release: promote develop to release/0.1 (0.1.0-RC.9) #64

Merged

james.maes merged 10 commits from develop into release/0.1 2026-11-06 15:35:42 +00:00

Conversation 0 Commits 10 Files Changed 16

+101 -109

10 Commits

Author	SHA1	Message	Date
james.maes	4d45796651	Merge pull request 'fix(admin): queue two-person approval when Create Group grants authentik.*' (#63) from fix/create-time-approval-20261106 into develop	2026-11-06 15:31:54 +00:00
james.maesandClaude Fable 5.1	53bc414490	fix(admin): queue two-person approval when Create Group grants authentik.* ... With twoPersonApproval=true, the native Create Group action persisted a new group carrying authentik.* permissions (for example authentik.users.read) immediately, while Edit Group queued an authentik_approval_request for a second person. Apply the same identity-permission expansion and second-person condition at creation time: the plan becomes NEEDS_APPROVAL and nothing is written until a distinct operator holding authentik.approve approves it; the stored request keeps the native requester/approver and live revalidation checks. Regression test: creating a group with authentik.users.read queues one approval request and writes nothing, self-approval is refused, a second operator with approve + groups.manage completes the creation, the persisted group carries exactly the requested permission, the request is APPROVED, and a repeat approval is refused. Carried locally by GG Forge as qbit-authentik-rc8-create-approval.patch since 0.1.0-RC.8. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: James Maes <james@kof22.com>	2026-11-06 08:40:17 -06:00
james.maes	d928575104	Merge pull request 'ci: use shared ci-workflows Maven workflow' (#61) from ci/ci-workflows into develop	2026-11-06 00:48:15 +00:00
James MaesandClaude Opus 5.5	ea5c5ab65e	test(authentik): surface Authentik error logs when the contract stack fails to start ... When the blueprint wait times out, also print error-level worker lines and error/warning server lines (API-triggered re-applies run in the server), so the failing blueprint's cause is visible in CI logs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 18:28:50 -06:00
James MaesandClaude Opus 5.5	38660be0f5	test(authentik): also re-apply never-applied kof22 blueprints at startup ... Run 5488: with errored blueprints re-applied, kof22-oauth2-apps and kof22-qqq-tokens succeeded but kof22-identity-bootstrap stayed "unknown" (never applied) until the wait timed out. Re-apply blueprints in "error" or "unknown" state after a 60s grace period, every 30s. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 17:30:04 -06:00
James MaesandClaude Opus 5.5	8b52f583e9	test(authentik): re-apply errored kof22 blueprints during contract stack startup ... On a cold runner the built-in Authentik blueprints can race our custom ones on first boot, leaving kof22-oauth2-apps in "error" until the 8-minute wait times out (run 5465). The local-review path already re-applied errored blueprints; do the same (throttled to every 10s) in the shared contract-stack wait. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 17:11:53 -06:00
James MaesandClaude Opus 5.5	ba5a688525	test(authentik): make contract ITs run against a non-loopback Docker host ... - SchemaDriftIT/SchemaDriftTest: quote OpenAPI path templates before turning {key} into a regex; other placeholders such as {slug} were compiled as regex repetition and threw PatternSyntaxException. - Contract ITs: set allowInsecureHttp on the test qbit config; the Authentik test container is plain http and is reached via the Docker host address (e.g. 172.17.0.1 in CI), not loopback. Production https validation is unchanged. - Postgres ITs: bind the mapped port to 127.0.0.1 only when the Docker daemon is local; with a remote daemon the loopback-only binding made the database unreachable (connection refused). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 16:52:46 -06:00
CI	c9806e2b82	ci: rerun shared workflow	2026-11-05 16:23:54 -06:00
CI	8f91c08e3e	ci: rerun shared workflow	2026-11-05 16:15:15 -06:00
james.maesandClaude Opus 5.5	021a9ae446	ci: use shared ci-workflows Maven workflow ... Replace the platform-ci release callers with one caller of KofTwentyTwo/ci-workflows maven.yaml (qqq-orb port). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 22:02:07 +00:00