test(ci): isolate existing Authentik bootstrap setup

Co-Authored-By: Codex <noreply@openai.com>

.circleci/config.yml

@@ -1,12 +1,12 @@
 version: 2.1
 setup: true
 orbs:
-  qqq-orb: kingsrook/qqq-orb@0.7.12
+  qqq-orb: kingsrook/qqq-orb@0.8
 workflows:
   setup:
     jobs:
     - qqq-orb/generate_pipeline:
-        orb_version: 0.7.12
+        orb_version: '0.8'
         filters:
           branches:
             ignore: automation/qbit-rc-pending

.gitea/workflows/auth-bootstrap-diagnostic.yaml

@@ -0,0 +1,109 @@
+name: DIAGNOSIS ONLY - Authentik BootstrapBlueprintIT repro
+# TEMPORARY, MANUAL, DIAGNOSIS ONLY. Never publication, never production qualification, never a gate.
+# Runs only BootstrapBlueprintIT through the original Maven verify command (same -T4, no skipITs, no relaxed checks).
+# Because only one IT is selected, the original coverage check may fail for that reason; that is NOT the blueprint verdict.
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+env:
+  CI: 'true'
+jobs:
+  diagnose:
+    runs-on: browser-build
+    timeout-minutes: 15
+    container:
+      image: local/java-browser:298bba0a82d7b62237dbcd15e6c876c4d4bb68a575ee6f47dedeeb5591f5e7f0
+      options: --init --shm-size=256m
+      volumes:
+        - /var/lib/gitea-job-workspace:${{ github.workspace }}
+        - /run/user/1002/docker.sock:/run/test-docker.sock
+    env:
+      CI: 'true'
+      HOME: /tmp
+      MAVEN_OPTS: -Duser.home=/tmp -Xmx1g
+      MAVEN_CONFIG: /tmp/.m2
+      DOCKER_HOST: unix:///run/test-docker.sock
+      TESTCONTAINERS_DOCKER_SOCKET_OVERRIDE: /run/user/1002/docker.sock
+      TESTCONTAINERS_HOST_OVERRIDE: 172.17.0.1
+    steps:
+      - name: Checkout application at the frozen qualification head
+        uses: builtin:checkout
+        with:
+          repository: QRun-IO/qbit-authentik
+          ref: 4d675b18f65b75c43c7724a632ff8d296b56fefa
+      - name: Checkout platform-ci tools at the exact engine into a separate path
+        uses: builtin:checkout
+        with:
+          repository: KofTwentyTwo/platform-ci
+          ref: d3ee308467433ebbf7db785a9f8c2185d1485f29
+          path: .ci-diagnostic-tools
+      - run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+      - name: Install the pinned action runtime without root
+        run: |
+          set -eu
+          mkdir -p /tmp/java-actions-node
+          curl -fsSL https://nodejs.org/dist/v22.20.0/node-v22.20.0-linux-x64.tar.gz -o /tmp/java-actions-node/node.tar.gz
+          printf '%s\n' 'eeaccb0378b79406f2208e8b37a62479c70595e20be6b659125eb77dd1ab2a29  /tmp/java-actions-node/node.tar.gz' | sha256sum -c -
+          tar -xzf /tmp/java-actions-node/node.tar.gz -C /tmp/java-actions-node --strip-components=1
+          echo /tmp/java-actions-node/bin >> "$GITHUB_PATH"
+      - name: Verify execution boundary
+        run: node "$GITHUB_WORKSPACE/.ci-diagnostic-tools/scripts/docker-boundary.mjs"
+      - name: Run BootstrapBlueprintIT only (original verify command plus filter flags)
+        run: |
+          set -eu
+          tools="$GITHUB_WORKSPACE/.ci-diagnostic-tools"
+          test -f pom.xml
+          java -version
+          mvn -version
+          bash "$tools/scripts/setup-maven-settings.sh"
+          proxy_pid=''
+          proxy_dir=''
+          cleanup() {
+            if [ -n "$proxy_pid" ]; then
+              kill "$proxy_pid" 2>/dev/null || true
+              wait "$proxy_pid" 2>/dev/null || true
+            fi
+            if [ -n "$proxy_dir" ]; then rm -rf "$proxy_dir"; fi
+          }
+          trap cleanup EXIT
+          trap 'exit 143' INT TERM
+          proxy_dir="$(mktemp -d "${RUNNER_TEMP:-/tmp}/qrun-localhost.XXXXXX")"
+          node "$tools/scripts/compose-localhost-forward.mjs" --containers --host 172.17.0.1 --ready "$proxy_dir/ready" &
+          proxy_pid=$!
+          waited=0
+          while [ ! -f "$proxy_dir/ready" ]; do
+            if ! kill -0 "$proxy_pid" 2>/dev/null || [ "$waited" -ge 100 ]; then
+              echo 'Localhost Testcontainers proxy did not become ready'
+              exit 1
+            fi
+            sleep 0.1
+            waited=$((waited + 1))
+          done
+          kill -0 "$proxy_pid"
+          # set -e keeps Maven's nonzero status; the EXIT trap cleans up the forwarder first.
+          ( export TESTCONTAINERS_HOST_OVERRIDE=localhost; mvn -s /tmp/circleci/mvn-settings.xml --update-snapshots -T4 --no-transfer-progress verify -Dit.test=BootstrapBlueprintIT -Dtest=none -Dsurefire.failIfNoSpecifiedTests=false )
+          kill -0 "$proxy_pid"
+      - if: ${{ always() }}
+        name: Collect Maven reports
+        run: bash "$GITHUB_WORKSPACE/.ci-diagnostic-tools/scripts/collect-maven-reports.sh" ci-reports
+      - name: Require private artifact service
+        if: ${{ always() }}
+        id: artifact_endpoint
+        run: |
+          set -eu
+          case "$ACTIONS_RUNTIME_URL" in https://git.kof22.com|https://git.kof22.com/*) ;; *) echo 'Runtime endpoint is not the private HTTPS forge'; exit 1 ;; esac
+          case "${ACTIONS_RESULTS_URL:-}" in ''|https://git.kof22.com|https://git.kof22.com/*) ;; *) echo 'Results endpoint is not the private HTTPS forge'; exit 1 ;; esac
+      - name: Retain diagnostic reports
+        if: ${{ always() && steps.artifact_endpoint.outcome == 'success' }}
+        uses: self:KofTwentyTwo/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: auth-bootstrap-diagnostic
+          path: |
+            target/surefire-reports/*
+            target/failsafe-reports/*
+            target/site/jacoco/jacoco.xml
+            ci-reports/jacoco/**
+            ci-reports/test-output/**
+          if-no-files-found: warn
+          retention-days: 7

.gitea/workflows/command-parity-qualification.yaml

@@ -0,0 +1,13 @@
+name: Original Maven command qualification
+on:
+  workflow_dispatch: {}
+permissions:
+  contents: read
+jobs:
+  qualify:
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/java-docker.yaml@b7cca9f697774d03660fbf73f71182c893137c7d
+    with:
+      runner: linux-small
+      docker-runner: container-build
+      browsers: true
+      browser-runner: browser-build

.gitea/workflows/release-rc.yaml

@@ -0,0 +1,72 @@
+name: Release candidate
+'on':
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Plan a cut without changing release state
+        type: boolean
+        default: false
+      finalize:
+        description: Retry finalization of an existing cut; do not cut another RC
+        type: boolean
+        default: false
+      recover:
+        description: Recover the same published RC after a deployment timeout; never
+          reupload
+        type: boolean
+        default: false
+      circle_build:
+        description: Original release run id (recovery only)
+        type: string
+        default: ''
+      merge_sha:
+        description: Existing cut merge_sha (finalize retry only)
+        type: string
+        default: ''
+      bump_sha:
+        description: Existing cut bump_sha (finalize retry only)
+        type: string
+        default: ''
+      branch:
+        description: Existing cut branch (finalize retry only)
+        type: string
+        default: ''
+      version:
+        description: Existing cut version (finalize retry only)
+        type: string
+        default: ''
+  pull_request:
+    types:
+    - closed
+    branches:
+    - develop
+permissions:
+  contents: read
+jobs:
+  release-rc:
+    # The old qbit-rc-published repository_dispatch is replaced by the already-proven workflow_dispatch
+    # completion: the publisher's own ActionsWRITE job dispatches this workflow with finalize=true plus
+    # merge_sha/bump_sha/branch/version (same inputs as the manual finalize retry).
+    permissions:
+      contents: write
+      actions: read
+      pull-requests: write
+    if: github.event_name == 'workflow_dispatch'
+      || (github.event_name == 'pull_request' && github.event.pull_request.merged
+      == true && github.event.pull_request.base.ref == 'develop' && contains(github.event.pull_request.labels.*.name,
+      'release:rc'))
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/qbit-release-rc.yaml@qrun-release-v1
+    with:
+      dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false
+        }}
+      finalize: ${{ github.event_name == 'workflow_dispatch' && inputs.finalize }}
+      recover: ${{ github.event_name == 'workflow_dispatch' && inputs.recover || false
+        }}
+      circle_build: ${{ github.event_name == 'workflow_dispatch' && inputs.circle_build
+        || '' }}
+      merge_sha: ${{ inputs.merge_sha || '' }}
+      bump_sha: ${{ inputs.bump_sha || '' }}
+      branch: ${{ inputs.branch || '' }}
+      version: ${{ inputs.version || '' }}
+    secrets:
+      QRUN_TAG_SIGNING_KEY: ${{ secrets.QRUN_TAG_SIGNING_KEY }}

.github/workflows/codeql.yml

@@ -0,0 +1,23 @@
+name: CodeQL
+'on':
+  push:
+    branches:
+    - main
+    - develop
+    - release/**
+    - hotfix/**
+  pull_request: {}
+  schedule:
+  - cron: 41 16 * * 0
+  workflow_dispatch: {}
+permissions:
+  contents: read
+  actions: read
+  security-events: write
+  packages: read
+concurrency:
+  group: codeql-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+jobs:
+  analyze:
+    uses: QRun-IO/qqq-orb/.github/workflows/qbit-codeql.yml@c288a8864fe9054f68410e1d78f5863aea4c4d22

.qqq-ci.yml

@@ -1,5 +1,5 @@
 profile: qbit
-orb_version: 0.7.12
+orb_version: '0.8'
 default_branch: develop
 java_version: '21'
 browsers: true