test(ci): compare Authentik fixture startup order

Co-Authored-By: Codex <noreply@openai.com>

.gitea/workflows/auth-bootstrap-order-diagnostic.yaml

@@ -0,0 +1,136 @@
+name: DIAGNOSIS ONLY - diagnosis-only-start-order - Authentik BootstrapBlueprintIT repro
+# TEMPORARY, MANUAL, DIAGNOSIS ONLY. Never publication, never production qualification, never a gate.
+# THE CHECKED-OUT TEST FIXTURE IS TEMPORARILY MODIFIED (AuthentikTestStack startup order: server.start() before worker.start()).
+# A green result supports the ordering hypothesis only; it does NOT prove the unmodified source works.
+# Runs only BootstrapBlueprintIT through the original Maven verify command (same -T4, no skipITs, no relaxed checks).
+# Because only one IT is selected, the original coverage check may fail for that reason; that is NOT the blueprint verdict.
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+env:
+  CI: 'true'
+jobs:
+  diagnose:
+    runs-on: qqq-builder-2-browser
+    timeout-minutes: 15
+    container:
+      image: local/java-browser:298bba0a82d7b62237dbcd15e6c876c4d4bb68a575ee6f47dedeeb5591f5e7f0
+      options: --init --shm-size=256m
+      volumes:
+        - /var/lib/gitea-job-workspace:${{ github.workspace }}
+        - /run/user/1002/docker.sock:/run/test-docker.sock
+    env:
+      CI: 'true'
+      HOME: /tmp
+      MAVEN_OPTS: -Duser.home=/tmp -Xmx1g
+      MAVEN_CONFIG: /tmp/.m2
+      DOCKER_HOST: unix:///run/test-docker.sock
+      TESTCONTAINERS_DOCKER_SOCKET_OVERRIDE: /run/user/1002/docker.sock
+      TESTCONTAINERS_HOST_OVERRIDE: 172.17.0.1
+    steps:
+      - name: Checkout application at the frozen qualification head
+        uses: builtin:checkout
+        with:
+          repository: QRun-IO/qbit-authentik
+          ref: 4d675b18f65b75c43c7724a632ff8d296b56fefa
+      - name: Checkout platform-ci tools at the exact engine into a separate path
+        uses: builtin:checkout
+        with:
+          repository: KofTwentyTwo/platform-ci
+          ref: d3ee308467433ebbf7db785a9f8c2185d1485f29
+          path: .ci-diagnostic-tools
+      - run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+      - name: Install the pinned action runtime without root
+        run: |
+          set -eu
+          mkdir -p /tmp/java-actions-node
+          curl -fsSL https://nodejs.org/dist/v22.20.0/node-v22.20.0-linux-x64.tar.gz -o /tmp/java-actions-node/node.tar.gz
+          printf '%s\n' 'eeaccb0378b79406f2208e8b37a62479c70595e20be6b659125eb77dd1ab2a29  /tmp/java-actions-node/node.tar.gz' | sha256sum -c -
+          tar -xzf /tmp/java-actions-node/node.tar.gz -C /tmp/java-actions-node --strip-components=1
+          echo /tmp/java-actions-node/bin >> "$GITHUB_PATH"
+      - name: Verify execution boundary
+        run: node "$GITHUB_WORKSPACE/.ci-diagnostic-tools/scripts/docker-boundary.mjs"
+      - name: TEMPORARY test-fixture edit - swap worker.start()/server.start() order (diagnosis only)
+        run: |
+          set -eu
+          python3 -I - "$GITHUB_WORKSPACE/src/test/java/com/kingsrook/qbits/authentik/contract/AuthentikTestStack.java" <<'PY'
+          import re, sys
+          path = sys.argv[1]
+          with open(path, 'rb') as f:
+              raw = f.read()
+          text = raw.decode('utf-8')
+          pat = re.compile(r'([ \t]*)worker\.start\(\);(\r?\n)([ \t]*)server\.start\(\);')
+          matches = list(pat.finditer(text))
+          if len(matches) != 1:
+              sys.exit('expected exactly one adjacent worker/server start pair')
+          m = matches[0]
+          new = m.group(1) + 'server.start();' + m.group(2) + m.group(3) + 'worker.start();'
+          out = text[:m.start()] + new + text[m.end():]
+          # Verify the only difference is the swapped pair.
+          if out[:m.start()] != text[:m.start()] or out[m.start() + len(new):] != text[m.end():]:
+              sys.exit('unexpected change outside the swapped pair')
+          if len(out) != len(text) or out == text:
+              sys.exit('unexpected edit result')
+          with open(path, 'wb') as f:
+              f.write(out.encode('utf-8'))
+          print('diagnostic fixture startup order changed')
+          PY
+      - name: Run BootstrapBlueprintIT only (original verify command plus filter flags; fixture temporarily modified)
+        run: |
+          set -eu
+          tools="$GITHUB_WORKSPACE/.ci-diagnostic-tools"
+          test -f pom.xml
+          java -version
+          mvn -version
+          bash "$tools/scripts/setup-maven-settings.sh"
+          proxy_pid=''
+          proxy_dir=''
+          cleanup() {
+            if [ -n "$proxy_pid" ]; then
+              kill "$proxy_pid" 2>/dev/null || true
+              wait "$proxy_pid" 2>/dev/null || true
+            fi
+            if [ -n "$proxy_dir" ]; then rm -rf "$proxy_dir"; fi
+          }
+          trap cleanup EXIT
+          trap 'exit 143' INT TERM
+          proxy_dir="$(mktemp -d "${RUNNER_TEMP:-/tmp}/qrun-localhost.XXXXXX")"
+          node "$tools/scripts/compose-localhost-forward.mjs" --containers --host 172.17.0.1 --ready "$proxy_dir/ready" &
+          proxy_pid=$!
+          waited=0
+          while [ ! -f "$proxy_dir/ready" ]; do
+            if ! kill -0 "$proxy_pid" 2>/dev/null || [ "$waited" -ge 100 ]; then
+              echo 'Localhost Testcontainers proxy did not become ready'
+              exit 1
+            fi
+            sleep 0.1
+            waited=$((waited + 1))
+          done
+          kill -0 "$proxy_pid"
+          # set -e keeps Maven's nonzero status; the EXIT trap cleans up the forwarder first.
+          ( export TESTCONTAINERS_HOST_OVERRIDE=localhost; mvn -s /tmp/circleci/mvn-settings.xml --update-snapshots -T4 --no-transfer-progress verify -Dit.test=BootstrapBlueprintIT -Dtest=none -Dsurefire.failIfNoSpecifiedTests=false )
+          kill -0 "$proxy_pid"
+      - if: ${{ always() }}
+        name: Collect Maven reports
+        run: bash "$GITHUB_WORKSPACE/.ci-diagnostic-tools/scripts/collect-maven-reports.sh" ci-reports
+      - name: Require private artifact service
+        if: ${{ always() }}
+        id: artifact_endpoint
+        run: |
+          set -eu
+          case "$ACTIONS_RUNTIME_URL" in https://git.kof22.com|https://git.kof22.com/*) ;; *) echo 'Runtime endpoint is not the private HTTPS forge'; exit 1 ;; esac
+          case "${ACTIONS_RESULTS_URL:-}" in ''|https://git.kof22.com|https://git.kof22.com/*) ;; *) echo 'Results endpoint is not the private HTTPS forge'; exit 1 ;; esac
+      - name: Retain diagnostic reports
+        if: ${{ always() && steps.artifact_endpoint.outcome == 'success' }}
+        uses: self:KofTwentyTwo/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: diagnosis-only-start-order
+          path: |
+            target/surefire-reports/*
+            target/failsafe-reports/*
+            target/site/jacoco/jacoco.xml
+            ci-reports/jacoco/**
+            ci-reports/test-output/**
+          if-no-files-found: warn
+          retention-days: 7

.gitea/workflows/command-parity-qualification.yaml

@@ -0,0 +1,13 @@
+name: Original Maven command qualification
+on:
+  workflow_dispatch: {}
+permissions:
+  contents: read
+jobs:
+  qualify:
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/java-docker.yaml@b7cca9f697774d03660fbf73f71182c893137c7d
+    with:
+      runner: linux-small
+      docker-runner: container-build
+      browsers: true
+      browser-runner: browser-build

.gitea/workflows/release-rc.yaml

@@ -0,0 +1,72 @@
+name: Release candidate
+'on':
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Plan a cut without changing release state
+        type: boolean
+        default: false
+      finalize:
+        description: Retry finalization of an existing cut; do not cut another RC
+        type: boolean
+        default: false
+      recover:
+        description: Recover the same published RC after a deployment timeout; never
+          reupload
+        type: boolean
+        default: false
+      circle_build:
+        description: Original release run id (recovery only)
+        type: string
+        default: ''
+      merge_sha:
+        description: Existing cut merge_sha (finalize retry only)
+        type: string
+        default: ''
+      bump_sha:
+        description: Existing cut bump_sha (finalize retry only)
+        type: string
+        default: ''
+      branch:
+        description: Existing cut branch (finalize retry only)
+        type: string
+        default: ''
+      version:
+        description: Existing cut version (finalize retry only)
+        type: string
+        default: ''
+  pull_request:
+    types:
+    - closed
+    branches:
+    - develop
+permissions:
+  contents: read
+jobs:
+  release-rc:
+    # The old qbit-rc-published repository_dispatch is replaced by the already-proven workflow_dispatch
+    # completion: the publisher's own ActionsWRITE job dispatches this workflow with finalize=true plus
+    # merge_sha/bump_sha/branch/version (same inputs as the manual finalize retry).
+    permissions:
+      contents: write
+      actions: read
+      pull-requests: write
+    if: github.event_name == 'workflow_dispatch'
+      || (github.event_name == 'pull_request' && github.event.pull_request.merged
+      == true && github.event.pull_request.base.ref == 'develop' && contains(github.event.pull_request.labels.*.name,
+      'release:rc'))
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/qbit-release-rc.yaml@qrun-release-v1
+    with:
+      dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false
+        }}
+      finalize: ${{ github.event_name == 'workflow_dispatch' && inputs.finalize }}
+      recover: ${{ github.event_name == 'workflow_dispatch' && inputs.recover || false
+        }}
+      circle_build: ${{ github.event_name == 'workflow_dispatch' && inputs.circle_build
+        || '' }}
+      merge_sha: ${{ inputs.merge_sha || '' }}
+      bump_sha: ${{ inputs.bump_sha || '' }}
+      branch: ${{ inputs.branch || '' }}
+      version: ${{ inputs.version || '' }}
+    secrets:
+      QRUN_TAG_SIGNING_KEY: ${{ secrets.QRUN_TAG_SIGNING_KEY }}