From 0f5448256c77647fa6c18ae1fbca108142f97e36 Mon Sep 17 00:00:00 2001 From: James Maes Date: Wed, 14 Oct 2026 08:48:08 -0500 Subject: [PATCH 1/2] feat(guardrails): allow qbit-email's published API by default Adds com.kingsrook.qbits:qbit-email to the default G1 artifact allow-list and com.kingsrook.qbits.email.api to the default API packages, as for qbit-object-storage, so qbits that call qbit-email's api package need no per-repo allow-list. Internal qbit-email packages stay forbidden. Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 3 +++ README.md | 4 ++-- pom.xml | 4 ++-- .../java/com/kingsrook/qbits/guardrails/GuardrailProject.java | 4 ++-- 4 files changed, 9 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e3a2cc9..9350b68 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Changed +- G1 default allow-lists include qbit-email's published API: artifact `com.kingsrook.qbits:qbit-email` and package `com.kingsrook.qbits.email.api` (as for qbit-object-storage), so consumers need no per-repo allow-list. + ## [2.1.0] - 2026-10-13 ### Added diff --git a/README.md b/README.md index 535cd43..68fcb42 100644 --- a/README.md +++ b/README.md @@ -64,8 +64,8 @@ Configuration properties: | Property | Default / meaning | | --- | --- | | `qbit.guardrails.enforce` | `false`; fail on G1, G3, G4 and G7 violations when `true`. | -| `qbit.guardrails.allowedQbitArtifacts` | Comma-separated Maven `groupId:artifactId` patterns, with `*` wildcards. Default: `com.kingsrook.qbits:qbit-object-storage,com.kingsrook.qbits:*-api`. Replacing this property replaces the allow-list. | -| `qbit.guardrails.allowedApiPackages` | Comma-separated package prefixes. Default: `com.kingsrook.qbits.objectstorage.api`. A trailing `..` is accepted. Package boundaries are exact (`apiInternal` is not `api`). | +| `qbit.guardrails.allowedQbitArtifacts` | Comma-separated Maven `groupId:artifactId` patterns, with `*` wildcards. Default: `com.kingsrook.qbits:qbit-object-storage,com.kingsrook.qbits:qbit-email,com.kingsrook.qbits:*-api`. Replacing this property replaces the allow-list. | +| `qbit.guardrails.allowedApiPackages` | Comma-separated package prefixes. Default: `com.kingsrook.qbits.objectstorage.api,com.kingsrook.qbits.email.api`. A trailing `..` is accepted. Package boundaries are exact (`apiInternal` is not `api`). | | `qbit.guardrails.ownPackage` | Optional JVM/CLI property: fourth segment (e.g. `alerts`) or full `com.kingsrook.qbits.alerts` prefix. Otherwise the most frequent fourth segment among main classes is used, with lexical tie-breaking. | | `qbit.guardrails.strictUiApiRoutes` | `false`; opt into core's strict runtime route audit in tests. | | `qbit.guardrails.skip` | Unset. `-Dqbit.guardrails.skip=true` disables the entire profile. Activation is based on property absence, so even setting it to `false` disables the profile; leave it unset to enable checks. | diff --git a/pom.xml b/pom.xml index 18deb01..42e4e4d 100644 --- a/pom.xml +++ b/pom.xml @@ -50,8 +50,8 @@ 2.1.0 false - com.kingsrook.qbits:qbit-object-storage,com.kingsrook.qbits:*-api - com.kingsrook.qbits.objectstorage.api + com.kingsrook.qbits:qbit-object-storage,com.kingsrook.qbits:qbit-email,com.kingsrook.qbits:*-api + com.kingsrook.qbits.objectstorage.api,com.kingsrook.qbits.email.api false diff --git a/qbit-guardrails/src/main/java/com/kingsrook/qbits/guardrails/GuardrailProject.java b/qbit-guardrails/src/main/java/com/kingsrook/qbits/guardrails/GuardrailProject.java index ab961f8..ca9b619 100644 --- a/qbit-guardrails/src/main/java/com/kingsrook/qbits/guardrails/GuardrailProject.java +++ b/qbit-guardrails/src/main/java/com/kingsrook/qbits/guardrails/GuardrailProject.java @@ -76,8 +76,8 @@ final class GuardrailProject ***************************************************************************/ Set apiPackages() throws IOException { - Set packages = new TreeSet<>(csv(System.getProperty("qbit.guardrails.allowedApiPackages", "com.kingsrook.qbits.objectstorage.api"))); - List allowedArtifacts = csv(System.getProperty("qbit.guardrails.allowedQbitArtifacts", "com.kingsrook.qbits:qbit-object-storage,com.kingsrook.qbits:*-api")); + Set packages = new TreeSet<>(csv(System.getProperty("qbit.guardrails.allowedApiPackages", "com.kingsrook.qbits.objectstorage.api,com.kingsrook.qbits.email.api"))); + List allowedArtifacts = csv(System.getProperty("qbit.guardrails.allowedQbitArtifacts", "com.kingsrook.qbits:qbit-object-storage,com.kingsrook.qbits:qbit-email,com.kingsrook.qbits:*-api")); String classpath = System.getProperty("surefire.test.class.path", System.getProperty("java.class.path")); for(String entry : classpath.split(Pattern.quote(File.pathSeparator))) { -- 2.54.0 From 574a1696b6e5c3eb3cf8af7490df96c39f7bba72 Mon Sep 17 00:00:00 2001 From: James Maes Date: Wed, 14 Oct 2026 09:13:42 -0500 Subject: [PATCH 2/2] ci: re-run after a ChromeDriver install flake Co-Authored-By: Claude Opus 5.5 -- 2.54.0