chore(canonical): promote fleetwide config extensions

[rubenvdlinde]

Summary

Lock the canonical root configs so they reflect the union of patterns already in use across the 17 PHP apps. Each addition is driven by a fleetwide concern — per the consolidation directive, exceptions are fleetwide or they don't exist.

phpcs.xml

• Add SpecTagSniff (warning) — hydra ADR-003 fleetwide @spec convention. Currently enforced in decidesk/pipelinq/procest; promote so every app surfaces the gap.
• Add NoLegacyServerAccessorsSniff (error) — blocks \OC::\$server->getX()/query() removed in Nextcloud 34. Already in openregister + openconnector.
• Add ignore_warnings_on_exit=1 so SpecTag warnings surface in CI without failing the build.
• Add */vendor-bin/* exclude (bamarni/composer-bin-plugin, used by larpingapp + softwarecatalog).
• Add lib/Resources/template/* exclude (apps that ship a verbatim template snapshot, e.g. openbuilt).

psalm.xml — add referencedClass entries that recur across the fleet

• OCA\OpenRegister Db (ObjectEntity, RegisterMapper, SchemaMapper), Event (Object{Creating,Created,Updating,Updated,Deleted}Event), and Service (RegisterService, FileService).
• OCP infrastructure: IBootContext, IRegistrationContext, DoesNotExistException, DB\Exception, IGroup, IUser, IRepairStep.

phpstan.neon — promote ignoreErrors families that recur in 4+ apps

• Broader OC\ + OC_App ignoreErrors (server internals not in OCP stubs).
• OCA\DAV\ family (DAV server-internal).
• OCA\OpenRegister\ family extras (has invalid type, implements unknown interface).
• Doctrine\DBAL\ family (shipped by NC server, not stubbed).
• OCP stub gaps: IRequest::getContent, IRequest::setParameter, IMessage::attachFile, Entity::jsonSerialize.
• Add vendor-bin/ and lib/Resources/template/ to excludePaths.

New custom sniff files

Both copied verbatim from their current homes — they're already in production use:

• SpecTagSniff.php from decidesk
• NoLegacyServerAccessorsSniff.php from openregister

Context — what this unblocks

Phase 2 of a fleetwide root-config consolidation. After Phase 1 (drift-outlier cleanup) the next step was to sync canonical configs across the 17 apps. The investigation pass found that pure byte-for-byte sync would have silently disabled custom sniffs that 2–3 apps already enforce and would have lost legitimate framework-stub-gap suppressions. The user's directive — "no per-app validation rules; if we need exceptions then they are for all apps" — drives this PR: every recurring per-app extension gets promoted here once, then the per-app variants get dropped in the fleet sync.

After this lands:

• 3 apps remain canonical-compatible without change (shillinq, planix, deskdesk).
• 14 apps need a sync PR that overwrites their phpcs/phpmd/psalm/phpstan with these canonical files and removes per-app overrides.
• Apps with lint debt unmasked by the sync (openconnector silent commenting suppressions, mydash relaxed phpmd, softwarecatalog defensive-coding suppressions, openregister psalm entity-getter UndefinedMethod block, etc.) get follow-up code-fix PRs.

Test plan

• phpcs.xml + psalm.xml: valid XML
• phpstan.neon: parses as valid YAML/NEON
• composer check:strict green inside the template (template's own lib/ is small; existing CI workflow will run it)
• After merge: pilot fleet-sync on decidesk and confirm CI green there

[github-actions]

Quality Report — ConductionNL/nextcloud-app-template @ 820c99b

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		❌
stylelint		❌
composer			❌	✅ 100/100
npm			✅	❌ 2/684 denied
PHPUnit					⏭️
Newman					⏭️
Playwright					⏭️

❌ Denied npm licenses

Package	Version	License
pako	1.0.11	(MIT AND Zlib)
sha.js	2.4.12	(MIT AND BSD-3-Clause)

---

Quality workflow — 2026-05-21 19:16 UTC

Download the full PDF report from the workflow artifacts.