pom.xml

<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://maven.apache.org/POM/4.0.0"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.open-elements</groupId>
    <artifactId>java-parent</artifactId>
    <version>1.4.0-SNAPSHOT</version>
    <packaging>pom</packaging>

    <name>Java Parent</name>
    <description>Java Parent for projects by Open Elements</description>
    <url>https://github.com/OpenElementsLabs/java-parent</url>

    <licenses>
        <license>
            <name>Apache License, Version 2.0</name>
            <url>https://www.apache.org/licenses/LICENSE-2.0</url>
        </license>
    </licenses>

    <developers>
        <developer>
            <name>Hendrik Ebbers</name>
            <email>hendrik.ebbers@open-elements.com</email>
            <organization>Open Elements</organization>
            <organizationUrl>https://open-elements.com</organizationUrl>
        </developer>
    </developers>

    <scm>
        <connection>scm:git:https://github.com/OpenElementsLabs/java-parent.git</connection>
        <developerConnection>scm:git:https://github.com/OpenElementsLabs/java-parent.git</developerConnection>
        <url>https://github.com/OpenElementsLabs/java-parent</url>
    </scm>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>

        <!-- Reproducible builds: a fixed, deterministic timestamp for every archive entry
             and manifest, inherited by every child project. Because it is a literal in a POM
             published to Maven Central, and children pin their parent version exactly, a
             third party can rebuild a release byte-identically with a plain
             `./mvnw -Pfull-build clean verify`, without knowing any build flag.
             Maintained by release.sh, which rewrites it on every release.
             NOTE: this is NOT a build time. It describes the java-parent release an
             artifact was built against. For "when did this source state come into being",
             use the Git-Commit-Time manifest entry written by the full-build profile. -->
        <project.build.outputTimestamp>2026-09-10T17:19:06Z</project.build.outputTimestamp>

        <maven.compiler.source>21</maven.compiler.source>
        <maven.compiler.target>21</maven.compiler.target>
        <!-- Emit -parameters so formal parameter names survive into the bytecode. Spring relies on
             them to resolve constructor/method injection by name (e.g. disambiguating two beans of
             the same type by parameter name) and to bind @RequestParam/@PathVariable/@ConfigurationProperties
             without an explicit name. Spring Boot's own parent enables this by default for the same reason. -->
        <maven.compiler.parameters>true</maven.compiler.parameters>

        <!-- Minimum build environment enforced by the maven-enforcer-plugin.
             Child projects may override these to require a newer toolchain. -->
        <enforcer.requiredMavenVersion>3.9.11</enforcer.requiredMavenVersion>
        <enforcer.requiredJavaVersion>21</enforcer.requiredJavaVersion>

        <!-- Release: GitHub repo coordinates used by the deploy-release profile.
             Defaults assume the GitHub repo name equals the Maven artifactId;
             a child project overrides release.github.repo (or .owner) when it differs. -->
        <release.github.owner>OpenElementsLabs</release.github.owner>
        <release.github.repo>${project.artifactId}</release.github.repo>

        <!-- Plugin versions -->
        <maven-resources-plugin.version>3.5.0</maven-resources-plugin.version>
        <maven-compiler-plugin.version>3.15.0</maven-compiler-plugin.version>
        <maven-surefire-plugin.version>3.5.5</maven-surefire-plugin.version>
        <maven-javadoc-plugin.version>3.12.0</maven-javadoc-plugin.version>
        <maven-source-plugin.version>3.4.0</maven-source-plugin.version>
        <maven-gpg-plugin.version>3.2.8</maven-gpg-plugin.version>
        <maven-jar-plugin.version>3.5.0</maven-jar-plugin.version>
        <maven-deploy-plugin.version>3.1.4</maven-deploy-plugin.version>
        <maven-clean-plugin.version>3.5.0</maven-clean-plugin.version>
        <maven-enforcer-plugin.version>3.6.3</maven-enforcer-plugin.version>
        <cyclonedx-maven-plugin.version>2.9.2</cyclonedx-maven-plugin.version>
        <jreleaser-maven-plugin.version>1.24.0</jreleaser-maven-plugin.version>
        <versions-maven-plugin.version>2.21.0</versions-maven-plugin.version>
        <spotless-maven-plugin.version>3.7.0</spotless-maven-plugin.version>
        <git-commit-id-maven-plugin.version>10.0.0</git-commit-id-maven-plugin.version>
        <pomchecker-maven-plugin.version>1.14.0</pomchecker-maven-plugin.version>

        <!-- Dependency versions -->
        <spring-boot.version>3.5.14</spring-boot.version>
        <testcontainers.version>2.0.5</testcontainers.version>
        <jspecify.version>1.0.0</jspecify.version>

        <!-- OpenAPI stack. These three versions are coupled and MUST be bumped together.
             springdoc is built against one specific Swagger version, and mixing Swagger
             versions does not merely downgrade a feature: swagger-core calls annotation
             members that only exist in its own release, so a split stack throws
             NoSuchMethodError at runtime.
             To find the matching values for a new springdoc release, open
             org/springdoc/springdoc-openapi/<version>/springdoc-openapi-<version>.pom
             and read <swagger-api.version> and <swagger-ui.version>. They are not
             exposed by springdoc-openapi-bom, which manages springdoc artifacts only.

             Floor: io.swagger.core.v3:swagger-bom was first published at 2.2.47, so
             swagger.version cannot go below that. A springdoc release pinned to an
             older Swagger would need the three jakarta artifacts pinned individually
             instead of the BOM import. -->
        <springdoc.version>2.8.17</springdoc.version>
        <swagger.version>2.2.47</swagger.version>
        <swagger-ui.version>5.32.2</swagger-ui.version>
    </properties>

    <distributionManagement>
        <snapshotRepository>
            <id>central-portal-snapshots</id>
            <name>Central Portal Snapshots</name>
            <url>https://central.sonatype.com/repository/maven-snapshots/</url>
        </snapshotRepository>
    </distributionManagement>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.testcontainers</groupId>
                <artifactId>testcontainers-bom</artifactId>
                <version>${testcontainers.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-dependencies</artifactId>
                <version>${spring-boot.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <!-- OpenAPI stack, kept version-uniform for every child project.
                 springdoc-openapi-bom manages the springdoc starters and nothing else;
                 the Swagger versions it is built against are deliberately not part of
                 that contract, so swagger-bom is imported alongside it. Without the
                 second import Swagger floats and nearest-wins mediation can split the
                 stack across incompatible releases. -->
            <dependency>
                <groupId>org.springdoc</groupId>
                <artifactId>springdoc-openapi-bom</artifactId>
                <version>${springdoc.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>io.swagger.core.v3</groupId>
                <artifactId>swagger-bom</artifactId>
                <version>${swagger.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <!-- Covered by neither BOM: springdoc pulls the Swagger UI webjar
                 transitively and its version belongs to the same coupled set. -->
            <dependency>
                <groupId>org.webjars</groupId>
                <artifactId>swagger-ui</artifactId>
                <version>${swagger-ui.version}</version>
            </dependency>
            <dependency>
                <groupId>org.jspecify</groupId>
                <artifactId>jspecify</artifactId>
                <version>${jspecify.version}</version>
                <scope>compile</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-resources-plugin</artifactId>
                    <version>${maven-resources-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-compiler-plugin</artifactId>
                    <version>${maven-compiler-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-surefire-plugin</artifactId>
                    <version>${maven-surefire-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-javadoc-plugin</artifactId>
                    <version>${maven-javadoc-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-source-plugin</artifactId>
                    <version>${maven-source-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-gpg-plugin</artifactId>
                    <version>${maven-gpg-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-jar-plugin</artifactId>
                    <version>${maven-jar-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-deploy-plugin</artifactId>
                    <version>${maven-deploy-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-clean-plugin</artifactId>
                    <version>${maven-clean-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-enforcer-plugin</artifactId>
                    <version>${maven-enforcer-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.cyclonedx</groupId>
                    <artifactId>cyclonedx-maven-plugin</artifactId>
                    <version>${cyclonedx-maven-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.jreleaser</groupId>
                    <artifactId>jreleaser-maven-plugin</artifactId>
                    <version>${jreleaser-maven-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.codehaus.mojo</groupId>
                    <artifactId>versions-maven-plugin</artifactId>
                    <version>${versions-maven-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>com.diffplug.spotless</groupId>
                    <artifactId>spotless-maven-plugin</artifactId>
                    <version>${spotless-maven-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>io.github.git-commit-id</groupId>
                    <artifactId>git-commit-id-maven-plugin</artifactId>
                    <version>${git-commit-id-maven-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.kordamp.maven</groupId>
                    <artifactId>pomchecker-maven-plugin</artifactId>
                    <version>${pomchecker-maven-plugin.version}</version>
                </plugin>
            </plugins>
        </pluginManagement>

        <plugins>
            <plugin>
                <groupId>com.diffplug.spotless</groupId>
                <artifactId>spotless-maven-plugin</artifactId>
                <configuration>
                    <!-- Spotless defaults to GIT_ATTRIBUTES, so in a child project without its own
                         .gitattributes it writes whatever the local core.autocrlf implies - CRLF on
                         a Windows default install. UNIX makes the formatter's output independent of
                         the developer's platform and Git configuration for every inheriting project.
                         This does not make a child's sources jar LF-clean on its own; that still
                         requires the child to carry a .gitattributes (see README). -->
                    <lineEndings>UNIX</lineEndings>
                    <java>
                        <googleJavaFormat/>
                    </java>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
                <executions>
                    <execution>
                        <id>enforce-build-environment</id>
                        <goals>
                            <goal>enforce</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <requireMavenVersion>
                                    <version>${enforcer.requiredMavenVersion}</version>
                                </requireMavenVersion>
                                <requireJavaVersion>
                                    <version>${enforcer.requiredJavaVersion}</version>
                                </requireJavaVersion>
                            </rules>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>versions-maven-plugin</artifactId>
                <configuration>
                    <generateBackupPoms>false</generateBackupPoms>
                    <overwriteOutput>true</overwriteOutput>
                </configuration>
            </plugin>
        </plugins>
    </build>

    <profiles>
        <profile>
            <!-- The full-build profile is used for snapshot and release builds that are deployed / published.
            It generates a git commit id and other git metadata, attaches javadocs and sources, and generates a CycloneDX SBOM.
            Check .github/workflows/snapshot.yml and .github/workflows/release.yml to see how it is used. -->
            <id>full-build</id>
            <build>
                <defaultGoal>verify</defaultGoal>
                <plugins>
                    <plugin>
                        <groupId>io.github.git-commit-id</groupId>
                        <artifactId>git-commit-id-maven-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>get-the-git-infos</id>
                                <goals>
                                    <goal>revision</goal>
                                </goals>
                                <phase>initialize</phase>
                            </execution>
                        </executions>
                        <configuration>
                            <!-- No git.properties file: a shared /git.properties collides on a
                                 consumer's classpath (only the first jar's copy is ever read).
                                 The git infos are written into each jar's own MANIFEST.MF below. -->
                            <generateGitPropertiesFile>false</generateGitPropertiesFile>
                            <commitIdGenerationMode>full</commitIdGenerationMode>
                            <!-- Reproducible builds: format the commit time in a fixed format and
                                 in UTC, so the rendered string does not depend on the build
                                 machine's locale or timezone. -->
                            <dateFormat>yyyy-MM-dd'T'HH:mm:ss'Z'</dateFormat>
                            <dateFormatTimeZone>UTC</dateFormatTimeZone>
                            <!-- A build from a published source archive (no .git) must not fail;
                                 this also lets third parties verify reproducibility from sources. -->
                            <failOnNoGitDirectory>false</failOnNoGitDirectory>
                            <!-- Reproducible builds: exclude every property that varies between
                                 builds of the same commit (build time, host, the build machine's
                                 git user, and remote-tracking state). Only commit-/repo-derived
                                 values that are deterministic for a given commit are kept. -->
                            <excludeProperties>
                                <excludeProperty>git.build.time</excludeProperty>
                                <excludeProperty>git.build.host</excludeProperty>
                                <excludeProperty>git.build.user.name</excludeProperty>
                                <excludeProperty>git.build.user.email</excludeProperty>
                                <excludeProperty>git.local.branch.ahead</excludeProperty>
                                <excludeProperty>git.local.branch.behind</excludeProperty>
                            </excludeProperties>
                        </configuration>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-jar-plugin</artifactId>
                        <configuration>
                            <archive>
                                <!-- Git metadata lives in the per-jar manifest (no classpath
                                     collision). All values are commit-/repo-derived and thus
                                     deterministic for a given commit, keeping builds reproducible. -->
                                <manifestEntries>
                                    <Git-Commit>${git.commit.id.abbrev}</Git-Commit>
                                    <Git-Commit-Time>${git.commit.time}</Git-Commit-Time>
                                    <Git-Branch>${git.branch}</Git-Branch>
                                    <Git-Tag>${git.tags}</Git-Tag>
                                    <Git-Dirty>${git.dirty}</Git-Dirty>
                                </manifestEntries>
                            </archive>
                        </configuration>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-javadoc-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>attach-javadocs</id>
                                <goals>
                                    <goal>jar</goal>
                                </goals>
                                <configuration>
                                    <attach>true</attach>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-source-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>attach-sources</id>
                                <goals>
                                    <goal>jar</goal>
                                </goals>
                                <configuration>
                                    <attach>true</attach>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.cyclonedx</groupId>
                        <artifactId>cyclonedx-maven-plugin</artifactId>
                        <executions>
                            <execution>
                                <phase>package</phase>
                                <goals>
                                    <goal>makeBom</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <!-- Validates every POM against Maven Central's publishing rules
                             (url, name, description, licenses, developers, scm, ...) as part
                             of the build, so a missing required field fails here rather than
                             later during the JReleaser deploy. SNAPSHOT versions are allowed
                             (release=false), so this also runs cleanly on snapshot builds. -->
                        <groupId>org.kordamp.maven</groupId>
                        <artifactId>pomchecker-maven-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>check-maven-central</id>
                                <phase>verify</phase>
                                <goals>
                                    <goal>check-maven-central</goal>
                                </goals>
                                <configuration>
                                    <release>false</release>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <profile>
            <!-- The deploy-release profile is used for release builds that are deployed to Maven Central and published on GitHub.
                 It signs artifacts, deploys them to Maven Central, and creates a GitHub release with changelog.
                 Check .github/workflows/release.yml to see how it is used. -->
            <id>deploy-release</id>
            <build>
                <defaultGoal>deploy</defaultGoal>
                <plugins>
                    <plugin>
                        <groupId>org.jreleaser</groupId>
                        <artifactId>jreleaser-maven-plugin</artifactId>
                        <configuration>
                            <jreleaser>
                                <signing>
                                    <pgp>
                                        <active>ALWAYS</active>
                                        <armored>true</armored>
                                    </pgp>
                                </signing>
                                <deploy>
                                    <maven>
                                        <mavenCentral>
                                            <sonatype>
                                                <active>ALWAYS</active>
                                                <url>https://central.sonatype.com/api/v1/publisher</url>
                                                <stagingRepositories>target/staging-deploy</stagingRepositories>
                                            </sonatype>
                                        </mavenCentral>
                                    </maven>
                                </deploy>
                                <release>
                                    <github>
                                        <owner>${release.github.owner}</owner>
                                        <name>${release.github.repo}</name>
                                        <changelog>
                                            <formatted>ALWAYS</formatted>
                                            <preset>conventional-commits</preset>
                                        </changelog>
                                    </github>
                                </release>
                            </jreleaser>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>
</project>