<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>

    <groupId>se.ayoy.maven-plugins</groupId>
    <artifactId>ayoy-license-verifier-maven-plugin</artifactId>
    <version>1.2.0</version>
    <packaging>maven-plugin</packaging>

    <name>${project.groupId}:${project.artifactId}</name>
    <description>A maven plugin to verify dependency licenses.
        If an unknown or "bad" license is detected, the build will fail.</description>
    <url>https://github.com/AyoyAB/Ayoy-Maven-License-Verifier-Plugin</url>

    <inceptionYear>2017</inceptionYear>

    <licenses>
        <license>
            <name>The Apache Software License, Version 2.0</name>
            <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
            <distribution>repo</distribution>
        </license>
    </licenses>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <minMavenVersion>3.2.5</minMavenVersion>
        <maven.compiler.source>11</maven.compiler.source>
        <maven.compiler.target>11</maven.compiler.target>
    </properties>

    <prerequisites>
        <maven>${minMavenVersion}</maven>
    </prerequisites>

    <developers>
        <developer>
            <id>smuda</id>
            <name>John Allberg</name>
            <email>john+github@ayoy.se</email>
            <url>https://www.ayoy.se</url>
            <organization>Ayoy AB</organization>
            <organizationUrl>https://www.ayoy.se</organizationUrl>
        </developer>
    </developers>
    <contributors>
        <contributor>
            <name>Tibor Digaňa</name>
            <email>tibordigana@apache.org</email>
            <url>https://github.com/Tibor17/</url>
        </contributor>
        <contributor>
            <name>Mads Opheim</name>
            <email>mads.opheim@gmail.com</email>
            <url>https://github.com/madsop/</url>
        </contributor>
    </contributors>

    <scm>
        <connection>https://github.com/AyoyAB/Ayoy-Maven-License-Verifier-Plugin.git</connection>
        <developerConnection>https://github.com/AyoyAB/Ayoy-Maven-License-Verifier-Plugin.git</developerConnection>
        <url>https://github.com/AyoyAB/Ayoy-Maven-License-Verifier-Plugin.git</url>
    </scm>

    <distributionManagement>
        <snapshotRepository>
            <id>ossrh</id>
            <url>https://oss.sonatype.org/content/repositories/snapshots</url>
        </snapshotRepository>
        <repository>
            <id>ossrh</id>
            <url>https://oss.sonatype.org/service/local/staging/deploy/maven2/</url>
        </repository>
    </distributionManagement>

    <dependencies>
        <dependency>
            <groupId>org.apache.maven</groupId>
            <artifactId>maven-plugin-api</artifactId>
            <version>3.2.5</version>
        </dependency>

        <dependency>
            <groupId>org.apache.maven.shared</groupId>
            <artifactId>maven-dependency-tree</artifactId>
            <version>3.0.1</version>
        </dependency>

        <!-- dependencies to annotations -->
        <dependency>
            <groupId>org.apache.maven.plugin-tools</groupId>
            <artifactId>maven-plugin-annotations</artifactId>
            <version>3.6.0</version>
        </dependency>
        <dependency>
            <groupId>org.apache.maven</groupId>
            <artifactId>maven-core</artifactId>
            <version>3.2.5</version>
        </dependency>

        <!-- local upgrades of dependencies to dependencies -->
        <dependency>
            <!-- CVE-2017-1000487 -->
            <!-- Dependency of org.apache.maven:maven-core:3.0.5 -->
            <groupId>org.codehaus.plexus</groupId>
            <artifactId>plexus-utils</artifactId>
            <version>3.2.0</version>
        </dependency>
        <dependency>
            <!-- CVE-2018-10237 -->
            <!--
              Dependency of
              org.apache.maven:maven-core:jar:3.2.5
              -> org.sonatype.sisu:sisu-guice:jar:no_aop:3.2.3
                 -> com.google.guava:guava:jar:16.0.1
            -->
            <groupId>com.google.guava</groupId>
            <artifactId>guava</artifactId>
            <version>24.1.1-jre</version>
        </dependency>

        <!-- dependencies for unit test -->
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.13.1</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.mockito</groupId>
            <artifactId>mockito-all</artifactId>
            <version>1.10.19</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.powermock</groupId>
            <artifactId>powermock-reflect</artifactId>
            <version>2.0.9</version>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <!-- these plugins are in-directly used and is specified in the super-pom -->
            <plugin>
                <artifactId>maven-clean-plugin</artifactId>
                <version>3.1.0</version>
            </plugin>
            <plugin>
                <artifactId>maven-deploy-plugin</artifactId>
                <version>3.0.0-M1</version>
            </plugin>
            <plugin>
                <artifactId>maven-install-plugin</artifactId>
                <version>3.0.0-M1</version>
            </plugin>
            <plugin>
                <artifactId>maven-jar-plugin</artifactId>
                <version>3.2.0</version>
            </plugin>
            <plugin>
                <artifactId>maven-resources-plugin</artifactId>
                <version>3.2.0</version>
            </plugin>
            <plugin>
                <artifactId>maven-site-plugin</artifactId>
                <version>3.9.1</version>
            </plugin>
            <plugin>
                <artifactId>maven-plugin-plugin</artifactId>
                <version>3.6.0</version>
            </plugin>
            <!-- these plugins are directly used -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.8.1</version>
                <configuration>
                    <source>${maven.compiler.source}</source>
                    <target>${maven.compiler.target}</target>
                    <fork>true</fork>
                </configuration>
            </plugin>

            <!-- Code analysis plugins -->
            <plugin>
                <groupId>com.github.spotbugs</groupId>
                <artifactId>spotbugs-maven-plugin</artifactId>
                <version>4.1.4</version>
                <configuration>
                    <xmlOutput>true</xmlOutput>
                    <!-- Optional directory to put findbugs xdoc xml report -->
                    <xmlOutputDirectory>target</xmlOutputDirectory>
                    <effort>Max</effort>
                    <threshold>Low</threshold>
                    <failOnError>true</failOnError>
                    <plugins>
                        <!--<plugin>
                            <groupId>com.h3xstream.findsecbugs</groupId>
                            <artifactId>findsecbugs-plugin</artifactId>
                            <version>1.9.0</version>
                        </plugin>-->
                    </plugins>
                </configuration>
                <executions>
                    <execution>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>3.0.0-M5</version>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-invoker-plugin</artifactId>
                <version>3.2.1</version>
                <executions>
                    <execution>
                        <id>pre-its</id>
                        <phase>pre-integration-test</phase>
                        <goals>
                            <goal>install</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>integration-tests</id>
                        <goals>
                            <goal>run</goal>
                        </goals>
                        <configuration>
                            <cloneProjectsTo>${project.build.directory}/it</cloneProjectsTo>
                            <postBuildHookScript>verify</postBuildHookScript>
                            <streamLogs>true</streamLogs>
                            <showErrors>true</showErrors>
                            <goals>
                                <goal>initialize</goal>
                            </goals>
                        </configuration>
                    </execution>
                    <execution>
                        <id>verify-integration-tests</id>
                        <goals>
                            <goal>verify</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <skipInvocation>${skipITs}</skipInvocation>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-pmd-plugin</artifactId>
                <version>3.14.0</version>
                <configuration>
                    <format>xml</format>
                    <failOnViolation>true</failOnViolation>
                </configuration>
                <executions>
                    <execution>
                        <goals>
                            <goal>pmd</goal>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.owasp</groupId>
                <artifactId>dependency-check-maven</artifactId>
                <version>6.0.3</version>
                <executions>
                    <execution>
                        <goals>
                            <goal>check</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <suppressionFile>dependency-check-suppress.xml</suppressionFile>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-checkstyle-plugin</artifactId>
                <version>3.1.1</version>
                <dependencies>
                    <dependency>
                        <groupId>com.puppycrawl.tools</groupId>
                        <artifactId>checkstyle</artifactId>
                        <version>8.36</version>
                    </dependency>
                </dependencies>
                <executions>
                    <execution>
                        <phase>process-sources</phase>
                        <goals>
                            <!-- Enable to break build on error -->
                            <goal>check</goal>
                            <goal>checkstyle</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <consoleOutput>true</consoleOutput>
                    <skip>false</skip>
                    <suppressionsLocation>checkstyle-suppressions.xml</suppressionsLocation>
                    <configLocation>checkstyle-conf.xml</configLocation>
                </configuration>
            </plugin>
            <plugin>
                <groupId>se.ayoy.maven-plugins</groupId>
                <artifactId>ayoy-license-verifier-maven-plugin</artifactId>
                <version>1.1.0</version>
                <executions>
                    <execution>
                        <phase>compile</phase>
                        <goals>
                            <goal>verify</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <licenseFile>${project.basedir}/src/licenses/licenses.xml</licenseFile>
                    <excludedMissingLicensesFile>${project.basedir}/src/licenses/allowedMissingLicense.xml</excludedMissingLicensesFile>
                    <failOnForbidden>true</failOnForbidden>
                    <failOnMissing>true</failOnMissing>
                    <failOnUnknown>true</failOnUnknown>
                </configuration>
            </plugin>
        </plugins>
    </build>
    <profiles>
        <profile>
            <id>release</id>
            <build>
                <plugins>
                    <!-- build javadoc and sources -->
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-source-plugin</artifactId>
                        <version>3.2.1</version>
                        <executions>
                            <execution>
                                <id>attach-sources</id>
                                <goals>
                                    <goal>jar-no-fork</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-javadoc-plugin</artifactId>
                        <version>3.2.0</version>
                        <executions>
                            <execution>
                                <id>attach-javadocs</id>
                                <goals>
                                    <goal>jar</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>

                    <!-- plugin to sign the stuff to be published -->
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-gpg-plugin</artifactId>
                        <version>1.6</version>
                        <executions>
                            <execution>
                                <id>sign-artifacts</id>
                                <phase>verify</phase>
                                <goals>
                                    <goal>sign</goal>
                                </goals>
                            </execution>
                        </executions>
                        <configuration>
                            <keyname>${gpg.keyname}</keyname>
                        </configuration>
                    </plugin>

                    <!-- plugin to publish the project -->
                    <plugin>
                        <groupId>org.sonatype.plugins</groupId>
                        <artifactId>nexus-staging-maven-plugin</artifactId>
                        <version>1.6.8</version>
                        <extensions>true</extensions>
                        <configuration>
                            <serverId>ossrh</serverId>
                            <nexusUrl>https://oss.sonatype.org/</nexusUrl>
                            <autoReleaseAfterClose>true</autoReleaseAfterClose>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>

    <reporting>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jxr-plugin</artifactId>
                <version>3.0.0</version>
            </plugin>
        </plugins>
    </reporting>
</project>