ci: scan develop with the shared CodeQL workflow

Co-Authored-By: Codex (GPT-6) <noreply@openai.com>

.circleci/config.yml

@@ -1,57 +1,14 @@
 version: 2.1
-
+setup: true
 orbs:
-  qqq-orb: kingsrook/qqq-orb@0.5.0
-
+  qqq-orb: kingsrook/qqq-orb@0.8
 workflows:
-
-  test_only:
+  setup:
     jobs:
-      - qqq-orb/mvn_test_only:
-          context: [ qqq-maven-registry-credentials ]
-          filters:
-            branches:
-              ignore: /(develop|main|release/.*|hotfix/.*|integration.*)/
-            tags:
-              only: []
-
-  publish_snapshot:
-    jobs:
-      - qqq-orb/mvn_publish:
-          context: [ qqq-maven-registry-credentials ]
-          branch_type: snapshot
-          filters:
-            branches:
-              only:
-                - develop
-
-  publish_release_candidate:
-    jobs:
-      - qqq-orb/mvn_publish:
-          context: [ qqq-maven-registry-credentials ]
-          branch_type: release_candidate
-          filters:
-            branches:
-              only:
-                - /release\/.*/
-
-  publish_release:
-    jobs:
-      - qqq-orb/mvn_publish:
-          context: [ qqq-maven-registry-credentials ]
-          branch_type: release
-          filters:
-            branches:
-              only: [ main ]
-            tags:
-              only: [ /v.*/ ]
-
-  publish_hotfix_release:
-    jobs:
-      - qqq-orb/mvn_publish:
-          context: [ qqq-maven-registry-credentials ]
-          branch_type: hotfix
-          filters:
-            branches:
-              only:
-                - /hotfix\/.*/
+    - qqq-orb/generate_pipeline:
+        orb_version: '0.8'
+        filters:
+          branches:
+            ignore: automation/qbit-rc-pending
+          tags:
+            only: /^v\d+\.\d+\.\d+$/

.claude/settings.local.json

@@ -1,22 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(wc:*)",
-      "Bash(mvn clean compile:*)",
-      "Bash(mvn compile:*)",
-      "Bash(find:*)",
-      "Bash(mvn test:*)",
-      "Bash(git add:*)",
-      "Bash(git commit:*)",
-      "Bash(git push:*)",
-      "Bash(mvn clean test:*)",
-      "Bash(gh pr create:*)",
-      "Bash(gh pr merge:*)",
-      "Bash(git checkout:*)",
-      "Bash(git pull:*)",
-      "Bash(git merge:*)",
-      "mcp__circleci-mcp-server__get_latest_pipeline_status",
-      "mcp__circleci-mcp-server__get_build_failure_logs"
-    ]
-  }
-}

.github/workflows/codeql.yml

@@ -0,0 +1,23 @@
+name: CodeQL
+'on':
+  push:
+    branches:
+    - main
+    - develop
+    - release/**
+    - hotfix/**
+  pull_request: {}
+  schedule:
+  - cron: 41 16 * * 0
+  workflow_dispatch: {}
+permissions:
+  contents: read
+  actions: read
+  security-events: write
+  packages: read
+concurrency:
+  group: codeql-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+jobs:
+  analyze:
+    uses: QRun-IO/qqq-orb/.github/workflows/qbit-codeql.yml@c288a8864fe9054f68410e1d78f5863aea4c4d22

.gitignore

@@ -21,3 +21,8 @@ Thumbs.db
 
 # Generated
 generated/
+
+.claude/
+
+# flatten-maven-plugin output
+.flattened-pom.xml

.qqq-ci.yml

@@ -0,0 +1,16 @@
+profile: qbit
+orb_version: '0.8'
+default_branch: main
+java_version: '21'
+browsers: true
+api_checks: false
+docs_only: false
+release_on_main: false
+release_tag_policy: stable
+test_branch_policy: non-release-no-hotfix-integration
+publish:
+  snapshot: true
+  release_candidate: true
+  release: true
+  hotfix: true
+  asciidoc: false

CHANGELOG.md

@@ -19,6 +19,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 - Upgraded to QQQ 0.35.0 with Java 21 support
+- Re-pinned to qbit-build-parent 2.0.0 (QQQ 4.0.0); opt-in `qqq-snapshot` Maven profile builds against QQQ 4.1.0-SNAPSHOT
+
+### Fixed
+- Published module poms name their parent by its real version instead of `${revision}` (flatten-maven-plugin)
 
 ## [0.1.0-alpha] - 2024-12-28
 

CLAUDE.md

@@ -9,4 +9,4 @@ Reviewed knowledge for this repo and the wider QQQ platform lives in the second-
   (reviewed commit `f7889fdf7495` on `main`, 2026-07-04)
 - QBit mechanics refresher: `R:/Git.Local/KofTwentyTwo/second-brain/knowledge/qqq/architecture/metadata-model.md`
 
-Key cautions from the review: entities produce PossibleValueSources only (`produceTableMetaData` defaults false — no tables are registered); the sync step's natural keys (`countryAlpha2`/`stateCode`) don't exist in the schema; the `geoDataSync` process name collides on multi-instance registration; pom/README still declare AGPL-3.0 while LICENSE/NOTICE are Apache-2.0; main and develop have diverged.
+Key cautions from the review: entities produce PossibleValueSources only (`produceTableMetaData` defaults false — no tables are registered); the sync step's natural keys (`countryAlpha2`/`stateCode`) don't exist in the schema; the `geoDataSync` process name collides on multi-instance registration; current first-party pom/README declarations align with Apache-2.0 LICENSE/NOTICE; main and develop have diverged.

README.md

@@ -162,4 +162,11 @@ The generator creates a changelog with your prefix substituted and only includes
 
 ## License
 
-AGPL-3.0 - See [LICENSE](LICENSE)
+Both Maven child modules set `qbit.noticesDirectory` to their parent directory,
+where this repository's `LICENSE` and `NOTICE` live. This supports the shared
+notice packaging correction in `qbit-build-parent`; it takes effect after adopting
+a parent version containing that correction. Existing public parent 2.0.0 is
+unchanged. Verify each generated module archive against these root files when
+integrating the new parent.
+
+Apache-2.0 - See [LICENSE](LICENSE)

pom.xml

@@ -7,7 +7,7 @@
    <parent>
       <groupId>com.kingsrook</groupId>
       <artifactId>qbit-build-parent</artifactId>
-      <version>1.5.1</version>
+      <version>2.0.0</version>
    </parent>
 
    <groupId>com.kingsrook.qbits</groupId>
@@ -21,8 +21,8 @@
 
    <licenses>
       <license>
-         <name>GNU Affero General Public License v3.0</name>
-         <url>https://www.gnu.org/licenses/agpl-3.0.html</url>
+         <name>Apache License, Version 2.0</name>
+         <url>https://www.apache.org/licenses/LICENSE-2.0</url>
          <distribution>repo</distribution>
       </license>
    </licenses>
@@ -50,7 +50,7 @@
    </modules>
 
    <properties>
-      <revision>0.1.0</revision>
+      <revision>0.2.0-SNAPSHOT</revision>
       <maven.compiler.source>21</maven.compiler.source>
       <maven.compiler.target>21</maven.compiler.target>
       <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -73,7 +73,7 @@
          <dependency>
             <groupId>org.assertj</groupId>
             <artifactId>assertj-core</artifactId>
-            <version>3.27.3</version>
+            <version>3.27.7</version>
          </dependency>
       </dependencies>
    </dependencyManagement>
@@ -93,5 +93,68 @@
             </plugin>
          </plugins>
       </pluginManagement>
+      <plugins>
+         <!-- Replace ${revision} with its value in the poms that get installed and published. -->
+         <plugin>
+            <groupId>org.codehaus.mojo</groupId>
+            <artifactId>flatten-maven-plugin</artifactId>
+            <version>1.7.3</version>
+            <configuration>
+               <updatePomFile>true</updatePomFile>
+               <flattenMode>resolveCiFriendliesOnly</flattenMode>
+            </configuration>
+            <executions>
+               <execution>
+                  <id>flatten</id>
+                  <phase>process-resources</phase>
+                  <goals>
+                     <goal>flatten</goal>
+                  </goals>
+               </execution>
+               <execution>
+                  <id>flatten.clean</id>
+                  <phase>clean</phase>
+                  <goals>
+                     <goal>clean</goal>
+                  </goals>
+               </execution>
+            </executions>
+         </plugin>
+      </plugins>
    </build>
+
+   <profiles>
+      <!-- Opt-in check against the next qqq line: mvn -B verify -Pqqq-snapshot     -->
+      <!-- (override the version with -Dqqq.snapshot.version=...).  Default builds -->
+      <!-- take the qqq version only from qbit-build-parent.                       -->
+      <profile>
+         <id>qqq-snapshot</id>
+         <properties>
+            <qqq.snapshot.version>4.1.0-SNAPSHOT</qqq.snapshot.version>
+         </properties>
+         <dependencyManagement>
+            <dependencies>
+               <dependency>
+                  <groupId>com.kingsrook.qqq</groupId>
+                  <artifactId>qqq-bom-pom</artifactId>
+                  <version>${qqq.snapshot.version}</version>
+                  <type>pom</type>
+                  <scope>import</scope>
+               </dependency>
+            </dependencies>
+         </dependencyManagement>
+         <repositories>
+            <repository>
+               <id>sonatype-snapshots</id>
+               <url>https://central.sonatype.com/repository/maven-snapshots/</url>
+               <releases>
+                  <enabled>false</enabled>
+               </releases>
+               <snapshots>
+                  <enabled>true</enabled>
+               </snapshots>
+            </repository>
+         </repositories>
+      </profile>
+   </profiles>
 </project>

qbit-geo-data-core/docs/00-getting-started.md

@@ -2,9 +2,9 @@
 
 ## Prerequisites
 
-- Java 17+
+- Java 21+
 - Maven 3.8+
-- QQQ 0.23.0+
+- QQQ 4.0.0+
 
 ## Creating Your Data QBit
 

qbit-geo-data-core/pom.xml

@@ -13,6 +13,10 @@
    <artifactId>qbit-geo-data</artifactId>
    <packaging>jar</packaging>
 
+   <properties>
+      <qbit.noticesDirectory>${project.basedir}/..</qbit.noticesDirectory>
+   </properties>
+
    <name>QBit Geographic Data</name>
    <description>Geographic reference data for QQQ applications - countries, states/provinces, and cities</description>
 

tools/pom.xml

@@ -13,6 +13,10 @@
    <artifactId>qbit-geo-data-tools</artifactId>
    <packaging>jar</packaging>
 
+   <properties>
+      <qbit.noticesDirectory>${project.basedir}/..</qbit.noticesDirectory>
+   </properties>
+
    <name>QBit Geographic Data - Tools</name>
    <description>Data acquisition and formatting utilities for geo-data</description>