Description

<dependency>
    <groupId>ch.exense.step</groupId>
    <artifactId>step-api</artifactId>
    <version>1.6.0</version>
</dependency>

<?xml version="1.0" encoding="UTF-8"?>
<!-- Copyright (c) exense GmbH -->
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>ch.exense.step</groupId>
  <artifactId>step-api</artifactId>
  <version>1.6.0</version>
  <packaging>pom</packaging>

  <!-- required metadata for maven central -->
  <name>${project.groupId}:${project.artifactId}</name>
  <description>Step API</description>
  <url>https://github.com/exense/step-api</url>

  <licenses>
    <license>
      <name>The GNU Affero General Public License, Version 3</name>
      <url>https://www.gnu.org/licenses/#AGPL</url>
    </license>
  </licenses>

  <developers>
    <developer>
      <name>Exense GmbH</name>
      <organization>Exense GmbH</organization>
      <organizationUrl>https://exense.ch</organizationUrl>
      <email>support@exense.ch</email>
    </developer>
  </developers>

  <scm>
    <connection>scm:git:https://github.com/exense/step-api.git</connection>
    <developerConnection>scm:git:https://github.com/exense/step-api.git</developerConnection>
    <url>https://github.com/exense/step-api</url>
  </scm>
  <!-- metadata end -->

  <properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <maven.compiler.release>21</maven.compiler.release>

    <!-- exense dependencies -->
    <dependencies.version>2026.6.03</dependencies.version>
    <step-streaming.version>2.0.0</step-streaming.version>
  </properties>

  <repositories>
    <!-- staging nexus -->
    <repository>
      <id>nexus-staging</id>
      <url>https://nexus-enterprise.exense.ch/repository/staging-maven/</url>
    </repository>
    <!-- private nexus -->
    <repository>
      <id>nexus-exense</id>
      <url>https://nexus-enterprise.exense.ch/repository/exense/</url>
    </repository>
  </repositories>

  <!-- Reminder: don't forget to add all modules to the end of the dependencyManagement section just below -->
  <modules>
    <module>step-api-function</module>
    <module>step-api-keyword</module>
    <module>step-api-reporting</module>
    <module>step-api-json-schema</module>
  </modules>

  <!-- available dependencies, can be used in dependent projects WITHOUT specifying a version number -->
  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>ch.exense.dependencies</groupId>
        <artifactId>dependencies-junit</artifactId>
        <version>${dependencies.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
      <dependency>
        <groupId>ch.exense.dependencies</groupId>
        <artifactId>dependencies-logging</artifactId>
        <version>${dependencies.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
      <dependency>
        <groupId>ch.exense.dependencies</groupId>
        <artifactId>dependencies-jackson</artifactId>
        <version>${dependencies.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
      <dependency>
        <groupId>ch.exense.streaming</groupId>
        <artifactId>step-streaming</artifactId>
        <version>${step-streaming.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>

      <!-- BOM of *this* project, exporting our OWN modules -->
      <dependency>
        <groupId>ch.exense.step</groupId>
        <artifactId>step-api-function</artifactId>
        <version>${project.version}</version>
      </dependency>
      <dependency>
        <groupId>ch.exense.step</groupId>
        <artifactId>step-api-keyword</artifactId>
        <version>${project.version}</version>
      </dependency>
      <dependency>
        <groupId>ch.exense.step</groupId>
        <artifactId>step-api-reporting</artifactId>
        <version>${project.version}</version>
      </dependency>
      <dependency>
        <groupId>ch.exense.step</groupId>
        <artifactId>step-api-json-schema</artifactId>
        <version>${project.version}</version>
      </dependency>
    </dependencies>
  </dependencyManagement>

  <!-- actually used dependencies, exported to all modules (but not externally referring projects) -->
  <dependencies>
    <dependency>
      <groupId>org.slf4j</groupId>
      <artifactId>slf4j-api</artifactId>
    </dependency>
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>ch.qos.logback</groupId>
      <artifactId>logback-classic</artifactId>
      <scope>test</scope>
    </dependency>
  </dependencies>

  <build>
    <pluginManagement>
      <plugins>
        <plugin>
          <groupId>org.sonatype.central</groupId>
          <artifactId>central-publishing-maven-plugin</artifactId>
          <version>0.8.0</version>
        </plugin>
        <plugin>
          <groupId>org.owasp</groupId>
          <artifactId>dependency-check-maven</artifactId>
          <version>12.1.0</version>
        </plugin>
        <plugin>
          <groupId>org.jacoco</groupId>
          <artifactId>jacoco-maven-plugin</artifactId>
          <version>0.8.12</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-compiler-plugin</artifactId>
          <version>3.14.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-deploy-plugin</artifactId>
          <version>3.1.3</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-enforcer-plugin</artifactId>
          <version>3.5.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-gpg-plugin</artifactId>
          <version>3.2.7</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-javadoc-plugin</artifactId>
          <version>3.11.2</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-shade-plugin</artifactId>
          <version>3.6.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-source-plugin</artifactId>
          <version>3.3.1</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-surefire-plugin</artifactId>
          <version>3.5.2</version>
        </plugin>
      </plugins>
    </pluginManagement>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-surefire-plugin</artifactId>
      </plugin>
      <!-- Source -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-source-plugin</artifactId>
        <executions>
          <execution>
            <id>attach-sources</id>
            <goals>
              <goal>jar-no-fork</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
      <!-- Javadoc -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-javadoc-plugin</artifactId>
        <configuration>
          <header><![CDATA[<meta name='viewport' content='width=device-width, initial-scale=1.0'>]]></header>
          <!-- detectLinks MUST NOT be set to true in a production context, as it derives random domain names
                    from package names, then tries to download data from those random URLs. -->
          <detectLinks>false</detectLinks>

          <!-- detectOfflineLinks SHOULD also be set to false, because:  -->
          <!-- a) it cannot generate meaningful links to the javadoc from other projects, anyway -->
          <!-- b) it causes unnecessarily scary ERROR messages at build time  -->
          <detectOfflineLinks>false</detectOfflineLinks>

          <quiet>true</quiet>
          <release>21</release>
          <additionalOptions>
            <additionalOption>-Xdoclint:none</additionalOption>
          </additionalOptions>
        </configuration>
        <executions>
          <execution>
            <id>attach-javadocs</id>
            <goals>
              <goal>jar</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
      <!-- Coverage -->
      <plugin>
        <groupId>org.jacoco</groupId>
        <artifactId>jacoco-maven-plugin</artifactId>
        <executions>
          <execution>
            <id>default-prepare-agent</id>
            <goals>
              <goal>prepare-agent</goal>
            </goals>
          </execution>
          <execution>
            <id>default-report</id>
            <goals>
              <goal>report</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-enforcer-plugin</artifactId>
        <executions>
          <execution>
            <id>enforce-policies</id>
            <goals>
              <goal>enforce</goal>
            </goals>
            <configuration>
              <rules>
                <requireUpperBoundDeps/>
              </rules>
              <fail>true</fail>
            </configuration>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>

  <profiles>
    <profile>
      <id>SignedBuild</id>
      <activation>
        <activeByDefault>false</activeByDefault>
      </activation>
      <build>
        <plugins>
          <!-- Signature -->
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-gpg-plugin</artifactId>
            <executions>
              <execution>
                <id>sign-artifacts</id>
                <phase>verify</phase>
                <goals>
                  <goal>sign</goal>
                </goals>
                <configuration>
                  <gpgArguments>
                    <arg>--pinentry-mode</arg>
                    <arg>loopback</arg>
                  </gpgArguments>
                </configuration>
              </execution>
            </executions>
          </plugin>

          <!-- Disable old maven-deploy plugin -->
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-deploy-plugin</artifactId>
            <configuration>
              <skip>true</skip>
            </configuration>
          </plugin>

          <!-- Publish directly to central instead -->
          <plugin>
            <groupId>org.sonatype.central</groupId>
            <artifactId>central-publishing-maven-plugin</artifactId>
            <extensions>true</extensions>
            <configuration>
              <publishingServerId>sonatype</publishingServerId>
            </configuration>
          </plugin>
        </plugins>
      </build>
    </profile>
    <profile>
      <id>DependencyCheck</id>
      <activation>
        <activeByDefault>false</activeByDefault>
      </activation>
      <!-- Profile use for checking security issues in external dependencies. -->
      <!-- This may take a LOOONG time (possibly multiple minutes), even when using an API key -->
      <!-- To quickly check the results, run this (in the project directory):
                 find . -name dependency-check-report.csv | xargs wc -l
             -->
      <!-- Anything that returns more than 1 line (the CSV header line) is potentially vulnerable. -->
      <build>
        <plugins>
          <plugin>
            <groupId>org.owasp</groupId>
            <artifactId>dependency-check-maven</artifactId>
            <configuration>
              <formats>HTML,CSV</formats>
              <skipDependencyManagement>false</skipDependencyManagement>
              <!--                            <nvdApiKey>KEY_HERE</nvdApiKey>-->
              <failOnError>false</failOnError>
            </configuration>
            <executions>
              <execution>
                <phase>
                  verify
                </phase>
                <goals>
                  <goal>check</goal>
                </goals>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>
  </profiles>
</project>