ci(release-rc): pass secrets to the shared workflow so it can sign the RC tag

QRun-IO/.github#2 adds a tag-and-release job that signs vX with the
QRUN_TAG_SIGNING_KEY secret after Maven Central confirms the artifact.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/release-rc.yml

@@ -21,5 +21,6 @@ jobs:
   release-rc:
     if: github.event_name == 'workflow_dispatch' || (github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'release:rc'))
     uses: QRun-IO/.github/.github/workflows/qbit-release-rc.yml@main
+    secrets: inherit
     with:
       dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}

CHANGELOG.md

@@ -5,6 +5,9 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 
 ## [Unreleased]
 
+### Fixed
+- QBit metadata now reads the Maven artifact version from a filtered resource, keeping snapshot and release versions in sync with the help bundle.
+
 ### Added
 - Central `webhooks.endpoint.<id>` and `webhooks.dispatcher` dependency checks, every 300 seconds, using persisted endpoint health and outbox age.
 - A native home status line linking to the webhooks checks in System Health.

pom.xml

@@ -149,6 +149,7 @@
             <filtering>true</filtering>
             <includes>
                <include>help/*.yaml</include>
+               <include>qbit-webhooks.properties</include>
             </includes>
          </resource>
          <resource>
@@ -156,6 +157,7 @@
             <filtering>false</filtering>
             <excludes>
                <exclude>help/*.yaml</exclude>
+               <exclude>qbit-webhooks.properties</exclude>
             </excludes>
          </resource>
       </resources>

src/main/java/com/kingsrook/qbits/webhooks/WebhooksQBitProducer.java

@@ -21,10 +21,13 @@
 package com.kingsrook.qbits.webhooks;
 
 
+import java.io.IOException;
+import java.io.InputStream;
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Properties;
 import com.kingsrook.qbits.webhooks.app.WebhooksApp;
 import com.kingsrook.qbits.webhooks.events.WebhooksProcessListener;
 import com.kingsrook.qbits.webhooks.events.WebhooksRecordChangeListener;
@@ -75,13 +78,40 @@ public class WebhooksQBitProducer implements QBitMetaDataProducer<WebhooksQBitCo
 {
    public static final String GROUP_ID    = "com.kingsrook.qbits";
    public static final String ARTIFACT_ID = "qbit-webhooks";
-   public static final String VERSION     = "1.0.0";
+   public static final String VERSION     = loadVersion();
 
    private WebhooksQBitConfig qBitConfig;
    private String             namespace;
 
 
 
+   /*******************************************************************************
+    ** The artifact version, from the Maven-filtered qbit-webhooks.properties.
+    *******************************************************************************/
+   private static String loadVersion()
+   {
+      try(InputStream inputStream = WebhooksQBitProducer.class.getClassLoader().getResourceAsStream("qbit-webhooks.properties"))
+      {
+         if(inputStream == null)
+         {
+            throw (new IllegalStateException("Missing qbit-webhooks.properties; build with Maven to generate the artifact version."));
+         }
+         Properties properties = new Properties();
+         properties.load(inputStream);
+         String version = properties.getProperty("version");
+         if(version == null || version.isBlank() || version.contains("${"))
+         {
+            throw (new IllegalStateException("Missing or unfiltered version in qbit-webhooks.properties; build with Maven."));
+         }
+         return (version);
+      }
+      catch(IOException e)
+      {
+         throw (new IllegalStateException("Could not read artifact version from qbit-webhooks.properties.", e));
+      }
+   }
+
+
    /*******************************************************************************
     ** Fluent setter for the config.
     *******************************************************************************/

src/main/resources/qbit-webhooks.properties

@@ -0,0 +1 @@
+version=${project.version}

src/test/java/com/kingsrook/qbits/webhooks/WebhooksHelpBundleTest.java

@@ -75,7 +75,7 @@ class WebhooksHelpBundleTest
       assertThat(HelpBundles.of(instance).getBundles()).singleElement().satisfies(bundle ->
       {
          assertThat(bundle.getId()).isEqualTo("qbit-webhooks");
-         assertThat(bundle.getVersion()).as("the help bundle carries the artifact version").isEqualTo(System.getProperty("qbit.artifactVersion"));
+         assertThat(bundle.getVersion()).as("the help bundle carries the artifact version").isNotBlank().isEqualTo(System.getProperty("qbit.artifactVersion")).isEqualTo(WebhooksQBitProducer.VERSION);
       });
    }
 }

src/test/java/com/kingsrook/qbits/webhooks/WebhooksQBitProducerTest.java

@@ -45,6 +45,19 @@ import static org.assertj.core.api.Assertions.assertThatThrownBy;
  *******************************************************************************/
 class WebhooksQBitProducerTest
 {
+   /*******************************************************************************
+    ** Producer metadata carries the artifact version supplied by Maven.
+    *******************************************************************************/
+   @Test
+   void versionMatchesArtifact()
+   {
+      String artifactVersion = System.getProperty("qbit.artifactVersion");
+      assertThat(artifactVersion).isNotBlank();
+      assertThat(WebhooksQBitProducer.VERSION).isEqualTo(artifactVersion);
+      assertThat(new WebhooksQBitProducer().getQBitMetaData().getVersion()).isEqualTo(artifactVersion);
+   }
+
+
    /*******************************************************************************
     ** Table names: lowercase snake_case with the webhooks_ prefix; backend
     ** column names snake_case; a valid instance.