QRun-IO/qqq-orb
Archived
2
0 Fork 0
Code Issues 6 Actions Packages Projects Releases 17 Wiki Activity

Release orb without Maven settings leak for QQQ 4.1 #12

New Issue
Open
opened 2026-09-26 17:09:56 +00:00 by KofTwentyTwo · 2 comments
KofTwentyTwo commented 2026-09-26 17:09:56 +00:00 (Migrated from github.com)
Copy link
Copy source

QQQ 4.1's release workflow currently pins qqq-orb@0.6.0. The orb's mvn_jar_deploy.sh prints /tmp/circleci/mvn-settings.xml before deploying, and the line remains in v0.6.5. That settings file can contain Central credentials. Remove the print and add a regression check that fails if the deploy script emits settings content. Do not echo credentials in tests or logs.

The 0.6.0 release-candidate job also calls publish_github_release even though it does not create the required RC tag; 0.6.5 already removes that RC step. QQQ needs a published successor containing both the RC fix and the settings fix before the 4.1 release branch is cut.

Acceptance:

  • No Maven settings content or credential value is written to CI logs by the deploy script.
  • Preserve signed Maven deployment and its existing error behavior; verify lint/pack/shellcheck and a focused regression test.
  • Release a new stable orb version after review and CI, then update QQQ's pinned orb and dry-run the 4.1 RC/tag version paths before publication.
QQQ 4.1's release workflow currently pins `qqq-orb@0.6.0`. The orb's `mvn_jar_deploy.sh` prints `/tmp/circleci/mvn-settings.xml` before deploying, and the line remains in `v0.6.5`. That settings file can contain Central credentials. Remove the print and add a regression check that fails if the deploy script emits settings content. Do not echo credentials in tests or logs. The 0.6.0 release-candidate job also calls `publish_github_release` even though it does not create the required RC tag; 0.6.5 already removes that RC step. QQQ needs a published successor containing both the RC fix and the settings fix before the 4.1 release branch is cut. Acceptance: - No Maven settings content or credential value is written to CI logs by the deploy script. - Preserve signed Maven deployment and its existing error behavior; verify lint/pack/shellcheck and a focused regression test. - Release a new stable orb version after review and CI, then update QQQ's pinned orb and dry-run the 4.1 RC/tag version paths before publication.
KofTwentyTwo commented 2026-09-29 18:44:53 +00:00 (Migrated from github.com)
Copy link
Copy source

Delivered through reviewed orb PR13 and release PR14. Public immutable kingsrook/qqq-orb@0.6.6 was published by job1126 from signature-verified main commit49e09a677646c16cae254e76f0a9832439861c98. Tagv0.6.6 targets that commit (the existing publisher creates an unsigned annotated tag; no claim of a signed orb tag).

Fetched the public registry source independently. All commands/jobs/executors match the reviewed local pack; the only serialization difference is the example's YAML version2.1 represented as a string. Public SHA256:3d321bc502bc20a81fd01548b72184abf40d3354faa0ce8cc29fb9072b475db5.

The regression runs in CI command-test, captures stdout/stderr, and the four synthetic leak controls fail as intended without credentials. Exact-head development and release CI passed. QQQ's consumer pin and RC/tag calculator dry-run remain under orb#12/#798; this CI-regression requirement is complete.

Delivered through reviewed orb PR13 and release PR14. Public immutable kingsrook/qqq-orb@0.6.6 was published by job1126 from signature-verified main commit49e09a677646c16cae254e76f0a9832439861c98. Tagv0.6.6 targets that commit (the existing publisher creates an unsigned annotated tag; no claim of a signed orb tag). Fetched the public registry source independently. All commands/jobs/executors match the reviewed local pack; the only serialization difference is the example's YAML version2.1 represented as a string. Public SHA256:3d321bc502bc20a81fd01548b72184abf40d3354faa0ce8cc29fb9072b475db5. The regression runs in CI command-test, captures stdout/stderr, and the four synthetic leak controls fail as intended without credentials. Exact-head development and release CI passed. QQQ's consumer pin and RC/tag calculator dry-run remain under orb#12/#798; this CI-regression requirement is complete.
KofTwentyTwo commented 2026-09-29 21:30:28 +00:00 (Migrated from github.com)
Copy link
Copy source

The QQQ consumer update is now in reviewed PR QRun-IO/qqq#917 at signed223a7f965: exact public orb0.6.8, validated CircleCI config, and successful dry-runs for the actual release/4.1 source (4.1.0-SNAPSHOT -> 4.1.0-RC.1) plus an owned disposable v4.1.0 tag fixture (->4.1.0). No product tag or POM was changed by those probes. Prior public-orb/runtime and secret-log regression evidence remains valid. QQQ combined CI4472–4476 is running; keep this ticket open until the consumer pin is integrated.

The QQQ consumer update is now in reviewed PR QRun-IO/qqq#917 at signed223a7f965: exact public orb0.6.8, validated CircleCI config, and successful dry-runs for the actual release/4.1 source (4.1.0-SNAPSHOT -> 4.1.0-RC.1) plus an owned disposable v4.1.0 tag fixture (->4.1.0). No product tag or POM was changed by those probes. Prior public-orb/runtime and secret-log regression evidence remains valid. QQQ combined CI4472–4476 is running; keep this ticket open until the consumer pin is integrated.
This repo is archived. You cannot comment on issues.
No Branch/Tag Specified
Labels
Clear labels
bug
Something isn't working
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 question
Further information is requested
 wontfix
This will not be worked on
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: QRun-IO/qqq-orb#12