pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>com.voxgig</groupId>
  <artifactId>struct-java</artifactId>
  <version>0.1.1</version>
  <name>voxgig-struct-java</name>
  <description>Voxgig Struct — utilities for transforming JSON-like data structures (Java port).</description>
  <url>https://github.com/voxgig/struct</url>

  <licenses>
    <license>
      <name>MIT License</name>
      <url>https://opensource.org/licenses/MIT</url>
      <distribution>repo</distribution>
    </license>
  </licenses>

  <developers>
    <developer>
      <id>voxgig</id>
      <name>Voxgig</name>
      <organization>Voxgig</organization>
      <organizationUrl>https://voxgig.com</organizationUrl>
    </developer>
  </developers>

  <scm>
    <connection>scm:git:https://github.com/voxgig/struct.git</connection>
    <developerConnection>scm:git:git@github.com:voxgig/struct.git</developerConnection>
    <url>https://github.com/voxgig/struct</url>
  </scm>

  <!-- Publishing goes through the Sonatype Central Portal via the
       central-publishing-maven-plugin (see the `release` profile) — NOT the
       legacy OSSRH/Nexus staging API, which Sonatype shut down on 2025-06-30.
       The plugin uploads the bundle to the Portal; there is no
       distributionManagement repository. Portal user-token credentials
       (server id = central) come from a settings.xml at release time. -->

  <properties>
    <maven.compiler.source>17</maven.compiler.source>
    <maven.compiler.target>17</maven.compiler.target>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <junit.jupiter.version>6.1.0</junit.jupiter.version>
    <gson.version>2.14.0</gson.version>
    <checkstyle.plugin.version>3.6.0</checkstyle.plugin.version>
    <checkstyle.version>13.5.0</checkstyle.version>
    <spotbugs.plugin.version>4.9.8.3</spotbugs.plugin.version>
    <central.publishing.plugin.version>0.11.0</central.publishing.plugin.version>
  </properties>

  <dependencies>
    <!-- Gson is used ONLY by the test harness (corpus loading + assertion
         diffs). The library proper has no third-party JSON dependency. -->
    <dependency>
      <groupId>com.google.code.gson</groupId>
      <artifactId>gson</artifactId>
      <version>${gson.version}</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>org.junit.jupiter</groupId>
      <artifactId>junit-jupiter</artifactId>
      <version>${junit.jupiter.version}</version>
      <scope>test</scope>
    </dependency>
  </dependencies>

  <build>
    <sourceDirectory>src</sourceDirectory>
    <testSourceDirectory>src/test</testSourceDirectory>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <version>3.14.0</version>
        <configuration>
          <excludes>
            <exclude>test/**</exclude>
          </excludes>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-surefire-plugin</artifactId>
        <version>3.5.2</version>
        <configuration>
          <useModulePath>false</useModulePath>
        </configuration>
      </plugin>

      <!-- Code quality: Checkstyle (style) -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-checkstyle-plugin</artifactId>
        <version>${checkstyle.plugin.version}</version>
        <dependencies>
          <dependency>
            <groupId>com.puppycrawl.tools</groupId>
            <artifactId>checkstyle</artifactId>
            <version>${checkstyle.version}</version>
          </dependency>
        </dependencies>
        <configuration>
          <configLocation>${project.basedir}/checkstyle.xml</configLocation>
          <includeTestSourceDirectory>true</includeTestSourceDirectory>
          <consoleOutput>true</consoleOutput>
          <failsOnError>true</failsOnError>
          <violationSeverity>warning</violationSeverity>
        </configuration>
        <executions>
          <execution>
            <id>checkstyle</id>
            <phase>verify</phase>
            <goals>
              <goal>check</goal>
            </goals>
          </execution>
        </executions>
      </plugin>

      <!-- Code quality: SpotBugs (bug pattern detection) -->
      <plugin>
        <groupId>com.github.spotbugs</groupId>
        <artifactId>spotbugs-maven-plugin</artifactId>
        <version>${spotbugs.plugin.version}</version>
        <configuration>
          <effort>Max</effort>
          <threshold>Medium</threshold>
          <includeTests>false</includeTests>
          <excludeFilterFile>${project.basedir}/spotbugs-exclude.xml</excludeFilterFile>
        </configuration>
        <executions>
          <execution>
            <id>spotbugs</id>
            <phase>verify</phase>
            <goals>
              <goal>check</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>

  <profiles>
    <!-- The shared test runner, voxgig/omni, consumed as a local checkout: it
         is not published to Maven Central. `make test` builds its jar, installs
         it into the local repository (see `setup-omni`) and activates this
         profile, so it resolves like any other test-scoped dependency.

         Two things it is deliberately NOT:

         Not `system` scope, the obvious shortcut. A system-scoped dependency
         sits on the COMPILE classpath, so omni would reach the library's own
         build and its published POM - the leak register 4.13 is about.

         Not an unconditional test-scoped dependency either, which is where
         this started. Test scope keeps omni off consumers' classpaths, but
         the coordinate still sits in the POM, and anything that resolves the
         POM statically - osv-scanner's transitive dependency scan, for one -
         goes looking for com.voxgig:omni:0.1.0 on Central and fails hard:

             failed resolving {Maven:com.voxgig:struct-java[Concrete:0.1.0]}:
             version Maven:com.voxgig:omni[Concrete:0.1.0]: not found

         An inactive profile is invisible to that resolution. `mvn test` on its
         own now fails to COMPILE the test sources ("package voxgig.omni does
         not exist"); use `make test`, which passes -Pomni. -->
    <profile>
      <id>omni</id>
      <dependencies>
        <dependency>
          <groupId>com.voxgig</groupId>
          <artifactId>omni</artifactId>
          <version>0.1.0</version>
          <scope>test</scope>
        </dependency>
      </dependencies>
    </profile>

    <!-- Release profile: attaches the sources + javadoc jars (required by
         Maven Central) and signs all artifacts with GPG. Signing is bound to
         the `verify` phase, so a plain `mvn -Prelease package` produces the
         three jars WITHOUT needing a GPG key; the key is only required once
         the build reaches `verify`/`deploy` (see the Makefile `publish`
         target). The GPG key + passphrase are operator-provided at release. -->
    <profile>
      <id>release</id>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-source-plugin</artifactId>
            <version>3.3.1</version>
            <configuration>
              <!-- Test sources physically live under src/test (same source
                   dir as the library); keep them out of the published jar. -->
              <excludes>
                <exclude>test/**</exclude>
              </excludes>
            </configuration>
            <executions>
              <execution>
                <id>attach-sources</id>
                <phase>package</phase>
                <goals>
                  <goal>jar-no-fork</goal>
                </goals>
              </execution>
            </executions>
          </plugin>

          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-javadoc-plugin</artifactId>
            <version>3.11.2</version>
            <configuration>
              <!-- The ported source is large/dense; relax doclint and never
                   fail the build on javadoc warnings so the jar still builds. -->
              <doclint>none</doclint>
              <failOnError>false</failOnError>
              <!-- Exclude the test sources (they share the voxgig.struct
                   package but sit in src/test and pull in test-scope deps),
                   so javadoc documents only the library API. -->
              <sourceFileExcludes>
                <sourceFileExclude>test/**</sourceFileExclude>
              </sourceFileExcludes>
            </configuration>
            <executions>
              <execution>
                <id>attach-javadoc</id>
                <phase>package</phase>
                <goals>
                  <goal>jar</goal>
                </goals>
              </execution>
            </executions>
          </plugin>

          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-gpg-plugin</artifactId>
            <version>3.2.7</version>
            <configuration>
              <!-- Headless signing: read the passphrase from the environment
                   (MAVEN_GPG_PASSPHRASE) and drive gpg with loopback pinentry
                   so it never prompts on a TTY. -->
              <gpgArguments>
                <arg>--pinentry-mode</arg>
                <arg>loopback</arg>
              </gpgArguments>
            </configuration>
            <executions>
              <execution>
                <id>sign-artifacts</id>
                <!-- verify (not package) so `package` does NOT require a key. -->
                <phase>verify</phase>
                <goals>
                  <goal>sign</goal>
                </goals>
              </execution>
            </executions>
          </plugin>

          <!-- Upload + release to the Sonatype Central Portal (replaces the
               retired OSSRH staging API). autoPublish=true releases without a
               manual gate; waitUntil=published blocks until Central finishes
               so a failed release fails the build (and we never tag). The
               `central` server token comes from the release settings.xml. -->
          <plugin>
            <groupId>org.sonatype.central</groupId>
            <artifactId>central-publishing-maven-plugin</artifactId>
            <version>${central.publishing.plugin.version}</version>
            <extensions>true</extensions>
            <configuration>
              <publishingServerId>central</publishingServerId>
              <autoPublish>true</autoPublish>
              <waitUntil>published</waitUntil>
            </configuration>
          </plugin>
        </plugins>
      </build>
    </profile>
  </profiles>
</project>