Release: merge development into beta

.github/workflows/branch-protection.yml

@@ -7,7 +7,7 @@ on:
       - beta
 
 jobs:
-  protect:
+  branch-protection:
     # The callee's `check-branch` job is a single bash comparison of
     # `github.base_ref` against `github.head_ref` — no checkout, no network, no
     # API call. It needs nothing, so it gets nothing. `{}` is an explicit empty

.github/workflows/code-quality.yml

@@ -132,14 +132,14 @@ jobs:
       app-name: stackiq
       php-version: "8.3"
       # THE LIST IS THE WHOLE DECLARED RANGE. appinfo/info.xml declares
-      # <nextcloud min-version="32" max-version="34"/>, so 32, 33 and 34 each get
-      # a leg. Adopting NC 34 by REPLACING the list left 32 and 33 advertised to
-      # the App Store with no job touching them — the declared floor became the
+      # <nextcloud min-version="32" max-version="35"/>, so 32, 33, 34 and 35 each
+      # get a leg. Adopting NC 34 by REPLACING the list left 32 and 33 advertised
+      # to the App Store with no job touching them — the declared floor became the
       # untested end, which is the same drift as never testing 34, reversed.
-      # stable34 leads because newman, playwright and journeydoc-capture all read
-      # `fromJSON(inputs.nextcloud-test-refs)[0]` as their single server, and 34
-      # is the major this app had never been exercised on.
-      nextcloud-test-refs: '["stable34", "stable32", "stable33"]'
+      # stable35 leads because newman, playwright and journeydoc-capture all read
+      # `fromJSON(inputs.nextcloud-test-refs)[0]` as their single server, and 35
+      # is the newest major this app declares (same order as thematiq).
+      nextcloud-test-refs: '["stable35", "stable32", "stable33", "stable34"]'
       enable-psalm: true
       enable-phpstan: true
       enable-phpmetrics: true
@@ -158,7 +158,14 @@ jobs:
       # object API directly (tests/e2e/workflows/_fixtures.ts), so testing
       # against `main` measures a different backend than the one this app is
       # written for. Pinned to `development` to match.
-      additional-apps: '[{"repo":"ConductionNL/openregister","app":"openregister","ref":"development"}]'
+      #
+      # integriq is here because the Integrations page reads integriq's
+      # `app_connection` rows (adopt-connection-registry). Without it the page
+      # shows the missing-dependency screen and
+      # `tests/e2e/workflows/integrations-page.spec.ts` fails on every run.
+      # `app` is `integriq`, verified in its appinfo/info.xml on `development`
+      # on 2026-09-14.
+      additional-apps: '[{"repo":"ConductionNL/openregister","app":"openregister","ref":"development"},{"repo":"ConductionNL/integriq","app":"integriq","ref":"development"}]'
       # Newman disabled: tests/magic-mapper-import.postman_collection.json was
       # written against a dev env with URL rewriting + a fixed disk layout — it
       # hits bare paths like `/configurations` and uploads files from

.github/workflows/documentation.yml

@@ -14,6 +14,13 @@ on:
 
 jobs:
   deploy:
+    # Permission CEILING for the called workflow, not a grant: the callee's
+    # deploy job declares `contents: write` (gh-pages push) and its fallback
+    # image job `packages: write` (GHCR). A ceiling below what the callee
+    # declares makes the call fail to start.
+    permissions:
+      contents: write
+      packages: write
     uses: ConductionNL/.github/.github/workflows/documentation.yml@main
     # A reusable workflow receives NO secrets by default. Without this block the
     # callee's publish step finds CF_API_TOKEN empty, skips itself on its own

CHANGELOG.md

@@ -1,6 +1,13 @@
 # Changelog
 
 ## [Unreleased]
+### Added
+- CMDB import: a Nextcloud admin imports a TOPdesk CMDB export (xlsx) for one
+  municipality from the admin settings. Every application row of the two CMDB
+  sheets becomes or updates a module, its vendor, a usage for the municipality
+  and a contact person for its owner; a repeat import matches on APPID, so it
+  updates instead of duplicating. See `docs/features/cmdb-import.md`.
+
 ### Changed
 - EOL feed: the register and schema slugs the feature reads from are corrected.
   `EOL_DEFAULT_REGISTER` still said `openconnector`, a register renamed to

appinfo/info.xml

@@ -50,7 +50,7 @@ Vrij en open source onder de EUPL-licentie.
 
 **Ondersteuning:** Voor ondersteuning, neem contact op via support@conduction.nl. Voor een Service Level Agreement (SLA), neem contact op via sales@conduction.nl.
     ]]></description>
-    <version>0.2.2-unstable.20260910105110</version>
+    <version>0.2.4-unstable.20261001120000</version>
     <licence>EUPL-1.2</licence>
     <author mail="info@conduction.nl" homepage="https://www.conduction.nl/">Conduction</author>
     <namespace>Stackiq</namespace>
@@ -91,7 +91,7 @@ Vrij en open source onder de EUPL-licentie.
         <database min-version="10">pgsql</database>
         <database>sqlite</database>
         <database min-version="8.0">mysql</database>
-        <nextcloud min-version="32" max-version="34"/>
+        <nextcloud min-version="32" max-version="35"/>
     </dependencies>
 
 	<background-jobs>
@@ -224,6 +224,7 @@ Vrij en open source onder de EUPL-licentie.
 			<step>OCA\Stackiq\Repair\InitializeSettings</step>
 			<step>OCA\Stackiq\Repair\MigrateContactsToNc</step>
 			<step>OCA\Stackiq\Repair\BackfillContractApprovalState</step>
+			<step>OCA\Stackiq\Repair\BackfillModuleVersionPublication</step>
 			<!--
 				Must run AFTER the register sync that adds the English columns, so it
 				can tell the rename case from the back-fill case. Scoped by SCHEMA,

appinfo/routes.php

@@ -104,7 +104,11 @@
         ['name' => 'settings#killArchiMateImport', 'url' => '/api/archimate/import/kill', 'verb' => 'POST'], // deprecated
         ['name' => 'settings#clearArchiMateExportStatus', 'url' => '/api/archimate/status/export/clear', 'verb' => 'POST'],
 
-        ['name' => 'settings#testArchiMateRoundTrip', 'url' => '/api/archimate/test-round-trip', 'verb' => 'POST'],
+        // CMDB export import (TOPdesk xlsx) — Nextcloud admins only (no delegated groups), CSRF-protected.
+        // Progress is read through the existing /api/progress/{operationId}.
+        // @spec openspec/changes/cmdb-export-import/tasks.md#task-8
+        ['name' => 'cmdbImport#import', 'url' => '/api/cmdb-import', 'verb' => 'POST'],
+        ['name' => 'cmdbImport#cancel', 'url' => '/api/cmdb-import/{operationId}/cancel', 'verb' => 'POST'],
 
         // User Groups management routes
         ['name' => 'settings#getGenericUserGroups', 'url' => '/api/settings/user-groups/generic', 'verb' => 'GET'],
@@ -126,7 +130,12 @@
         // ArchiMate focused endpoints
         ['name' => 'settings#getArchiMateConfig', 'url' => '/api/archimate/config', 'verb' => 'GET'],
         ['name' => 'settings#updateArchiMateConfig', 'url' => '/api/archimate/config', 'verb' => 'POST'],
-        ['name' => 'settings#getArchiMateConfig', 'url' => '/api/archimate/status', 'verb' => 'GET'],
+        // A route name carries no URL, so without a 'postfix' this entry and the
+        // GET '/api/archimate/config' one above register under the same name and
+        // only the last declared survives. This one won on line order, which left
+        // the config read a 404 and made the store's polling endpoint depend on
+        // nothing but the order of these two lines.
+        ['name' => 'settings#getArchiMateConfig', 'url' => '/api/archimate/status', 'verb' => 'GET', 'postfix' => 'Status'],
 
         // Email focused endpoints
         ['name' => 'settings#getEmailConfig', 'url' => '/api/email/config', 'verb' => 'GET'],
@@ -289,6 +298,14 @@
         ['name' => 'settings#triggerEolSync', 'url' => '/api/eol-sync/trigger', 'verb' => 'POST'],
         ['name' => 'settings#getEolSyncStatus', 'url' => '/api/eol-sync/status', 'verb' => 'GET'],
 
+        // SERVICE DESK EXCHANGE (sharing-itsm-exchange): status for the CMDB
+        // page, set-up and file import for admins. The flows themselves run
+        // in OpenRegister and integriq; these only create and start them.
+        ['name' => 'itsmExchange#status', 'url' => '/api/itsm/status', 'verb' => 'GET'],
+        ['name' => 'itsmExchange#config', 'url' => '/api/itsm/config', 'verb' => 'GET'],
+        ['name' => 'itsmExchange#setUp', 'url' => '/api/itsm/setup', 'verb' => 'POST'],
+        ['name' => 'itsmExchange#import', 'url' => '/api/itsm/import', 'verb' => 'POST'],
+
         // Gebruik by group
         ['name' => 'gebruik#getGebruiken', 'url' => '/api/gebruik', 'verb' => 'GET'],
         ['name' => 'gebruik#getGebruikenForDeelnemer', 'url' => '/api/gebruik/deelnemer', 'verb' => 'GET'],

composer.json

@@ -32,7 +32,7 @@
         "phpmetrics:violations": "./vendor/bin/phpmetrics --violations-xml=phpmetrics/violations.xml lib/",
         "psalm": "if [ -f vendor/bin/psalm ]; then ./vendor/bin/psalm --threads=1 --no-cache --memory-limit=2G; else echo 'Psalm not installed, skipping...'; fi",
         "phpstan": "if [ -f vendor/bin/phpstan ]; then ./vendor/bin/phpstan analyse --memory-limit=1G; else echo 'PHPStan not installed, skipping...'; fi",
-        "test:unit": "phpunit tests -c tests/phpunit.xml --colors=always --fail-on-warning --fail-on-risky",
+        "test:unit": "phpunit -c phpunit-unit.xml --colors=always --fail-on-warning --fail-on-risky",
         "test:all": "if [ ! -f vendor/bin/phpunit ]; then echo 'SKIPPED: phpunit not installed - run composer install'; elif [ ! -f ../../lib/base.php ]; then echo 'SKIPPED: tests/bootstrap.php requires a Nextcloud server tree (../../lib/base.php not found) - run from inside a Nextcloud checkout or in CI'; else ./vendor/bin/phpunit --colors=always; fi",
         "check": "E=0; for CMD in lint phpcs psalm test:unit; do echo; echo \"=== $CMD ===\"; composer $CMD || E=1; done; echo; if [ $E -eq 0 ]; then echo \"ALL CHECKS PASSED\"; else echo \"SOME CHECKS FAILED (see above)\"; fi; exit $E",
         "check:full": "E=0; for CMD in lint phpcs psalm phpstan test:all; do echo; echo \"=== $CMD ===\"; composer $CMD || E=1; done; echo; if [ $E -eq 0 ]; then echo \"ALL CHECKS PASSED\"; else echo \"SOME CHECKS FAILED (see above)\"; fi; exit $E",
@@ -84,7 +84,7 @@
         "cyclonedx/cyclonedx-php-composer": "^6.2",
         "edgedesign/phpqa": "^1.27",
         "guzzlehttp/guzzle": "^7.8",
-        "nextcloud/ocp": "^34.0",
+        "nextcloud/ocp": "^35.0",
         "phpcsstandards/phpcsextra": "^1.4",
         "phpmd/phpmd": "^2.15",
         "phpmetrics/phpmetrics": "^2.8",