build(release): prepare the first published release (0.1.0) on core 4.1.0-RC.22 #23

Merged

james.maes merged 6 commits from release/first-release-20261106 into develop 2026-11-06 15:33:09 +00:00

Conversation 0 Commits 6 Files Changed 16

+1358 -65

james.maes commented 2026-11-06 14:54:07 +00:00

Owner

Copy link

Copy source

Prepares, without cutting, the first published release of qbit-session-store. Nothing is tagged or published by this PR.

What is here

• Merge of feature/session (b5276ab101): the application-scoped shared Redis session work that GG Forge pins as qbit-session-store:0.1.0-forge.b5276ab10151-core33464. That commit was never on develop; it lived only on feature/session and the stacked drafts PR #17 / PR #18. Original authorship is preserved (merge, not rewrite). CI files (.circleci/config.yml, .qqq-ci.yml, .gitea/workflows/build.yaml) keep develop's shared ci-workflows setup; the feature branch's CircleCI publish-tag filters are not carried over.
• Cherry-pick of 0f50ca1 (PR #17): AssertJ 3.27.7 for GHSA-rqfh-9r24-8c9r. Supersedes Dependabot PR #1 as well.
• Published coordinates instead of the in-flight snapshots: qqq.version=4.1.0-RC.22 (first release-line core with QSessionStoreRegistry.getInstance(QInstance) / clearIfSame; RC.21 does not compile, as Forge's docs/REDIS-SESSION-QUALIFICATION.md records) and qbit-redis.version=0.1.0-RC.1 (public api is a superset of the 7fe5492 snapshot). Both are properties so they can be overridden on the command line.
• revision stays 0.1.0-SNAPSHOT on purpose: the shared Maven workflow assigns 0.1.0-RC.N from release/0.1 and 0.1.0 from tag v0.1.0.
• CHANGELOG 0.1.0 entry; README compatibility matrix and "Releasing" procedure.

Not included: PR #18's Redis primary/replica promotion IT (draft, QRun-IO/qqq#1301 still open).

Verification

Maven 3.9.11, Temurin 21, Docker 29.9.2. The Gitea registry needs an authenticated read from this host, so the exact same sources were installed locally under local-labeled versions (core release/4.1 tip f1cdf31e9, qbit-redis tag v0.1.0-RC.1) and mvn verify -Dqqq.version=4.1.0-local.f1cdf31e9 -Dqbit-redis.version=0.1.0-local.6b0814d ran against the committed POM:

• 67 unit tests, 29 integration tests (Redis Testcontainers included), 0 failures / errors / skips
• 0 Checkstyle violations, JaCoCo gates met

These are the same 67/29 counts Forge recorded for its b5276ab build. The shared CI run on this branch resolves the real 4.1.0-RC.22 / 0.1.0-RC.1 from the registry.

Note: the branch name release/first-release-20261106 does not match the workflow's release/X.Y version rule, so the push-triggered run on this branch stops at "No version rule" before deploying anything. The PR merge into develop is what matters; the real cut uses release/0.1.

After merge (the actual cut, not done here)

1. git checkout -b release/0.1 origin/develop && git push origin release/0.1 -> workflow publishes 0.1.0-RC.1 to https://git.kof22.com/api/packages/QRun-IO/maven, commits the bump and tags v0.1.0-RC.1.
2. Qualify the RC (Forge can switch its pin to 0.1.0-RC.1).
3. Tag the bumped release/0.1 head v0.1.0 and push the tag -> publishes 0.1.0; the workflow pushes the bump to main (this repo has no main yet; it will be created).
4. Merge release/0.1 back into develop; develop advances to 0.2.0-SNAPSHOT. Fill in the CHANGELOG date.

🤖 Generated with Claude Code

Prepares, without cutting, the first published release of qbit-session-store. Nothing is tagged or published by this PR. ## What is here - **Merge of `feature/session` (b5276ab10151)**: the application-scoped shared Redis session work that GG Forge pins as `qbit-session-store:0.1.0-forge.b5276ab10151-core33464`. That commit was never on `develop`; it lived only on `feature/session` and the stacked drafts PR #17 / PR #18. Original authorship is preserved (merge, not rewrite). CI files (`.circleci/config.yml`, `.qqq-ci.yml`, `.gitea/workflows/build.yaml`) keep develop's shared ci-workflows setup; the feature branch's CircleCI publish-tag filters are not carried over. - **Cherry-pick of 0f50ca1** (PR #17): AssertJ 3.27.7 for GHSA-rqfh-9r24-8c9r. Supersedes Dependabot PR #1 as well. - **Published coordinates** instead of the in-flight snapshots: `qqq.version=4.1.0-RC.22` (first release-line core with `QSessionStoreRegistry.getInstance(QInstance)` / `clearIfSame`; RC.21 does not compile, as Forge's `docs/REDIS-SESSION-QUALIFICATION.md` records) and `qbit-redis.version=0.1.0-RC.1` (public api is a superset of the 7fe5492 snapshot). Both are properties so they can be overridden on the command line. - `revision` stays `0.1.0-SNAPSHOT` on purpose: the shared Maven workflow assigns `0.1.0-RC.N` from `release/0.1` and `0.1.0` from tag `v0.1.0`. - CHANGELOG 0.1.0 entry; README compatibility matrix and "Releasing" procedure. Not included: PR #18's Redis primary/replica promotion IT (draft, QRun-IO/qqq#1301 still open). ## Verification Maven 3.9.11, Temurin 21, Docker 29.9.2. The Gitea registry needs an authenticated read from this host, so the exact same sources were installed locally under local-labeled versions (core `release/4.1` tip f1cdf31e9, qbit-redis tag `v0.1.0-RC.1`) and `mvn verify -Dqqq.version=4.1.0-local.f1cdf31e9 -Dqbit-redis.version=0.1.0-local.6b0814d` ran against the committed POM: - 67 unit tests, 29 integration tests (Redis Testcontainers included), 0 failures / errors / skips - 0 Checkstyle violations, JaCoCo gates met These are the same 67/29 counts Forge recorded for its b5276ab build. The shared CI run on this branch resolves the real `4.1.0-RC.22` / `0.1.0-RC.1` from the registry. Note: the branch name `release/first-release-20261106` does not match the workflow's `release/X.Y` version rule, so the push-triggered run on this branch stops at "No version rule" before deploying anything. The PR merge into `develop` is what matters; the real cut uses `release/0.1`. ## After merge (the actual cut, not done here) 1. `git checkout -b release/0.1 origin/develop && git push origin release/0.1` -> workflow publishes `0.1.0-RC.1` to `https://git.kof22.com/api/packages/QRun-IO/maven`, commits the bump and tags `v0.1.0-RC.1`. 2. Qualify the RC (Forge can switch its pin to `0.1.0-RC.1`). 3. Tag the bumped `release/0.1` head `v0.1.0` and push the tag -> publishes `0.1.0`; the workflow pushes the bump to `main` (this repo has no `main` yet; it will be created). 4. Merge `release/0.1` back into `develop`; `develop` advances to `0.2.0-SNAPSHOT`. Fill in the CHANGELOG date. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

james.maes added 6 commits 2026-11-06 14:54:08 +00:00

feat: integrate application-scoped shared Redis sessions ... 95ac6e6ea1

Use the Redis QBit public API with explicit namespace and lifecycle ownership. Preserve optional Redis absence and legacy providers. Local verification: 67 unit and 29 integration tests; launcher lifecycle and real HTTP outage/logout retry acceptance passed. Coordinated prerequisite publication and cold-host checks remain pending.

Co-Authored-By: Codex <noreply@openai.com>

ci: enable coordinated feature snapshot publication ... e8f7a0c4a8

Use existing publish-tag support to produce isolated candidate coordinates without merging into develop. Setup configs validated; session-store moves to orb0.7.18 for QBit feature support. Exact prerequisite versions and artifact publication remain pending.

Co-Authored-By: Codex <noreply@openai.com>

build: align session store with published core and Redis ... b5276ab101

Use canonical feature publication tag filter.

Co-Authored-By: Codex <noreply@openai.com>

Merge branch 'feature/session' into release/first-release-20261106 ... 3f68fff26f

Bring the application-scoped shared Redis session work (b5276ab101, the
exact source behind GG Forge's qbit-session-store 0.1.0-forge pin) onto the
release line. Conflicts in .circleci/config.yml and .qqq-ci.yml are resolved
in favor of develop, which already moved to the shared Gitea ci-workflows
Maven workflow; the feature branch's CircleCI publish-tag filters are not
carried over.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>

fix: upgrade session-store test assertions to patched AssertJ ... f97c7c41a4

Use3.27.7 for GHSA-rqfh-9r24-8c9r. Verified synthetic external-entity/DTD rejection, ordinary XML control, dependency resolution,67unit and29integration tests with coverage.

Co-Authored-By: Codex <noreply@openai.com>
(cherry picked from commit 0f50ca15af)
Signed-off-by: James Maes <james@kof22.com>

build(release): prepare 0.1.0 on published core 4.1.0-RC.22 and qbit-redis 0.1.0-RC.1 ... 40226b3a2a

Replace the in-flight snapshot coordinates that the shared-session work was
built against (qqq-bom-pom 4.1.0-collab-33464d37e-SNAPSHOT, qbit-redis
0.1.0-redis-7fe5492-SNAPSHOT) with published coordinates exposed as
overridable properties: qqq.version=4.1.0-RC.22, the first release-line core
carrying QSessionStoreRegistry.getInstance(QInstance) and clearIfSame, and
qbit-redis.version=0.1.0-RC.1, whose public api is a strict superset of the
7fe5492 snapshot. The revision stays 0.1.0-SNAPSHOT: the shared ci-workflows
Maven workflow assigns 0.1.0-RC.N from release/0.1 and 0.1.0 from the v0.1.0
tag, so no version is hand-edited here.

CHANGELOG records the 0.1.0 contents; README gains a compatibility matrix and
the release/publication procedure for this repository.

Verification (Maven 3.9.11, Temurin 21, Docker 29.9.2 for Testcontainers):
mvn verify with the same sources installed locally under local-labeled
versions (core release/4.1 tip f1cdf31e9 as 4.1.0-local.f1cdf31e9, qbit-redis
tag v0.1.0-RC.1 as 0.1.0-local.6b0814d, because the Gitea registry needs an
authenticated read from this host): 67 unit tests, 29 integration tests
(RedisSessionStoreProviderIT, SharedRedisSessionStoreProviderIT,
TableBasedSessionStoreProviderIT) with zero failures/errors/skips, zero
Checkstyle violations, JaCoCo coverage gates met.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>

james.maes merged commit bf725e056a into develop 2026-11-06 15:33:09 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something isn't working

dependencies

documentation

Improvements or additions to documentation

duplicate

This issue or pull request already exists

enhancement

New feature or request

good first issue

Good for newcomers

help wanted

Extra attention is needed

invalid

This doesn't seem right

java

Pull requests that update java code

question

Further information is requested

release:rc

Merging this develop PR cuts the next release candidate

secuurity

wontfix

This will not be worked on

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

forge-recovery (Forge Recovery) james.maes (James Maes)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-session-store#23