ci: leave release branches to the shared pipeline in the legacy caller guard

The legacy caller already skips develop because the shared pipeline publishes it. A push to release/X.Y would otherwise start the retired
producer next to the shared release-candidate channel and publish the same RC twice. Skip release/* the same way. Needs CI-owner review: the
file is the standard thin caller (its sha256 is an enrolled workflow identity of the legacy route, which is retired for this repository).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.ci.yaml

@@ -0,0 +1,55 @@
+schema: 1
+
+scoped_delegation: true
+
+verification:
+  push:
+    branches: [main, master, dev, rc, "release/**", "hotfix/**", "qualification/**"]
+
+components:
+  library:
+    directory: .
+    platforms: [linux-amd64]
+    toolchains:
+      java: "21"
+    build:
+      tool: maven
+      # Shared verification uses the release version property so unchanged tested outputs can be reused.
+      commands:
+        - ["--batch-mode", "--update-snapshots", "-T4", "--no-transfer-progress", "verify"]
+        - ["--batch-mode", "--no-transfer-progress", "org.codehaus.mojo:flatten-maven-plugin:1.7.3:flatten", "-Dflatten.mode=resolveCiFriendliesOnly", "-DupdatePomFile=true"]
+    reports:
+      junit: "**/target/surefire-reports/*.xml"
+    artifacts:
+      packages:
+        format: maven
+        # Retain the generated consumer POM alongside the tested JAR; both are required for publication.
+        paths: [".flattened-pom.xml", "target/*.jar"]
+
+release:
+  channels:
+    snapshot:
+      trigger:
+        push_branches: [develop]
+      versioning: maven-snapshot
+      effective_version:
+        rule: develop-next-minor
+      central_completion: true
+      version_write_back: {}
+    # Release candidates: a push to release/X.Y derives X.Y.0-RC.n with the existing rc-from-branch rule (the first RC of a branch that declares
+    # X.Y.Z-SNAPSHOT is RC.1); maven-release refuses a SNAPSHOT effective version. Published to the same destination as the snapshot, with the same
+    # Central completion and source write-back policy.
+    release-candidate:
+      trigger:
+        push_branches: ["release/*"]
+      versioning: maven-release
+      effective_version:
+        rule: rc-from-branch
+      central_completion: true
+      version_write_back: {}
+  publications:
+    qbit-sftp-packages:
+      component: library
+      artifact: packages
+      destination: qrun-maven
+      channels: [snapshot, release-candidate]

.circleci/config.yml

@@ -1,12 +1,12 @@
 version: 2.1
 setup: true
 orbs:
-  qqq-orb: kingsrook/qqq-orb@0.7.12
+  qqq-orb: kingsrook/qqq-orb@0.8
 workflows:
   setup:
     jobs:
     - qqq-orb/generate_pipeline:
-        orb_version: 0.7.12
+        orb_version: '0.8'
         filters:
           branches:
             ignore: automation/qbit-rc-pending

.gitea/workflows/qrun-release.yaml

@@ -0,0 +1,24 @@
+# Standard QRun release caller (v2, thin contract): every push and manual dispatch delegates to the protected qrun-release-v1 channel. Do not edit per repository.
+name: qrun-release
+on:
+  push: {}
+  workflow_dispatch: {}
+permissions:
+  contents: read
+  actions: read
+jobs:
+  release:
+    # Develop and release candidates use the repository-owned shared pipeline configuration.
+    if: ${{ github.ref != 'refs/heads/develop' && !startsWith(github.ref, 'refs/heads/release/') }}
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/java-maven.yaml@qrun-release-v1
+    with:
+      runner: linux-small
+  postpublish:
+    if: ${{ needs.release.outputs.capture == 'true' }}
+    needs: release
+    permissions:
+      contents: write
+      actions: write
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/qrun-source-version.yaml@qrun-release-v1
+    with:
+      runner: linux-small

.gitea/workflows/release-rc.yaml

@@ -0,0 +1,72 @@
+name: Release candidate
+'on':
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Plan a cut without changing release state
+        type: boolean
+        default: false
+      finalize:
+        description: Retry finalization of an existing cut; do not cut another RC
+        type: boolean
+        default: false
+      recover:
+        description: Recover the same published RC after a deployment timeout; never
+          reupload
+        type: boolean
+        default: false
+      circle_build:
+        description: Original release run id (recovery only)
+        type: string
+        default: ''
+      merge_sha:
+        description: Existing cut merge_sha (finalize retry only)
+        type: string
+        default: ''
+      bump_sha:
+        description: Existing cut bump_sha (finalize retry only)
+        type: string
+        default: ''
+      branch:
+        description: Existing cut branch (finalize retry only)
+        type: string
+        default: ''
+      version:
+        description: Existing cut version (finalize retry only)
+        type: string
+        default: ''
+  pull_request:
+    types:
+    - closed
+    branches:
+    - develop
+permissions:
+  contents: read
+jobs:
+  release-rc:
+    # The old qbit-rc-published repository_dispatch is replaced by the already-proven workflow_dispatch
+    # completion: the publisher's own ActionsWRITE job dispatches this workflow with finalize=true plus
+    # merge_sha/bump_sha/branch/version (same inputs as the manual finalize retry).
+    permissions:
+      contents: write
+      actions: read
+      pull-requests: write
+    if: github.event_name == 'workflow_dispatch'
+      || (github.event_name == 'pull_request' && github.event.pull_request.merged
+      == true && github.event.pull_request.base.ref == 'develop' && contains(github.event.pull_request.labels.*.name,
+      'release:rc'))
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/qbit-release-rc.yaml@qrun-release-v1
+    with:
+      dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false
+        }}
+      finalize: ${{ github.event_name == 'workflow_dispatch' && inputs.finalize }}
+      recover: ${{ github.event_name == 'workflow_dispatch' && inputs.recover || false
+        }}
+      circle_build: ${{ github.event_name == 'workflow_dispatch' && inputs.circle_build
+        || '' }}
+      merge_sha: ${{ inputs.merge_sha || '' }}
+      bump_sha: ${{ inputs.bump_sha || '' }}
+      branch: ${{ inputs.branch || '' }}
+      version: ${{ inputs.version || '' }}
+    secrets:
+      QRUN_TAG_SIGNING_KEY: ${{ secrets.QRUN_TAG_SIGNING_KEY }}

.github/workflows/codeql.yml

@@ -0,0 +1,23 @@
+name: CodeQL
+'on':
+  push:
+    branches:
+    - main
+    - develop
+    - release/**
+    - hotfix/**
+  pull_request: {}
+  schedule:
+  - cron: 41 16 * * 0
+  workflow_dispatch: {}
+permissions:
+  contents: read
+  actions: read
+  security-events: write
+  packages: read
+concurrency:
+  group: codeql-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+jobs:
+  analyze:
+    uses: QRun-IO/qqq-orb/.github/workflows/qbit-codeql.yml@c288a8864fe9054f68410e1d78f5863aea4c4d22

.qqq-ci.yml

@@ -1,8 +1,8 @@
 profile: qbit
-orb_version: 0.7.12
+orb_version: '0.8'
 default_branch: develop
 java_version: '21'
-browsers: true
+browsers: false
 api_checks: false
 docs_only: false
 release_on_main: false

pom.xml

@@ -22,7 +22,7 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    
    <properties>
-      <revision>0.4.0-SNAPSHOT</revision>
+      <revision>0.5.0-SNAPSHOT</revision>
    </properties>
 
    <parent>