Spec scenario: an example public-share token in a Given/When/Then step, not a credential."
+targetRules = ["generic-api-key"]
+paths = [
+  '''(^|/)openspec/changes/archive/2026\-06\-14\-dashboard\-public\-share/specs/dashboard\-public\-share/spec\.md$''',
+]
+
+[[allowlists]]
+description = "Smoke-test notes: curl logins of the throwaway local test users (admin, user, alice)."
+targetRules = ["curl-auth-user"]
+paths = [
+  '''(^|/)openspec/changes/archive/2026\-06\-14\-role\-based\-content/smoke\.md$''',
+]
+
+[[allowlists]]
+description = "Spec example: a truncated sample JWT in an SDK usage snippet, not a credential."
+targetRules = ["generic-api-key"]
+paths = [
+  '''(^|/)openspec/changes/embedded\-analytics/specs/sdk\-and\-rendering\.md$''',
+]
+
+[[allowlists]]
+description = "Design note: a curl example with a user:app-password placeholder."
+targetRules = ["curl-auth-user"]
+paths = [
+  '''(^|/)openspec/changes/governance\-rest\-api\-reference/design\.md$''',
+]
+
+[[allowlists]]
+description = "Spec scenario: an example public-share token in a Given/When/Then step, not a credential."
+targetRules = ["generic-api-key"]
+paths = [
+  '''(^|/)openspec/specs/dashboard\-public\-share/spec\.md$''',
+]
+
+[[allowlists]]
+description = "E2E seed script: curl login built from the ADMIN_USER/ADMIN_PASSWORD environment variables, not a literal."
+targetRules = ["curl-auth-user"]
+paths = [
+  '''(^|/)tests/e2e/seed\.sh$''',
+]

.maintainability-floor.json

@@ -0,0 +1,21 @@
+{
+  "measured_at": "2026-11-11T15:41:23Z",
+  "commit": "4d835a4387a923ae69cd19c49c13c80257b82aa6",
+  "tool_version": "estimator sha256:391d6ca5ea39; lizard 1.24.3; jscpd 4.0.5; profile five-star",
+  "tolerance": 0.01,
+  "overall": 4.21,
+  "overall_range": [
+    4.21,
+    4.32
+  ],
+  "properties": {
+    "volume": null,
+    "duplication": 4.54,
+    "unit_size": 3.4,
+    "unit_complexity": 4.02,
+    "unit_interfacing": 3.14,
+    "module_coupling": 4.65,
+    "component_independence": 5.5,
+    "component_entanglement": 5.5
+  }
+}

.procedure-code-baseline.json

@@ -0,0 +1 @@
+{"count": 0}

README.md

@@ -21,6 +21,12 @@ LaunchPad supercharges the Nextcloud dashboard. Create multiple personalized wor
 
 📚 **[Step-by-step tutorials](https://launchpad.conduction.nl/docs/category/tutorials)** — user + admin walkthroughs with screenshots, kept in sync with the live UI via the [journeydoc](https://github.com/ConductionNL/hydra/blob/development/openspec/architecture/adr-030-journeydoc-pattern.md) capture spec.
 
+## Test coverage
+
+<!-- coverage:start -->
+Measured test coverage: 81.0% of statements (PHP 81.0% of 21,952 statements), at commit `b3fd2179` on 2026-11-11. The JavaScript frontend is not in this figure, because it has no coverage measurement yet. The figures come from [`coverage-summary.json`](coverage-summary.json); refresh them with `composer coverage:publish`.
+<!-- coverage:end -->
+
 ## Screenshots
 
 <table>

SECURITY.md

@@ -60,7 +60,7 @@ curl -sL https://github.com/ConductionNL/launchpad/releases/download/v1.0.0/sbom
 
 ### Update cadence
 
-A new SBOM is generated and attached on every release tag. We do not commit SBOMs into the repository tree — they are published exclusively as release assets to keep main-branch history clean and to guarantee every SBOM corresponds to an immutable release artifact.
+A new SBOM is generated and attached on every release tag. The `sbom.cdx.json` at the repository root is a snapshot of the dependencies on the `development` branch. For an SBOM that matches an immutable release, use the release assets above.
 
 ### Format