From fa400ff482f73011cd7abc89377ec8cbf7b99880 Mon Sep 17 00:00:00 2001 From: James Maes Date: Wed, 21 Oct 2026 12:25:33 -0500 Subject: [PATCH 1/7] ci: centralize branch verification and source scanning (#6) Co-authored-by: Codex --- .circleci/config.yml | 71 +++++------------------------------- .github/workflows/codeql.yml | 23 ++++++++++++ .qqq-ci.yml | 15 ++++++++ CLAUDE.md | 2 +- README.md | 2 +- pom.xml | 2 +- 6 files changed, 51 insertions(+), 64 deletions(-) create mode 100644 .github/workflows/codeql.yml create mode 100644 .qqq-ci.yml diff --git a/.circleci/config.yml b/.circleci/config.yml index 8f47e24..23c1a84 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -1,65 +1,14 @@ version: 2.1 - +setup: true orbs: - qqq-orb: kingsrook/qqq-orb@0.6.9 - -commands: - configure-package-install: - steps: - - run: - name: Keep package installation unattended - command: | - # These build machines are discarded after the job. - sudo install -d /etc/needrestart/conf.d - printf '%s\n' '$nrconf{restart} = "l";' | sudo tee /etc/needrestart/conf.d/99-qqq-ci.conf >/dev/null - + qqq-orb: kingsrook/qqq-orb@0.7.15 workflows: - - test_only: + setup: jobs: - - qqq-orb/mvn_test_only: - pre-steps: - - configure-package-install - context: [ qqq-maven-registry-credentials ] - filters: - branches: - ignore: /(develop|release/.*|integration.*)/ - tags: - only: [] - - publish_snapshot: - jobs: - - qqq-orb/mvn_publish: - pre-steps: - - configure-package-install - context: [ qqq-maven-registry-credentials ] - branch_type: snapshot - filters: - branches: - only: - - develop - - publish_release_candidate: - jobs: - - qqq-orb/mvn_publish: - pre-steps: - - configure-package-install - context: [ qqq-maven-registry-credentials ] - branch_type: release_candidate - filters: - branches: - only: - - /release\/.*/ - - publish_release: - jobs: - - qqq-orb/mvn_publish: - pre-steps: - - configure-package-install - context: [ qqq-maven-registry-credentials ] - branch_type: release - filters: - branches: - ignore: /.*/ - tags: - only: [ /^v\d+\.\d+\.\d+$/ ] + - qqq-orb/generate_pipeline: + orb_version: 0.7.15 + filters: + branches: + ignore: automation/qbit-rc-pending + tags: + only: /^v\d+\.\d+\.\d+$/ diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..bd3ceaf --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,23 @@ +name: CodeQL +'on': + push: + branches: + - main + - develop + - release/** + - hotfix/** + pull_request: {} + schedule: + - cron: 41 16 * * 0 + workflow_dispatch: {} +permissions: + contents: read + actions: read + security-events: write + packages: read +concurrency: + group: codeql-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} +jobs: + analyze: + uses: QRun-IO/qqq-orb/.github/workflows/qbit-codeql.yml@c288a8864fe9054f68410e1d78f5863aea4c4d22 diff --git a/.qqq-ci.yml b/.qqq-ci.yml new file mode 100644 index 0000000..e2c1c0f --- /dev/null +++ b/.qqq-ci.yml @@ -0,0 +1,15 @@ +profile: qbit +orb_version: 0.7.15 +default_branch: main +java_version: '21' +browsers: true +api_checks: false +docs_only: false +release_on_main: false +release_tag_policy: stable +test_branch_policy: non-release-no-integration +publish: + snapshot: true + release_candidate: true + release: true + asciidoc: false diff --git a/CLAUDE.md b/CLAUDE.md index 2e9efc8..e1a035c 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -4,7 +4,7 @@ QQQ in-app help authoring only. Core owns storage, targeting, search, applicatio ## Build -Java 21, `qbit-build-parent` 2.0.0, `qqq.version=4.1.0-RC.7`; verify bundle work with local `-Dqqq.version=4.1.0-help2-SNAPSHOT` (QRun-IO/qqq#1198), stand-in deadline RC.8. Use `./mvnw -o verify` (`mvnw.cmd` on Windows), then online if missing artifacts. Maven 3.10 cannot load the current parent's unflattened `${revision}`; wrapper is 3.9.11. +Java 21, `qbit-build-parent` 2.0.0, `qqq.version=4.1.0-RC.11`; the published dependency includes the help-bundle APIs (QRun-IO/qqq#1198), so no local stand-in is required. Use `./mvnw -o verify` (`mvnw.cmd` on Windows), then online if missing artifacts. Maven 3.10 cannot load the current parent's unflattened `${revision}`; wrapper is 3.9.11. JUnit 5 + AssertJ, real QQQ memory backend and streamed process runner. Checkstyle is copied from qbit-webhooks. JaCoCo requires 70% instruction and 90% class coverage. Do not skip gates or exclude authoring classes. diff --git a/README.md b/README.md index 16e46df..79897cc 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,7 @@ The authoring experience for QQQ in-app help: a **Help** app, coverage dashboard ## Requirements and installation - Java 21 and `qbit-build-parent` 2.0.0. -- QQQ with help bundles (QRun-IO/qqq#1198). Verification uses the locally installed `4.1.0-help2-SNAPSHOT`; the checked-in pin is `4.1.0-RC.7`, with the stand-in removed by RC.8. This is not a claim that published RC.7 contains the bundle APIs. +- QQQ `4.1.0-RC.11` with help bundles (QRun-IO/qqq#1198), available from the configured Maven repository. Full verification and coverage checks run against this published dependency; a local stand-in is no longer required. - A QQQ UI using `/qqq/v1`, including its widget and process endpoints. Next supplies the help renderer and in-context author mode. - A host backend supporting the standard core `helpContent` table. The host owns database schema creation/migration; the producer defines metadata, not database DDL. diff --git a/pom.xml b/pom.xml index ba088a6..846933c 100644 --- a/pom.xml +++ b/pom.xml @@ -23,7 +23,7 @@ 0.1.0-SNAPSHOT - 4.1.0-RC.7 + 4.1.0-RC.11 21 21 0.8.15 -- 2.54.0 From a8cf35c252611812018b9b95b68683d3c0441d40 Mon Sep 17 00:00:00 2001 From: James Maes Date: Wed, 21 Oct 2026 19:52:41 -0500 Subject: [PATCH 2/7] ci: enroll in the shared QQQ orb (#12) Co-authored-by: Codex --- .circleci/config.yml | 4 ++-- .qqq-ci.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 23c1a84..f890c28 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -1,12 +1,12 @@ version: 2.1 setup: true orbs: - qqq-orb: kingsrook/qqq-orb@0.7.15 + qqq-orb: kingsrook/qqq-orb@0.8 workflows: setup: jobs: - qqq-orb/generate_pipeline: - orb_version: 0.7.15 + orb_version: '0.8' filters: branches: ignore: automation/qbit-rc-pending diff --git a/.qqq-ci.yml b/.qqq-ci.yml index e2c1c0f..e8347a8 100644 --- a/.qqq-ci.yml +++ b/.qqq-ci.yml @@ -1,5 +1,5 @@ profile: qbit -orb_version: 0.7.15 +orb_version: '0.8' default_branch: main java_version: '21' browsers: true -- 2.54.0 From 730106d16b2f9ab12160e65150d119c7833cb171 Mon Sep 17 00:00:00 2001 From: Forge Recovery Date: Mon, 2 Nov 2026 04:12:24 +0000 Subject: [PATCH 3/7] ci: add the identical QRun release caller Co-Authored-By: Codex --- .gitea/workflows/qrun-release.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 .gitea/workflows/qrun-release.yaml diff --git a/.gitea/workflows/qrun-release.yaml b/.gitea/workflows/qrun-release.yaml new file mode 100644 index 0000000..122f7e9 --- /dev/null +++ b/.gitea/workflows/qrun-release.yaml @@ -0,0 +1,12 @@ +# Identical in every QRun Maven application: do not edit. It only delegates to the protected qrun-release-v1 channel. +name: qrun-release +on: + push: + branches: [main, develop, 'release/**', 'hotfix/**'] +permissions: + contents: read +jobs: + release: + uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/java-maven.yaml@qrun-release-v1 + with: + runner: linux-small -- 2.54.0 From 506675037eb23afeabf3732e141cbf5ec6e64fa8 Mon Sep 17 00:00:00 2001 From: Forge Recovery Date: Mon, 2 Nov 2026 06:18:34 +0000 Subject: [PATCH 4/7] ci: move the QRun release caller to the thin v2 contract Co-Authored-By: Claude Sonnet 5.5 Co-Authored-By: Codex --- .gitea/workflows/qrun-release.yaml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/qrun-release.yaml b/.gitea/workflows/qrun-release.yaml index 122f7e9..711441c 100644 --- a/.gitea/workflows/qrun-release.yaml +++ b/.gitea/workflows/qrun-release.yaml @@ -1,12 +1,15 @@ -# Identical in every QRun Maven application: do not edit. It only delegates to the protected qrun-release-v1 channel. +# Standard QRun release caller (v2, thin contract): every push and manual dispatch delegates to the protected qrun-release-v1 channel. Do not edit per repository. name: qrun-release on: - push: - branches: [main, develop, 'release/**', 'hotfix/**'] + push: {} + workflow_dispatch: {} permissions: contents: read + actions: read jobs: release: uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/java-maven.yaml@qrun-release-v1 with: runner: linux-small + browsers: true + browser-runner: browser-build -- 2.54.0 From e2a0b2a3554dce6431a24c9e2a7dc1be9c952ca3 Mon Sep 17 00:00:00 2001 From: Forge Recovery Date: Mon, 2 Nov 2026 15:49:46 +0000 Subject: [PATCH 5/7] ci: add the isolated postpublish job to the QRun release caller Co-Authored-By: Claude Sonnet 5.5 Co-Authored-By: Codex --- .gitea/workflows/qrun-release.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.gitea/workflows/qrun-release.yaml b/.gitea/workflows/qrun-release.yaml index 711441c..cb745b2 100644 --- a/.gitea/workflows/qrun-release.yaml +++ b/.gitea/workflows/qrun-release.yaml @@ -13,3 +13,12 @@ jobs: runner: linux-small browsers: true browser-runner: browser-build + postpublish: + if: ${{ needs.release.outputs.capture == 'true' }} + needs: release + permissions: + contents: write + actions: write + uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/qrun-source-version.yaml@qrun-release-v1 + with: + runner: linux-small -- 2.54.0 From 97134b68f1f70ff8d9056f09157ef12eb42c51d4 Mon Sep 17 00:00:00 2001 From: James Maes Date: Fri, 6 Nov 2026 15:56:58 +0000 Subject: [PATCH 6/7] ci: use shared ci-workflows Maven workflow Replace the platform-ci release callers with one caller of KofTwentyTwo/ci-workflows maven.yaml (qqq-orb port). Co-Authored-By: Claude Opus 5.5 --- .gitea/workflows/build.yaml | 9 +++++++++ .gitea/workflows/qrun-release.yaml | 24 ------------------------ 2 files changed, 9 insertions(+), 24 deletions(-) create mode 100644 .gitea/workflows/build.yaml delete mode 100644 .gitea/workflows/qrun-release.yaml diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml new file mode 100644 index 0000000..3432b77 --- /dev/null +++ b/.gitea/workflows/build.yaml @@ -0,0 +1,9 @@ +name: build +on: + push: +jobs: + maven: + uses: self:KofTwentyTwo/ci-workflows/.gitea/workflows/maven.yaml@v1 + secrets: inherit + with: + browsers: true diff --git a/.gitea/workflows/qrun-release.yaml b/.gitea/workflows/qrun-release.yaml deleted file mode 100644 index cb745b2..0000000 --- a/.gitea/workflows/qrun-release.yaml +++ /dev/null @@ -1,24 +0,0 @@ -# Standard QRun release caller (v2, thin contract): every push and manual dispatch delegates to the protected qrun-release-v1 channel. Do not edit per repository. -name: qrun-release -on: - push: {} - workflow_dispatch: {} -permissions: - contents: read - actions: read -jobs: - release: - uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/java-maven.yaml@qrun-release-v1 - with: - runner: linux-small - browsers: true - browser-runner: browser-build - postpublish: - if: ${{ needs.release.outputs.capture == 'true' }} - needs: release - permissions: - contents: write - actions: write - uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/qrun-source-version.yaml@qrun-release-v1 - with: - runner: linux-small -- 2.54.0 From 51fdf767a67eabc86f5369431786168f5d05d128 Mon Sep 17 00:00:00 2001 From: James Maes Date: Sat, 7 Nov 2026 18:03:30 +0000 Subject: [PATCH 7/7] build(deps): align with Gitea registry (parent 2.2.1, QQQ 4.1.0-RC.26) pom.xml: parent -> 2.2.1 pom.xml: qqq.version: 4.1.0-RC.11 -> 4.1.0-RC.26 Co-Authored-By: Claude Opus 5.5 --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 846933c..cf0d837 100644 --- a/pom.xml +++ b/pom.xml @@ -23,7 +23,7 @@ 0.1.0-SNAPSHOT - 4.1.0-RC.11 + 4.1.0-RC.26 21 21 0.8.15 @@ -32,7 +32,7 @@ com.kingsrook qbit-build-parent - 2.0.0 + 2.2.1 com.kingsrook.qbits -- 2.54.0