Merge pull request 'build(deps): align with Gitea registry (parent 2.2.1, QQQ 4.1.0-RC.26)' (#32 ) from deps/align-gitea into develop

build(deps): align with Gitea registry (parent 2.2.1, QQQ 4.1.0-RC.26)
pom.xml: parent -> 2.2.1 pom.xml: qqq.snapshot.version: 4.1.0-SNAPSHOT -> 4.1.0-RC.26 pom.xml: removed Central snapshot repository pom.xml: added qqq.version=4.1.0-RC.26 (parent BOM import) pom.xml: revision -> 0.3.0-SNAPSHOT Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-07 18:08:21 +00:00 · 2026-11-07 18:03:19 +00:00 · 2026-11-06 16:07:46 +00:00 · 2026-11-06 14:10:21 +00:00 · 2026-11-06 13:18:41 +00:00 · 2026-11-05 17:18:39 -06:00
13 changed files with 141 additions and 84 deletions
@@ -1,57 +1,14 @@
 version: 2.1
-
+setup: true
 orbs:
-  qqq-orb: kingsrook/qqq-orb@0.5.0
-
+  qqq-orb: kingsrook/qqq-orb@0.8
 workflows:
-
-  test_only:
+  setup:
    jobs:
-      - qqq-orb/mvn_test_only:
-          context: [ qqq-maven-registry-credentials ]
-          filters:
-            branches:
-              ignore: /(develop|main|release/.*|hotfix/.*|integration.*)/
-            tags:
-              only: []
-
-  publish_snapshot:
-    jobs:
-      - qqq-orb/mvn_publish:
-          context: [ qqq-maven-registry-credentials ]
-          branch_type: snapshot
-          filters:
-            branches:
-              only:
-                - develop
-
-  publish_release_candidate:
-    jobs:
-      - qqq-orb/mvn_publish:
-          context: [ qqq-maven-registry-credentials ]
-          branch_type: release_candidate
-          filters:
-            branches:
-              only:
-                - /release\/.*/
-
-  publish_release:
-    jobs:
-      - qqq-orb/mvn_publish:
-          context: [ qqq-maven-registry-credentials ]
-          branch_type: release
-          filters:
-            branches:
-              only: [ main ]
-            tags:
-              only: [ /v.*/ ]
-
-  publish_hotfix_release:
-    jobs:
-      - qqq-orb/mvn_publish:
-          context: [ qqq-maven-registry-credentials ]
-          branch_type: hotfix
-          filters:
-            branches:
-              only:
-                - /hotfix\/.*/
+    - qqq-orb/generate_pipeline:
+        orb_version: '0.8'
+        filters:
+          branches:
+            ignore: automation/qbit-rc-pending
+          tags:
+            only: /^v\d+\.\d+\.\d+$/
@@ -1,22 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(wc:*)",
-      "Bash(mvn clean compile:*)",
-      "Bash(mvn compile:*)",
-      "Bash(find:*)",
-      "Bash(mvn test:*)",
-      "Bash(git add:*)",
-      "Bash(git commit:*)",
-      "Bash(git push:*)",
-      "Bash(mvn clean test:*)",
-      "Bash(gh pr create:*)",
-      "Bash(gh pr merge:*)",
-      "Bash(git checkout:*)",
-      "Bash(git pull:*)",
-      "Bash(git merge:*)",
-      "mcp__circleci-mcp-server__get_latest_pipeline_status",
-      "mcp__circleci-mcp-server__get_build_failure_logs"
-    ]
-  }
-}
@@ -0,0 +1,7 @@
+name: build
+on:
+  push:
+jobs:
+  maven:
+    uses: self:KofTwentyTwo/ci-workflows/.gitea/workflows/maven.yaml@v1
+    secrets: inherit
@@ -0,0 +1,23 @@
+name: CodeQL
+'on':
+  push:
+    branches:
+    - main
+    - develop
+    - release/**
+    - hotfix/**
+  pull_request: {}
+  schedule:
+  - cron: 41 16 * * 0
+  workflow_dispatch: {}
+permissions:
+  contents: read
+  actions: read
+  security-events: write
+  packages: read
+concurrency:
+  group: codeql-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+jobs:
+  analyze:
+    uses: QRun-IO/qqq-orb/.github/workflows/qbit-codeql.yml@c288a8864fe9054f68410e1d78f5863aea4c4d22
@@ -21,3 +21,8 @@ Thumbs.db

 # Generated
 generated/
+
+.claude/
+
+# flatten-maven-plugin output
+.flattened-pom.xml
@@ -0,0 +1,16 @@
+profile: qbit
+orb_version: '0.8'
+default_branch: main
+java_version: '21'
+browsers: true
+api_checks: false
+docs_only: false
+release_on_main: false
+release_tag_policy: stable
+test_branch_policy: non-release-no-hotfix-integration
+publish:
+  snapshot: true
+  release_candidate: true
+  release: true
+  hotfix: true
+  asciidoc: false
@@ -19,6 +19,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ### Changed
 - Upgraded to QQQ 0.35.0 with Java 21 support
+- Re-pinned to qbit-build-parent 2.0.0 (QQQ 4.0.0); opt-in `qqq-snapshot` Maven profile builds against QQQ 4.1.0-SNAPSHOT
+
+### Fixed
+- Published module poms name their parent by its real version instead of `${revision}` (flatten-maven-plugin)

 ## [0.1.0-alpha] - 2024-12-28

@@ -9,4 +9,4 @@ Reviewed knowledge for this repo and the wider QQQ platform lives in the second-
  (reviewed commit `f7889fdf7495` on `main`, 2026-07-04)
 - QBit mechanics refresher: `R:/Git.Local/KofTwentyTwo/second-brain/knowledge/qqq/architecture/metadata-model.md`

-Key cautions from the review: entities produce PossibleValueSources only (`produceTableMetaData` defaults false — no tables are registered); the sync step's natural keys (`countryAlpha2`/`stateCode`) don't exist in the schema; the `geoDataSync` process name collides on multi-instance registration; pom/README still declare AGPL-3.0 while LICENSE/NOTICE are Apache-2.0; main and develop have diverged.
+Key cautions from the review: entities produce PossibleValueSources only (`produceTableMetaData` defaults false — no tables are registered); the sync step's natural keys (`countryAlpha2`/`stateCode`) don't exist in the schema; the `geoDataSync` process name collides on multi-instance registration; current first-party pom/README declarations align with Apache-2.0 LICENSE/NOTICE; main and develop have diverged.
@@ -162,4 +162,11 @@ The generator creates a changelog with your prefix substituted and only includes

 ## License

-AGPL-3.0 - See [LICENSE](LICENSE)
+Both Maven child modules set `qbit.noticesDirectory` to their parent directory,
+where this repository's `LICENSE` and `NOTICE` live. This supports the shared
+notice packaging correction in `qbit-build-parent`; it takes effect after adopting
+a parent version containing that correction. Existing public parent 2.0.0 is
+unchanged. Verify each generated module archive against these root files when
+integrating the new parent.
+
+Apache-2.0 - See [LICENSE](LICENSE)
@@ -7,7 +7,7 @@
   <parent>
      <groupId>com.kingsrook</groupId>
      <artifactId>qbit-build-parent</artifactId>
-      <version>1.5.1</version>
+      <version>2.2.1</version>
   </parent>

   <groupId>com.kingsrook.qbits</groupId>
@@ -21,8 +21,8 @@

   <licenses>
      <license>
-         <name>GNU Affero General Public License v3.0</name>
-         <url>https://www.gnu.org/licenses/agpl-3.0.html</url>
+         <name>Apache License, Version 2.0</name>
+         <url>https://www.apache.org/licenses/LICENSE-2.0</url>
         <distribution>repo</distribution>
      </license>
   </licenses>
@@ -50,7 +50,8 @@
   </modules>

   <properties>
-      <revision>0.1.0</revision>
+      <qqq.version>4.1.0-RC.26</qqq.version> <!-- feeds qbit-build-parent's qqq-bom-pom import -->
+      <revision>0.3.0-SNAPSHOT</revision>
      <maven.compiler.source>21</maven.compiler.source>
      <maven.compiler.target>21</maven.compiler.target>
      <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -73,7 +74,7 @@
         <dependency>
            <groupId>org.assertj</groupId>
            <artifactId>assertj-core</artifactId>
-            <version>3.27.3</version>
+            <version>3.27.7</version>
         </dependency>
      </dependencies>
   </dependencyManagement>
@@ -93,5 +94,56 @@
            </plugin>
         </plugins>
      </pluginManagement>
+      <plugins>
+         <!-- Replace ${revision} with its value in the poms that get installed and published. -->
+         <plugin>
+            <groupId>org.codehaus.mojo</groupId>
+            <artifactId>flatten-maven-plugin</artifactId>
+            <version>1.7.3</version>
+            <configuration>
+               <updatePomFile>true</updatePomFile>
+               <flattenMode>resolveCiFriendliesOnly</flattenMode>
+            </configuration>
+            <executions>
+               <execution>
+                  <id>flatten</id>
+                  <phase>process-resources</phase>
+                  <goals>
+                     <goal>flatten</goal>
+                  </goals>
+               </execution>
+               <execution>
+                  <id>flatten.clean</id>
+                  <phase>clean</phase>
+                  <goals>
+                     <goal>clean</goal>
+                  </goals>
+               </execution>
+            </executions>
+         </plugin>
+      </plugins>
   </build>
+
+   <profiles>
+      <!-- Opt-in check against the next qqq line: mvn -B verify -Pqqq-snapshot     -->
+      <!-- (override the version with -Dqqq.snapshot.version=...).  Default builds -->
+      <!-- take the qqq version only from qbit-build-parent.                       -->
+      <profile>
+         <id>qqq-snapshot</id>
+         <properties>
+            <qqq.snapshot.version>4.1.0-RC.26</qqq.snapshot.version>
+         </properties>
+         <dependencyManagement>
+            <dependencies>
+               <dependency>
+                  <groupId>com.kingsrook.qqq</groupId>
+                  <artifactId>qqq-bom-pom</artifactId>
+                  <version>${qqq.snapshot.version}</version>
+                  <type>pom</type>
+                  <scope>import</scope>
+               </dependency>
+            </dependencies>
+         </dependencyManagement>
+      </profile>
+   </profiles>
 </project>
@@ -2,9 +2,9 @@

 ## Prerequisites

- Java 17+
+- Java 21+
 - Maven 3.8+
- QQQ 0.23.0+
+- QQQ 4.0.0+

 ## Creating Your Data QBit

@@ -13,6 +13,10 @@
   <artifactId>qbit-geo-data</artifactId>
   <packaging>jar</packaging>

+   <properties>
+      <qbit.noticesDirectory>${project.basedir}/..</qbit.noticesDirectory>
+   </properties>
+
   <name>QBit Geographic Data</name>
   <description>Geographic reference data for QQQ applications - countries, states/provinces, and cities</description>

@@ -13,6 +13,10 @@
   <artifactId>qbit-geo-data-tools</artifactId>
   <packaging>jar</packaging>

+   <properties>
+      <qbit.noticesDirectory>${project.basedir}/..</qbit.noticesDirectory>
+   </properties>
+
   <name>QBit Geographic Data - Tools</name>
   <description>Data acquisition and formatting utilities for geo-data</description>