Description

<dependency>
    <groupId>photos.sluice</groupId>
    <artifactId>secret-store</artifactId>
    <version>1.0.1</version>
</dependency>

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>photos.sluice</groupId>
  <artifactId>secret-store</artifactId>
  <version>1.0.1</version>
  <packaging>jar</packaging>

  <name>Secret Store</name>
  <description>
    A tiered secret store for Java. Reads a credential from the first place that answers, in the
    order environment variable, the operating system's own credential store, then a
    permission-restricted file. Saves to the strongest place that can be written, and a remove
    clears every place a save can reach. Windows, macOS and Linux are bound through
    java.lang.foreign, so there is no runtime dependency beyond the JDK.
  </description>
  <url>https://github.com/AdrianNachev91/secret-store</url>

  <licenses>
    <license>
      <name>MIT License</name>
      <url>https://opensource.org/license/mit</url>
      <distribution>repo</distribution>
    </license>
  </licenses>

  <developers>
    <developer>
      <name>Adrian Nachev</name>
      <url>https://github.com/AdrianNachev91</url>
    </developer>
  </developers>

  <scm>
    <connection>scm:git:https://github.com/AdrianNachev91/secret-store.git</connection>
    <developerConnection>scm:git:ssh://git@github.com/AdrianNachev91/secret-store.git</developerConnection>
    <url>https://github.com/AdrianNachev91/secret-store</url>
  </scm>

  <issueManagement>
    <system>GitHub Issues</system>
    <url>https://github.com/AdrianNachev91/secret-store/issues</url>
  </issueManagement>

  <properties>
    <!-- The current LTS. Raising it breaks every consumer below, so it moves only on a major
         version. -->
    <maven.compiler.release>25</maven.compiler.release>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <junit.version>6.1.3</junit.version>
  </properties>

  <dependencies>
    <dependency>
      <groupId>org.jspecify</groupId>
      <artifactId>jspecify</artifactId>
      <version>1.0.1</version>
      <scope>provided</scope>
    </dependency>

    <dependency>
      <groupId>org.junit.jupiter</groupId>
      <artifactId>junit-jupiter</artifactId>
      <version>${junit.version}</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.junit.platform</groupId>
      <artifactId>junit-platform-launcher</artifactId>
      <version>${junit.version}</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.assertj</groupId>
      <artifactId>assertj-core</artifactId>
      <version>3.27.7</version>
      <scope>test</scope>
    </dependency>
  </dependencies>

  <build>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <version>3.16.0</version>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-surefire-plugin</artifactId>
        <version>3.6.0</version>
        <configuration>
          <!-- A consumer has to pass this flag too. -->
          <argLine>--enable-native-access=ALL-UNNAMED</argLine>
          <!-- With module-info.java present, Surefire would put the tests on the module path,
               where their package-private access across the tree stops resolving. On the classpath
               they are in the unnamed module, which is what the flag above grants. -->
          <useModulePath>false</useModulePath>
          <!-- Read back by the one test that pins withEnvironmentOverride() against the real
               process environment. Nothing else can tell System::getenv from another lookup of
               the same shape. -->
          <environmentVariables>
            <SECRET_STORE_FIXTURE_ENVIRONMENT>sk-synthetic-from-environment</SECRET_STORE_FIXTURE_ENVIRONMENT>
          </environmentVariables>
        </configuration>
      </plugin>
    </plugins>
  </build>

  <profiles>
    <!-- What Central requires on top of the jar. In a profile so an ordinary build neither signs
         nor reaches a repository. -->
    <profile>
      <id>release</id>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-source-plugin</artifactId>
            <version>3.4.0</version>
            <executions>
              <execution>
                <id>attach-sources</id>
                <goals>
                  <goal>jar-no-fork</goal>
                </goals>
              </execution>
            </executions>
          </plugin>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-javadoc-plugin</artifactId>
            <version>3.12.0</version>
            <executions>
              <execution>
                <id>attach-javadocs</id>
                <goals>
                  <goal>jar</goal>
                </goals>
              </execution>
            </executions>
          </plugin>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-gpg-plugin</artifactId>
            <version>3.2.8</version>
            <executions>
              <execution>
                <id>sign-artifacts</id>
                <phase>verify</phase>
                <goals>
                  <goal>sign</goal>
                </goals>
              </execution>
            </executions>
          </plugin>
          <plugin>
            <groupId>org.sonatype.central</groupId>
            <artifactId>central-publishing-maven-plugin</artifactId>
            <version>0.11.0</version>
            <extensions>true</extensions>
            <configuration>
              <publishingServerId>central</publishingServerId>
              <!-- The upload validates and then waits in the Portal. Central is immutable, so
                   releasing stays a person's button rather than a tag's side effect. -->
              <autoPublish>false</autoPublish>
              <waitUntil>validated</waitUntil>
            </configuration>
          </plugin>
        </plugins>
      </build>
    </profile>
  </profiles>
</project>