ci: centralize QBit source scanning

Co-Authored-By: Codex <noreply@openai.com>

.circleci/config.yml

@@ -1,57 +1,14 @@
 version: 2.1
-
+setup: true
 orbs:
-  qqq-orb: kingsrook/qqq-orb@0.5.0
-
+  qqq-orb: kingsrook/qqq-orb@0.7.12
 workflows:
-
-  test_only:
+  setup:
     jobs:
-      - qqq-orb/mvn_test_only:
-          context: [ qqq-maven-registry-credentials ]
-          filters:
-            branches:
-              ignore: /(develop|main|release/.*|hotfix/.*|integration.*)/
-            tags:
-              only: []
-
-  publish_snapshot:
-    jobs:
-      - qqq-orb/mvn_publish:
-          context: [ qqq-maven-registry-credentials ]
-          branch_type: snapshot
-          filters:
-            branches:
-              only:
-                - develop
-
-  publish_release_candidate:
-    jobs:
-      - qqq-orb/mvn_publish:
-          context: [ qqq-maven-registry-credentials ]
-          branch_type: release_candidate
-          filters:
-            branches:
-              only:
-                - /release\/.*/
-
-  publish_release:
-    jobs:
-      - qqq-orb/mvn_publish:
-          context: [ qqq-maven-registry-credentials ]
-          branch_type: release
-          filters:
-            branches:
-              only: [ main ]
-            tags:
-              only: [ /v.*/ ]
-
-  publish_hotfix_release:
-    jobs:
-      - qqq-orb/mvn_publish:
-          context: [ qqq-maven-registry-credentials ]
-          branch_type: hotfix
-          filters:
-            branches:
-              only:
-                - /hotfix\/.*/
+    - qqq-orb/generate_pipeline:
+        orb_version: 0.7.12
+        filters:
+          branches:
+            ignore: automation/qbit-rc-pending
+          tags:
+            only: /^v\d+\.\d+\.\d+$/

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @KofTwentyTwo

.github/workflows/codeql.yml

@@ -0,0 +1,23 @@
+name: CodeQL
+'on':
+  push:
+    branches:
+    - main
+    - develop
+    - release/**
+    - hotfix/**
+  pull_request: {}
+  schedule:
+  - cron: 41 16 * * 0
+  workflow_dispatch: {}
+permissions:
+  contents: read
+  actions: read
+  security-events: write
+  packages: read
+concurrency:
+  group: codeql-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+jobs:
+  analyze:
+    uses: QRun-IO/qqq-orb/.github/workflows/qbit-codeql.yml@c288a8864fe9054f68410e1d78f5863aea4c4d22

.github/workflows/release-rc.yml

@@ -0,0 +1,74 @@
+name: Release candidate
+'on':
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Plan a cut without changing release state
+        type: boolean
+        default: false
+      finalize:
+        description: Retry finalization of an existing cut; do not cut another RC
+        type: boolean
+        default: false
+      recover:
+        description: Recover the same published RC after a deployment timeout; never
+          reupload
+        type: boolean
+        default: false
+      circle_build:
+        description: Original Circle publisher build number (recovery only)
+        type: string
+        default: ''
+      merge_sha:
+        description: Existing cut merge_sha (finalize retry only)
+        type: string
+        default: ''
+      bump_sha:
+        description: Existing cut bump_sha (finalize retry only)
+        type: string
+        default: ''
+      branch:
+        description: Existing cut branch (finalize retry only)
+        type: string
+        default: ''
+      version:
+        description: Existing cut version (finalize retry only)
+        type: string
+        default: ''
+  pull_request:
+    types:
+    - closed
+    branches:
+    - develop
+  repository_dispatch:
+    types:
+    - qbit-rc-published
+permissions:
+  contents: write
+  actions: read
+  checks: read
+jobs:
+  release-rc:
+    if: github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch'
+      || (github.event_name == 'pull_request' && github.event.pull_request.merged
+      == true && github.event.pull_request.base.ref == 'develop' && contains(github.event.pull_request.labels.*.name,
+      'release:rc'))
+    uses: QRun-IO/qqq-orb/.github/workflows/qbit-release-rc.yml@cc30f599e63c8e41629c99d23395bac1adb8bc44
+    with:
+      dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false
+        }}
+      finalize: ${{ github.event_name == 'repository_dispatch' || (github.event_name
+        == 'workflow_dispatch' && inputs.finalize) }}
+      recover: ${{ github.event_name == 'workflow_dispatch' && inputs.recover || false
+        }}
+      circle_build: ${{ github.event_name == 'workflow_dispatch' && inputs.circle_build
+        || '' }}
+      merge_sha: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.merge_sha
+        || inputs.merge_sha || '' }}
+      bump_sha: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.bump_sha
+        || inputs.bump_sha || '' }}
+      branch: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.branch
+        || inputs.branch || '' }}
+      version: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.version
+        || inputs.version || '' }}
+    secrets: inherit

.gitignore

@@ -18,4 +18,3 @@ hs_err_pid*
 dependency-reduced-pom.xml
 /.env.local
 /.cache/
-.claude/

.qqq-ci.yml

@@ -0,0 +1,16 @@
+profile: qbit
+orb_version: 0.7.12
+default_branch: develop
+java_version: '21'
+browsers: true
+api_checks: false
+docs_only: false
+release_on_main: false
+release_tag_policy: stable
+test_branch_policy: non-release
+publish:
+  snapshot: true
+  release_candidate: true
+  release: true
+  asciidoc: false
+release_completion: true

CLAUDE.md

@@ -0,0 +1,23 @@
+# qbit-customizable-table-views
+
+## Knowledge base
+
+A reviewed dossier for this repo lives in the second-brain vault:
+
+- Hub / start here: `R:/Git.Local/KofTwentyTwo/second-brain/knowledge/qqq/qqq-hub.md`
+- This repo's dossier: `R:/Git.Local/KofTwentyTwo/second-brain/knowledge/qqq/repos/qbit-customizable-table-views.md`
+- QBit mechanics refresher: `R:/Git.Local/KofTwentyTwo/second-brain/knowledge/qqq/architecture/metadata-model.md`
+
+Reviewed at commit `6a0f548afa8e` (branch `develop`, 2026-05-21). If HEAD has moved
+significantly past that commit, treat the dossier as potentially stale.
+
+Notes for agents working here:
+
+- The README describes a "saved views" API (`QSavedViewMetaData`, `saved_view` tables) that
+  does NOT exist in this code — trust the source, not the README. CHANGELOG.md and
+  CONTRIBUTING.md are copy-pasted from qbit-user-role-permissions.
+- Licensing metadata is contradictory (LICENSE/NOTICE = Apache-2.0; pom, file headers,
+  checkstyle template = AGPL-3.0; README footer says proprietary). Open PR #5 fixes the pom.
+- Default builds take the qqq version only from `qbit-build-parent` (2.0.0 = qqq 4.0.0);
+  do not add an always-on `qqq-bom-pom` import (ADR-0007). To check the next qqq line, run
+  `mvn -B verify -Pqqq-snapshot` (4.1.0-SNAPSHOT; override with `-Dqqq.snapshot.version`).

CONTRIBUTING.md

@@ -1,6 +1,4 @@
-# Contributing
+# Contributing to QBit User Role Permissions
 
-See the QQQ project [Contributing Guide](https://github.com/Kingsrook/qqq/blob/develop/CONTRIBUTING.md) for code standards and PR workflow.
-
-For release procedures, see [RELEASING.md](RELEASING.md).
+* See Project [Contributing](https://github.com/Kingsrook/qqq/blob/develop/CONTRIBUTING.md)
 

RELEASING.md

@@ -1,119 +0,0 @@
-# Releasing
-
-This QBit uses the [qqq-orb](https://circleci.com/developer/orbs/orb/kingsrook/qqq-orb) CircleCI orb for automated builds, versioning, and publishing to Maven Central. Releases are triggered by branch conventions -- no manual version bumping or publishing is required.
-
-## Prerequisites
-
-- CircleCI project linked to this repository
-- `qqq-maven-registry-credentials` context configured in CircleCI with:
-  - `MAVEN_USERNAME` / `MAVEN_PASSWORD` (Sonatype Central Portal)
-  - `GPG_PRIVATE_KEY_B64` / `GPG_KEYNAME` / `GPG_PASSPHRASE` (artifact signing)
-  - `GITHUB_TOKEN` (GitHub Release creation)
-
-## Branch Workflow
-
-```
-feature/my-work --> develop --> release/X.Y --> main
-                                                 \--> hotfix/X.Y.Z
-```
-
-### Development (develop branch)
-
-Every commit to `develop` publishes a **SNAPSHOT** to Maven Central.
-
-- Version format: `X.Y.Z-SNAPSHOT`
-- Consumers use this for integration testing against the latest build
-
-```bash
-# Normal development workflow
-git checkout develop
-git pull
-git checkout -b feature/my-feature
-# ... make changes, commit, push ...
-# Open PR targeting develop
-# Merge PR -> SNAPSHOT auto-publishes
-```
-
-### Release Candidate (release/* branches)
-
-When `develop` is ready for release, create a release branch. Every commit to a `release/*` branch publishes a **Release Candidate** to Maven Central.
-
-- Version format: `X.Y.Z-RC.1`, `X.Y.Z-RC.2`, etc. (auto-incremented per commit)
-- Use this for final QA and stabilization
-
-```bash
-# Create a release branch from develop
-git checkout develop
-git pull
-git checkout -b release/0.4
-git push -u origin release/0.4
-# RC.1 auto-publishes
-
-# If bug fixes are needed during QA:
-git commit -m "fix: resolve edge case in view sharing"
-git push
-# RC.2 auto-publishes (incremented automatically)
-```
-
-### Production Release (main branch)
-
-Merge the release branch into `main` to publish a **stable release**.
-
-- Version format: `X.Y.Z`
-- Automatically creates a git tag (`vX.Y.Z`) and a GitHub Release
-- Published to Maven Central as a final release artifact
-
-```bash
-# Merge release branch to main (via PR recommended)
-git checkout main
-git merge release/0.4
-git push
-
-# CI auto-creates tag v0.4.0, GitHub Release, publishes to Maven Central
-
-# After release, merge main back to develop and bump the revision
-git checkout develop
-git merge main
-# Update <revision> in pom.xml to next development version
-git commit -m "chore: bump revision to 0.5.0"
-git push
-```
-
-### Hotfix (hotfix/* branches)
-
-For critical production fixes that cannot wait for the next release cycle.
-
-- Version format: `X.Y.(Z+1)` (patch bump from current release)
-- Automatically creates a git tag and GitHub Release
-
-```bash
-# Create hotfix branch from main
-git checkout main
-git pull
-git checkout -b hotfix/0.4.1
-# ... apply fix ...
-git commit -m "fix: critical null check in view loading"
-git push -u origin hotfix/0.4.1
-# Patch release auto-publishes
-
-# Merge hotfix back to develop
-git checkout develop
-git merge hotfix/0.4.1
-git push
-```
-
-## CI/CD Configuration
-
-The release pipeline is defined in `.circleci/config.yml` and uses the `qqq-orb` to handle build, test, version calculation, and publishing. The workflows are:
-
-| Workflow | Trigger | Branch Type | Publishes |
-|----------|---------|-------------|-----------|
-| `test_only` | Push to feature/* | -- | Nothing (test only) |
-| `publish_snapshot` | Push to develop | snapshot | SNAPSHOT to Maven Central |
-| `publish_release_candidate` | Push to release/* | release_candidate | RC to Maven Central |
-| `publish_release` | Push to main | release | Stable to Maven Central + GitHub Release |
-| `publish_hotfix_release` | Push to hotfix/* | hotfix | Patch to Maven Central + GitHub Release |
-
-## Version Management
-
-The project version is controlled by the `<revision>` property in `pom.xml`. The CI pipeline reads and manipulates this value automatically based on branch type. You should only manually update `<revision>` when bumping the development version on `develop` after a release.

pom.xml

@@ -1,22 +1,23 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
   ~ QQQ - Low-code Application Framework for Engineers.
-  ~ Copyright (C) 2021-2025.  QRunIO, LLC
+  ~ Copyright (C) 2021-2022.  Kingsrook, LLC
   ~ 651 N Broad St Ste 205 # 6917 | Middletown DE 19709 | United States
   ~ contact@kingsrook.com
-  ~ https://github.com/QRun-IO/
+  ~ https://github.com/Kingsrook/
   ~
-  ~ Licensed under the Apache License, Version 2.0 (the "License");
-  ~ you may not use this file except in compliance with the License.
-  ~ You may obtain a copy of the License at
+  ~ This program is free software: you can redistribute it and/or modify
+  ~ it under the terms of the GNU Affero General Public License as
+  ~ published by the Free Software Foundation, either version 3 of the
+  ~ License, or (at your option) any later version.
   ~
-  ~     http://www.apache.org/licenses/LICENSE-2.0
+  ~ This program is distributed in the hope that it will be useful,
+  ~ but WITHOUT ANY WARRANTY; without even the implied warranty of
+  ~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  ~ GNU Affero General Public License for more details.
   ~
-  ~ Unless required by applicable law or agreed to in writing, software
-  ~ distributed under the License is distributed on an "AS IS" BASIS,
-  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  ~ See the License for the specific language governing permissions and
-  ~ limitations under the License.
+  ~ You should have received a copy of the GNU Affero General Public License
+  ~ along with this program.  If not, see <https://www.gnu.org/licenses/>.
   -->
 
   <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
@@ -24,12 +25,12 @@
    <parent>
       <groupId>com.kingsrook</groupId>
       <artifactId>qbit-build-parent</artifactId>
-      <version>1.5.1</version>
+      <version>2.0.0</version>
    </parent>
 
    <groupId>com.kingsrook.qbits</groupId>
    <artifactId>qbit-customizable-table-views</artifactId>
-   <version>0.4.0-SNAPSHOT</version>
+   <version>${revision}</version>
    <packaging>jar</packaging>
 
    <name>QBit Customizable Table Views</name>
@@ -40,8 +41,8 @@
 
    <licenses>
       <license>
-         <name>Apache License, Version 2.0</name>
-         <url>https://www.apache.org/licenses/LICENSE-2.0</url>
+         <name>GNU Affero General Public License v3.0</name>
+         <url>https://www.gnu.org/licenses/agpl-3.0.html</url>
          <distribution>repo</distribution>
       </license>
    </licenses>
@@ -64,21 +65,9 @@
    </scm>
 
    <properties>
-      <revision>0.4.0-SNAPSHOT</revision>
+      <revision>0.5.0-SNAPSHOT</revision>
    </properties>
 
-   <dependencyManagement>
-      <dependencies>
-         <dependency>
-            <groupId>com.kingsrook.qqq</groupId>
-            <artifactId>qqq-bom-pom</artifactId>
-            <version>0.40.0-SNAPSHOT</version>
-            <type>pom</type>
-            <scope>import</scope>
-         </dependency>
-      </dependencies>
-   </dependencyManagement>
-
    <dependencies>
       <dependency>
          <groupId>com.kingsrook.qqq</groupId>
@@ -109,11 +98,39 @@
       </dependency>
    </dependencies>
 
-   <repositories>
-      <repository>
-         <id>sonatype-snapshots</id>
-         <url>https://central.sonatype.com/repository/maven-snapshots/</url>
-      </repository>
-   </repositories>
+   <profiles>
+      <!-- Opt-in check against the next qqq line: mvn -B verify -Pqqq-snapshot       -->
+      <!-- (override the version with -Dqqq.snapshot.version=...).  Default builds   -->
+      <!-- take the qqq version only from qbit-build-parent.                         -->
+      <profile>
+         <id>qqq-snapshot</id>
+         <properties>
+            <qqq.snapshot.version>4.1.0-SNAPSHOT</qqq.snapshot.version>
+         </properties>
+         <dependencyManagement>
+            <dependencies>
+               <dependency>
+                  <groupId>com.kingsrook.qqq</groupId>
+                  <artifactId>qqq-bom-pom</artifactId>
+                  <version>${qqq.snapshot.version}</version>
+                  <type>pom</type>
+                  <scope>import</scope>
+               </dependency>
+            </dependencies>
+         </dependencyManagement>
+         <repositories>
+            <repository>
+               <id>sonatype-snapshots</id>
+               <url>https://central.sonatype.com/repository/maven-snapshots/</url>
+               <releases>
+                  <enabled>false</enabled>
+               </releases>
+               <snapshots>
+                  <enabled>true</enabled>
+               </snapshots>
+            </repository>
+         </repositories>
+      </profile>
+   </profiles>
 
 </project>

src/main/java/com/kingsrook/qbits/customizabletableviews/CustomizableTableViewsQBitProducer.java

@@ -41,10 +41,6 @@ import com.kingsrook.qqq.backend.core.model.metadata.qbits.QBitMetaDataProducer;
  *******************************************************************************/
 public class CustomizableTableViewsQBitProducer implements QBitMetaDataProducer<CustomizableTableViewsQBitConfig>
 {
-   public static final String GROUP_ID    = "com.kingsrook.qbits";
-   public static final String ARTIFACT_ID = "customizable-table-views";
-   public static final String VERSION     = "0.4.0";
-
    private CustomizableTableViewsQBitConfig customizableTableViewsQBitConfig;
 
 
@@ -56,9 +52,9 @@ public class CustomizableTableViewsQBitProducer implements QBitMetaDataProducer<
    public QBitMetaData getQBitMetaData()
    {
       QBitMetaData qBitMetaData = new QBitMetaData()
-         .withGroupId(GROUP_ID)
-         .withArtifactId(ARTIFACT_ID)
-         .withVersion(VERSION)
+         .withGroupId("com.kingsrook.qbits")
+         .withArtifactId("customizable-table-views")
+         .withVersion("0.1.0")
          .withNamespace(getNamespace())
          .withConfig(getQBitConfig());
 

src/main/java/com/kingsrook/qbits/customizabletableviews/tables/customizers/TableViewFieldCustomizer.java

@@ -36,6 +36,7 @@ import com.kingsrook.qqq.backend.core.model.data.QRecord;
 import com.kingsrook.qqq.backend.core.model.metadata.fields.QFieldMetaData;
 import com.kingsrook.qqq.backend.core.model.statusmessages.BadInputStatusMessage;
 import com.kingsrook.qqq.backend.core.model.statusmessages.SystemErrorStatusMessage;
+import com.kingsrook.qqq.backend.core.utils.ValueUtils;
 
 
 /*******************************************************************************
@@ -57,8 +58,8 @@ public class TableViewFieldCustomizer implements TableCustomizerInterface
          try
          {
             Integer id            = record.getValueInteger("id");
-            String  fieldName     = RecordCustomizerUtilityInterface.getValueFromRecordOrOldRecord("fieldName", record, id, oldRecordMap);
-            String  accessLevelId = RecordCustomizerUtilityInterface.getValueFromRecordOrOldRecord("accessLevel", record, id, oldRecordMap);
+            String  fieldName     = ValueUtils.getValueAsString(RecordCustomizerUtilityInterface.getValueFromRecordElseFromOldRecord("fieldName", record, id, oldRecordMap));
+            String  accessLevelId = ValueUtils.getValueAsString(RecordCustomizerUtilityInterface.getValueFromRecordElseFromOldRecord("accessLevel", record, id, oldRecordMap));
 
             String[] parts     = fieldName.split("\\.");
             String   tableName = parts[0];

src/test/java/com/kingsrook/qbits/customizabletableviews/BaseTest.java

@@ -78,7 +78,7 @@ public class BaseTest
       // basic definition of an instance //
       /////////////////////////////////////
       QInstance qInstance = new QInstance();
-      qInstance.setAuthentication(new QAuthenticationMetaData().withType(QAuthenticationType.FULLY_ANONYMOUS));
+      qInstance.withInstanceDefaultAuthentication(new QAuthenticationMetaData().withType(QAuthenticationType.FULLY_ANONYMOUS));
       qInstance.addBackend(new RDBMSBackendMetaData()
          .withName(RDBMS_BACKEND_NAME)
          .withVendor("h2")

src/test/java/com/kingsrook/qbits/customizabletableviews/tables/customizers/TableViewFieldCustomizerTest.java

@@ -96,6 +96,32 @@ class TableViewFieldCustomizerTest extends BaseTest
 
 
 
+   /*******************************************************************************
+    ** a sparse update (e.g., only accessLevel set) must validate against the
+    ** fieldName from the old record.
+    *******************************************************************************/
+   @Test
+   void testSparseUpdateUsesOldRecordValues() throws QException
+   {
+      QContext.getQInstance().addTable(new QTableMetaData()
+         .withName("testTable3")
+         .withField(new QFieldMetaData("mandatory", QFieldType.STRING).withIsRequired(true))
+         .withField(new QFieldMetaData("optional", QFieldType.STRING)));
+
+      Optional<List<QRecord>> oldRecordList = Optional.of(List.of(
+         new TableViewField().withId(1).withFieldName("testTable3.mandatory").withAccessLevel(FieldAccessLevel.EDITABLE_REQUIRED).toQRecord(),
+         new TableViewField().withId(2).withFieldName("testTable3.optional").withAccessLevel(FieldAccessLevel.EDITABLE_OPTIONAL).toQRecord()));
+
+      QRecord mandatoryToReadOnly = new QRecord().withValue("id", 1).withValue("accessLevel", FieldAccessLevel.READ_ONLY.getId());
+      QRecord optionalToReadOnly  = new QRecord().withValue("id", 2).withValue("accessLevel", FieldAccessLevel.READ_ONLY.getId());
+      new TableViewFieldCustomizer().preInsertOrUpdate(null, List.of(mandatoryToReadOnly, optionalToReadOnly), false, oldRecordList);
+
+      assertThat(mandatoryToReadOnly.getErrors()).hasSizeGreaterThan(0);
+      assertThat(optionalToReadOnly.getErrors()).isNullOrEmpty();
+   }
+
+
+
    /***************************************************************************
     *
     ***************************************************************************/