From b10adfd5792f37e9c6a87d96bdec86aaa02c7f8d Mon Sep 17 00:00:00 2001 From: James Maes Date: Wed, 21 Oct 2026 13:37:12 -0500 Subject: [PATCH] ci: centralize release branch verification and workflows Co-Authored-By: Codex --- .circleci/config.yml | 63 +++++---------------------- .github/workflows/codeql.yml | 23 ++++++++++ .github/workflows/release-rc.yml | 74 ++++++++++++++++++++++++++++++++ .qqq-ci.yml | 16 +++++++ 4 files changed, 123 insertions(+), 53 deletions(-) create mode 100644 .github/workflows/codeql.yml create mode 100644 .github/workflows/release-rc.yml create mode 100644 .qqq-ci.yml diff --git a/.circleci/config.yml b/.circleci/config.yml index 07c6be2..7165c4c 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -1,57 +1,14 @@ version: 2.1 - +setup: true orbs: - qqq-orb: kingsrook/qqq-orb@0.3.7 - + qqq-orb: kingsrook/qqq-orb@0.7.16 workflows: - - test_only: + setup: jobs: - - qqq-orb/mvn_test_only: - context: [ qqq-maven-registry-credentials ] - filters: - branches: - ignore: /(develop|main|release/.*|hotfix/.*|integration.*)/ - tags: - only: [] - - publish_snapshot: - jobs: - - qqq-orb/mvn_publish: - context: [ qqq-maven-registry-credentials ] - branch_type: snapshot - filters: - branches: - only: - - develop - - publish_release_candidate: - jobs: - - qqq-orb/mvn_publish: - context: [ qqq-maven-registry-credentials ] - branch_type: release_candidate - filters: - branches: - only: - - /release\/.*/ - - publish_release: - jobs: - - qqq-orb/mvn_publish: - context: [ qqq-maven-registry-credentials ] - branch_type: release - filters: - branches: - ignore: /.*/ - tags: - only: [ /v.*/ ] - - publish_hotfix_release: - jobs: - - qqq-orb/mvn_publish: - context: [ qqq-maven-registry-credentials ] - branch_type: hotfix - filters: - branches: - only: - - /hotfix\/.*/ + - qqq-orb/generate_pipeline: + orb_version: 0.7.16 + filters: + branches: + ignore: automation/qbit-rc-pending + tags: + only: /v.*/ diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..bd3ceaf --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,23 @@ +name: CodeQL +'on': + push: + branches: + - main + - develop + - release/** + - hotfix/** + pull_request: {} + schedule: + - cron: 41 16 * * 0 + workflow_dispatch: {} +permissions: + contents: read + actions: read + security-events: write + packages: read +concurrency: + group: codeql-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} +jobs: + analyze: + uses: QRun-IO/qqq-orb/.github/workflows/qbit-codeql.yml@c288a8864fe9054f68410e1d78f5863aea4c4d22 diff --git a/.github/workflows/release-rc.yml b/.github/workflows/release-rc.yml new file mode 100644 index 0000000..b48a32a --- /dev/null +++ b/.github/workflows/release-rc.yml @@ -0,0 +1,74 @@ +name: Release candidate +'on': + workflow_dispatch: + inputs: + dry_run: + description: Plan a cut without changing release state + type: boolean + default: false + finalize: + description: Retry finalization of an existing cut; do not cut another RC + type: boolean + default: false + recover: + description: Recover the same published RC after a deployment timeout; never + reupload + type: boolean + default: false + circle_build: + description: Original Circle publisher build number (recovery only) + type: string + default: '' + merge_sha: + description: Existing cut merge_sha (finalize retry only) + type: string + default: '' + bump_sha: + description: Existing cut bump_sha (finalize retry only) + type: string + default: '' + branch: + description: Existing cut branch (finalize retry only) + type: string + default: '' + version: + description: Existing cut version (finalize retry only) + type: string + default: '' + pull_request: + types: + - closed + branches: + - develop + repository_dispatch: + types: + - qbit-rc-published +permissions: + contents: write + actions: read + checks: read +jobs: + release-rc: + if: github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch' + || (github.event_name == 'pull_request' && github.event.pull_request.merged + == true && github.event.pull_request.base.ref == 'develop' && contains(github.event.pull_request.labels.*.name, + 'release:rc')) + uses: QRun-IO/qqq-orb/.github/workflows/qbit-release-rc.yml@cc30f599e63c8e41629c99d23395bac1adb8bc44 + with: + dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false + }} + finalize: ${{ github.event_name == 'repository_dispatch' || (github.event_name + == 'workflow_dispatch' && inputs.finalize) }} + recover: ${{ github.event_name == 'workflow_dispatch' && inputs.recover || false + }} + circle_build: ${{ github.event_name == 'workflow_dispatch' && inputs.circle_build + || '' }} + merge_sha: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.merge_sha + || inputs.merge_sha || '' }} + bump_sha: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.bump_sha + || inputs.bump_sha || '' }} + branch: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.branch + || inputs.branch || '' }} + version: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.version + || inputs.version || '' }} + secrets: inherit diff --git a/.qqq-ci.yml b/.qqq-ci.yml new file mode 100644 index 0000000..7c43ed0 --- /dev/null +++ b/.qqq-ci.yml @@ -0,0 +1,16 @@ +profile: qbit +orb_version: 0.7.16 +default_branch: main +java_version: '21' +browsers: true +api_checks: false +docs_only: false +release_on_main: false +release_tag_policy: v-prefix +test_branch_policy: feature-no-hotfix +publish: + snapshot: true + release_candidate: true + release: true + hotfix: true + asciidoc: false -- 2.54.0