[full-ci] chore(web): adopt Nx as task orchestrator for web/

[mzner]

Description

Introduces Nx as the task orchestrator for the web/ pnpm workspace, so lint/typecheck/test
only run against projects actually affected by a change instead of the whole monorepo on every
PR. Adds per-project test, lint, and typecheck targets, breaks a package dependency cycle that
was blocking per-project test targets, and scopes CI to nx affected on normal PRs (full,
unscoped runs still happen on push and [full-ci]).

The cycle was {design-system, web-pkg, web-test-helpers}: the mount helpers have to install
the design system (its components are registered globally) and web-pkg's mocked pinia stores,
so the test-helper package was imported by both of the packages it imported. It is now resolved
by layering the helpers onto the packages that already need them, without adding a package:

layer	contents
@ownclouders/design-system/testing	mount/shallowMount, prop types, design system + gettext + router-link-stub plugins
web-pkg/src/testing	the above, extended with casl abilities, mocked pinia stores, component mocks
@ownclouders/web-test-helpers	a single export * of the above

design-system is at the bottom of the workspace graph, so it cannot depend on a package that
installs it — hence the generic half lives there. web-pkg composes those plugins instead of
duplicating them, so each helper is still defined exactly once and no package depends on one
above it. The public API of @ownclouders/web-test-helpers is unchanged, so external
extensions are unaffected.

Two consequences worth calling out for review:

• @pinia/testing and vitest-mock-extended are now dependencies of web-pkg. They are only
  reachable from its ./src/testing entry (never from an app bundle), but they have to be
  declared there rather than in web-test-helpers, otherwise the published testing entry has a
  phantom dependency and fails to resolve under a strict pnpm layout.
• The published subpath is @ownclouders/web-pkg/src/testing (with src in the name) so that
  the same specifier resolves both in the workspace, where web-pkg has no exports map and is
  consumed as source, and for published consumers via publishConfig.exports.

Related Issue

• Fixes OCISDEV-1440

Motivation and Context

web/'s CI ran every check against every package on every PR, regardless of what changed.
Nx's dependency graph lets CI scope lint/test to only the projects affected by a given diff,
cutting CI time on small PRs while still running everything on master/full-ci.

The dependency cycle had to go with it: Nx tolerates a cycle for inputs: ["^default"], but any
target using dependsOn: ["^target"] fails outright with Could not execute command because the task graph has a circular dependency. That rules out build/typecheck pipelines as long as the
cycle exists, so it is fixed here rather than left to bite later.

How Has This Been Tested?

• test environment: local worktree, clean pnpm install --frozen-lockfile, Node 24.15.0 / pnpm 10.33.3
• test case 1: nx run-many -t test --skip-nx-cache — 16/16 projects pass
• test case 2: pnpm test:unit (full root vitest run) — 380 files / 3113 tests pass, unchanged from before the refactor
• test case 3: pnpm lint, pnpm check:types (vue-tsc, 0 errors), pnpm check:format, pnpm licenses:check — all pass; 95 lint warnings, all pre-existing
• test case 4: pnpm build — succeeds
• test case 5: nx show projects --affected --files=<shared config file> — correctly returns all 16 test-bearing projects for changes to pnpm-lock.yaml, nx.json, eslint.config.js, and shared vitest setup/stub files (previously returned none, due to an empty sharedGlobals)
• test case 6: cycle is really gone — a probe target with dependsOn: ["^test"] now builds a task graph; with the cycle restored it fails as above. pnpm install emits no cyclic-workspace warning
• test case 7: published artifacts verified the way an external extension consumes them — specs mounted through the built dist/ bundles, resolving every @ownclouders/* specifier via publishConfig.exports instead of workspace source. Asserts that components are identity-equal to the consumer's own @ownclouders/design-system import, wrappers are instances of the consumer's own @vue/test-utils, $gettext renders (single vue3-gettext copy), and the mocked pinia stores are shared with the main web-pkg bundle. All publishConfig.exports targets exist for design-system, web-pkg and web-test-helpers
• test case 8: exported-name diff against master for @ownclouders/web-test-helpers — 28/28 names still present, two additive (routerLinkStubPlugin, DesignSystemPluginsOptions)

Screenshots (if appropriate):

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Technical debt
• Tests only (no source changes)

Checklist:

• Code changes
• Unit tests added
• Acceptance tests added
• Documentation ticket raised: n/a — build tooling and test helpers only, no user-facing or admin-facing change

[update-docs]

Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes.

[kw-security]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[LukasHirt]

Why this new package?

[mzner]

web-pkg, web-test-helpers, and design-system formed a dependency cycle (pnpm was already warning about it), which also blocks giving them a cached Nx build target. web-test-helpers-core breaks that cycle: it's the generic test-helper code (mount, stubs, defaultPlugins, etc.) that doesn't depend on anything in the cycle — defaultPlugins gets the real DesignSystem plugin and pinia factory injected via a small registry instead of importing them directly.

web-test-helpers itself is now just a thin facade that re-exports web-test-helpers-core (plus web-pkg/src/testing for the web-pkg-specific mocks) under the same names, so nothing changes for the 17 published web-extensions that depend on it. I kept it this way instead of moving those mocks directly, since that was tried first and turned out to be a silent breaking change for those extensions.

[LukasHirt]

Hmm, personally, I do not like having another package for this. It's already leading to some confusion the split of the existing packages. Having another one in play and having one just as to re-export stuff feels wrong.

[mzner]

Fair point — the extra package is gone. Instead of a package that only re-exports, the helpers now sit in the packages that already need them:

• @ownclouders/design-system/testing — mount/shallowMount, prop types, and the design system + gettext + router-link-stub plugins. It has to live here: design-system is at the bottom of the workspace graph, so it can't depend on a package that installs it — that was the cycle.
• web-pkg/src/testing — composes the above and adds casl abilities, mocked pinia stores and the component mocks.
• @ownclouders/web-test-helpers — a single export * of that, unchanged public API, so extensions aren't affected.

Every helper is still defined exactly once (web-pkg extends the design system's plugin list rather than duplicating it), and no package depends on one above it, so dependsOn: ["^target"] in Nx works. Net effect vs. master: no new package, no plugin registry singleton, no .npmrc hoist entries, and web-pkg no longer has a test package in its runtime dependencies.

[mzner]

Splitting this into two PRs per review discussion above: the dependency-cycle fix on its own in #13010, and Nx adoption on top of it in #13011. Closing this one in favor of those.