feat(ci): configure shared Linux snapshot pipeline

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
ci: enroll shared Gitea lifecycle
2026-11-05 10:54:49 +00:00 · 2026-11-02 20:22:51 +00:00 · 2026-11-02 20:20:36 +00:00 · 2026-11-02 18:35:22 +00:00 · 2026-11-02 18:32:16 +00:00 · 2026-11-02 15:53:01 +00:00
7 changed files with 166 additions and 5 deletions
@@ -0,0 +1,42 @@
+schema: 1
+
+scoped_delegation: true
+
+verification:
+  push:
+    branches: [main, master, dev, rc, "release/**", "hotfix/**", "qualification/**"]
+
+components:
+  library:
+    directory: .
+    platforms: [linux-amd64]
+    toolchains:
+      java: "21"
+    build:
+      tool: maven
+      commands:
+        - ["--batch-mode", "--update-snapshots", "-T4", "--no-transfer-progress", "verify"]
+        - ["--batch-mode", "--no-transfer-progress", "org.codehaus.mojo:flatten-maven-plugin:1.7.3:flatten", "-Dflatten.mode=resolveCiFriendliesOnly", "-DupdatePomFile=true"]
+    reports:
+      junit: "**/target/surefire-reports/*.xml"
+    artifacts:
+      packages:
+        format: maven
+        paths: [".flattened-pom.xml", "target/*.jar"]
+
+release:
+  channels:
+    snapshot:
+      trigger:
+        push_branches: [develop]
+      versioning: maven-snapshot
+      effective_version:
+        rule: develop-next-minor
+      central_completion: true
+      version_write_back: {}
+  publications:
+    qbit-sftp-packages:
+      component: library
+      artifact: packages
+      destination: qrun-maven
+      channels: [snapshot]
@@ -1,12 +1,12 @@
 version: 2.1
 setup: true
 orbs:
-  qqq-orb: kingsrook/qqq-orb@0.7.12
+  qqq-orb: kingsrook/qqq-orb@0.8
 workflows:
  setup:
    jobs:
    - qqq-orb/generate_pipeline:
-        orb_version: 0.7.12
+        orb_version: '0.8'
        filters:
          branches:
            ignore: automation/qbit-rc-pending
@@ -0,0 +1,24 @@
+# Standard QRun release caller (v2, thin contract): every push and manual dispatch delegates to the protected qrun-release-v1 channel. Do not edit per repository.
+name: qrun-release
+on:
+  push: {}
+  workflow_dispatch: {}
+permissions:
+  contents: read
+  actions: read
+jobs:
+  release:
+    # Develop uses the repository-owned shared pipeline configuration.
+    if: ${{ github.ref != 'refs/heads/develop' }}
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/java-maven.yaml@qrun-release-v1
+    with:
+      runner: linux-small
+  postpublish:
+    if: ${{ needs.release.outputs.capture == 'true' }}
+    needs: release
+    permissions:
+      contents: write
+      actions: write
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/qrun-source-version.yaml@qrun-release-v1
+    with:
+      runner: linux-small
@@ -0,0 +1,72 @@
+name: Release candidate
+'on':
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Plan a cut without changing release state
+        type: boolean
+        default: false
+      finalize:
+        description: Retry finalization of an existing cut; do not cut another RC
+        type: boolean
+        default: false
+      recover:
+        description: Recover the same published RC after a deployment timeout; never
+          reupload
+        type: boolean
+        default: false
+      circle_build:
+        description: Original release run id (recovery only)
+        type: string
+        default: ''
+      merge_sha:
+        description: Existing cut merge_sha (finalize retry only)
+        type: string
+        default: ''
+      bump_sha:
+        description: Existing cut bump_sha (finalize retry only)
+        type: string
+        default: ''
+      branch:
+        description: Existing cut branch (finalize retry only)
+        type: string
+        default: ''
+      version:
+        description: Existing cut version (finalize retry only)
+        type: string
+        default: ''
+  pull_request:
+    types:
+    - closed
+    branches:
+    - develop
+permissions:
+  contents: read
+jobs:
+  release-rc:
+    # The old qbit-rc-published repository_dispatch is replaced by the already-proven workflow_dispatch
+    # completion: the publisher's own ActionsWRITE job dispatches this workflow with finalize=true plus
+    # merge_sha/bump_sha/branch/version (same inputs as the manual finalize retry).
+    permissions:
+      contents: write
+      actions: read
+      pull-requests: write
+    if: github.event_name == 'workflow_dispatch'
+      || (github.event_name == 'pull_request' && github.event.pull_request.merged
+      == true && github.event.pull_request.base.ref == 'develop' && contains(github.event.pull_request.labels.*.name,
+      'release:rc'))
+    uses: self:KofTwentyTwo/platform-ci/.gitea/workflows/qbit-release-rc.yaml@qrun-release-v1
+    with:
+      dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false
+        }}
+      finalize: ${{ github.event_name == 'workflow_dispatch' && inputs.finalize }}
+      recover: ${{ github.event_name == 'workflow_dispatch' && inputs.recover || false
+        }}
+      circle_build: ${{ github.event_name == 'workflow_dispatch' && inputs.circle_build
+        || '' }}
+      merge_sha: ${{ inputs.merge_sha || '' }}
+      bump_sha: ${{ inputs.bump_sha || '' }}
+      branch: ${{ inputs.branch || '' }}
+      version: ${{ inputs.version || '' }}
+    secrets:
+      QRUN_TAG_SIGNING_KEY: ${{ secrets.QRUN_TAG_SIGNING_KEY }}
@@ -0,0 +1,23 @@
+name: CodeQL
+'on':
+  push:
+    branches:
+    - main
+    - develop
+    - release/**
+    - hotfix/**
+  pull_request: {}
+  schedule:
+  - cron: 41 16 * * 0
+  workflow_dispatch: {}
+permissions:
+  contents: read
+  actions: read
+  security-events: write
+  packages: read
+concurrency:
+  group: codeql-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+jobs:
+  analyze:
+    uses: QRun-IO/qqq-orb/.github/workflows/qbit-codeql.yml@c288a8864fe9054f68410e1d78f5863aea4c4d22
@@ -1,8 +1,8 @@
 profile: qbit
-orb_version: 0.7.12
+orb_version: '0.8'
 default_branch: develop
 java_version: '21'
-browsers: true
+browsers: false
 api_checks: false
 docs_only: false
 release_on_main: false
@@ -22,7 +22,7 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
   
   <properties>
-      <revision>0.4.0-SNAPSHOT</revision>
+      <revision>0.5.0-SNAPSHOT</revision>
   </properties>

   <parent>