Merge pull request 'ci: build on the shared ci-workflows workflow' (#179) from ci/ci-workflows into develop

The Selenium ITs need a headless Chrome and the HTTPS React dev server on
:3001. Move the prebuild into scripts/ci-prebuild.sh, which also starts the
dev server (HTTPS, port 3001, backend proxy 8001) the way the qqq-orb
frontend-material pipeline did, and treat CI=true like QQQ_SELENIUM_HEADLESS
(and like CIRCLECI for waitForever) so the tests run headless on any CI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.circleci/config.yml

@@ -1,167 +0,0 @@
----
-version: 2.1
-
-parameters:
-  run_playwright:
-    type: boolean
-    default: false
-
-orbs:
-  qqq-orb: kingsrook/qqq-orb@0.6.6
-
-commands:
-  configure-package-install:
-    steps:
-      - run:
-          name: Keep package installation unattended
-          command: |
-            # These build machines are discarded after the job.
-            sudo install -d /etc/needrestart/conf.d
-            printf '%s\n' '$nrconf{restart} = "l";' | sudo tee /etc/needrestart/conf.d/99-qqq-ci.conf >/dev/null
-
-executors:
-  playwright:
-    docker:
-      - image: mcr.microsoft.com/playwright:v1.58.2-jammy
-
-jobs:
-  playwright_tests:
-    executor: playwright
-    steps:
-      - checkout
-      - restore_cache:
-          keys:
-            - npm-deps-{{ checksum "package-lock.json" }}
-            - npm-deps-
-      - run:
-          name: Install dependencies
-          command: npm ci --legacy-peer-deps
-      - save_cache:
-          key: npm-deps-{{ checksum "package-lock.json" }}
-          paths:
-            - node_modules
-      - run:
-          name: Run Playwright visual regression tests
-          command: npx playwright test
-      - store_artifacts:
-          path: playwright-report/
-          destination: playwright-report
-      - store_test_results:
-          path: test-results/
-
-workflows:
-  test_only:
-    jobs:
-      - qqq-orb/mvn_frontend_test_only:
-          pre-steps:
-            - configure-package-install
-          context: [qqq-maven-registry-credentials]
-          filters:
-            branches:
-              ignore: /(develop|main|release/.*|hotfix/.*)/
-            tags:
-              only: []
-
-  test_only_with_playwright:
-    when: << pipeline.parameters.run_playwright >>
-    jobs:
-      - playwright_tests:
-          filters:
-            branches:
-              ignore: /(develop|main|release/.*|hotfix/.*)/
-            tags:
-              only: []
-      - qqq-orb/mvn_frontend_test_only:
-          pre-steps:
-            - configure-package-install
-          context: [qqq-maven-registry-credentials]
-          requires:
-            - playwright_tests
-          filters:
-            branches:
-              ignore: /(develop|main|release/.*|hotfix/.*)/
-            tags:
-              only: []
-
-  publish_snapshot:
-    jobs:
-      - qqq-orb/mvn_frontend_publish:
-          pre-steps:
-            - configure-package-install
-          context: [qqq-maven-registry-credentials]
-          branch_type: snapshot
-          filters:
-            branches:
-              only:
-                - develop
-
-  publish_snapshot_with_playwright:
-    when: << pipeline.parameters.run_playwright >>
-    jobs:
-      - playwright_tests:
-          filters:
-            branches:
-              only:
-                - develop
-      - qqq-orb/mvn_frontend_publish:
-          pre-steps:
-            - configure-package-install
-          context: [qqq-maven-registry-credentials]
-          branch_type: snapshot
-          requires:
-            - playwright_tests
-          filters:
-            branches:
-              only:
-                - develop
-
-  publish_feature:
-    jobs:
-      - qqq-orb/mvn_frontend_publish:
-          pre-steps:
-            - configure-package-install
-          context: [qqq-maven-registry-credentials]
-          branch_type: feature
-          filters:
-            branches:
-              only:
-                - feature/.*
-            tags:
-              only: [/publish.*/]
-
-  publish_release_candidate:
-    jobs:
-      - qqq-orb/mvn_frontend_publish:
-          pre-steps:
-            - configure-package-install
-          context: [qqq-maven-registry-credentials]
-          branch_type: release_candidate
-          filters:
-            branches:
-              only:
-                - /release\/.*/
-
-  publish_release:
-    jobs:
-      - qqq-orb/mvn_frontend_publish:
-          pre-steps:
-            - configure-package-install
-          context: [qqq-maven-registry-credentials]
-          branch_type: release
-          filters:
-            branches:
-              ignore: /.*/
-            tags:
-              only: ['/^v[0-9]+\.[0-9]+\.[0-9]+$/']
-
-  publish_hotfix_release:
-    jobs:
-      - qqq-orb/mvn_frontend_publish:
-          pre-steps:
-            - configure-package-install
-          context: [qqq-maven-registry-credentials]
-          branch_type: hotfix
-          filters:
-            branches:
-              only:
-                - /hotfix\/.*/

.gitea/workflows/build.yaml

@@ -0,0 +1,12 @@
+name: build
+on:
+  push:
+jobs:
+  maven:
+    uses: self:KofTwentyTwo/ci-workflows/.gitea/workflows/maven.yaml@v1
+    secrets: inherit
+    with:
+      # Selenium ITs need the Chrome-capable image; the React build is packaged into the jar.
+      browsers: true
+      node-version: '22.20.0'
+      prebuild: bash scripts/ci-prebuild.sh

.github/workflows/codeql.yml

@@ -0,0 +1,23 @@
+name: CodeQL
+'on':
+  push:
+    branches:
+    - main
+    - develop
+    - release/**
+    - hotfix/**
+  pull_request: {}
+  schedule:
+  - cron: 41 16 * * 0
+  workflow_dispatch: {}
+permissions:
+  contents: read
+  actions: read
+  security-events: write
+  packages: read
+concurrency:
+  group: codeql-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+jobs:
+  analyze:
+    uses: QRun-IO/qqq-orb/.github/workflows/qbit-codeql.yml@c288a8864fe9054f68410e1d78f5863aea4c4d22

.gitleaksignore

@@ -0,0 +1,4 @@
+
+
+# Reviewed findings committed before the Gitea migration; exact historical fingerprints only.
+267580b44babf4935c152da8fa2320d6059105f3:src/qqq/components/processes/GoogleDriveFolderPicker.tsx:gcp-api-key:43

pom.xml

@@ -348,35 +348,6 @@
         </executions>
       </plugin>
 
-      <!-- GPG signing for Maven Central -->
-      <plugin>
-        <groupId>org.apache.maven.plugins</groupId>
-        <artifactId>maven-gpg-plugin</artifactId>
-        <version>3.1.0</version>
-        <executions>
-          <execution>
-            <id>sign-artifacts</id>
-            <phase>verify</phase>
-            <goals>
-              <goal>sign</goal>
-            </goals>
-          </execution>
-        </executions>
-      </plugin>
-
-      <!-- Sonatype Central publishing (replaces deploy to distributionManagement) -->
-      <plugin>
-        <groupId>org.sonatype.central</groupId>
-        <artifactId>central-publishing-maven-plugin</artifactId>
-        <version>0.8.0</version>
-        <extensions>true</extensions>
-        <configuration>
-          <!-- Server credentials with this ID must be provided in settings.xml -->
-          <publishingServerId>central</publishingServerId>
-          <autoPublish>true</autoPublish>
-        </configuration>
-      </plugin>
-
     </plugins>
   </build>
 

scripts/ci-prebuild.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+############################################################################
+## ci-prebuild.sh
+## CI prebuild for the shared ci-workflows maven.yaml (runs before Maven):
+## Jest unit tests, the React build that is packaged into the jar, and the
+## HTTPS dev server on :3001 that the Selenium ITs drive (as the old
+## qqq-orb frontend-material pipeline did). Maven then runs the ITs headless.
+############################################################################
+set -euo pipefail
+
+npm ci --legacy-peer-deps
+npm test -- --watchAll=false
+npm run build-and-publish
+
+HTTPS=true PORT=3001 REACT_APP_PROXY_LOCALHOST_PORT=8001 \
+   nohup setsid npm run start > /tmp/react-dev-server.log 2>&1 < /dev/null &
+
+for _ in $(seq 1 150); do
+   if curl -ksf -o /dev/null https://localhost:3001/; then
+      echo "React dev server is up on https://localhost:3001"
+      exit 0
+   fi
+   sleep 2
+done
+echo "React dev server did not come up on :3001"
+cat /tmp/react-dev-server.log
+exit 1

src/test/java/com/kingsrook/qqq/frontend/materialdashboard/selenium/lib/QBaseSeleniumTest.java

@@ -66,7 +66,7 @@ public class QBaseSeleniumTest
       chromeOptions.addArguments("--remote-allow-origins=*");
 
       String headless = System.getenv("QQQ_SELENIUM_HEADLESS");
-      if("true".equals(headless))
+      if("true".equals(headless) || "true".equals(System.getenv("CI")))
       {
          chromeOptions.addArguments("--headless=new");
       }

src/test/java/com/kingsrook/qqq/frontend/materialdashboard/selenium/lib/QSeleniumLib.java

@@ -193,9 +193,9 @@ public class QSeleniumLib
     *******************************************************************************/
    public void waitForever()
    {
-      if(System.getenv("CIRCLECI") != null)
+      if(System.getenv("CIRCLECI") != null || "true".equals(System.getenv("CI")))
       {
-         LOG.warn("A waitForever was found in CIRCLECI - so, we don't want to do that, so, returning immediately.");
+         LOG.warn("A waitForever was found in CI - so, we don't want to do that, so, returning immediately.");
          return;
       }
 

src/test/java/com/kingsrook/qqq/frontend/materialdashboard/seleniumwithqapplication/lib/QBaseSeleniumWithQApplicationTest.java

@@ -93,7 +93,7 @@ public class QBaseSeleniumWithQApplicationTest
       chromeOptions.addArguments("--remote-allow-origins=*");
 
       String headless = System.getenv("QQQ_SELENIUM_HEADLESS");
-      if("true".equals(headless))
+      if("true".equals(headless) || "true".equals(System.getenv("CI")))
       {
          chromeOptions.addArguments("--headless=new");
       }