Description

<dependency>
    <groupId>de.cuioss.sheriff.token</groupId>
    <artifactId>token-sheriff-parent</artifactId>
    <version>0.9.6</version>
</dependency>

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>de.cuioss</groupId>
        <artifactId>cui-quarkus-parent</artifactId>
        <version>1.7.5</version>
        <relativePath />
    </parent>
    <groupId>de.cuioss.sheriff.token</groupId>
    <artifactId>token-sheriff-parent</artifactId>
    <version>0.9.6</version>
    <packaging>pom</packaging>
    <!-- Must be declared: <inceptionYear> is inherited, and the license plugin binds
         the copyright ${year} to it. Without this, this project would report
         cui-parent-pom's 2022 and restamp every header on each -Ppre-commit run. -->
    <inceptionYear>2025</inceptionYear>
    <name>Token-Sheriff Parent</name>
    <description>A comprehensive framework for validating OAuth/JWT tokens in multi-issuer environments.
        The module provides robust token parsing, validation, and management capabilities
        with a focus on security and ease of use, leveraging standard JDK cryptographic providers.
    </description>

    <url>https://github.com/cuioss/TokenSheriff/</url>
    <modules>
        <module>bom</module>
        <module>token-sheriff-validation</module>
        <module>token-sheriff-client</module>
        <module>token-sheriff-quarkus-parent</module>
        <module>benchmarking</module>
    </modules>
    <scm>
        <url>https://github.com/cuioss/TokenSheriff/</url>
        <connection>
            scm:git:https://github.com/cuioss/TokenSheriff.git
        </connection>
        <developerConnection>
            scm:git:https://github.com/cuioss/TokenSheriff/
        </developerConnection>
        <tag>0.9.6</tag>
    </scm>
    <issueManagement>
        <url>https://github.com/cuioss/TokenSheriff/issues</url>
        <system>GitHub Issues</system>
    </issueManagement>

    <properties>
        <maven.compiler.release>21</maven.compiler.release>
    </properties>

    <profiles>
        <profile>
            <!-- Parent-drift guard for the pre-commit profile.

                 -Ppre-commit is inherited from cui-java-parent and AUTO-FIXES: it runs
                 license:format and rewrite:run, both of which rewrite tracked sources in
                 place and precede verify. That is the intended org-wide behaviour - the
                 quality gate auto-fixes, in every language. Review what it changed and
                 commit it.

                 This repo previously inverted that, overriding both inherited executions BY
                 ID with <phase>none</phase> and adding license:check plus
                 rewrite:dryRun(failOnDryRunResults=true) to make -Ppre-commit a non-mutating
                 verify gate. That inversion has been removed. Two reasons, independent of
                 each other:

                   1. It contradicted the org decision that the gate auto-fixes, leaving this
                      repo the only one where -Ppre-commit means something different.
                   2. It was fragile by construction. The override worked ONLY by matching the
                      parent's execution ids, so a parent restructure that renamed either id
                      would silently restore the mutations with no signal here at all - the
                      overrides would simply append beside the inherited entries instead of
                      merging onto them.

                 What remains below is unrelated to the mutation question and is deliberately
                 KEPT: a durable guard asserting the parent has not silently re-activated
                 org.openrewrite.java.migrate.util.JavaUtilAPIs. -->
            <id>pre-commit</id>
            <build>
                <plugins>
                    <plugin>
                        <!-- Durable guard for the parent-inherited JavaUtilAPIs exclusion.

                             cui-java-parent keeps org.openrewrite.java.migrate.util.JavaUtilAPIs OUT
                             of activeRecipes because its transitive UseMapOf recipe emits
                             non-compiling output (see TokenSheriff PR #577). The exclusion lives
                             entirely in the parent and is invisible from here, so a future parent
                             bump could silently re-activate it with no local signal. This dumps the
                             RESOLVED recipe list; the next execution asserts against it.

                             OBSERVED FACT, established by generating the effective POM once and
                             inspecting it before the pattern below was written: help:effective-pom
                             STRIPS XML comments. The parent keeps the exclusion as a commented-out
                             <recipe> element, and neither that element nor its rationale comment
                             appears in the generated file - only genuinely active recipes are
                             rendered. The pattern is nonetheless anchored to the uncommented
                             <recipe> element form, so it matches an active declaration only and
                             could not match a commented-out one even if comment handling changed.

                             Both executions are inherited=false: the recipe list resolves once, on
                             the root aggregator, so running this per module would only repeat the
                             same check. -->
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-help-plugin</artifactId>
                        <inherited>false</inherited>
                        <executions>
                            <execution>
                                <id>dump-effective-pom-for-recipe-audit</id>
                                <phase>validate</phase>
                                <goals>
                                    <goal>effective-pom</goal>
                                </goals>
                                <configuration>
                                    <output>${project.build.directory}/effective-pom-pre-commit.xml</output>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <!-- The assertion itself: no helper script and no XML parser, just grep's
                             exit code inverted through exec:exec successCodes.

                             OBSERVED FACT (measured, not assumed): grep -L is NOT usable as the
                             signal here. On BSD grep (macOS) a -L run over a file that does NOT
                             contain the pattern prints the filename and still exits 1, so the
                             "absent implies exit 0" premise does not hold across platforms and the
                             assertion would fail permanently on a correctly-excluded tree.

                             Plain grep has portable, well-defined exit codes: 0 = pattern FOUND,
                             1 = NOT found, 2 = file missing or unreadable. Declaring 1 as the only
                             success code therefore asserts exactly "the recipe is not active", and
                             is fail-closed in both other directions: an active recipe (0) reds the
                             build, and so does a missing or unreadable effective POM (2), which
                             would otherwise let the guard pass while checking nothing.

                             On failure grep prints the offending line, so the build output names
                             the recipe that came back. -->
                        <groupId>org.codehaus.mojo</groupId>
                        <artifactId>exec-maven-plugin</artifactId>
                        <inherited>false</inherited>
                        <executions>
                            <execution>
                                <id>assert-javautilapis-excluded</id>
                                <phase>validate</phase>
                                <goals>
                                    <goal>exec</goal>
                                </goals>
                                <configuration>
                                    <executable>grep</executable>
                                    <arguments>
                                        <argument>-F</argument>
                                        <argument>&lt;recipe&gt;org.openrewrite.java.migrate.util.JavaUtilAPIs&lt;/recipe&gt;</argument>
                                        <argument>${project.build.directory}/effective-pom-pre-commit.xml</argument>
                                    </arguments>
                                    <successCodes>
                                        <successCode>1</successCode>
                                    </successCodes>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>

</project>