The producer read a literal version, so released artifacts reported a stale
or -SNAPSHOT version. qbit-cdn.properties (version=${project.version}) is
Maven-filtered and the producer loads it; tests assert producer == bundle ==
artifact version.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The bundle version is now Maven-filtered, so a literal SNAPSHOT in the test
fails every release build. Surefire passes the artifact version in
qbit.artifactVersion.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On release branches the bundle's version and the producer's differed, so the
bundle test that asserts they match failed, and released bundles recorded
SNAPSHOT as their provenance. help/*.yaml is now filtered:
version: ${project.version}.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Host-neutral help (deployment-specific facts removed), registered with
HelpBundles, gated by HelpBundleAssertions. QQQ 4.1.0-RC.7.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Move the core baseline to the released 4.1.0-RC.6 (architecture review
finding F19, guardrail G7). Adopt qbit-build-parent 2.1.0 with the
architecture guardrails enforced (G1, G3, G4, G7) and tests in strict
raw-route mode (G2). Everything passes with no source changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Replace the hand-rolled HMAC in RevalidationHookRunner with core
WebhookSigner (Standard Webhooks) from QQQ 4.1.0-RC.5, and send through
core SafeHttpClient.
New cdn_revalidation_hook fields:
- signatureFormat: STANDARD_WEBHOOKS (the default for new rows) or LEGACY,
which keeps X-Revalidate-Signature byte-for-byte. A null format, as on
existing rows, stays LEGACY.
- allowPlainHttp and internalAllowlist: explicit exceptions to the SSRF
policy.
Closes#15 (architecture review QRun-IO/qqq#1150, finding F11).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2.41.10 carries the HIGH advisory GHSA-443w-3rq3-5m5h (flagged by a Trivy scan); 2.41.30+ fixes it. Same minor line, so no API change.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- spi.CdnOperations (connection test, stats import, drift) implemented by the CloudFront adapter.
- Test Connection / Import Edge Stats / Check Config Drift as standard ETL actions on cdn_provider, plus daily scheduled stats import and drift/connection checks; findings are opened, kept and resolved.
- Checkstyle now runs in verify with the repo's config and an Apache header file; violations fixed.
- WireMock removed (Jetty conflict with the QQQ BOM); tests use a JDK HttpServer stub.
- README describes the complete qbit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
james.maesandClaude Opus 5.5