diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml index ce00351..986ae29 100644 --- a/.gitea/workflows/build.yaml +++ b/.gitea/workflows/build.yaml @@ -1,7 +1,11 @@ +# Shared QRun Maven CI/CD (KofTwentyTwo/ci-workflows): every push verifies; vX.Y.Z tags publish the +# tested JAR/POM to the QRun-IO Gitea Maven registry. QQQ resolves from that registry with the job token. name: build on: push: jobs: maven: uses: self:KofTwentyTwo/ci-workflows/.gitea/workflows/maven.yaml@v1 + with: + maven-args: -Pui-demo secrets: inherit diff --git a/CHANGELOG.md b/CHANGELOG.md index 6110d70..e7fc7b0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,18 @@ # Changelog +## 1.1.2 + +Runtime and publication move to the QRun-IO Gitea Maven registry; no printing contract +change (extension 2.4.0, wire v1, subprotocol unchanged). The server now runs on QQQ +**4.1.0-RC.22**, published only in the Gitea registry (it carries the session-logout, +process-identity and scoped-session fixes the Forge cohort depends on). CI moves from the +`qrun-release` caller and trusted publisher to the shared `ci-workflows` Maven workflow, +which resolves QQQ from the Gitea registry with the job token and publishes `vX.Y.Z` tags +straight to it. The ui-demo frontend (`qqq-frontend-next` 1.0.0-RC.37) was mirrored into the +registry byte-for-byte from Central, so every QRun artifact resolves from Gitea; third-party +dependencies still resolve through the Maven Central mirror until the registry proxies them. +Same test gate (`-Pui-demo verify`). + ## 1.1.1 Realtime upgrade fix; no contract change. The WebSocket callbacks read the device diff --git a/README.md b/README.md index 0a15fbb..0a1c253 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ Cloud printing for QQQ 4.1+, paired with the [Windows AppKit connector](https:// **Released:** [QQQ Printing 1.1.1](https://git.kof22.com/QRun-IO/qbit-printing/releases/tag/v1.1.1), with a library JAR, matching POM and `SHA256SUMS` ([1.1.0](https://git.kof22.com/QRun-IO/qbit-printing/releases/tag/v1.1.0) is superseded by the realtime upgrade fix; [1.0.0](https://git.kof22.com/QRun-IO/qbit-printing/releases/tag/v1.0.0) remains available for rollback). The same JAR/POM are published in the QRun-IO Gitea Maven registry. Gitea requires sign-in for downloads. The QBit itself is not published to Maven Central and is not a standalone executable/fat JAR. See [installation and release access](docs/RELEASES.md). -**Runtime:** Java 21 and QQQ **4.1.0-RC.21**, published on Maven Central with native session login. The optional native UI demo uses QQQ frontend **1.0.0-RC.37**. Product version 1.1.1, native extension 2.4.0 and wire payload v1 are separate version contracts. +**Runtime:** Java 21 and QQQ **4.1.0-RC.22**, published in the QRun-IO Gitea Maven registry (not on Maven Central) with native session login. The optional native UI demo uses QQQ frontend **1.0.0-RC.37**, also served from that registry. Product version 1.1.2, native extension 2.4.0 and wire payload v1 are separate version contracts. Implemented: single-use enrollment, device credentials, inventory/approval, PDF/ZPL submission, durable JDBC queue, idempotency, claim/content/events, native QQQ setup/test-print processes, read-only device/printer/job tables and a durable enqueue effect target. @@ -79,7 +79,7 @@ The local setup uses the same native authorization and transport paths as an int Use the [authenticated Gitea Maven registry](docs/RELEASES.md#use-the-maven-registry), or download the release JAR, matching POM and `SHA256SUMS` and verify both files. For a local installation of the downloaded artifacts: ```powershell -.\mvnw.cmd install:install-file '-Dfile=qbit-printing-1.1.0.jar' '-DpomFile=qbit-printing-1.1.0.pom' +.\mvnw.cmd install:install-file '-Dfile=qbit-printing-1.1.2.jar' '-DpomFile=qbit-printing-1.1.2.pom' ``` After the artifact is available in your configured repository, add: @@ -88,7 +88,7 @@ After the artifact is available in your configured repository, add: com.kingsrook.qbits qbit-printing - 1.1.0 + 1.1.2 ``` diff --git a/docs/RELEASES.md b/docs/RELEASES.md index bf32dce..983a192 100644 --- a/docs/RELEASES.md +++ b/docs/RELEASES.md @@ -1,6 +1,6 @@ # Installation and release operations -The stable server library is [QQQ Printing 1.1.1](https://git.kof22.com/QRun-IO/qbit-printing/releases/tag/v1.1.1) (1.1.0 is superseded: its realtime upgrade fails behind an ingress that lowercases header names), paired with protocol 1.1.0 and Windows connector 1.2.1 (1.0.x/1.1.x connectors keep working on the unchanged 2.3 behaviour). It requires Java 21 and the QQQ 4.1.0-RC.21 dependency tuple. Its native printing extension is 2.4.0; the WebSocket subprotocol remains `qqq-printing.v1`. The previous stable library, [1.0.0](https://git.kof22.com/QRun-IO/qbit-printing/releases/tag/v1.0.0), remains available for rollback. +The stable server library is [QQQ Printing 1.1.1](https://git.kof22.com/QRun-IO/qbit-printing/releases/tag/v1.1.1) (1.1.0 is superseded: its realtime upgrade fails behind an ingress that lowercases header names), paired with protocol 1.1.0 and Windows connector 1.2.1 (1.0.x/1.1.x connectors keep working on the unchanged 2.3 behaviour). It requires Java 21 and the QQQ 4.1.0-RC.22 dependency tuple, which is published only in the QRun-IO Gitea Maven registry. Its native printing extension is 2.4.0; the WebSocket subprotocol remains `qqq-printing.v1`. The previous stable library, [1.0.0](https://git.kof22.com/QRun-IO/qbit-printing/releases/tag/v1.0.0), remains available for rollback. Gitea is primary for source, pull requests, CI, packages and server releases. This forge requires sign-in even for download links on public repositories. An HTML sign-in page is not an artifact. Use your existing approved forge identity; never commit its token or put it in a command line. @@ -18,7 +18,7 @@ Configure the consuming application's existing Maven repository setup with repos ``` -Merge this entry into the existing settings; preserve other servers, mirrors and profiles. Supply the environment through your approved credential loader. The credential needs package read access. Add `com.kingsrook.qbits:qbit-printing:1.1.1` as shown in the [README](../README.md#add-to-a-qqq-application). QQQ's RC.21 dependencies resolve from Maven Central; the printing 1.0.0 library resolves from Gitea. +Merge this entry into the existing settings; preserve other servers, mirrors and profiles. Supply the environment through your approved credential loader. The credential needs package read access. Add `com.kingsrook.qbits:qbit-printing:1.1.1` as shown in the [README](../README.md#add-to-a-qqq-application). QQQ 4.1.0-RC.22 and the printing library both resolve from this registry; third-party dependencies still come from the Maven Central mirror until the registry proxies them. ## Download and verify release files @@ -37,11 +37,13 @@ On Linux, use `sha256sum -c SHA256SUMS`; on macOS, use `shasum -a 256 -c SHA256S ## Maintainer release path -1. Update the POM version and active documentation on a branch in Gitea. Keep the immutable protocol fixture ref in `.gitea/workflows/qrun-release.yaml` aligned with the reviewed contract. -2. Open a normal pull request and satisfy required CI checks. The caller delegates to the protected `qrun-release-v1` channel; shared CI changes belong to its owner, not an application-specific bypass. -3. Merge normally and wait for the successful main run. Its `maven-reactor` artifact contains tested JAR/POM bytes, a source commit, manifest and checksums. The trusted publisher verifies that evidence before publishing immutable Maven packages. A passing build alone does not prove registry publication. -4. Verify the exact version's registry JAR/POM against the captured bytes. Create `v` at the qualified source without moving an existing tag. Create a draft Gitea release, attach the same JAR/POM and a flat `SHA256SUMS`, read them back with the approved forge identity, then publish. Reconcile identical existing artifacts; never replace different bytes under a released version. -5. Record the source, successful run, artifact, release and verified hashes. Publication is separate from installing a host or accepting physical printer output. +Since 1.1.2 the repository builds on the shared `KofTwentyTwo/ci-workflows` Maven workflow (`.gitea/workflows/build.yaml`, pinned to `@v1`): every push runs `-Pui-demo verify`; a `vX.Y.Z` tag runs the same tests once and deploys the JAR/POM to the QRun-IO Gitea Maven registry under exactly that version. The former caller's pinned protocol checkout is gone; `PrintingContractTest` reads the vendored copy in `src/test/resources/protocol-fixtures` (kept byte-identical to the reviewed protocol commit named in its README), which is also what local `verify` uses. Earlier releases (1.0.0, 1.1.0, 1.1.1) went through the protected `qrun-release-v1` channel and the trusted publisher; their evidence below stands. + +1. Update the POM version (the tag must equal it), `qqq.version` if the runtime moves, and active documentation on a branch in Gitea. Open a normal pull request; the push build must be green. +2. Merge normally and wait for the green main build (verify only; main never publishes). +3. Create `v` at the qualified main commit without moving an existing tag and push it. The tag build tests and deploys `com.kingsrook.qbits:qbit-printing:` to the registry; a tag build that fails publishes nothing and the next attempt is the next patch version (tags are immutable). +4. Read the registry JAR/POM back with the approved forge identity, create the Gitea release on the tag, attach the same JAR/POM and a flat `SHA256SUMS`, read them back, then publish. Never replace different bytes under a released version. +5. Record the source, tag build, release and verified hashes here. Publication is separate from installing a host or accepting physical printer output. For 1.1.1, source `2a561815fcec8b7c95e76bb4b36fba314f512027` (main; merge of PR 30, the realtime upgrade header-case fix), main run `5976` (verify, secrets scan, gate and post-publish succeeded), reactor artifact `4426`. The trusted publisher first refused the run because the 1.1.0 documentation merge had re-pinned the protocol fixture in `qrun-release.yaml`, changing the caller hash its enrollment verifies; the enrollment was re-reviewed in cluster-gitops (PRs 283 and 285) and the capture was then published unchanged. Registry files and release assets match the capture byte-for-byte. The JAR SHA-256 is `156720da6928f62d77101521a2953f6e1026d58d02e7fc7815a8c8fcbcedaefa`; the POM SHA-256 is `2fa451260a26f5b5ede30800d46c78050e223694d3d8dda640f9ca875d120ab0`. diff --git a/docs/SESSION-STATE.md b/docs/SESSION-STATE.md index 6823b0c..4066571 100644 --- a/docs/SESSION-STATE.md +++ b/docs/SESSION-STATE.md @@ -1,5 +1,9 @@ # Session state — 2026-11-06 +## In progress — 1.1.2: QQQ 4.1.0-RC.22 from the Gitea registry, shared CI + +James's direction (2026-11-06): everything moves to the QRun-IO Gitea Maven registry; no more Maven Central for QRun artifacts. 1.1.1 was certified on QQQ 4.1.0-RC.21 from Central while Forge pins RC.22 (Gitea only), so 1.1.2 pins `qqq.version` 4.1.0-RC.22 and moves CI to the shared `ci-workflows` Maven workflow (the protected `qrun-release` channel resolves only Central and cannot build RC.22). No printing contract change. Gate: the push build's `-Pui-demo verify` on the Gitea registry; then tag v1.1.2, registry readback, Gitea release, handoff update. `qqq-frontend-next` 1.0.0-RC.37 (ui-demo profile) was mirrored into the registry byte-for-byte from Central (JAR `c9fa2eb2…`, POM `4761d2fd…`, verified against Central's SHA-1 and read back), so every QRun artifact now resolves from Gitea; only third-party dependencies still come through the Central mirror until the registry proxies them. + ## Current — 1.1.1 released (2026-11-06) [QQQ Printing 1.1.1](https://git.kof22.com/QRun-IO/qbit-printing/releases/tag/v1.1.1) is published on primary Gitea and its Maven registry (`com.kingsrook.qbits:qbit-printing:1.1.1`). It supersedes 1.1.0: Forge's adoption qualification of 1.1.0 (`~/.cache/gg-forge-printing-cohort-20261106/HANDOFF.md`) reproduced a connection failure before WELCOME when the WebSocket upgrade headers arrive lowercase, because the socket callbacks read `X-QQQ-Device-Id` from the WebSocket context, whose header lookup is case-sensitive. 1.1.1 resolves the device once on the authorized HTTP upgrade and carries it as a connection attribute; `PrintingRealtimeTest.lowercaseUpgradeHeadersReachWelcomeAndFrames` fails on the old code and passes on the fix. No contract change: extension 2.4.0, wire v1, subprotocol unchanged. Source `2a561815fcec8b7c95e76bb4b36fba314f512027` (PR 30), main run `5976`, reactor artifact `4426`, release `1381`; JAR `156720da6928f62d77101521a2953f6e1026d58d02e7fc7815a8c8fcbcedaefa`, POM `2fa451260a26f5b5ede30800d46c78050e223694d3d8dda640f9ca875d120ab0`, read back against the capture and the registry. The publisher had refused the run until its enrollment hash was re-reviewed (cluster-gitops PRs 283 and 285) after the 1.1.0 docs merge re-pinned the protocol fixture in the release caller. diff --git a/pom.xml b/pom.xml index 2fd0766..ac11e67 100644 --- a/pom.xml +++ b/pom.xml @@ -9,13 +9,13 @@ com.kingsrookqbit-build-parent2.0.0 com.kingsrook.qbits qbit-printing - 1.1.1 + 1.1.2 QQQ Printing Apache License, Version 2.0https://www.apache.org/licenses/LICENSE-2.0 21 UTF-8 - 4.1.0-RC.21 + 4.1.0-RC.22 none diff --git a/src/test/resources/protocol-fixtures/README.md b/src/test/resources/protocol-fixtures/README.md index 7f28bdc..6c27875 100644 --- a/src/test/resources/protocol-fixtures/README.md +++ b/src/test/resources/protocol-fixtures/README.md @@ -5,7 +5,7 @@ # Protocol fixtures used by PrintingContractTest Unaltered copies of files from the `fixtures/` directory of the canonical `qqq-print-protocol` repository -at commit `42c0d249f81395f00408ec0f92638dcbbf5deb03` (the commit this source pins), so the contract tests run +at commit `5005f3c9e27053b6c327bb923695012832c0fdcc` (protocol 1.1.0, the commit this source pins; the files below are unchanged since `42c0d249f81395f00408ec0f92638dcbbf5deb03`), so the contract tests run without a sibling checkout. Only the files the test reads are copied: - `action-refresh-inventory.request.json`