ci-workflows

Shared Gitea Actions workflows for KOF and QRun repositories. A small, direct port of the CircleCI qqq-orb. Keep it that way.

Maven

Add one file to the repository, .gitea/workflows/build.yaml:

name: build
on:
  push:
jobs:
  maven:
    uses: self:KofTwentyTwo/ci-workflows/.gitea/workflows/maven.yaml@v1
    secrets: inherit
    # with:
    #   java-version: '17'
    #   maven-args: -Pui-demo

The repository needs a <revision> property in the root pom.xml.

Every push builds once. PRs use the push run's status on the head commit. Builds run on the container-build runners, which provide a Docker daemon for Testcontainers.

Ref	Version	Action
feature and other branches, main	unchanged	mvn verify
develop	next minor -SNAPSHOT after a release, else unchanged	test, deploy, commit bump
release/X.Y	X.Y.0-RC.N	test, deploy, commit bump, tag vX.Y.0-RC.N
hotfix/*	patch + 1	test, deploy, commit bump, tag vX.Y.Z
tag vX.Y.Z	X.Y.Z	test, deploy, commit to main
tag publish-*	X.Y.Z-<feature>-<sha>-SNAPSHOT	test, deploy

Packages go to the owner's Gitea Maven registry, https://git.kof22.com/api/packages/<owner>/maven, using the job token (or an optional PACKAGES_TOKEN secret). Builds resolve dependencies from the QRun-IO registry as well as Maven Central.

Releasing

To publish	Do this
A snapshot	Merge to develop.
A release candidate	git push origin develop:release/X.Y (first RC), then push or merge fixes to release/X.Y. Every push publishes the next X.Y.0-RC.N.
A release	Merge release/X.Y to main and develop, then git tag vX.Y.0 && git push origin vX.Y.0.
A hotfix	Push to hotfix/<name>; each push publishes patch + 1. Merge back to main and develop.

A push to main never publishes on its own. The tag is the release.

Changing this workflow

Repositories pin @v1, a tag that only moves after a change is proven. QRun-IO/qbit-sftp-data-integration is the canary and calls @main.

1. Push the change to main.
2. Prove it on the canary: push a branch there (verify), then re-run its latest develop run (publish), and any other path the change touches.
3. Move the tag: git tag -fa v1 -m "<why>" <commit> && git push -f origin v1.

A breaking change (new required input, changed behavior for existing repos) gets v2 and a rollout, not a moved v1.

Differences from the orb

• Publishes to the Gitea registry, not Maven Central, and does not GPG-sign.
• main only verifies; the vX.Y.Z tag publishes the release, so a version is never published twice.
• The release:rc PR label flow is gone. Cut a release candidate by pushing release/X.Y.
• RC and hotfix publishes create a v<version> git tag. No GitHub or Gitea release objects are created; tags appear on the repository's Releases page.
• Not ported yet: security scans (gitleaks, Semgrep, OWASP, CycloneDX), SpotBugs/PMD, the QQQ middleware API-version check and frontend packaging.