release: promote develop to release/0.1 (0.1.0-RC.9) #64

Merged

james.maes merged 10 commits from develop into release/0.1 2026-11-06 15:35:42 +00:00

Conversation 0 Commits 10 Files Changed 16

+101 -109

james.maes commented 2026-11-06 15:34:21 +00:00

Owner

Copy link

Copy source

Carries the create-time two-person approval fix (PR 63) and everything since RC.8 onto the release train. The shared workflow publishes 0.1.0-RC.9 to the Gitea Maven registry and tags v0.1.0-RC.9 on merge.

🤖 Generated with Claude Code

Carries the create-time two-person approval fix (PR 63) and everything since RC.8 onto the release train. The shared workflow publishes 0.1.0-RC.9 to the Gitea Maven registry and tags v0.1.0-RC.9 on merge. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

james.maes added 10 commits 2026-11-06 15:34:21 +00:00

ci: use shared ci-workflows Maven workflow ... 021a9ae446

Replace the platform-ci release callers with one caller of
KofTwentyTwo/ci-workflows maven.yaml (qqq-orb port).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ci: rerun shared workflow 8f91c08e3e

ci: rerun shared workflow c9806e2b82

test(authentik): make contract ITs run against a non-loopback Docker host ... ba5a688525

- SchemaDriftIT/SchemaDriftTest: quote OpenAPI path templates before
  turning {key} into a regex; other placeholders such as {slug} were
  compiled as regex repetition and threw PatternSyntaxException.
- Contract ITs: set allowInsecureHttp on the test qbit config; the
  Authentik test container is plain http and is reached via the Docker
  host address (e.g. 172.17.0.1 in CI), not loopback. Production https
  validation is unchanged.
- Postgres ITs: bind the mapped port to 127.0.0.1 only when the Docker
  daemon is local; with a remote daemon the loopback-only binding made
  the database unreachable (connection refused).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test(authentik): re-apply errored kof22 blueprints during contract stack startup ... 8b52f583e9

On a cold runner the built-in Authentik blueprints can race our custom
ones on first boot, leaving kof22-oauth2-apps in "error" until the
8-minute wait times out (run 5465). The local-review path already
re-applied errored blueprints; do the same (throttled to every 10s) in
the shared contract-stack wait.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test(authentik): also re-apply never-applied kof22 blueprints at startup ... 38660be0f5

Run 5488: with errored blueprints re-applied, kof22-oauth2-apps and
kof22-qqq-tokens succeeded but kof22-identity-bootstrap stayed
"unknown" (never applied) until the wait timed out. Re-apply blueprints
in "error" or "unknown" state after a 60s grace period, every 30s.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test(authentik): surface Authentik error logs when the contract stack fails to start ... ea5c5ab65e

When the blueprint wait times out, also print error-level worker lines
and error/warning server lines (API-triggered re-applies run in the
server), so the failing blueprint's cause is visible in CI logs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Merge pull request 'ci: use shared ci-workflows Maven workflow' (#61) from ci/ci-workflows into develop d928575104

fix(admin): queue two-person approval when Create Group grants authentik.* ... 53bc414490

With twoPersonApproval=true, the native Create Group action persisted a
new group carrying authentik.* permissions (for example
authentik.users.read) immediately, while Edit Group queued an
authentik_approval_request for a second person. Apply the same
identity-permission expansion and second-person condition at creation
time: the plan becomes NEEDS_APPROVAL and nothing is written until a
distinct operator holding authentik.approve approves it; the stored
request keeps the native requester/approver and live revalidation
checks.

Regression test: creating a group with authentik.users.read queues one
approval request and writes nothing, self-approval is refused, a second
operator with approve + groups.manage completes the creation, the
persisted group carries exactly the requested permission, the request is
APPROVED, and a repeat approval is refused.

Carried locally by GG Forge as qbit-authentik-rc8-create-approval.patch
since 0.1.0-RC.8.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>

Merge pull request 'fix(admin): queue two-person approval when Create Group grants authentik.*' (#63) from fix/create-time-approval-20261106 into develop 4d45796651

james.maes merged commit 3ee07e26ba into release/0.1 2026-11-06 15:35:42 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

architecture

Architecture review: coupling, cohesion, UI API

bug

Something isn't working

dependencies

documentation

Improvements or additions to documentation

duplicate

This issue or pull request already exists

enhancement

New feature or request

github_actions

Pull requests that update GitHub Actions code

good first issue

Good for newcomers

help wanted

Extra attention is needed

invalid

This doesn't seem right

java

Pull requests that update java code

question

Further information is requested

release:rc

Merging this develop PR cuts the next release candidate

secuurity

wontfix

This will not be worked on

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

forge-recovery (Forge Recovery) james.maes (James Maes)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-authentik#64