ci: a branch nobody named got no checks at all

[rubenvdlinde]

Code Quality's push trigger is an allow-list of branch prefixes, and a branch matching none of them gets no CI at all — its last visible status is whatever it inherited, which on every dashboard reads the same as passing.

Two live examples, both 2026-08-14: perf/** was uncovered in openconnector, where a merge carrying unresolved conflict markers and 84 failing tests was pushed and nothing ran; and feat/** was uncovered in openregister — the list said feature/**, so every feat/... branch had been running unchecked.

merge-hygiene.yml (new) runs on ** — every branch, every push — and checks only what takes seconds and needs nothing installed: no committed conflict markers, every PHP file parses, every JSON file parses. A smoke alarm, not the fire brigade.

Verified against the offending merge itself: the marker check finds all eight markers and fails the push. Against a clean HEAD it passes. The regex is anchored to column 0, so <<<<<<< inside a string or a docs example stays legal.

code-quality.yml keeps its allow-list (it is expensive — PHPUnit matrix, Newman, Playwright) with the missing prefixes added.

⚠️ Adding prefixes is not the durable fix — the next invented prefix is uncovered again. The durable fix is branch protection requiring a PR into development, which the pull_request trigger already gates correctly. That is a repo setting, not a file.

Rolled out across the fleet; 14 repos carried the identical allow-list.

[github-actions]

Quality Report — ConductionNL/launchpad @ aab1962

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
format		✅
composer			✅	✅ 104/104
npm			✅	✅ 536/536
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					✅
Hydra gates					❌

---

Quality workflow — 2026-08-14 18:08 UTC

Download the full PDF report from the workflow artifacts.