From 6290b23a324c3ba2415cf35c8308523fdf030a73 Mon Sep 17 00:00:00 2001
From: Forge Recovery <forge-recovery@kof22.com>
Date: Tue, 3 Nov 2026 17:57:26 +0000
Subject: [PATCH] ci: restore Auth fixture startup order and shared lifecycle

Co-Authored-By: Codex <noreply@openai.com>

Co-Authored-By: Codex <noreply@openai.com>
---
 .gitea/workflows/qrun-release.yaml            | 25 +++++++
 .gitea/workflows/release-rc.yaml              | 72 +++++++++++++++++++
 .../contract/AuthentikTestStack.java          |  2 +-
 3 files changed, 98 insertions(+), 1 deletion(-)
 create mode 100644 .gitea/workflows/qrun-release.yaml
 create mode 100644 .gitea/workflows/release-rc.yaml

diff --git a/.gitea/workflows/qrun-release.yaml b/.gitea/workflows/qrun-release.yaml
new file mode 100644
index 0000000..5ebc530
--- /dev/null
+++ b/.gitea/workflows/qrun-release.yaml
@@ -0,0 +1,25 @@
+# Standard QRun release caller (v2, thin contract): every push and manual dispatch delegates to the protected qrun-release-v1 channel. Do not edit per repository.
+name: qrun-release
+on:
+  push: {}
+  workflow_dispatch: {}
+permissions:
+  contents: read
+  actions: read
+jobs:
+  release:
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/java-docker.yaml@qrun-release-v1
+    with:
+      runner: linux-small
+      docker-runner: container-build
+      browsers: true
+      browser-runner: browser-build
+  postpublish:
+    if: ${{ needs.release.outputs.capture == 'true' }}
+    needs: release
+    permissions:
+      contents: write
+      actions: write
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/qrun-source-version.yaml@qrun-release-v1
+    with:
+      runner: linux-small
diff --git a/.gitea/workflows/release-rc.yaml b/.gitea/workflows/release-rc.yaml
new file mode 100644
index 0000000..12ec9fc
--- /dev/null
+++ b/.gitea/workflows/release-rc.yaml
@@ -0,0 +1,72 @@
+name: Release candidate
+'on':
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Plan a cut without changing release state
+        type: boolean
+        default: false
+      finalize:
+        description: Retry finalization of an existing cut; do not cut another RC
+        type: boolean
+        default: false
+      recover:
+        description: Recover the same published RC after a deployment timeout; never
+          reupload
+        type: boolean
+        default: false
+      circle_build:
+        description: Original release run id (recovery only)
+        type: string
+        default: ''
+      merge_sha:
+        description: Existing cut merge_sha (finalize retry only)
+        type: string
+        default: ''
+      bump_sha:
+        description: Existing cut bump_sha (finalize retry only)
+        type: string
+        default: ''
+      branch:
+        description: Existing cut branch (finalize retry only)
+        type: string
+        default: ''
+      version:
+        description: Existing cut version (finalize retry only)
+        type: string
+        default: ''
+  pull_request:
+    types:
+    - closed
+    branches:
+    - develop
+permissions:
+  contents: read
+jobs:
+  release-rc:
+    # The old qbit-rc-published repository_dispatch is replaced by the already-proven workflow_dispatch
+    # completion: the publisher's own ActionsWRITE job dispatches this workflow with finalize=true plus
+    # merge_sha/bump_sha/branch/version (same inputs as the manual finalize retry).
+    permissions:
+      contents: write
+      actions: read
+      pull-requests: write
+    if: github.event_name == 'workflow_dispatch'
+      || (github.event_name == 'pull_request' && github.event.pull_request.merged
+      == true && github.event.pull_request.base.ref == 'develop' && contains(github.event.pull_request.labels.*.name,
+      'release:rc'))
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/qbit-release-rc.yaml@qrun-release-v1
+    with:
+      dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false
+        }}
+      finalize: ${{ github.event_name == 'workflow_dispatch' && inputs.finalize }}
+      recover: ${{ github.event_name == 'workflow_dispatch' && inputs.recover || false
+        }}
+      circle_build: ${{ github.event_name == 'workflow_dispatch' && inputs.circle_build
+        || '' }}
+      merge_sha: ${{ inputs.merge_sha || '' }}
+      bump_sha: ${{ inputs.bump_sha || '' }}
+      branch: ${{ inputs.branch || '' }}
+      version: ${{ inputs.version || '' }}
+    secrets:
+      QRUN_TAG_SIGNING_KEY: ${{ secrets.QRUN_TAG_SIGNING_KEY }}
diff --git a/src/test/java/com/kingsrook/qbits/authentik/contract/AuthentikTestStack.java b/src/test/java/com/kingsrook/qbits/authentik/contract/AuthentikTestStack.java
index 7d54de4..c3f14a1 100644
--- a/src/test/java/com/kingsrook/qbits/authentik/contract/AuthentikTestStack.java
+++ b/src/test/java/com/kingsrook/qbits/authentik/contract/AuthentikTestStack.java
@@ -165,8 +165,8 @@ public final class AuthentikTestStack
    {
       postgres.start();
       mailpit.start();
-      worker.start();
       server.start();
+      worker.start();
 
       TestApi admin = admin();
       try
-- 
2.54.0