Release: merge development into beta

.github/workflows/admin-api.yml

@@ -0,0 +1,30 @@
+name: Admin API document
+
+# Lints docs/api/admin-v1.openapi.json as OpenAPI 3.1 (admin-public-api §2.1).
+# That the document and appinfo/routes.php agree is checked by PHPUnit
+# (tests/Unit/Contract/AdminApiContractTest.php) in the code quality workflow.
+
+on:
+  push:
+    branches: [main, development]
+    paths: ["docs/api/**", ".github/workflows/admin-api.yml"]
+  pull_request:
+    branches: [main, development, beta]
+    paths: ["docs/api/**", ".github/workflows/admin-api.yml"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - run: npx --yes @redocly/cli@1 lint docs/api/admin-v1.openapi.json

.github/workflows/browser-extension.yml

@@ -0,0 +1,46 @@
+name: Browser extension
+
+# Builds the extension for Chromium and Firefox and loads each package in a
+# headless browser to check its background starts and answers the popup
+# (clients-browser-builds). Safari needs a macOS runner and stays an open task.
+
+on:
+  push:
+    branches: [main, development]
+    paths: ["browser-extension/**", "src/crypto/**", "src/totp/**", ".github/workflows/browser-extension.yml"]
+  pull_request:
+    branches: [main, development, beta]
+    paths: ["browser-extension/**", "src/crypto/**", "src/totp/**", ".github/workflows/browser-extension.yml"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build-and-load:
+    runs-on: ubuntu-latest
+    # A build and two browser starts; minutes at most.
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          cache: npm
+      - run: npm ci --ignore-scripts
+      - run: npm run build:extension
+      - name: Chromium loads the package
+        run: |
+          npx playwright install --with-deps chromium
+          node browser-extension/load-check/chromium.mjs
+      - name: Firefox loads the package
+        run: |
+          npm install --no-save selenium-webdriver@4
+          firefox --version
+          geckodriver --version
+          node browser-extension/load-check/firefox.mjs
+      - uses: actions/upload-artifact@v4
+        with:
+          name: browser-extension
+          path: browser-extension/dist/
+          retention-days: 14

.github/workflows/cli-macos.yml

@@ -0,0 +1,62 @@
+name: CLI on macOS
+
+# Checks `keepiq ssh-agent` on macOS, where nobody on the team has a Mac to
+# try it by hand (keepiq#1042). With no secrets and no Nextcloud server it:
+#
+#   - runs the CLI's Go tests, including the real-sshd integration test and
+#     the `eval` test, and fails if either of those is skipped
+#   - runs cli/scripts/ssh-agent-e2e.sh: the README's recipe in a real shell
+#     against a fake Keepiq (cli/internal/fakevault) and a throwaway sshd
+#     started as the runner user on a high port, never the system sshd
+#   - installs the README's launchd plist in the runner user's home and checks
+#     the agent launchd starts (same script, KEEPIQ_E2E_LAUNCHD=1)
+
+on:
+  pull_request:
+    branches: [main, development, beta]
+    paths: ["cli/**", "sdk/go/**", "sdk/testdata/**", ".github/workflows/cli-macos.yml"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: cli-macos-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ssh-agent:
+    runs-on: macos-latest
+    # The Go tests take a few minutes (RSA-4096 keys); the e2e script under two.
+    timeout-minutes: 25
+    defaults:
+      run:
+        working-directory: cli
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25.x"
+          cache-dependency-path: cli/go.sum
+      - name: Versions
+        run: |
+          sw_vers
+          uname -m
+          go version
+          ssh -V
+          command -v sshd ssh-add git
+          id
+      - run: go vet ./...
+      - name: Go tests, with the ssh-agent tests required to run
+        run: |
+          set -o pipefail
+          go test -count=1 -v ./... 2>&1 | tee "$RUNNER_TEMP/go-test.log" | grep -E '^(--- |ok|FAIL|PASS)'
+          for t in TestRealSSHThroughTheAgent TestEvalReturnsAndTheAgentKeepsServing TestVaultUnlockerReadsOnlyCiphertext; do
+            grep -q -- "--- PASS: $t " "$RUNNER_TEMP/go-test.log" || { echo "::error::$t did not pass (skipped or missing)"; exit 1; }
+          done
+      - name: README recipe and launchd plist, end to end
+        # A hang in `eval "$(keepiq ssh-agent)"` (keepiq#1022) ends here, not at the job limit.
+        timeout-minutes: 10
+        env:
+          KEEPIQ_E2E_LAUNCHD: "1"
+        run: bash scripts/ssh-agent-e2e.sh

.github/workflows/cli-release.yml

@@ -1,23 +1,30 @@
 name: CLI Release
 
 # Builds the keepiq-cli single static binary for every supported platform.
-# On a tag push it also uploads the artifacts to the GitHub release. The CLI is
-# stdlib-only Go, so the matrix is a plain cross-compile — no PHP/Node needed.
+# On a tag push it also uploads the artifacts to the GitHub release, with a
+# SHA256SUMS file that the GitHub Action and the GitLab template check every
+# download against, and pushes the container image ghcr.io/conductionnl/keepiq-cli
+# at the same version. The CLI is pure Go: the standard library, sdk/go in this
+# repository, and the Go project's golang.org/x/crypto and golang.org/x/sys for
+# the SSH agent. The matrix is a plain cross-compile with no PHP or Node needed.
 
 on:
   push:
     branches: [main, development]
-    paths: ["cli/**"]
+    paths: ["cli/**", "sdk/go/**", "sdk/testdata/**", ".github/workflows/cli-release.yml"]
     tags: ["cli-v*"]
   pull_request:
     branches: [main, development, beta]
-    paths: ["cli/**"]
+    paths: ["cli/**", "sdk/go/**", "sdk/testdata/**", ".github/workflows/cli-release.yml"]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
-    # No observed runs yet; a Go vet+test of a stdlib-only CLI is minutes at most.
+    # No observed runs yet; vet, test and govulncheck of the CLI are minutes at most.
     timeout-minutes: 20
     defaults:
       run:
@@ -26,14 +33,23 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.22"
+          go-version: "1.25.x"
       - run: go vet ./...
+      # The SSH agent's integration test runs the real ssh client against a
+      # throwaway sshd on localhost (cli-ssh-agent).
+      - name: Install OpenSSH for the agent integration test
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq openssh-server openssh-client && sudo mkdir -p /run/sshd
       - run: go test ./...
+      # The CLI now has dependencies: check them for known vulnerabilities.
+      - run: go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 ./...
 
   build:
     needs: test
     runs-on: ubuntu-latest
-    # No observed runs yet; a stdlib-only Go cross-compile is minutes at most.
+    # Attaches the binary to the GitHub release on a cli-v tag.
+    permissions:
+      contents: write
+    # No observed runs yet; a pure-Go cross-compile is minutes at most.
     timeout-minutes: 20
     defaults:
       run:
@@ -51,7 +67,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.22"
+          go-version: "1.25.x"
       - name: Build static binary
         env:
           GOOS: ${{ matrix.target.goos }}
@@ -72,3 +88,82 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           files: ${{ env.ARTIFACT }}
+
+  checksums:
+    # One SHA256SUMS over every binary, attached to the release. On a branch or
+    # pull request it is built and uploaded as an artifact only (the dry run).
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    # Attaches SHA256SUMS to the GitHub release on a cli-v tag.
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: keepiq-*
+          merge-multiple: true
+          path: dist
+      - name: Write SHA256SUMS
+        working-directory: dist
+        run: |
+          sha256sum keepiq-* > SHA256SUMS
+          cat SHA256SUMS
+          test "$(wc -l < SHA256SUMS)" -eq 6
+      - uses: actions/upload-artifact@v4
+        with:
+          name: SHA256SUMS
+          path: dist/SHA256SUMS
+      - name: Attach to release
+        if: startsWith(github.ref, 'refs/tags/cli-v')
+        uses: softprops/action-gh-release@v2
+        with:
+          files: dist/SHA256SUMS
+
+  image:
+    # ghcr.io/conductionnl/keepiq-cli: the linux binaries on a distroless static
+    # base, multi-arch, tagged with the release version. Pushed on a cli-v tag;
+    # built without pushing otherwise (the dry run).
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: keepiq-linux-*
+          merge-multiple: true
+          path: cli/dist
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - name: Log in to ghcr.io
+        if: startsWith(github.ref, 'refs/tags/cli-v')
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Image tags
+        id: tags
+        run: |
+          version="${GITHUB_REF_NAME#cli-v}"
+          echo "tags=ghcr.io/conductionnl/keepiq-cli:${version},ghcr.io/conductionnl/keepiq-cli:latest" >> "$GITHUB_OUTPUT"
+      - uses: docker/build-push-action@v6
+        with:
+          context: cli
+          file: cli/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: ${{ startsWith(github.ref, 'refs/tags/cli-v') }}
+          load: false
+          tags: ${{ steps.tags.outputs.tags }}
+          labels: |
+            org.opencontainers.image.source=https://github.com/ConductionNL/keepiq
+            org.opencontainers.image.description=keepiq CLI, the zero-knowledge Keepiq command-line client
+            org.opencontainers.image.licenses=EUPL-1.2
+      - name: Smoke test the amd64 image
+        run: |
+          docker buildx build --platform linux/amd64 --load -t keepiq-cli:smoke -f cli/Dockerfile cli
+          docker run --rm keepiq-cli:smoke --version

.github/workflows/code-quality.yml

@@ -110,9 +110,21 @@ permissions:
 
 jobs:
   quality:
-    # Skips the standing "development → beta" sync PR, which would otherwise
-    # re-run the whole pipeline on every merge into development.
-    if: (github.event_name != 'pull_request' || github.head_ref != 'development')
+    # THE PROMOTION PR RUNS (keepiq#882). A pull request whose head is
+    # `development` is skipped only when it targets something other than
+    # `beta`. The standing "development to beta" sync PR used to be skipped
+    # too, and the shared workflow keeps Playwright off ordinary `development`
+    # traffic (`e2e-promotion-only`, default true) and runs it on PRs into
+    # `beta` and `main` instead. The two rules together meant the promotion
+    # into `beta` ran nothing, so release.yml cut the beta artifact before
+    # Playwright had seen the promoted tree.
+    #
+    # The price is a full run each time a merge into `development` updates the
+    # sync PR. The concurrency group above cancels a superseded PR run, so only
+    # the newest one finishes. The fast tier on that run repeats what the push
+    # to `development` already checked; the shared workflow has no input to run
+    # only the heavy tier.
+    if: (github.event_name != 'pull_request' || github.head_ref != 'development' || github.base_ref == 'beta')
     uses: ConductionNL/.github/.github/workflows/quality.yml@main
     with:
       app-name: keepiq
@@ -171,12 +183,10 @@ jobs:
       enable-eslint: true
       enable-phpunit: true
       enable-newman: true
-      # Keepiq adopts OpenRegister's AppHost engine in lib/AppInfo/Application.php
-      # (ADR-040 / ADR-022) and ships lib/Settings/keepiq_register.json, so
-      # OpenRegister must be present in the test instance — otherwise
-      # SettingsService::isOpenRegisterAvailable() is false, InitializeSettings
-      # skips the register import with a warning, and the app boots without the
-      # host engine it delegates to.
+      # Keepiq needs no other app (ADR-006); standalone.yml proves that on an
+      # instance with Keepiq alone. OpenRegister is installed HERE so this
+      # suite covers the integrations that need it: the Flows pages and the
+      # MCP tools, which appear only when OpenRegister is enabled.
       #
       # NOTE the org is ConductionNL, not Conduction. `Conduction` does not
       # exist, and the shared workflow clones additional-apps UNAUTHENTICATED —
@@ -190,7 +200,10 @@ jobs:
       # integriq is here because the Integrations page reads integriq's
       # `app_connection` rows (adopt-connection-registry). Without it the page
       # shows the missing-dependency screen and
-      # `tests/e2e/workflows/integrations-page.spec.ts` fails on every run.
+      # `tests/e2e/workflows/integrations-page.spec.ts` fails wherever
+      # Playwright runs: the promotion PRs into `beta` and `main`, the nightly
+      # dispatch, and a manual dispatch. Ordinary `development` pushes and PRs
+      # do not run Playwright (`e2e-promotion-only`).
       # `app` is `integriq`, verified in its appinfo/info.xml on `development`
       # on 2026-09-15.
       additional-apps: '[{"repo":"ConductionNL/openregister","app":"openregister","ref":"development"},{"repo":"ConductionNL/integriq","app":"integriq","ref":"development"}]'