ci: use central source scanning

Co-Authored-By: Codex <noreply@openai.com>
ci: adopt central orb 0.7.12 and stable gates (#36 )
2026-10-21 11:38:46 -05:00 · 2026-10-21 03:36:27 -05:00 · 2026-10-21 01:33:08 -05:00 · 2026-10-21 00:58:52 -05:00 · 2026-10-20 21:56:33 -05:00
4 changed files with 27 additions and 4 deletions
@@ -1,12 +1,12 @@
 version: 2.1
 setup: true
 orbs:
-  qqq-orb: kingsrook/qqq-orb@0.7.9
+  qqq-orb: kingsrook/qqq-orb@0.7.12
 workflows:
  setup:
    jobs:
    - qqq-orb/generate_pipeline:
-        orb_version: 0.7.9
+        orb_version: 0.7.12
        filters:
          branches:
            ignore: automation/qbit-rc-pending
@@ -0,0 +1,23 @@
+name: CodeQL
+'on':
+  push:
+    branches:
+    - main
+    - develop
+    - release/**
+    - hotfix/**
+  pull_request: {}
+  schedule:
+  - cron: 41 16 * * 0
+  workflow_dispatch: {}
+permissions:
+  contents: read
+  actions: read
+  security-events: write
+  packages: read
+concurrency:
+  group: codeql-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+jobs:
+  analyze:
+    uses: QRun-IO/qqq-orb/.github/workflows/qbit-codeql.yml@c288a8864fe9054f68410e1d78f5863aea4c4d22
@@ -42,7 +42,7 @@ permissions:
  checks: read
 jobs:
  release:
-    uses: QRun-IO/qqq-orb/.github/workflows/qqq-all-release.yml@65265e48a4176d8fb0f4f744e2919bad587bd5ca
+    uses: QRun-IO/qqq-orb/.github/workflows/qqq-all-release.yml@0f33ddadf88b9a1b940b8883782fe2000ee1d2bd
    with:
      version: ${{ inputs.version }}
      release_sha: ${{ inputs.release_sha }}
@@ -1,5 +1,5 @@
 profile: all
-orb_version: 0.7.9
+orb_version: 0.7.12
 default_branch: develop
 publish:
  snapshot: true
Author	SHA1	Message	Date
james.maesandCodex	061f7b8944	ci: use central source scanning Co-Authored-By: Codex <noreply@openai.com>	2026-10-21 11:38:46 -05:00
james.maesandCodex	2b75c6beb9	ci: adopt central orb 0.7.12 and stable gates (#36 ) Co-authored-by: Codex <noreply@openai.com>	2026-10-21 03:36:27 -05:00
james.maesandCodex	12ae927c33	ci: align canonical shared orb workers (#35 ) Co-authored-by: Codex <noreply@openai.com>	2026-10-21 01:33:08 -05:00
james.maesandCodex	6bcc28e332	ci: adopt shared orb 0.7.11 (#34 ) Co-authored-by: Codex <noreply@openai.com>	2026-10-21 00:58:52 -05:00
james.maesandCodex	cc89f73680	ci: centralize All builds smoke checks and releases (#33 ) * ci: centralize All builds smoke checks and releases Use orb 0.7.9 and its immutable shared release worker. Build once, preserve core/full verification and conditional public GHCR delivery, and consume public Circle provenance without exporting a token. Co-Authored-By: Codex <noreply@openai.com> * fix: use shared SDK v2 S3 support for MinIO Replace obsolete SDK v1 client overrides with upstream endpoint and path-style metadata. Preserve endpoint coverage for every filesystem action and local HTTP listing/write assertions. Co-Authored-By: Codex <noreply@openai.com> * test: verify the HttpOnly OIDC session contract Current QQQ omits the session UUID from JSON for HttpOnly cookies. Require the nonempty HttpOnly cookie and reject exposed UUIDs, retaining authenticated backend and permission checks. Co-Authored-By: Codex <noreply@openai.com> * fix: accept leading-dash Mongo credentials in Compose Use explicit username/password option assignments in health and replica-set initialization. Reproduced the original failure and verified authenticated ping with the corrected arguments against mongo:7 and a leading-dash fixture password. Co-Authored-By: Codex <noreply@openai.com> --------- Co-authored-by: Codex <noreply@openai.com>	2026-10-20 21:56:33 -05:00