ci: centralize branch verification and source scanning

Co-Authored-By: Codex <noreply@openai.com>

.circleci/config.yml

@@ -1,65 +1,14 @@
-version: 2.1
-
-orbs:
-  qqq-orb: kingsrook/qqq-orb@0.5.0
-
-commands:
-  configure-package-install:
-    steps:
-      - run:
-          name: Keep package installation unattended
-          command: |
-            # These build machines are discarded after the job.
-            sudo install -d /etc/needrestart/conf.d
-            printf '%s\n' '$nrconf{restart} = "l";' | sudo tee /etc/needrestart/conf.d/99-qqq-ci.conf >/dev/null
-
-workflows:
-
-  test_only:
-    jobs:
-      - qqq-orb/mvn_test_only:
-          pre-steps:
-            - configure-package-install
-          context: [ qqq-maven-registry-credentials ]
-          filters:
-            branches:
-              ignore: /(develop|release/.*|integration.*)/
-            tags:
-              only: []  
-
-  publish_snapshot:
-    jobs:
-      - qqq-orb/mvn_publish:
-          pre-steps:
-            - configure-package-install
-          context: [ qqq-maven-registry-credentials ]
-          branch_type: snapshot
-          filters:
-            branches:
-              only:
-                - develop
-
-  publish_release_candidate:
-    jobs:
-      - qqq-orb/mvn_publish:
-          pre-steps:
-            - configure-package-install
-          context: [ qqq-maven-registry-credentials ]
-          branch_type: release_candidate
-          filters:
-            branches:
-              only:
-                - /release\/.*/
-
-  publish_release:
-    jobs:
-      - qqq-orb/mvn_publish:
-          pre-steps:
-            - configure-package-install
-          context: [ qqq-maven-registry-credentials ]
-          branch_type: release
-          filters:
-            branches:
-               ignore: /.*/
-            tags:
-              only: [ /^v\d+\.\d+\.\d+$/ ]
+version: 2.1
+setup: true
+orbs:
+  qqq-orb: kingsrook/qqq-orb@0.7.15
+workflows:
+  setup:
+    jobs:
+    - qqq-orb/generate_pipeline:
+        orb_version: 0.7.15
+        filters:
+          branches:
+            ignore: automation/qbit-rc-pending
+          tags:
+            only: /^v\d+\.\d+\.\d+$/

.github/workflows/codeql.yml

@@ -0,0 +1,23 @@
+name: CodeQL
+'on':
+  push:
+    branches:
+    - main
+    - develop
+    - release/**
+    - hotfix/**
+  pull_request: {}
+  schedule:
+  - cron: 41 16 * * 0
+  workflow_dispatch: {}
+permissions:
+  contents: read
+  actions: read
+  security-events: write
+  packages: read
+concurrency:
+  group: codeql-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+jobs:
+  analyze:
+    uses: QRun-IO/qqq-orb/.github/workflows/qbit-codeql.yml@c288a8864fe9054f68410e1d78f5863aea4c4d22

.qqq-ci.yml

@@ -0,0 +1,16 @@
+profile: qbit
+orb_version: 0.7.15
+default_branch: main
+java_version: '21'
+browsers: true
+api_checks: false
+docs_only: false
+release_on_main: false
+release_tag_policy: stable
+test_branch_policy: non-release-no-integration
+publish:
+  snapshot: true
+  release_candidate: true
+  release: true
+  asciidoc: false
+release_completion: false

CLAUDE.md

@@ -15,5 +15,6 @@ Key orientation facts (details and caveats in the dossier):
   README's `io.qrun:qbit-bom` coordinates do not exist on Maven Central.
 - v1.6.0 imports `com.kingsrook.qqq:qqq-bom-pom:0.40.0` (Java 21, junit-bom 6.0.1);
   develop pins `0.41.0-SNAPSHOT`, which no longer resolves (qqq renumbered to 4.0.x).
-- Known licensing inconsistency: LICENSE/NOTICE = Apache-2.0, pom `<licenses>` = AGPL-3.0
-  (shipped to Central in 1.6.0), README says Proprietary. See dossier "Maturity & risks".
+- First-party license declarations in the current source are Apache-2.0, consistent
+  with LICENSE and NOTICE. Previously published artifacts retain their original
+  metadata; publish a new version for declaration corrections.

README.md

@@ -95,4 +95,33 @@ The running core version is read from `META-INF/maven/com.kingsrook.qqq/qqq-back
 
 ## License
 
-See [LICENSE](LICENSE) and [NOTICE](NOTICE).
+### Packaged notices
+
+The packaging change in this source tree copies each consumer's own root
+`LICENSE` and `NOTICE` into `META-INF` in main/test archives and Maven shared
+archive resources used by source/Javadoc archives. Existing main/test resources
+remain included. Consumers must adopt a newly published parent version to receive
+this change; the existing public 2.0.0 artifact is unchanged.
+
+The default `qbit.noticesDirectory` is `${project.basedir}`. In a nested module
+whose files live at the repository root, set it to `${project.basedir}/..` (adjust
+for the actual layout). Do not point it at the build-parent checkout: these are
+the consuming project's notices. If a child overrides `<resources>` or
+`<testResources>`, retain the inherited shared archive resource directory.
+
+After packaging the consumer, explicitly check every produced archive using
+Python 3 and the guard from this checkout:
+
+```bash
+mvn -Prelease -DskipTests -Dgpg.skip=true clean package
+python3 /path/to/qbit-bom/scripts/check-packaged-notices.py --root . target/*.jar
+```
+
+For a multi-module consumer, pass each module's actual JAR paths and its repository
+root. The guard rejects missing archives, missing/duplicate entries and changed
+notice bytes. Packaging-only checks skip runtime tests; existing tests, review
+and release requirements still apply. The publishing workflow does not invoke
+this guard automatically.
+
+Licensed under the Apache License, Version 2.0. See [LICENSE](LICENSE) and [NOTICE](NOTICE).
+

pom.xml

@@ -19,8 +19,8 @@
    <url>https://github.com/Kingsrook/qbit-bom</url>
    <licenses>
       <license>
-         <name>GNU Affero General Public License v3.0</name>
-         <url>https://www.gnu.org/licenses/agpl-3.0-standalone.html</url>
+         <name>Apache License, Version 2.0</name>
+         <url>https://www.apache.org/licenses/LICENSE-2.0</url>
          <distribution>repo</distribution>
       </license>
    </licenses>
@@ -44,9 +44,11 @@
       <java.version>21</java.version>
       <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
       <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
+      <!-- Multi-module consumers override this in modules whose notices live above basedir. -->
+      <qbit.noticesDirectory>${project.basedir}</qbit.noticesDirectory>
 
       <!-- use revision property in children -->
-      <revision>2.1.1</revision>
+      <revision>2.1.2</revision>
       <!-- Do not use revision here: children override it with their own version. -->
       <qbit.guardrails.version>2.1.0</qbit.guardrails.version>
       <qbit.guardrails.enforce>false</qbit.guardrails.enforce>
@@ -79,6 +81,52 @@
    </dependencyManagement>
 
    <build>
+      <resources>
+         <resource>
+            <directory>src/main/resources</directory>
+         </resource>
+         <resource>
+            <directory>${project.build.directory}/maven-shared-archive-resources</directory>
+         </resource>
+      </resources>
+      <testResources>
+         <testResource>
+            <directory>src/test/resources</directory>
+         </testResource>
+         <testResource>
+            <directory>${project.build.directory}/maven-shared-archive-resources</directory>
+         </testResource>
+      </testResources>
+      <plugins>
+         <!-- Source and Javadoc archives also consume Maven's shared archive resources. -->
+         <plugin>
+            <groupId>org.apache.maven.plugins</groupId>
+            <artifactId>maven-resources-plugin</artifactId>
+            <version>3.4.0</version>
+            <executions>
+               <execution>
+                  <id>package-root-notices</id>
+                  <phase>generate-resources</phase>
+                  <goals>
+                     <goal>copy-resources</goal>
+                  </goals>
+                  <configuration>
+                     <outputDirectory>${project.build.directory}/maven-shared-archive-resources/META-INF</outputDirectory>
+                     <resources>
+                        <resource>
+                           <directory>${qbit.noticesDirectory}</directory>
+                           <filtering>false</filtering>
+                           <includes>
+                              <include>LICENSE</include>
+                              <include>NOTICE</include>
+                           </includes>
+                        </resource>
+                     </resources>
+                  </configuration>
+               </execution>
+            </executions>
+         </plugin>
+      </plugins>
       <pluginManagement>
          <plugins>
             <!-- Compiler -->

scripts/check-packaged-notices.py

@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+"""Verify exact project notices in explicitly listed Maven archives."""
+
+import argparse
+from pathlib import Path
+import sys
+from zipfile import BadZipFile, ZipFile
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--root", type=Path, required=True,
+                        help="consumer repository containing LICENSE and NOTICE")
+    parser.add_argument("--prefix", default="META-INF",
+                        help="directory containing the project's archive copies")
+    parser.add_argument("archives", type=Path, nargs="+")
+    args = parser.parse_args()
+    expected = {name: (args.root / name).read_bytes() for name in ("LICENSE", "NOTICE")}
+    failures = []
+    for archive in args.archives:
+        try:
+            with ZipFile(archive) as jar:
+                for name, content in expected.items():
+                    entry = f"{args.prefix.rstrip('/')}/{name}"
+                    if jar.namelist().count(entry) != 1:
+                        failures.append(f"{archive}: expected exactly one {entry}")
+                    elif jar.read(entry) != content:
+                        failures.append(f"{archive}: {entry} differs from root {name}")
+        except (OSError, BadZipFile) as error:
+            failures.append(f"{archive}: {error}")
+    if failures:
+        print("\n".join(failures), file=sys.stderr)
+        return 1
+    print(f"PASS: exact LICENSE/NOTICE in {len(args.archives)} archives")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())