fix(build): stop shipping packages Nextcloud core already provides

[rubenvdlinde]

Closes #2433.

Cause

symfony/console ^7.4 is a direct require, so the release's composer install --no-dev put Console 7.4.16 in vendor/. Composer prepends each app's autoloader in front of core's 3rdparty one, so after occ app:enable integriq every Console class came from integriq's copy. Core apps written for core's 6.4 (Recommendations' execute() has no : int) then fatal, and every occ command dies.

Fix

• scripts/prune-core-provided-vendor.php, run as the last post-install-cmd. It only acts when COMPOSER_DEV_MODE=0 (the release workflow's --no-dev install). It deletes the listed packages from vendor/, removes them from installed.json/installed.php and re-dumps the autoloader (--classmap-authoritative), so no classmap, PSR-4 or files entry points at a removed package.
• composer.json extra.nextcloud-core-provided: the 30 packages in integriq's runtime tree that nextcloud/3rdparty ships on all of stable32, stable33, stable34 and master (symfony/console, http-foundation, event-dispatcher, string, uid, dom-crawler, css-selector, service-contracts, deprecation-contracts, intl polyfills, guzzle, psr/*, brick/math, spomky-labs/pki-framework, ...). Packages only some branches ship (polyfill-php82, polyfill-php85) stay vendored.
• Dev installs are unchanged, so psalm/phpstan/phpunit still have everything.

No replace block was used because it would also drop the packages from dev installs (psalm and nextcloud/ocp need them). openregister and dossiq have no replace block or vendor excludes to copy from.

Verification

• Compatibility: for each of NC32/33/34/35 a resolver probe pinned every pruned package to core's exact version and every remaining package to integriq's locked version. All four resolve.
• Release build (composer install --no-dev --optimize-autoloader --classmap-authoritative, as the shared workflow runs it): vendor/symfony/console is gone, along with all 30 listed packages. The autoloader loads cleanly and doesn't resolve Console.
• Live on NC 32.0.13 (rehearsal) with release 0.4.12-unstable.20261015073818 and this vendor: occ status exit 0, occ app:list lists integriq and recommendations as enabled, occ app:disable/app:enable integriq works, occ list integriq shows all 10 commands, occ recommendations:recommend admin exit 0. Before the swap, the same instance fataled on every occ command.
• composer check:strict: lint, phpcs, phpmd, psalm and phpstan are green. test:all has 11 errors in tests/Unit/AppInfo, and the same 11 show up on development locally (a DIContainer typed-property mismatch, inherited; CI on development is green). The new PruneCoreProvidedVendorTest passes.

AI assistance: prepared with Claude Code.

[github-actions]

Quality Report — ConductionNL/integriq @ 8fa5911

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
build		✅
check-specs		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 143/143
npm			✅	✅ 647/647
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					✅ 5490/5490 · 1 skipped
Newman					✅ 130/130
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					✅
Hydra gates (axe)					✅

---

Quality workflow — 2026-10-15 18:22 UTC

Download the full PDF report from the workflow artifacts.