Description

<dependency>
    <groupId>com.falkordb</groupId>
    <artifactId>jfalkordb</artifactId>
    <version>0.11.0</version>
</dependency>

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

	<modelVersion>4.0.0</modelVersion>

	<parent>
		<groupId>org.sonatype.oss</groupId>
		<artifactId>oss-parent</artifactId>
		<version>9</version>
	</parent>

	<groupId>com.falkordb</groupId>
	<artifactId>jfalkordb</artifactId>
	<version>0.11.0</version>
	<packaging>jar</packaging>

	<name>JFalkorDB</name>
	<description>Official client for FalkorDB</description>
	<url>https://www.falkordb.com</url>

	<organization>
		<name>FalkorDB</name>
		<url>https://www.falkordb.com</url>
	</organization>

	<ciManagement>
		<system>CircleCI</system>
		<url>https://circleci.com/gh/FalkorDB/JFalkorDB</url>
	</ciManagement>

	<issueManagement>
		<system>GitHub</system>
		<url>https://github.com/FalkorDB/JFalkorDB/issues</url>
	</issueManagement>

	<scm>
		<url>https://github.com/FalkorDB/JFalkorDB</url>
		<connection>scm:git:git://github.com/FalkorDB/JFalkorDB.git</connection>
		<developerConnection>scm:git:git@github.com:FalkorDB/JFalkorDB.git</developerConnection>
	</scm>

	<licenses>
		<license>
			<name>BSD 3-Clause</name>
			<url>https://opensource.org/licenses/BSD-3-Clause</url>
			<distribution>repo</distribution>
		</license>
	</licenses>

	<developers>
		<developer>
			<id>gkorland</id>
			<name>Guy Korland</name>
			<email>gkorland@gmail.com</email>
		</developer>
	</developers>
    <distributionManagement>
        <repository>
            <id>central</id>
            <url>https://central.sonatype.com/api/v1/publisher/upload/</url>
        </repository>
        <snapshotRepository>
            <id>central</id>
            <url>https://central.sonatype.com/repository/maven-snapshots/</url>
        </snapshotRepository>		
    </distributionManagement>

	<properties>
		<maven.compiler.release>8</maven.compiler.release>
		<!-- API-diff gate (japicmp, `-Pquality`). `api.diff.baseline` is the last PUBLISHED release the
		     public API is compared against — it must be bumped to the new version as part of releasing
		     (a later Wave-3 release PR automates this). `api.diff.fail` fails the build on public-API
		     breaks by default; a reviewed, intentional break is approved by overriding it to false (the
		     CI `api-diff` job sets -Dapi.diff.fail=false when the PR carries the `breaking-change`
		     label). -->
		<api.diff.baseline>0.10.1</api.diff.baseline>
		<api.diff.fail>true</api.diff.fail>
	</properties>

	<dependencies>
		<dependency>
			<groupId>org.jspecify</groupId>
			<artifactId>jspecify</artifactId>
			<version>1.0.1</version>
		</dependency>
		<dependency>
			<groupId>redis.clients</groupId>
			<artifactId>jedis</artifactId>
			<version>8.0.0</version>
		</dependency>
		<dependency>
			<groupId>org.slf4j</groupId>
			<artifactId>slf4j-simple</artifactId>
			<version>2.0.18</version>
			<scope>test</scope>
		</dependency>
		<dependency>
			<groupId>org.junit.jupiter</groupId>
			<artifactId>junit-jupiter</artifactId>
			<version>5.14.4</version>
			<scope>test</scope>
		</dependency>
		<dependency>
			<groupId>nl.jqno.equalsverifier</groupId>
			<artifactId>equalsverifier</artifactId>
			<version>3.19.4</version>
			<scope>test</scope>
		</dependency>
		<dependency>
			<groupId>net.jqwik</groupId>
			<artifactId>jqwik</artifactId>
			<version>1.10.1</version>
			<scope>test</scope>
		</dependency>
		<dependency>
			<groupId>org.testcontainers</groupId>
			<artifactId>testcontainers</artifactId>
			<version>2.0.5</version>
			<scope>test</scope>
		</dependency>
	</dependencies>

	<build>
		<plugins>
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-compiler-plugin</artifactId>
				<version>3.15.0</version>
				<configuration>
					<!-- Silence the spurious "unknown enum constant ElementType.MODULE" [classfile]
					     warning: JSpecify's @NullMarked @Target lists the Java-9 ElementType.MODULE,
					     which the release-8 symbol table can't resolve. It is harmless (the annotation
					     still applies); Java-8 compatibility is guaranteed by release 8 + Enforcer +
					     Animal Sniffer + the JDK-8 smoke, not by this lint category. -->
					<compilerArgs>
						<arg>-Xlint:-classfile</arg>
					</compilerArgs>
				</configuration>
			</plugin>

			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-surefire-plugin</artifactId>
				<version>3.5.6</version>
			</plugin>

			<!-- Integration tests (*IT, server-backed via Testcontainers) run in integration-test/verify.
			     @{argLine} makes Failsafe load the JaCoCo agent (append=true), so IT coverage is added
			     to the same jacoco.exec the unit tests write, and the report at `verify` covers both. -->
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-failsafe-plugin</artifactId>
				<version>3.5.6</version>
				<configuration>
					<argLine>@{argLine}</argLine>
				</configuration>
				<executions>
					<execution>
						<goals>
							<goal>integration-test</goal>
							<goal>verify</goal>
						</goals>
					</execution>
				</executions>
			</plugin>

			<plugin>
				<groupId>org.jacoco</groupId>
				<artifactId>jacoco-maven-plugin</artifactId>
				<version>0.8.15</version>
				<executions>
					<execution>
						<goals>
							<goal>prepare-agent</goal>
						</goals>
					</execution>
					<execution>
						<id>report</id>
						<phase>verify</phase>
						<goals>
							<goal>report</goal>
						</goals>
					</execution>
				</executions>
			</plugin>

			<!-- Java-8 guardrail #1: every SHIPPED (compile/runtime) dependency classfile is
			     <= Java-8 bytecode. Test scope is excluded (test tools may be newer now that the
			     build runs on JDK 21). strict=false (default) skips module-info / MRJAR versioned
			     entries, so this checks base classfiles. -->
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-enforcer-plugin</artifactId>
				<version>3.6.3</version>
				<dependencies>
					<dependency>
						<groupId>org.codehaus.mojo</groupId>
						<artifactId>extra-enforcer-rules</artifactId>
						<version>1.12.0</version>
					</dependency>
				</dependencies>
				<executions>
					<execution>
						<id>enforce-bytecode-8</id>
						<phase>validate</phase>
						<goals>
							<goal>enforce</goal>
						</goals>
						<configuration>
							<rules>
								<enforceBytecodeVersion>
									<maxJdkVersion>1.8</maxJdkVersion>
									<ignoredScopes>
										<ignoredScope>test</ignoredScope>
									</ignoredScopes>
								</enforceBytecodeVersion>
							</rules>
						</configuration>
					</execution>
				</executions>
			</plugin>

			<!-- Java-8 guardrail #2: our main code calls only the Java-8 API (a stronger check than
			     the compiler alone for API misuse it can't catch). Runs at verify. -->
			<plugin>
				<groupId>org.codehaus.mojo</groupId>
				<artifactId>animal-sniffer-maven-plugin</artifactId>
				<version>1.27</version>
				<configuration>
					<signature>
						<groupId>org.codehaus.mojo.signature</groupId>
						<artifactId>java18</artifactId>
						<version>1.0</version>
					</signature>
				</configuration>
				<executions>
					<execution>
						<id>check-java8-api</id>
						<phase>verify</phase>
						<goals>
							<goal>check</goal>
						</goals>
					</execution>
				</executions>
			</plugin>

			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-source-plugin</artifactId>
				<version>3.4.0</version>
				<executions>
					<execution>
						<id>attach-sources</id>
						<goals>
							<goal>jar-no-fork</goal>
						</goals>
					</execution>
				</executions>
			</plugin>

			<!-- Stable JPMS module name. MUST stay `jfalkordb`: that is the name Java already derives from
				     the jar FILENAME, so it is what existing modular consumers already write in
				     `requires jfalkordb;`. Pinning it here is what makes the name survive a rename or
				     shading; changing the VALUE would break module resolution for those consumers and is a
				     breaking change, not a patch. (Reverse-DNS `com.falkordb` would match the package, but
				     adopting it means a minor bump plus a `requires` migration note.) Manifest entry only,
				     not a module-info, so it is safe at release 8 and free at runtime. -->
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-jar-plugin</artifactId>
				<version>3.4.2</version>
				<configuration>
					<archive>
						<manifestEntries>
							<Automatic-Module-Name>jfalkordb</Automatic-Module-Name>
						</manifestEntries>
					</archive>
				</configuration>
			</plugin>

			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-javadoc-plugin</artifactId>
				<version>3.12.0</version>
				<configuration>
					<!-- Doc-generation only: pin javadoc to release 11 so JSpecify's @NullMarked
					     @Target (which lists the Java-9 ElementType.MODULE) resolves — under release 8
					     javadoc emits a spurious "unknown enum constant ElementType.MODULE" warning.
					     This does NOT affect the shipped artifact: the compiler still targets release 8
					     (Enforcer + Animal Sniffer + the JDK-8 smoke guarantee Java-8 compatibility). -->
					<release>11</release>
					<!-- Regression guard: any new Javadoc warning (missing main description, undocumented
					     default constructor, …) fails the build instead of scrolling past in the log. -->
					<failOnWarnings>true</failOnWarnings>
				</configuration>
				<executions>
					<execution>
						<id>attach-javadocs</id>
						<goals>
							<goal>jar</goal>
						</goals>
					</execution>
				</executions>
			</plugin>
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-gpg-plugin</artifactId>
				<version>3.2.8</version>
				<executions>
					<execution>
						<id>sign-artifacts</id>
						<phase>verify</phase>
						<goals>
							<goal>sign</goal>
						</goals>
					</execution>
				</executions>
			</plugin>
			<plugin>
				<groupId>org.sonatype.central</groupId>
				<artifactId>central-publishing-maven-plugin</artifactId>
				<version>0.11.0</version>
				<extensions>true</extensions>
				<configuration>
					<publishingServerId>central</publishingServerId>
					<autoPublish>true</autoPublish>
					<waitUntil>published</waitUntil>
				</configuration>
			</plugin>
		</plugins>
	</build>

	<profiles>
		<!-- Static-quality gates (Spotless / palantir-java-format). OFF by default and kept as a
		     separate explicit gate: activate with -Pquality (via `just fmt` / `just fmt-check`, and the
		     `format` CI job). Spotless has NO <executions> binding, so it runs only when its goal is
		     invoked explicitly (never during `verify`/`deploy`), keeping the aggregate build fast. -->
		<profile>
			<id>quality</id>
			<build>
				<plugins>
					<!-- Error Prone: compile-time bug patterns. Runs only in this profile (JDK 16+ needs
					     the compiler add-exports/add-opens flags and a forked compiler), so the default
					     release-8 build stays untouched. -->
					<plugin>
						<groupId>org.apache.maven.plugins</groupId>
						<artifactId>maven-compiler-plugin</artifactId>
						<configuration>
							<fork>true</fork>
							<compilerArgs>
								<arg>-XDcompilePolicy=simple</arg>
								<!-- Required by Error Prone on JDK 16+ (enforced since EP 2.4x). -->
								<arg>-XDaddTypeAnnotationsToSymbol=true</arg>
								<arg>--should-stop=ifError=FLOW</arg>
								<arg>-Xplugin:ErrorProne</arg>
								<arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED</arg>
								<arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED</arg>
								<arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.main=ALL-UNNAMED</arg>
								<arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.model=ALL-UNNAMED</arg>
								<arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED</arg>
								<arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.processing=ALL-UNNAMED</arg>
								<arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED</arg>
								<arg>-J--add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED</arg>
								<arg>-J--add-opens=jdk.compiler/com.sun.tools.javac.code=ALL-UNNAMED</arg>
								<arg>-J--add-opens=jdk.compiler/com.sun.tools.javac.comp=ALL-UNNAMED</arg>
							</compilerArgs>
							<annotationProcessorPaths>
								<path>
									<groupId>com.google.errorprone</groupId>
									<artifactId>error_prone_core</artifactId>
									<version>2.50.0</version>
								</path>
							</annotationProcessorPaths>
						</configuration>
					</plugin>
					<plugin>
						<groupId>com.diffplug.spotless</groupId>
						<artifactId>spotless-maven-plugin</artifactId>
						<version>3.9.0</version>
						<configuration>
							<java>
								<palantirJavaFormat>
									<version>2.80.0</version>
								</palantirJavaFormat>
								<removeUnusedImports/>
								<importOrder/>
							</java>
						</configuration>
					</plugin>
					<!-- SpotBugs + FindSecBugs: bytecode bug & security analysis of the shipped classes.
					     Runs on the JDK-21 build; never part of the default lifecycle (Java-8 guarantee). -->
					<plugin>
						<groupId>com.github.spotbugs</groupId>
						<artifactId>spotbugs-maven-plugin</artifactId>
						<version>4.10.3.0</version>
						<configuration>
							<effort>Max</effort>
							<threshold>Medium</threshold>
							<includeTests>false</includeTests>
							<excludeFilterFile>spotbugs-exclude.xml</excludeFilterFile>
							<plugins>
								<plugin>
									<groupId>com.h3xstream.findsecbugs</groupId>
									<artifactId>findsecbugs-plugin</artifactId>
									<version>1.14.0</version>
								</plugin>
							</plugins>
						</configuration>
						<executions>
							<execution>
								<id>spotbugs-check</id>
								<phase>verify</phase>
								<goals>
									<goal>check</goal>
								</goals>
							</execution>
						</executions>
					</plugin>
					<!-- OWASP dependency-check: known-CVE scan of the shipped dependency graph. Slow and
					     needs an NVD API key, so it is NOT bound to a phase — it is invoked on demand via
					     `just audit` (the dedicated scheduled/manual `audit` workflow), never in `verify`. -->
					<plugin>
						<groupId>org.owasp</groupId>
						<artifactId>dependency-check-maven</artifactId>
						<version>13.0.0</version>
						<configuration>
							<failBuildOnCVSS>7</failBuildOnCVSS>
							<skipProvidedScope>true</skipProvidedScope>
							<skipTestScope>true</skipTestScope>
							<nvdApiKeyEnvironmentVariable>NVD_API_KEY</nvdApiKeyEnvironmentVariable>
							<suppressionFiles>
								<suppressionFile>owasp-suppressions.xml</suppressionFile>
							</suppressionFiles>
						</configuration>
					</plugin>
					<!-- japicmp: public-API compatibility diff of the freshly built jar against the last
					     release on Maven Central (`api.diff.baseline`). Unbound (like OWASP above) —
					     invoked on demand via `just api-diff` (the dedicated `api-diff` workflow), never
					     in `verify`/`deploy`. Fails on binary- OR source-incompatible changes to the
					     PUBLIC/PROTECTED API only (`com.falkordb.impl` and its subpackages are internal
					     and excluded; `accessModifier=protected` also guards the protected subclassing
					     surface of the public value classes). A reviewed, intentional break is approved
					     by overriding -Dapi.diff.fail=false. Fails loudly when the baseline can't be
					     resolved (ignoreMissingOldVersion=false). -->
					<plugin>
						<groupId>com.github.siom79.japicmp</groupId>
						<artifactId>japicmp-maven-plugin</artifactId>
						<version>0.26.1</version>
						<configuration>
							<oldVersion>
								<dependency>
									<groupId>com.falkordb</groupId>
									<artifactId>jfalkordb</artifactId>
									<version>${api.diff.baseline}</version>
									<type>jar</type>
								</dependency>
							</oldVersion>
							<newVersion>
								<file>
									<path>${project.build.directory}/${project.build.finalName}.jar</path>
								</file>
							</newVersion>
							<parameter>
								<onlyModified>true</onlyModified>
								<accessModifier>protected</accessModifier>
								<breakBuildOnBinaryIncompatibleModifications>${api.diff.fail}</breakBuildOnBinaryIncompatibleModifications>
								<breakBuildOnSourceIncompatibleModifications>${api.diff.fail}</breakBuildOnSourceIncompatibleModifications>
								<ignoreMissingOldVersion>false</ignoreMissingOldVersion>
								<ignoreMissingNewVersion>false</ignoreMissingNewVersion>
								<excludes>
									<exclude>com.falkordb.impl</exclude>
								</excludes>
								<skipXmlReport>true</skipXmlReport>
							</parameter>
						</configuration>
					</plugin>
					<!-- PITest mutation testing: OBSERVABILITY ONLY — never bound to a phase or a gate.
					     Invoked on demand via `just mutation` (the scheduled/manual `mutation` workflow).
					     Scoped to the pure-unit packages whose fast unit tests can actually kill mutants;
					     `*IT` (server-backed) and the expensive jqwik property test are excluded so PIT
					     doesn't discover + re-run them per mutation. -->
					<plugin>
						<groupId>org.pitest</groupId>
						<artifactId>pitest-maven</artifactId>
						<version>1.25.9</version>
						<dependencies>
							<dependency>
								<groupId>org.pitest</groupId>
								<artifactId>pitest-junit5-plugin</artifactId>
								<version>1.2.3</version>
							</dependency>
						</dependencies>
						<configuration>
							<targetClasses>
								<param>com.falkordb.graph_entities.*</param>
								<param>com.falkordb.impl.Utils*</param>
							</targetClasses>
							<targetTests>
								<param>com.falkordb.graph_entities.*Test</param>
								<param>com.falkordb.impl.UtilsTest</param>
							</targetTests>
							<excludedTestClasses>
								<param>com.falkordb.impl.UtilsParamPropertyTest</param>
							</excludedTestClasses>
							<outputFormats>
								<param>HTML</param>
								<param>XML</param>
							</outputFormats>
							<timestampedReports>false</timestampedReports>
							<failWhenNoMutations>false</failWhenNoMutations>
						</configuration>
					</plugin>
					<!-- Javadoc gate: strict doclint on the PUBLIC/protected API (`com.falkordb.impl` is
					     internal and excluded, matching the `api-diff` boundary). `failOnWarnings` turns
					     any doclint gap into a failure. Off-lifecycle — invoked via `just javadoc`. -->
					<plugin>
						<groupId>org.apache.maven.plugins</groupId>
						<artifactId>maven-javadoc-plugin</artifactId>
						<version>3.12.0</version>
						<configuration>
							<!-- Doc-generation only: pin javadoc to release 11 so JSpecify's @NullMarked
							     @Target (which lists the Java-9 ElementType.MODULE) resolves — under
							     release 8 javadoc emits a spurious "unknown enum constant ElementType.MODULE"
							     warning that failOnWarnings turns fatal. This does NOT affect the shipped
							     artifact: the compiler still targets release 8 (Enforcer + Animal Sniffer +
							     the JDK-8 smoke guarantee Java-8 compatibility). -->
							<release>11</release>
							<show>protected</show>
							<doclint>all</doclint>
							<failOnWarnings>true</failOnWarnings>
							<excludePackageNames>com.falkordb.impl:com.falkordb.impl.*</excludePackageNames>
							<notimestamp>true</notimestamp>
						</configuration>
					</plugin>
				</plugins>
			</build>
		</profile>
	</profiles>
</project>