Description

<dependency>
    <groupId>life.qbic</groupId>
    <artifactId>linksmith</artifactId>
    <version>1.0.0-alpha.7</version>
</dependency>

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>life.qbic</groupId>
  <artifactId>linksmith</artifactId>
  <version>1.0.0-alpha.7</version>

  <name>${project.groupId}:${project.artifactId}</name>
  <description>A Java library to craft HTTP web links from serialized header data described in RFC 8288.</description>
  <url>https://github.com/qbicsoftware/linksmith</url>

  <licenses>
    <license>
      <name>GNU Affero General Public License, Version 3.0</name>
      <url>https://www.gnu.org/licenses/agpl-3.0.html.en#license-text</url>
    </license>
  </licenses>

  <developers>
    <developer>
      <name>Sven Fillinger</name>
      <email>sven.fillinger@uni-tuebingen.de</email>
      <organization>University of Tübingen</organization>
      <organizationUrl>https://uni-tuebingen.de</organizationUrl>
    </developer>
  </developers>

  <scm>
    <connection>scm:git:git://github.com/qbicsoftware/linksmith.git</connection>
    <developerConnection>scm:git:ssh://github.com:qbicsoftware/linksmith.git</developerConnection>
    <url>http://github.com/qbicsoftware/linksmith/tree/main</url>
  </scm>

  <properties>
    <maven.compiler.source>21</maven.compiler.source>
    <maven.compiler.target>21</maven.compiler.target>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <groovy.version>5.0.3</groovy.version>
    <spock.version>2.4-M7-groovy-5.0</spock.version>
    <gmavenplus.version>4.2.1</gmavenplus.version>
    <slf4j.version>2.0.17</slf4j.version>
    <cyclonedx.version>2.9.1</cyclonedx.version>
  </properties>

  <dependencies>
    <dependency>
      <groupId>org.slf4j</groupId>
      <artifactId>slf4j-api</artifactId>
      <version>${slf4j.version}</version>
    </dependency>
    <dependency>
      <groupId>org.spockframework</groupId>
      <artifactId>spock-core</artifactId>
      <version>${spock.version}</version>
      <scope>test</scope>
    </dependency>
    <!-- Groovy runtime for the specs -->
    <dependency>
      <groupId>org.apache.groovy</groupId>
      <artifactId>groovy</artifactId>
      <version>${groovy.version}</version>
      <scope>test</scope>
    </dependency>
  </dependencies>
  <build>
    <plugins>
      <plugin>
        <groupId>org.codehaus.mojo</groupId>
        <artifactId>license-maven-plugin</artifactId>
        <version>2.7.0</version> <!-- Use the latest version -->
        <executions>
          <execution>
            <goals>
              <goal>aggregate-add-third-party</goal>
            </goals>
          </execution>
        </executions>
        <configuration>
          <!-- Configuration for licenses aggregation -->
          <outputDirectory>${project.build.directory}/generated-sources/license</outputDirectory>
          <thirdPartyFilename>THIRD-PARTY.txt</thirdPartyFilename>
          <failIfWarning>false</failIfWarning> <!-- Optional: fail the build on issues -->
          <includeTransitiveDependencies>true</includeTransitiveDependencies>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.codehaus.gmavenplus</groupId>
        <artifactId>gmavenplus-plugin</artifactId>
        <version>${gmavenplus.version}</version>
        <executions>
          <execution>
            <goals>
              <goal>addSources</goal>
              <goal>addTestSources</goal>
              <goal>generateStubs</goal>
              <goal>compile</goal>
              <goal>generateTestStubs</goal>
              <goal>compileTests</goal>
              <goal>removeStubs</goal>
              <goal>removeTestStubs</goal>
            </goals>
          </execution>
        </executions>
        <configuration>
          <groovyDocOutputDirectory>${project.build.directory}/site/gapidocs
          </groovyDocOutputDirectory>
          <testGroovyDocOutputDirectory>${project.build.directory}/site/testgapidocs
          </testGroovyDocOutputDirectory>
        </configuration>
      </plugin>
      <plugin>
        <artifactId>maven-surefire-plugin</artifactId>
        <version>3.5.4</version>
        <configuration>
          <useModulePath>false</useModulePath>
          <includes>
            <include>**/*Spec.class</include>
          </includes>
        </configuration>
      </plugin>

      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-source-plugin</artifactId>
        <version>3.4.0</version>
        <executions>
          <execution>
            <id>attach-sources</id>
            <goals>
              <goal>jar</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-javadoc-plugin</artifactId>
        <version>3.8.0</version>
        <executions>
          <execution>
            <id>attach-javadocs</id>
            <goals>
              <goal>jar</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>
  <profiles>
    <profile>
      <id>release</id>
      <properties>
        <!-- this is what the plugin reads -->
        <gpg.passphrase>${env.MAVEN_GPG_PASSPHRASE}</gpg.passphrase>
      </properties>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-gpg-plugin</artifactId>
            <version>3.2.8</version>
            <executions>
              <execution>
                <id>sign-artifacts</id>
                <phase>verify</phase>
                <goals>
                  <goal>sign</goal>
                </goals>
              </execution>
            </executions>
            <configuration>
              <gpgArguments>
                <arg>--pinentry-mode</arg>
                <arg>loopback</arg>
              </gpgArguments>
              <passphrase>${gpg.passphrase}</passphrase>
            </configuration>
          </plugin>
          <plugin>
            <groupId>org.codehaus.mojo</groupId>
            <artifactId>build-helper-maven-plugin</artifactId>
            <version>3.6.1</version>
            <executions>
              <execution>
                <id>attach-sbom</id>
                <phase>package</phase>
                <goals>
                  <goal>attach-artifact</goal>
                </goals>
                <configuration>
                  <artifacts>
                    <artifact>
                      <file>${project.build.directory}/${project.artifactId}-${project.version}-sbom.json</file>
                      <type>json</type>
                      <classifier>sbom</classifier>
                    </artifact>
                  </artifacts>
                </configuration>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>
    <profile>
      <id>sigcheck</id>
      <activation>
        <file>
          <exists>src/main</exists>
        </file>
      </activation>
      <build>
        <pluginManagement>
          <plugins>
            <plugin>
              <groupId>org.apache.maven.plugins</groupId>
              <artifactId>maven-site-plugin</artifactId>
              <version>4.0.0-M16</version>
            </plugin>
            <plugin>
              <groupId>org.simplify4u.plugins</groupId>
              <artifactId>pgpverify-maven-plugin</artifactId>
              <version>1.19.1</version>
              <dependencies>
                <dependency>
                  <groupId>org.simplify4u</groupId>
                  <artifactId>pgp-keys-map</artifactId>
                  <version>2025.03.15</version> <!-- use latest available -->
                </dependency>
              </dependencies>
            </plugin>
          </plugins>
        </pluginManagement>
        <plugins>
          <plugin>
            <groupId>org.simplify4u.plugins</groupId>
            <artifactId>pgpverify-maven-plugin</artifactId>
            <executions>
              <execution>
                <id>pgp-verify</id>
                <phase>validate</phase>
                <goals>
                  <goal>check</goal>
                </goals>
              </execution>
            </executions>
            <configuration>
              <!-- verify build plugins too (compiler, surefire, etc.) -->
              <verifyPlugins>true</verifyPlugins>
              <verifyPluginDependencies>false</verifyPluginDependencies>
              <!-- include provided deps if you want to check servlet APIs etc. -->
              <verifyProvidedDependencies>false</verifyProvidedDependencies>
              <!-- optionally check SNAPSHOTs as well -->
              <verifySnapshots>false</verifySnapshots>
              <!-- add a keys map to lock critical coords to expected fingerprints -->
              <keysMapLocations>
                <!-- our overrides / allow-list -->
                <keysMapLocation>/pgp-keys-map.list</keysMapLocation>
                <keysMapLocation>${maven.multiModuleProjectDirectory}/pgp-keys-override.list</keysMapLocation>
              </keysMapLocations>
              <suppressSignatureOkLogging>true</suppressSignatureOkLogging>
              <!-- write a JSON report (optional) -->
              <reportWrite>true</reportWrite>
            </configuration>
          </plugin>

          <plugin>
            <groupId>org.jacoco</groupId>
            <artifactId>jacoco-maven-plugin</artifactId>
            <version>0.8.14</version>
            <executions>
              <!-- Attach JaCoCo agent to tests -->
              <execution>
                <id>prepare-agent</id>
                <goals>
                  <goal>prepare-agent</goal>
                </goals>
              </execution>
              <execution>
                <id>check</id>
                <phase>verify</phase>
                <goals>
                  <goal>check</goal>
                </goals>
                <configuration>
                  <rules>
                    <rule>
                      <element>BUNDLE</element>
                      <limits>
                        <limit>
                          <counter>INSTRUCTION</counter>
                          <value>COVEREDRATIO</value>
                          <minimum>0.80</minimum>
                        </limit>
                        <limit>
                          <counter>BRANCH</counter>
                          <value>COVEREDRATIO</value>
                          <minimum>0.70</minimum>
                        </limit>
                      </limits>
                    </rule>
                  </rules>
                </configuration>
              </execution>
              <!-- Generate coverage report after tests -->
              <execution>
                <id>report</id>
                <phase>verify</phase>
                <goals>
                  <goal>report</goal>
                </goals>
                <configuration>
                  <formats>
                    <format>XML</format>
                    <format>HTML</format>
                  </formats>
                </configuration>
              </execution>
            </executions>
          </plugin>
          <plugin>
            <groupId>org.sonatype.central</groupId>
            <artifactId>central-publishing-maven-plugin</artifactId>
            <version>0.9.0</version>
            <extensions>true</extensions>
            <configuration>
              <publishingServerId>central</publishingServerId>
              <checksums>required</checksums>
              <autoPublish>true</autoPublish>
            </configuration>
          </plugin>
        </plugins>
      </build>
    </profile>
    <profile>
      <id>sbom</id>
      <properties>
        <!-- Ensure CycloneDX does not skip SBOM generation due to deploy being skipped elsewhere -->
        <maven.deploy.skip>false</maven.deploy.skip>
      </properties>
      <build>
        <plugins>
          <plugin>
            <groupId>org.cyclonedx</groupId>
            <artifactId>cyclonedx-maven-plugin</artifactId>
            <version>${cyclonedx.version}</version>
            <executions>
              <execution>
                <id>generate-sbom</id>
                <phase>package</phase>
                <goals>
                  <goal>makeAggregateBom</goal>
                </goals>
                <configuration>
                  <schemaVersion>1.5</schemaVersion>
                  <outputFormat>json</outputFormat>
                  <outputName>${project.artifactId}-${project.version}-sbom</outputName>
                  <includeBomSerialNumber>true</includeBomSerialNumber>
                  <includeLicenseText>true</includeLicenseText>
                  <skipNotDeployed>false</skipNotDeployed>
                </configuration>
              </execution>
            </executions>
          </plugin>
        </plugins>
      </build>
    </profile>
  </profiles>
</project>