Description

<dependency>
    <groupId>com.qopanza</groupId>
    <artifactId>qopanza</artifactId>
    <version>0.1.0</version>
</dependency>

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>com.qopanza</groupId>
  <artifactId>qopanza</artifactId>
  <version>0.1.0</version>
  <packaging>jar</packaging>

  <name>qopanza</name>
  <description>Java SDK for the Qopanza API (PQC + AI security analysis)</description>
  <url>https://qopanza.com</url>

  <organization>
    <name>Gsente LLC</name>
    <url>https://qopanza.com</url>
  </organization>

  <licenses>
    <license>
      <name>Apache License, Version 2.0</name>
      <url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
      <distribution>repo</distribution>
    </license>
  </licenses>

  <!-- Maven Central rejects a POM without <scm>, <developers>, <url>,
       <name>, <description> and <licenses>. It is the strictest of the
       registries and the only one that refuses on metadata alone, so
       these are not optional decoration. -->
  <scm>
    <connection>scm:git:https://github.com/isingomajoel2023/qopanza-sdks.git</connection>
    <developerConnection>scm:git:ssh://git@github.com/isingomajoel2023/qopanza-sdks.git</developerConnection>
    <url>https://github.com/isingomajoel2023/qopanza-sdks</url>
    <tag>HEAD</tag>
  </scm>

  <developers>
    <developer>
      <name>Joel Isingoma</name>
      <organization>Gsente LLC</organization>
      <organizationUrl>https://qopanza.com</organizationUrl>
    </developer>
  </developers>

  <issueManagement>
    <system>GitHub Issues</system>
    <url>https://github.com/isingomajoel2023/qopanza-sdks/issues</url>
  </issueManagement>

  <properties>
    <maven.compiler.source>17</maven.compiler.source>
    <maven.compiler.target>17</maven.compiler.target>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
  </properties>

  <dependencies>
    <!-- HTTP client -->
    <dependency>
      <groupId>com.squareup.okhttp3</groupId>
      <artifactId>okhttp</artifactId>
      <version>4.12.0</version>
    </dependency>
    <!-- JSON -->
    <dependency>
      <groupId>com.fasterxml.jackson.core</groupId>
      <artifactId>jackson-databind</artifactId>
      <version>2.17.2</version>
    </dependency>

    <!-- Tests -->
    <dependency>
      <groupId>org.junit.jupiter</groupId>
      <artifactId>junit-jupiter</artifactId>
      <version>5.11.0</version>
      <scope>test</scope>
    </dependency>
  </dependencies>

  <build>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-surefire-plugin</artifactId>
        <version>3.2.5</version>
      </plugin>
    </plugins>
  </build>

  <!-- Everything Maven Central requires beyond the jar itself, kept in a
       profile so `mvn test` and `mvn package` stay fast. Javadoc and GPG
       add roughly a minute and neither is wanted on a normal build.

       Release with:  mvn -Prelease deploy

       Central refuses a bundle that is missing any of the three below,
       and it refuses it *after* upload, in a validation step, so the
       failure arrives late and reads like a server problem rather than a
       missing plugin. -->
  <profiles>
    <profile>
      <id>release</id>
      <build>
        <plugins>
          <!-- -sources.jar. Required by Central, and the reason anyone
               can step into this library in a debugger. -->
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-source-plugin</artifactId>
            <version>3.4.0</version>
            <executions>
              <execution>
                <id>attach-sources</id>
                <goals><goal>jar-no-fork</goal></goals>
              </execution>
            </executions>
          </plugin>

          <!-- -javadoc.jar. Also required. doclint is off because Central
               requires the jar to exist, not for every parameter to carry
               a @param — and a strict doclint failure blocks a release
               over a missing sentence. -->
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-javadoc-plugin</artifactId>
            <version>3.12.0</version>
            <configuration>
              <doclint>none</doclint>
              <quiet>true</quiet>
            </configuration>
            <executions>
              <execution>
                <id>attach-javadocs</id>
                <goals><goal>jar</goal></goals>
              </execution>
            </executions>
          </plugin>

          <!-- Every artifact signed, including the POM and the two jars
               above. In CI there is no TTY to prompt for a passphrase, so
               loopback pinentry (configured below) plus
               MAVEN_GPG_PASSPHRASE in the environment is the only
               combination that works unattended. Without it the build
               hangs waiting for a prompt nobody can answer, rather than
               failing, which is worse. -->
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-gpg-plugin</artifactId>
            <version>3.2.8</version>
            <executions>
              <execution>
                <id>sign-artifacts</id>
                <phase>verify</phase>
                <goals><goal>sign</goal></goals>
                <configuration>
                  <gpgArguments>
                    <arg>--pinentry-mode</arg>
                    <arg>loopback</arg>
                  </gpgArguments>
                </configuration>
              </execution>
            </executions>
          </plugin>

          <!-- The Central Portal publisher. This replaced the OSSRH
               nexus-staging plugin, which is retired — anything you find
               online referencing oss.sonatype.org is describing a service
               that no longer exists.

               autoPublish=false uploads the bundle and stops, so the
               first release can be inspected in the portal and dropped if
               it is wrong. A published version can never be replaced. -->
          <plugin>
            <groupId>org.sonatype.central</groupId>
            <artifactId>central-publishing-maven-plugin</artifactId>
            <version>0.11.0</version>
            <extensions>true</extensions>
            <configuration>
              <publishingServerId>central</publishingServerId>
              <autoPublish>false</autoPublish>
              <waitUntil>validated</waitUntil>
            </configuration>
          </plugin>
        </plugins>
      </build>
    </profile>
  </profiles>
</project>