build: re-pin to qbit-build-parent 2.0.0 and back-merge main (QRun-IO/qqq#766) #4
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: QRun-IO/qbit-standard-process-trace#4
Reference in new issue
Block a user
Summary
Re-pins
qbit-standard-process-tracetocom.kingsrook:qbit-build-parent:2.0.0(qqq 4.0.0 GA, Java 21) and adds an opt-inqqq-snapshotprofile that verifies it on qqq4.1.0-SNAPSHOT, so qqq-all can include it. The first commit back-mergesmainintodevelop, sincemainhad 7 commitsdeveloplacked.Merge this PR with a merge commit, not squash or rebase. That keeps
mainan ancestor ofdevelop, so the next release fromdeveloptomaindoes not conflict again.Changes
389e366chore: merge main into develop (git merge --no-ff origin/main). It brings in main's Java 21 parent bump, the 0.2.0 release, the Apache-2.0LICENSEandNOTICE, the standardized README, and.github/release.yml. Develop's backend-activity-stats feature, its tests,CODEOWNERSandCLAUDE.mdare kept; main had none of them. Againstorigin/develop, the merge changes onlyLICENSE,NOTICE,README.md,.github/release.ymland twopom.xmllines (parent, revision). No source file changed.eef914dbuild: re-pin to qbit-build-parent 2.0.0 (qqq 4.0.0). The parent goes to 2.0.0, and the childqqq-bom-pom:0.40.0-SNAPSHOTimport that shadowed the parent is removed, so default builds get qqq only from the parent. Java 21 comes from the parent'sjava.version. One qqq 4.0 API removal broke the test build:StandardProcessTraceTestApplicationnow callswithInstanceDefaultAuthentication(...), becauseQInstance.setAuthentication(...)was removed (BREAK-04-11). Main source compiled unchanged. The README prerequisite now says "QQQ application (v4.0.0+)". It said v0.35.0+.746a364build: add opt-in qqq-snapshot profile. It importsqqq-bom-pom:${qqq.snapshot.version}(default4.1.0-SNAPSHOT) ahead of the parent's BOM and adds the Central snapshots repository. The top-levelsonatype-snapshotsrepository only served the old snapshot BOM, so it moved into this profile. The profile is the same one used in qbit-quick-search and the B3 re-pin.7084430ci: keep package installs unattended on CircleCI machines. This copies theconfigure-package-installcommand and itspre-stepsfrom qbit-quick-searchdeveloponto all five orb jobs. Without it,install_javastalls on needrestart's interactive dialog and hits the 10-minute no-output limit (QRun-IO/qqq-orb#11). Drop it once the orb fixes that.5328b07docs: update CLAUDE.md notes for the parent 2.0.0 re-pin. It replaces the stale "branches diverged" andsetAuthenticationnotes.Other plan steps:
CI=true. Nothing to change.qqq-backend-corealready has no<version>.Merge conflict resolutions
LICENSE(add/add)33051ae, 2025-12-25)c86512d, 2026-01-05)NOTICE(which merged cleanly), and ADR-0003 settles on Apache-2.0. Keeping develop's file would have reverted main's LICENSE at the next release. B2 resolved it the same way (QRun-IO/qbit-user-role-permissions#5). The pom<licenses>, the README License section and the source headers are unchanged..circleci/config.ymlkingsrook/qqq-orb@0.6kingsrook/qqq-orb@0.5.00.6. It is the newer orb line.pom.xml<revision>0.1.3-SNAPSHOT, in a<properties>block moved to the top0.2.0, in the old block below<scm>0.2.0, so there is one<properties>block.v0.2.0is released, and0.1.3-SNAPSHOTsorts below it. Ondevelop, qqq-orb'scalculate_version.shturns a stable version into the next minor SNAPSHOT (0.3.0-SNAPSHOT), so 0.2.0 is not re-published. B2 did the same.Merged without conflict: parent 1.1.0 to 1.5.1 from main (moved to 2.0.0 in the next commit). From develop:
junit-bom6.0.2, the removal ofqqq-backend-module-rdbms, and the 0.40.0-SNAPSHOT BOM (removed in the next commit).Related Issues
Closes QRun-IO/qqq#766
Part of QRun-IO/qqq-all#1
Type of Change
Testing
All commands ran in this checkout with Maven 3.9.16 and OpenJDK 21.0.12.1. The repo has no
mvnw, so I usedmvn. I never ranmvn install.Test-first: I bumped the parent before migrating code and watched the build fail, and I checked that the profile did nothing before adding it.
mvn -B clean verifyon the merge commit389e366mvn -B clean verifycannot find symbol setAuthentication(QAuthenticationMetaData)atStandardProcessTraceTestApplication.java:84mvn -B clean verifyqqq-backend-core:4.0.0mvn -B -Pqqq-snapshot dependency:list -DincludeGroupIds=com.kingsrook.qqqThe requested profile "qqq-snapshot" could not be activated because it does not exist, and it still resolves4.0.0mvn -B -U dependency:list -DincludeGroupIds=com.kingsrook.qqqqqq-backend-core:4.0.0-Pqqq-snapshotqqq-backend-core:4.1.0-SNAPSHOT-Pqqq-snapshot -Dqqq.snapshot.version=4.0.0qqq-backend-core:4.0.0(the override works)mvn -B -U clean verify -Pqqq-snapshotFinal gates on HEAD
5328b07. Each ran aftermvn -B -q clean.mvn -B verifyCI=true mvn -B verifyCI=true mvn -B verify -Pqqq-snapshotmvn -B -U verify -Pqqq-snapshot -Dmaven.repo.local=/tmp/m2-b4qqq-backend-core-4.1.0-20260926.013610-8fromhttps://central.sonatype.com/repository/maven-snapshots/javap -v -cp target/classes ...StandardProcessTraceQBitConfigmajor version: 65circleci config validate .circleci/config.ymlCannot find kingsrook/qqq-orb@0.6, and the same for 0.5.0, 0.5.2 and 0.6.5).yqparses the file, and the new command andpre-stepsmatch qbit-quick-search's config. CircleCI then compiled and ran it:qqq-orb/mvn_test_onlybuild 46 passed on5328b07in 1m19s, including the new pre-step andinstall_java.I ran the isolated-repository gate because the shared
~/.m2can hold locally installed4.1.0-SNAPSHOTartifacts. It shows the build passes against the published Central snapshot.mvn test)mvn verify)Checklist
Additional Notes
[WARNING] Failed to build parent project for com.kingsrook.qbits:qbit-standard-process-trace:jar:0.2.0. The publishedqbit-build-parent-2.0.0.pomwas not flattened, so its<version>is the literal${revision}. The effective model is still correct (qqq 4.0.0, Java 21). The fix belongs inqbit-bomand affects every qbit on 2.0.0, as B2 and B3 also report.<licenses>(AGPL), the README License section ("Proprietary - QRun.IO"), and the AGPL source and pom headers. Licensing alignment is a separate owner decision. Also left alone: CHANGELOG text copied from another qbit, README example drift, theKingsrookURLs in<url>and<scm>, and the open dependabot assertj branch.Review, round 1 (plan task B4): approve
I found no blocking issues. I reviewed HEAD
5328b07against plan task B4 and the Global Constraints, on a clean clone of the PR head.Blocking
None.
Non-blocking
LICENSEchanges from AGPL-3.0 to Apache-2.0 andNOTICEis added. The merge also changes develop's README License section from AGPL to main's "Proprietary - QRun.IO". The README change merged cleanly, since develop never touchedREADME.mdafter the merge base. After the merge, develop's license state matchesmainexactly. Againstmain,README.md,LICENSEandNOTICEdiffer only by the prerequisite line. Read literally, the plan says not to change LICENSE files. The alternative is worse: keeping develop's files would put AGPL back onmainat the next release. This is the same call as B2, so I'm not blocking on it. One correction to the PR body: the conflict table says "the README License section ... unchanged". That is true againstmain, but againstdevelopit changed.allow_squash_merge: true,allow_rebase_merge: true). Either one would dropmainas an ancestor ofdevelop, and the next release would conflict again. Use a merge commit, as the PR body says.qbit-build-parent2.0.0 already declarescentral-portal-snapshotsat the same URL in every build. The effective POM without the profile lists it, and with-Pqqq-snapshotthe log fetchesmaven-metadata.xmlfrom both ids. The plan asks the profile to add the repository, and B2 and B3 add it too, so leave it.0f2ec0339048(branchdevelop, 2026-07-04)" sits above bullets that describe this PR's state, so it now reads as stale. The licensing bullet names the pom<licenses>and the source headers, but not the README's "Proprietary" line. Both are minor.[WARNING] Failed to build parent project for ...:0.2.0shows up here too. The effective model is correct. The cause is the unflattenedqbit-build-parent-2.0.0.pom, so the fix belongs inqbit-bom, not this PR.B4 requirements
mainintodevelop389e366is a real merge (parents0ee8782,c86512d). Againstorigin/developit touches onlyLICENSE,NOTICE,README.md,.github/release.ymland two pom lines. It changes no source or test files, so the backend-activity-stats feature and its tests are kept.2.0.0. Theqqq-bom-pom:0.40.0-SNAPSHOTimport is gone. The effective POM hasjava.version21, andjavapshowsmajor version: 65. The pom<licenses>and all source headers are unchanged againstdevelop.qqq-snapshotprofilecom.kingsrook.qqqentries, all at4.0.0. With-Pqqq-snapshot, 17 are at4.1.0-SNAPSHOT, plusqqq-frontend-next 0.2.1, which comes from the snapshot BOM itself. So the child's import replaces the parent's. The profile has no activation, andqqq.snapshot.versiondefaults to4.1.0-SNAPSHOT.CI=true@Disabledor assumptions insrc/.<version>sqqq-backend-coreis managed. The only qqq<version>left is the profile's BOM import,${qqq.snapshot.version}.Gates I ran
mvn -B clean verify(qqq 4.0.0 from the parent)CI=true mvn -B -U clean verify -Pqqq-snapshot -Dmaven.repo.local=<empty dir>qqq-backend-core-4.1.0-20260926.013614-9.jarfromsonatype-snapshotsjavap -vonStandardProcessTraceQBitConfigshowsmajor version: 65qqq-orb/mvn_test_onlypassed on5328b07, build 46LICENSE. The CircleCI change references the existing context by name.Other checks
v4.0.0,QInstance.withInstanceDefaultAuthentication(auth)callsregisterAuthenticationProvider(AuthScope.instanceDefault(), auth). That is the documented replacement for the removedsetAuthentication, anddevelopstill has it. The existing 4 tests exercise it on both qqq lines. There is no new behavior, so no new tests are needed.<revision>0.2.0on develop. I checked this against qqq-orbv0.6.5:handle_develop_branchincalculate_version.shturns a stableX.Y.ZintoX.(Y+1).0-SNAPSHOT. Sopublish_snapshotpublishes0.3.0-SNAPSHOTand won't re-publish0.2.0.mvn_test_onlyandmvn_publishboth use the orb'sjavaexecutor, amachineubuntu-2204image with sudo. So theconfigure-package-installpre-step is also safe on the four publish workflows, which only run after merge.$nrconf{restart}sits inside single quotes, so the shell does not expand it.