spotbugs-maven-plugin

pkg:maven/com.github.spotbugs/spotbugs-maven-plugin@4.9.3.0

Used in: 0 components

Overview
Overview

Versions
Versions

Dependents
Dependents

Dependencies
Dependencies

Overview

Description

This Plug-In generates reports based on the SpotBugs Library

Snippets

<dependency>
    <groupId>com.github.spotbugs</groupId>
    <artifactId>spotbugs-maven-plugin</artifactId>
    <version>4.9.3.0</version>
</dependency>

Maven POM File

<?xml version="1.0" encoding="UTF-8"?>
<!--

    Copyright 2005-2025 the original author or authors.

    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
    You may obtain a copy of the License at

        https://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.

-->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>

    <parent>
        <groupId>com.github.hazendaz</groupId>
        <artifactId>base-parent</artifactId>
        <version>51</version>
        <relativePath />
    </parent>

    <groupId>com.github.spotbugs</groupId>
    <artifactId>spotbugs-maven-plugin</artifactId>
    <version>4.9.3.0</version>
    <packaging>maven-plugin</packaging>

    <name>spotbugs-maven-plugin</name>
    <description>This Plug-In generates reports based on the SpotBugs Library</description>
    <url>https://spotbugs.github.io/spotbugs-maven-plugin/</url>
    <inceptionYear>2005</inceptionYear>
    <organization>
        <name>Spotbugs</name>
        <url>https://spotbugs.github.io/</url>
    </organization>
    <licenses>
        <license>
            <name>Apache 2.0</name>
            <url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
            <distribution>repo</distribution>
        </license>
    </licenses>
    <developers>
        <developer>
            <id>jlandis</id>
            <name>Jeremy Landis</name>
            <email>jeremylandis@hotmail.com</email>
            <url>https://www.linkedin.com/in/jeremy-landis-548b2719</url>
            <organization>hazendaz</organization>
            <organizationUrl>https://github.com/hazendaz</organizationUrl>
            <roles>
                <role>Architect</role>
                <role>Developer</role>
            </roles>
            <timezone>-5</timezone>
            <properties>
                <picUrl>https://avatars0.githubusercontent.com/u/975267</picUrl>
            </properties>
        </developer>
        <developer>
            <id>cr</id>
            <name>Cyrill Ruettimann</name>
            <email>mypublicaddress@mac.com</email>
            <roles>
                <role>Documentation</role>
                <role>Java Developer</role>
            </roles>
            <timezone>+1</timezone>
        </developer>
        <developer>
            <id>gl</id>
            <name>Garvin LeClaire</name>
            <email>gleclaire@codehaus.org</email>
            <url>https://gdleclaire.blogspot.com</url>
            <roles>
                <role>Documentation</role>
                <role>Java Developer</role>
            </roles>
            <timezone>-5</timezone>
        </developer>
    </developers>
    <contributors>
        <contributor>
            <name>Jeremy Landis</name>
            <email>jeremylandis@hotmail.com</email>
            <url>https://www.linkedin.com/in/jeremy-landis-548b2719</url>
            <organization>hazendaz</organization>
            <organizationUrl>https://github.com/hazendaz</organizationUrl>
            <roles>
                <role>Developer</role>
            </roles>
            <timezone>-5</timezone>
            <properties>
                <picUrl>https://avatars0.githubusercontent.com/u/975267</picUrl>
            </properties>
        </contributor>
        <contributor>
            <name>Olivier Lamy</name>
            <email>olamy@apache.org</email>
            <organization />
            <organizationUrl>https://olamy.blogspot.com/</organizationUrl>
            <roles>
                <role>Java Developer</role>
            </roles>
            <timezone>+1</timezone>
        </contributor>
        <contributor>
            <name>Detlef Pleiss</name>
            <email>d.pleiss@comundus.com</email>
            <organization>comundus GmbH</organization>
            <organizationUrl>https://www.comundus.com</organizationUrl>
            <roles>
                <role>Java Developer</role>
            </roles>
            <timezone>+1</timezone>
        </contributor>
        <contributor>
            <name>Rolf Kulemann</name>
            <email>roku@apache.org</email>
            <url>https://www.xing.com/profile/Rolf_Kulemann</url>
            <organization>NEO Business Partners</organization>
            <organizationUrl>https://www.axians.de/de/portfolio/sap-solutions-technology/</organizationUrl>
            <roles>
                <role>Java Developer</role>
            </roles>
            <timezone>+1</timezone>
        </contributor>
    </contributors>

    <prerequisites>
        <maven>3.6.3</maven>
    </prerequisites>

    <scm>
        <connection>scm:git:ssh://git@github.com/spotbugs/spotbugs-maven-plugin.git</connection>
        <developerConnection>scm:git:ssh://git@github.com/spotbugs/spotbugs-maven-plugin.git</developerConnection>
        <tag>spotbugs-maven-plugin-4.9.3.0</tag>
        <url>https://github.com/spotbugs/spotbugs-maven-plugin</url>
    </scm>
    <issueManagement>
        <system>Github</system>
        <url>https://github.com/spotbugs/spotbugs-maven-plugin/issues</url>
    </issueManagement>
    <ciManagement>
        <system>Github</system>
        <url>https://github.com/spotbugs/spotbugs-maven-plugin/actions</url>
    </ciManagement>
    <distributionManagement>
        <site>
            <id>gh-pages-scm</id>
            <url>scm:git:ssh://git@github.com/spotbugs/spotbugs-maven-plugin.git</url>
        </site>
    </distributionManagement>

    <properties>
        <!-- Align java runtime with spotbugs -->
        <java.version>11</java.version>
        <java.release.version>11</java.release.version>
        <javadoc.java.release.version>11</javadoc.java.release.version>

        <sourceDirectory>${project.basedir}/src/main/groovy</sourceDirectory>

        <!-- Reproducible Builds: override timestamp value from parent -->
        <project.build.outputTimestamp>1742066540</project.build.outputTimestamp>

        <!-- Override spotbugs to this version from base-parent -->
        <spotbugs.version>4.9.3</spotbugs.version>

        <junitVersion>5.12.1</junitVersion>
        <slf4jVersion>2.0.17</slf4jVersion>

        <antVersion>1.10.15</antVersion>
        <groovyVersion>4.0.26</groovyVersion>
        <javaparserVersion>3.26.3</javaparserVersion>

        <doxiaVersion>2.0.0</doxiaVersion>
        <doxiaSiteToolsVersion>2.0.0</doxiaSiteToolsVersion>

        <mavenSharedUtilsVersion>3.4.2</mavenSharedUtilsVersion>
        <mavenReportingApiVersion>4.0.0</mavenReportingApiVersion>
        <mavenReportingVersion>4.0.0</mavenReportingVersion>
        <mavenVersion>3.9.9</mavenVersion>

        <resolver.version>1.9.22</resolver.version>

        <plexusComponentAnnotationsVersion>2.2.0</plexusComponentAnnotationsVersion>
        <plexusResourcesVersion>1.3.0</plexusResourcesVersion>
        <plexusUtilsVersion>4.0.2</plexusUtilsVersion>
        <plexusVelocityVersion>2.2.0</plexusVelocityVersion>
        <plexusXmlVersion>3.0.1</plexusXmlVersion>

        <!-- TODO: Run latest dependency check as prior is throwing errors. Remove after next parent update. -->
        <dependency-check.plugin>12.1.0</dependency-check.plugin>

        <pluginPluginVersion>3.15.1</pluginPluginVersion>
        <l10nPluginVersion>1.1.0</l10nPluginVersion>
        <codenarcPluginVersion>0.22-1</codenarcPluginVersion>
        <gmavenPluginVersion>4.1.1</gmavenPluginVersion>
        <invokerPluginVersion>3.9.0</invokerPluginVersion>
        <scmPluginVersion>2.1.0</scmPluginVersion>

        <spotbugsTestDebug>false</spotbugsTestDebug>
        <integrationTestSrc>${project.build.directory}/it-src-spotbugs</integrationTestSrc>
        <localTestSrc>${user.dir}/SpotBugs</localTestSrc>
        <remoteTestSrc>scm:git:https://github.com/spotbugs/spotbugs/</remoteTestSrc>
        <includesTestSrcPattern>**spotbugsTestCases/src/java/A*.java, **spotbugsTestCases/src/java/Use*.java, **spotbugsTestCases/src/java/annotations/*.java</includesTestSrcPattern>
        <testSrc>remote</testSrc>

        <pmd.skip>true</pmd.skip>
        <cpd.skip>true</cpd.skip>
        <checkstyle.skip>true</checkstyle.skip>
        <skipSurefireReport>true</skipSurefireReport>

        <!-- Used by Integration tests -->
        <findsecbugs.version>1.13.0</findsecbugs.version>
        <servletApiVersion>6.0.0</servletApiVersion>
        <sb-contrib.version>7.6.9</sb-contrib.version>

        <jgit.version>7.1.0.202411261347-r</jgit.version>

        <!-- Targeted patches -->
        <asm.version>9.7.1</asm.version>
        <bcel.version>6.10.0</bcel.version>
        <beanutils.version>1.10.1</beanutils.version>
        <codec.version>1.18.0</codec.version>
        <codenarc.version>3.6.0-groovy-4.0</codenarc.version>
        <collections.version>3.2.2</collections.version>
        <gson.version>2.12.1</gson.version>
        <inject.version>1</inject.version>
        <io.version>2.18.0</io.version>
        <jaxen.version>2.0.0</jaxen.version>
        <lang3.version>3.17.0</lang3.version>
        <logging.version>1.3.5</logging.version>
        <saxon.he.version>12.5</saxon.he.version>

        <!-- Automatic Module Name -->
        <module.name>com.github.spotbugs.maven</module.name>
    </properties>

    <dependencyManagement>
        <dependencies>
            <!-- Ensure we use latest version regardless of spotbugs version -->
            <dependency>
                <groupId>org.ow2.asm</groupId>
                <artifactId>asm-bom</artifactId>
                <version>${asm.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

            <!-- Ensure we use latest version regardless of spotbugs version -->
            <dependency>
                <groupId>org.apache.groovy</groupId>
                <artifactId>groovy-bom</artifactId>
                <version>${groovyVersion}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

            <!-- Ensure we use latest version regardless of spotbugs version -->
            <dependency>
                <groupId>org.slf4j</groupId>
                <artifactId>slf4j-bom</artifactId>
                <version>${slf4jVersion}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>

            <!-- Ensure we use latest version regardless of spotbugs version -->
            <dependency>
                <groupId>org.apache.bcel</groupId>
                <artifactId>bcel</artifactId>
                <version>${bcel.version}</version>
            </dependency>

            <!-- Ensure we use latest version regardless of spotbugs version -->
            <dependency>
                <groupId>com.google.code.gson</groupId>
                <artifactId>gson</artifactId>
                <version>${gson.version}</version>
            </dependency>

            <!-- Ensure we use latest version regardless of spotbugs version -->
            <dependency>
                <groupId>jaxen</groupId>
                <artifactId>jaxen</artifactId>
                <version>${jaxen.version}</version>
            </dependency>

            <!-- Ensure we use latest version regardless of spotbugs version -->
            <dependency>
                <groupId>net.sf.saxon</groupId>
                <artifactId>Saxon-HE</artifactId>
                <version>${saxon.he.version}</version>
            </dependency>

            <!-- Override 'ant' used in groovy to latest -->
            <dependency>
                <groupId>org.apache.ant</groupId>
                <artifactId>ant</artifactId>
                <version>${antVersion}</version>
            </dependency>

            <!-- Commons -->
            <dependency>
                <groupId>commons-beanutils</groupId>
                <artifactId>commons-beanutils</artifactId>
                <version>${beanutils.version}</version>
            </dependency>
            <dependency>
                <groupId>commons-codec</groupId>
                <artifactId>commons-codec</artifactId>
                <version>${codec.version}</version>
            </dependency>
            <dependency>
                <groupId>commons-collections</groupId>
                <artifactId>commons-collections</artifactId>
                <version>${collections.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-lang3</artifactId>
                <version>${lang3.version}</version>
            </dependency>
            <dependency>
                <groupId>commons-logging</groupId>
                <artifactId>commons-logging</artifactId>
                <version>${logging.version}</version>
            </dependency>

            <!-- Force control of reporting api -->
            <dependency>
                <groupId>org.apache.maven.reporting</groupId>
                <artifactId>maven-reporting-api</artifactId>
                <version>${mavenReportingApiVersion}</version>
            </dependency>

            <!-- Ensure latest maven shared utils shows up -->
            <dependency>
                <groupId>org.apache.maven.shared</groupId>
                <artifactId>maven-shared-utils</artifactId>
                <version>${mavenSharedUtilsVersion}</version>
            </dependency>

            <!-- Use latest plexus component annotations -->
            <dependency>
                <groupId>org.codehaus.plexus</groupId>
                <artifactId>plexus-component-annotations</artifactId>
                <version>${plexusComponentAnnotationsVersion}</version>
            </dependency>

            <!-- Use latest plexus velocity for doxia 2 -->
            <dependency>
                <groupId>org.codehaus.plexus</groupId>
                <artifactId>plexus-velocity</artifactId>
                <version>${plexusVelocityVersion}</version>
            </dependency>

            <!-- Ensure plexus xml maven 3 compatibility -->
            <dependency>
                <groupId>org.codehaus.plexus</groupId>
                <artifactId>plexus-xml</artifactId>
                <version>${plexusXmlVersion}</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <dependencies>

        <!-- Spotbugs -->
        <dependency>
            <groupId>com.github.spotbugs</groupId>
            <artifactId>spotbugs-annotations</artifactId>
            <version>${spotbugs.version}</version>
        </dependency>
        <dependency>
            <groupId>com.github.spotbugs</groupId>
            <artifactId>spotbugs</artifactId>
            <version>${spotbugs.version}</version>
            <exclusions>
                <!-- We neither maven uses log4j2 so exclude it as we use slf4j -->
                <exclusion>
                    <groupId>org.apache.logging.log4j</groupId>
                    <artifactId>log4j-core</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <!-- Logging forced to slf4j due to spotbugs using log4j2 -->
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-to-slf4j</artifactId>
            <version>2.24.3</version>
        </dependency>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-simple</artifactId>
        </dependency>

        <dependency>
            <groupId>commons-io</groupId>
            <artifactId>commons-io</artifactId>
            <version>${io.version}</version>
        </dependency>

        <!-- Groovy -->
        <dependency>
            <groupId>org.apache.groovy</groupId>
            <artifactId>groovy</artifactId>
        </dependency>

        <dependency>
            <groupId>org.apache.groovy</groupId>
            <artifactId>groovy-ant</artifactId>
            <exclusions>
                <!-- We do not need these items from groovy ant -->
                <exclusion>
                    <groupId>org.apache.ant</groupId>
                    <artifactId>ant-antlr</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.apache.ant</groupId>
                    <artifactId>ant-junit</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <dependency>
            <groupId>org.apache.groovy</groupId>
            <artifactId>groovy-docgenerator</artifactId>
            <optional>true</optional>
        </dependency>

        <dependency>
            <groupId>org.apache.groovy</groupId>
            <artifactId>groovy-json</artifactId>
        </dependency>

        <dependency>
            <groupId>org.apache.groovy</groupId>
            <artifactId>groovy-templates</artifactId>
            <optional>true</optional>
        </dependency>

        <dependency>
            <groupId>org.apache.groovy</groupId>
            <artifactId>groovy-xml</artifactId>
        </dependency>

        <!-- Required by groovy but not shown as required -->
        <dependency>
            <groupId>com.github.javaparser</groupId>
            <artifactId>javaparser-core</artifactId>
            <version>${javaparserVersion}</version>
        </dependency>

        <!-- Maven -->
        <dependency>
            <groupId>org.apache.maven.reporting</groupId>
            <artifactId>maven-reporting-impl</artifactId>
            <version>${mavenReportingVersion}</version>
        </dependency>

        <dependency>
            <groupId>org.apache.maven.plugin-tools</groupId>
            <artifactId>maven-plugin-annotations</artifactId>
            <version>${pluginPluginVersion}</version>
            <scope>provided</scope>
        </dependency>

        <dependency>
            <groupId>org.apache.maven</groupId>
            <artifactId>maven-plugin-api</artifactId>
            <version>${mavenVersion}</version>
            <scope>provided</scope>
        </dependency>

        <dependency>
            <groupId>org.apache.maven</groupId>
            <artifactId>maven-artifact</artifactId>
            <version>${mavenVersion}</version>
            <scope>provided</scope>
        </dependency>

        <dependency>
            <groupId>org.apache.maven</groupId>
            <artifactId>maven-core</artifactId>
            <version>${mavenVersion}</version>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>org.apache.maven</groupId>
            <artifactId>maven-model</artifactId>
            <version>${mavenVersion}</version>
            <scope>provided</scope>
        </dependency>

        <!-- Resolver -->
        <dependency>
            <groupId>org.apache.maven.resolver</groupId>
            <artifactId>maven-resolver-api</artifactId>
            <version>${resolver.version}</version>
            <scope>provided</scope>
        </dependency>

        <dependency>
            <groupId>javax.inject</groupId>
            <artifactId>javax.inject</artifactId>
            <version>${inject.version}</version>
        </dependency>

        <!-- doxia -->
        <dependency>
            <groupId>org.apache.maven.doxia</groupId>
            <artifactId>doxia-core</artifactId>
            <version>${doxiaVersion}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.maven.doxia</groupId>
            <artifactId>doxia-sink-api</artifactId>
            <version>${doxiaVersion}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.maven.doxia</groupId>
            <artifactId>doxia-site-renderer</artifactId>
            <version>${doxiaSiteToolsVersion}</version>
            <exclusions>
                <!-- We don't need doxia html (using html5) -->
                <exclusion>
                    <groupId>org.apache.maven.doxia</groupId>
                    <artifactId>doxia-module-xhtml</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>org.apache.maven.doxia</groupId>
            <artifactId>doxia-integration-tools</artifactId>
            <version>${doxiaSiteToolsVersion}</version>
        </dependency>

        <!-- plexus -->
        <dependency>
            <groupId>org.codehaus.plexus</groupId>
            <artifactId>plexus-resources</artifactId>
            <version>${plexusResourcesVersion}</version>
        </dependency>
        <dependency>
            <groupId>org.codehaus.plexus</groupId>
            <artifactId>plexus-utils</artifactId>
            <version>${plexusUtilsVersion}</version>
        </dependency>
    </dependencies>

    <build>
        <defaultGoal>install</defaultGoal>

        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-plugin-plugin</artifactId>
                    <version>${pluginPluginVersion}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-plugin-report-plugin</artifactId>
                    <version>${pluginPluginVersion}</version>
                    <configuration>
                        <requirements>
                            <jdk>${project.build.java.target}</jdk>
                        </requirements>
                    </configuration>
                </plugin>

                <plugin>
                    <groupId>org.codehaus.mojo</groupId>
                    <artifactId>l10n-maven-plugin</artifactId>
                    <version>${l10nPluginVersion}</version>
                    <configuration>
                        <locales>
                            <locale>es</locale>
                            <locale>fr</locale>
                            <locale>no_NO</locale>
                            <locale>pt_BR</locale>
                        </locales>
                    </configuration>
                </plugin>

                <plugin>
                    <groupId>com.github.spotbugs</groupId>
                    <artifactId>spotbugs-maven-plugin</artifactId>
                    <version>${project.version}</version>
                    <configuration>
                        <excludeFilterFile>${project.basedir}/src/main/tools/spotbugs-exclude-filters.xml</excludeFilterFile>
                    </configuration>
                </plugin>

                <plugin>
                    <groupId>com.mycila</groupId>
                    <artifactId>license-maven-plugin</artifactId>
                    <configuration>
                        <licenseSets>
                            <licenseSet>
                                <excludes combine.children="append">
                                    <exclude>**/*edu.umd.cs.findbugs.core.prefs</exclude>
                                    <exclude>**/*.txt</exclude>
                                </excludes>
                            </licenseSet>
                        </licenseSets>
                        <mapping>
                            <bsh>SLASHSTAR_STYLE</bsh>
                        </mapping>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.codehaus.mojo</groupId>
                    <artifactId>codenarc-maven-plugin</artifactId>
                    <version>${codenarcPluginVersion}</version>
                    <configuration>
                        <!-- Repo https://github.com/gleclaire/codenarc-maven-plugin has been forked and will need major upgrades to use this. -->
                        <skip>true</skip>

                        <codeNarcVersion>${codenarc.version}</codeNarcVersion>
                        <groovyVersion>${groovyVersion}</groovyVersion>
                        <maxPriority1Violations>0</maxPriority1Violations>
                        <maxPriority2Violations>0</maxPriority2Violations>
                        <maxPriority3Violations>5</maxPriority3Violations>
                        <sourceDirectory>${project.basedir}/src/main/groovy</sourceDirectory>
                    </configuration>
                    <dependencies>
                        <dependency>
                            <groupId>org.codenarc</groupId>
                            <artifactId>CodeNarc</artifactId>
                            <version>${codenarc.version}</version>
                        </dependency>
                    </dependencies>
                </plugin>
            </plugins>
        </pluginManagement>

        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-plugin-plugin</artifactId>
                <executions>
                    <execution>
                        <id>default-descriptor</id>
                        <goals>
                            <goal>descriptor</goal>
                        </goals>
                        <phase>process-classes</phase>
                    </execution>
                    <!-- Generate help goal -->
                    <execution>
                        <id>help-goal</id>
                        <goals>
                            <goal>helpmojo</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.codehaus.gmavenplus</groupId>
                <artifactId>gmavenplus-plugin</artifactId>
                <version>${gmavenPluginVersion}</version>
                <configuration>
                    <attachGroovyDocAnnotation>true</attachGroovyDocAnnotation>
                    <docTitle>${project.name} Groovy Documentation</docTitle>
                    <groovyDocOutputDirectory>${project.reporting.outputDirectory}/gapidocs</groovyDocOutputDirectory>
                    <footer>${project.name} Groovy Documentation</footer>
                    <header>${project.name} Groovy Documentation</header>
                </configuration>
                <dependencies>
                    <dependency>
                        <groupId>org.apache.groovy</groupId>
                        <artifactId>groovy</artifactId>
                        <version>${groovyVersion}</version>
                    </dependency>
                </dependencies>
                <executions>
                    <execution>
                        <id>compileGroovy</id>
                        <goals>
                            <goal>addSources</goal>
                            <goal>addTestSources</goal>
                            <goal>generateStubs</goal>
                            <goal>compile</goal>
                            <goal>generateTestStubs</goal>
                            <goal>compileTests</goal>
                            <goal>removeStubs</goal>
                            <goal>removeTestStubs</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>site</id>
                        <goals>
                            <goal>generateStubs</goal>
                            <goal>generateTestStubs</goal>
                            <goal>groovydoc-jar</goal>
                            <goal>groovydocTests-jar</goal>
                        </goals>
                        <phase>site</phase>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <configuration>
                    <skipTests>true</skipTests>
                </configuration>
            </plugin>

            <!-- Override enforcer to allow commons-logging (remove after next parent release as commons-logging is good again) -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
                <configuration>
                    <rules>
                        <bannedDependencies>
                            <message>Do not use obsolete logging libraries.  Prefer slf4j/logback and override slf4j libraries for replacements</message>
                            <excludes>
                                <exclude>log4j:log4j</exclude>
                                <exclude>org.slf4j:slf4j-log4j12</exclude>
                            </excludes>
                        </bannedDependencies>
                    </rules>
                </configuration>
            </plugin>
        </plugins>
    </build>

    <reporting>
        <excludeDefaults>true</excludeDefaults>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-plugin-report-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>l10n-maven-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>codenarc-maven-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>com.github.spotbugs</groupId>
                <artifactId>spotbugs-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </reporting>

    <profiles>
        <profile>
            <id>eclipse</id>
            <activation>
                <property>
                    <name>m2e.version</name>
                </property>
            </activation>
            <build>
                <pluginManagement>
                    <plugins>
                        <!--This plugin's configuration is used to store Eclipse m2e settings only. It has no influence on the Maven build itself.-->
                        <plugin>
                            <groupId>org.eclipse.m2e</groupId>
                            <artifactId>lifecycle-mapping</artifactId>
                            <!-- Keep version here as fake version and maven report info has problems defining it in dependency management -->
                            <version>${lifecycle.plugin}</version>
                            <configuration>
                                <lifecycleMappingMetadata>
                                    <pluginExecutions combine.children="append">
                                        <!-- gmavenplus m2e in plugin states to ignore, we will process -->
                                        <pluginExecution>
                                            <pluginExecutionFilter>
                                                <groupId>org.codehaus.gmavenplus</groupId>
                                                <artifactId>gmavenplus-plugin</artifactId>
                                                <versionRange>[${gmavenPluginVersion},)</versionRange>
                                                <goals>
                                                    <goal>addSources</goal>
                                                    <goal>addTestSources</goal>
                                                    <goal>generateStubs</goal>
                                                    <goal>compile</goal>
                                                    <goal>generateTestStubs</goal>
                                                    <goal>compileTests</goal>
                                                    <goal>removeStubs</goal>
                                                    <goal>removeTestStubs</goal>
                                                </goals>
                                            </pluginExecutionFilter>
                                            <action>
                                                <ignore />
                                            </action>
                                        </pluginExecution>
                                    </pluginExecutions>
                                </lifecycleMappingMetadata>
                            </configuration>
                        </plugin>
                    </plugins>
                </pluginManagement>
            </build>
        </profile>

        <profile>
            <id>run-its</id>
            <properties>
                <spotbug.debug>false</spotbug.debug>
            </properties>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-invoker-plugin</artifactId>
                        <version>${invokerPluginVersion}</version>
                        <dependencies>
                            <!-- Keep groovy at same version we are using -->
                            <dependency>
                                <groupId>org.apache.groovy</groupId>
                                <artifactId>groovy</artifactId>
                                <version>${groovyVersion}</version>
                            </dependency>
                            <dependency>
                                <groupId>org.apache.groovy</groupId>
                                <artifactId>groovy-json</artifactId>
                                <version>${groovyVersion}</version>
                            </dependency>
                            <dependency>
                                <groupId>org.apache.groovy</groupId>
                                <artifactId>groovy-nio</artifactId>
                                <version>${groovyVersion}</version>
                            </dependency>
                            <dependency>
                                <groupId>org.apache.groovy</groupId>
                                <artifactId>groovy-xml</artifactId>
                                <version>${groovyVersion}</version>
                            </dependency>
                        </dependencies>
                        <executions>
                            <execution>
                                <!--Package test include and exclude files and file local repo -->
                                <id>prepare-integration-test</id>
                                <goals>
                                    <goal>install</goal>
                                    <goal>run</goal>
                                </goals>
                                <phase>pre-integration-test</phase>
                                <configuration>
                                    <parallelThreads>1</parallelThreads>
                                    <projectsDirectory>${project.basedir}/src/it-tools</projectsDirectory>
                                    <cloneProjectsTo>${project.build.directory}/it</cloneProjectsTo>
                                    <showVersion>true</showVersion>
                                    <pomIncludes>
                                        <pomInclude>*/pom.xml</pomInclude>
                                    </pomIncludes>
                                    <postBuildHookScript>verify</postBuildHookScript>
                                    <localRepositoryPath>${project.build.directory}/local-repo</localRepositoryPath>
                                    <goals>
                                        <goal>install --no-transfer-progress</goal>
                                    </goals>
                                    <settingsFile>${project.basedir}/src/it/settings.xml</settingsFile>
                                    <streamLogsOnFailures>true</streamLogsOnFailures>
                                </configuration>
                            </execution>
                            <execution>
                                <id>integration-test-run</id>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                                <configuration>
                                    <projectsDirectory>${project.basedir}/src/it</projectsDirectory>
                                    <cloneProjectsTo>${project.build.directory}/it</cloneProjectsTo>
                                    <showVersion>true</showVersion>
                                    <pomIncludes>
                                        <pomInclude>*/pom.xml</pomInclude>
                                    </pomIncludes>
                                    <postBuildHookScript>verify --no-transfer-progress</postBuildHookScript>
                                    <localRepositoryPath>${project.build.directory}/local-repo</localRepositoryPath>
                                    <settingsFile>${project.basedir}/src/it/settings.xml</settingsFile>
                                    <streamLogsOnFailures>true</streamLogsOnFailures>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <profile>
            <id>spot-it-src-checkout</id>
            <activation>
                <property>
                    <name>testSrc</name>
                    <value>remote</value>
                </property>
            </activation>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-scm-plugin</artifactId>
                        <version>${scmPluginVersion}</version>
                        <dependencies>
                            <dependency>
                                <groupId>org.apache.maven.scm</groupId>
                                <artifactId>maven-scm-provider-jgit</artifactId>
                                <version>${scmPluginVersion}</version>
                            </dependency>
                            <dependency>
                                <groupId>org.eclipse.jgit</groupId>
                                <artifactId>org.eclipse.jgit</artifactId>
                                <version>${jgit.version}</version>
                            </dependency>
                            <dependency>
                                <groupId>org.eclipse.jgit</groupId>
                                <artifactId>org.eclipse.jgit.ssh.jsch</artifactId>
                                <version>${jgit.version}</version>
                            </dependency>
                        </dependencies>
                        <executions>
                            <execution>
                                <id>prepare-integration-test-remote-spotbugs-src</id>
                                <goals>
                                    <goal>checkout</goal>
                                </goals>
                                <phase>pre-integration-test</phase>
                                <configuration>
                                    <connectionUrl>${remoteTestSrc}</connectionUrl>
                                    <checkoutDirectory>${integrationTestSrc}</checkoutDirectory>
                                    <providerImplementations>
                                        <git>jgit</git>
                                    </providerImplementations>
                                    <includes>${includesTestSrcPattern}</includes>
                                    <scmVersion>${spotbugs.version}</scmVersion>
                                    <scmVersionType>tag</scmVersionType>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <profile>
            <id>spot-it-src-local</id>
            <activation>
                <property>
                    <name>testSrc</name>
                    <value>local</value>
                </property>
            </activation>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-antrun-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>prepare-integration-test-local-spotbugs-src</id>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                                <phase>pre-integration-test</phase>
                                <configuration>
                                    <target>
                                        <echo level="debug">Copying Source for Tests......</echo>
                                        <echo level="debug">Making ${integrationTestSrc}</echo>
                                        <mkdir dir="${integrationTestSrc}" />
                                        <echo level="debug">Copying to ${integrationTestSrc}</echo>
                                        <echo level="debug">from ${localTestSrc}</echo>
                                        <echo level="debug">for ${includesTestSrcPattern}</echo>
                                        <copy todir="${integrationTestSrc}">
                                            <fileset dir="${localTestSrc}" includes="${includesTestSrcPattern}" />
                                        </copy>
                                    </target>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>

    </profiles>
</project>

2024 State of the Software Supply Chain

Open source consumption has exploded, with estimates placing this year’s downloads at over 6.6 trillion. This reliance on open source components, now making up to 90% of the modern software application, has ushered in both unprecedented innovation and complex challenges for software supply chains.

View the Report