chore(ci): stop pinning hydra-gates — track the package at @main

[rubenvdlinde]

What changed

This PR started life as hydra-gates-ref: v1.3.0 -> v1.4.0. It now does the opposite of a bump: it deletes the hydra-gates-ref line from .github/workflows/code-quality.yml so this repo inherits the shared workflow's default.

enable-hydra-gates: true is unchanged. enable-axe is untouched.

Why not just bump it

The input's default in ConductionNL/.github/.github/workflows/quality.yml is already main, and this repo consumes that workflow @main. With the override gone, both sides move together — a gate-package fix reaches this repo without needing a commit in this repo.

A pin is a silent expiry date on every upstream fix, and we have now been bitten by it from both directions:

• .github#159 — all 22 repos were pinned to v1.0.1, which predated the gate fixes. 16 gates were dead fleet-wide, and every one of them reported PASS. A check that did not run looks exactly like one that passed.
• .github#173 — a default flipped on .github main then reached those same old pinned runners, which could not honour it, and they went red on gates they had no subject matter for.

Bumping the pin fixes neither: it just resets the clock and guarantees the same two failures on the next release. The pin-justifying comment block (v1.3.0, reproducibility, the pin-move history) is replaced with a short note explaining why there is deliberately no ref here. The rationale for having the gates on at all is kept.

Rollback and escape hatch

• Roll back for everyone: revert on ConductionNL/.github main. One commit, whole fleet.
• Hold this one repo still: set hydra-gates-ref: explicitly here with a comment saying why. The input is still honoured — this PR removes an unexamined default, not the capability.

Safety net

ConductionNL/.github#177 adds the resolve probe plus the gates package suite gating .github main, so a gates change that would not resolve or would break the runner is caught before it can reach @main consumers like this one.

[github-actions]

Quality Report — ConductionNL/openbuild @ 7ace809

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
composer			✅	✅ 101/101
npm			✅	✅ 654/654
PHPUnit					✅
Newman					⏭️
Playwright					❌
Hydra gates					✅

---

Quality workflow — 2026-08-05 22:21 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/openbuild @ 999dfec

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
composer			✅	✅ 101/101
npm			✅	✅ 654/654
PHPUnit					✅
Newman					⏭️
Playwright					❌
Hydra gates					❌

---

Quality workflow — 2026-08-06 06:12 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/openbuild @ 2a6679b

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
composer			✅	✅ 101/101
npm			✅	✅ 654/654
PHPUnit					✅
Newman					⏭️
Playwright					❌
Hydra gates					❌

---

Quality workflow — 2026-08-06 06:46 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/openbuild @ 2a6679b

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
composer			✅	✅ 101/101
npm			✅	✅ 654/654
PHPUnit					✅
Newman					⏭️
Playwright					❌
Hydra gates					❌

---

Quality workflow — 2026-08-06 07:47 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/openbuild @ b63dd77

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
composer			✅	✅ 101/101
npm			✅	✅ 654/654
PHPUnit					✅
Newman					⏭️
Playwright					❌
Hydra gates					❌

---

Quality workflow — 2026-08-06 08:24 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

Hydra Gates is RED here on a genuine finding — not on this change

Hydra Gates fails on exactly one gate: gate-64 apphost-autoload-prelude (ADR-040). Everything else passes. This is a real finding and is being landed rather than silenced — no re-pin, no baseline, no continue-on-error.

Finding: lib/AppInfo/Application.php:45 has use OCA\OpenRegister\AppHost\Bootstrap; but nothing under lib/AppInfo/ registers OpenRegister's autoloader first.

Severity: LIVE-EXPOSED. Apps register in sorted order — getEnabledApps() sorts, then Coordinator::registerApps() calls registerAutoloading() and register() one app at a time, so every app's register() runs before the PSR-4 prefix of every alphabetically-later app exists.

Why it is not a regression from this PR: the failure is pre-existing, and unpinning did not introduce it — it made it visible. Measured against this repo's own baseline, Hydra Gates was already red before this change.

The fix (ADR-040 prelude, called before any OCA\OpenRegister\… reference including a class_exists() probe):

$p = \OCP\Server::get(\OCP\App\IAppManager::class)->getAppPath('openregister');
\OC_App::registerAutoloading('openregister', $p);

wrapped in try/catch (\Throwable). doriath has a reference implementation in lib/AppInfo/OpenRegisterAutoloader.php. This is left as a separate change so it gets its own review rather than riding along on a CI-config PR.