pom.xml

<?xml version="1.0" encoding="UTF-8"?>

<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">

    <modelVersion>4.0.0</modelVersion>
    <groupId>com.codedx</groupId>
    <artifactId>codedx-bamboo-plugin</artifactId>
    <version>3.0.0</version>

    <organization>
        <name>Code Dx</name>
        <url>https://www.codedx.com/</url>
    </organization>

    <name>codedx-bamboo-plugin</name>
    <description>This is the com.codedx:codedx-bamboo-plugin plugin for Atlassian Bamboo.</description>
    <packaging>atlassian-plugin</packaging>

    <properties>
        <bamboo.version>12.0.0</bamboo.version>
        <bamboo.data.version>${bamboo.version}</bamboo.data.version>
        <amps.version>9.12.1</amps.version>
        <plugin.testrunner.version>2.0.2</plugin.testrunner.version>
        <atlassian.spring.scanner.version>6.0.2</atlassian.spring.scanner.version>
        <jersey-version>3.1.11</jersey-version>
        <jackson-version>2.21.1</jackson-version>
        <jackson-annotations-version>2.21</jackson-annotations-version>
        <jackson-databind-version>2.21.1</jackson-databind-version>
        <jackson-databind-nullable-version>0.2.9</jackson-databind-nullable-version>
        <jakarta-annotation-version>2.1.1</jakarta-annotation-version>
        <!-- This key is used to keep the consistency between the key in atlassian-plugin.xml and the key to generate bundle. -->
        <atlassian.plugin.key>${project.groupId}.${project.artifactId}</atlassian.plugin.key>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <maven.compiler.source>21</maven.compiler.source>
        <maven.compiler.target>21</maven.compiler.target>
        <junit-version>4.13.2</junit-version>
        <swagger-core-version>1.5.15</swagger-core-version>
        <enforcer.skip>true</enforcer.skip>
    </properties>

    <dependencies>

        <!--
            jersey-shaded: Jersey 3.x + HK2 relocated to com.codedx.shaded.jersey.* and
            com.codedx.shaded.hk2.* so they do not conflict with Bamboo's parent-first
            org.glassfish.jersey.* / org.glassfish.hk2.* packages in atlassian-plugins-osgi.
            Build this module first: cd jersey-shaded && atlas-mvn install

            All original Jersey/HK2 JARs are excluded here because they are already shaded
            (relocated) inside jersey-shaded-2.0.1.jar. Without these exclusions, Maven
            would resolve the transitive deps and AMPS would embed the original
            org.glassfish.jersey.* classes alongside the shaded ones.
        -->
        <dependency>
            <groupId>com.codedx</groupId>
            <artifactId>jersey-shaded</artifactId>
            <version>3.0.0</version>
            <exclusions>
                <exclusion>
                    <groupId>org.glassfish.jersey.core</groupId>
                    <artifactId>jersey-client</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.glassfish.jersey.core</groupId>
                    <artifactId>jersey-common</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.glassfish.jersey.inject</groupId>
                    <artifactId>jersey-hk2</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.glassfish.jersey.media</groupId>
                    <artifactId>jersey-media-multipart</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.glassfish.jersey.media</groupId>
                    <artifactId>jersey-media-json-jackson</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.glassfish.jersey.ext</groupId>
                    <artifactId>jersey-entity-filtering</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.glassfish.jersey.connectors</groupId>
                    <artifactId>jersey-apache-connector</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.glassfish.hk2</groupId>
                    <artifactId>hk2-api</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.glassfish.hk2</groupId>
                    <artifactId>hk2-locator</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.glassfish.hk2</groupId>
                    <artifactId>hk2-utils</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.glassfish.hk2</groupId>
                    <artifactId>osgi-resource-locator</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.glassfish.hk2.external</groupId>
                    <artifactId>aopalliance-repackaged</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>jakarta.ws.rs</groupId>
                    <artifactId>jakarta.ws.rs-api</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>jakarta.annotation</groupId>
                    <artifactId>jakarta.annotation-api</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>com.fasterxml.jackson.core</groupId>
                    <artifactId>jackson-core</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>com.fasterxml.jackson.core</groupId>
                    <artifactId>jackson-databind</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>com.fasterxml.jackson.core</groupId>
                    <artifactId>jackson-annotations</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>com.fasterxml.jackson.module</groupId>
                    <artifactId>jackson-module-jakarta-xmlbind-annotations</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>jakarta.xml.bind</groupId>
                    <artifactId>jakarta.xml.bind-api</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>jakarta.activation</groupId>
                    <artifactId>jakarta.activation-api</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>jakarta.inject</groupId>
                    <artifactId>jakarta.inject-api</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.jvnet.mimepull</groupId>
                    <artifactId>mimepull</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>commons-logging</groupId>
                    <artifactId>commons-logging</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <!--
            jakarta.ws.rs-api: needed on the compile classpath (ApiClient.java uses jakarta.ws.rs.*).
            Bamboo 12.x provides jakarta.ws.rs 3.1.0 parent-first via its webapp classloader,
            so this must be 'provided' — embedding it causes AMPS to extract jakarta.ws.rs.*
            classes into the plugin bundle root, creating a classloader split-brain.
        -->
        <dependency>
            <groupId>jakarta.ws.rs</groupId>
            <artifactId>jakarta.ws.rs-api</artifactId>
            <version>3.1.0</version>
            <scope>provided</scope>
        </dependency>

        <dependency>
            <groupId>io.swagger</groupId>
            <artifactId>swagger-annotations</artifactId>
            <version>${swagger-core-version}</version>
        </dependency>

        <!-- test dependencies -->
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>${junit-version}</version>
            <scope>test</scope>
        </dependency>

        <dependency>
            <groupId>com.atlassian.bamboo</groupId>
            <artifactId>atlassian-bamboo-web</artifactId>
            <version>${bamboo.version}</version>
            <scope>provided</scope>
            <exclusions>
                <exclusion>
                    <groupId>org.glassfish.jersey.core</groupId>
                    <artifactId>jersey-common</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.glassfish.jersey.core</groupId>
                    <artifactId>jersey-server</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.glassfish.jersey.containers</groupId>
                    <artifactId>jersey-container-servlet</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.glassfish.jersey.containers</groupId>
                    <artifactId>jersey-container-servlet-core</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.glassfish.jersey.media</groupId>
                    <artifactId>jersey-media-jaxb</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.glassfish.hk2</groupId>
                    <artifactId>osgi-resource-locator</artifactId>
                </exclusion>
                <!--
                    net.sf.ehcache:ehcache:2.10.9.4.10 is an Atlassian-patched version that
                    does not exist in Maven Central and is not reliably available in
                    atlassian-public. Since atlassian-bamboo-web is 'provided', Bamboo
                    supplies ehcache at runtime — we do not need to resolve it here.
                -->
                <exclusion>
                    <groupId>net.sf.ehcache</groupId>
                    <artifactId>ehcache</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <dependency>
            <groupId>com.google.code.gson</groupId>
            <artifactId>gson</artifactId>
            <version>2.8.9</version>
            <scope>provided</scope>
        </dependency>

        <!-- JSON processing: jackson -->
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-core</artifactId>
            <version>${jackson-version}</version>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-annotations</artifactId>
            <version>${jackson-annotations-version}</version>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
            <version>${jackson-databind-version}</version>
        </dependency>
        <dependency>
            <groupId>org.openapitools</groupId>
            <artifactId>jackson-databind-nullable</artifactId>
            <version>${jackson-databind-nullable-version}</version>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.datatype</groupId>
            <artifactId>jackson-datatype-jsr310</artifactId>
            <version>${jackson-version}</version>
        </dependency>
        <!-- Required by jersey-media-json-jackson's DefaultJacksonJaxbJsonProvider at runtime -->
        <dependency>
            <groupId>com.fasterxml.jackson.module</groupId>
            <artifactId>jackson-module-jakarta-xmlbind-annotations</artifactId>
            <version>${jackson-version}</version>
            <exclusions>
                <!--
                    jakarta.xml.bind-api and jakarta.activation-api are transitive compile-scope
                    deps of this module. Bamboo 12.x provides these parent-first, so we must
                    exclude them here to prevent AMPS from copying their classes into the bundle root.
                -->
                <exclusion>
                    <groupId>jakarta.xml.bind</groupId>
                    <artifactId>jakarta.xml.bind-api</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>jakarta.activation</groupId>
                    <artifactId>jakarta.activation-api</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>com.sun.activation</groupId>
                    <artifactId>jakarta.activation</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>javax.xml.bind</groupId>
                    <artifactId>jaxb-api</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>com.sun.istack</groupId>
                    <artifactId>istack-commons-runtime</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>com.sun.xml.fastinfoset</groupId>
                    <artifactId>FastInfoset</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.glassfish.jaxb</groupId>
                    <artifactId>jaxb-runtime</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>jakarta.annotation</groupId>
            <artifactId>jakarta.annotation-api</artifactId>
            <version>${jakarta-annotation-version}</version>
            <scope>provided</scope>
        </dependency>

        <!-- Note: Required by Swagger-generated API client impl. for Basic Auth, but basic auth is not used here -->
        <dependency>
            <groupId>com.brsanthu</groupId>
            <artifactId>migbase64</artifactId>
            <version>2.2</version>
        </dependency>

    </dependencies>

    <dependencyManagement>
        <dependencies>
            <!--
                Override old org.glassfish.jaxb:jaxb-runtime versions that have broken POMs
                referencing defunct http://maven.java.net/ repositories. These old versions
                appear in dependency management of Bamboo's transitive deps and cause Maven
                to fail POM resolution. Overriding with a modern version avoids the issue.
            -->
            <dependency>
                <groupId>org.glassfish.jaxb</groupId>
                <artifactId>jaxb-runtime</artifactId>
                <version>4.0.5</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>javax.xml.bind</groupId>
                <artifactId>jaxb-api</artifactId>
                <version>2.3.1</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>com.sun.istack</groupId>
                <artifactId>istack-commons-runtime</artifactId>
                <version>4.1.2</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>com.sun.xml.fastinfoset</groupId>
                <artifactId>FastInfoset</artifactId>
                <version>2.1.1</version>
                <scope>provided</scope>
            </dependency>
            <!--
                Force jakarta.* packages that Bamboo 12.x provides parent-first to 'provided'
                scope so AMPS never copies their classes into the plugin bundle root.
            -->
            <dependency>
                <groupId>jakarta.xml.bind</groupId>
                <artifactId>jakarta.xml.bind-api</artifactId>
                <version>3.0.1</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>jakarta.activation</groupId>
                <artifactId>jakarta.activation-api</artifactId>
                <version>2.1.0</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>com.sun.activation</groupId>
                <artifactId>jakarta.activation</artifactId>
                <version>2.0.1</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>jakarta.inject</groupId>
                <artifactId>jakarta.inject-api</artifactId>
                <version>2.0.1</version>
                <scope>provided</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <build>
        <plugins>
            <plugin>
                <groupId>com.atlassian.maven.plugins</groupId>
                <artifactId>bamboo-maven-plugin</artifactId>
                <version>${amps.version}</version>
                <extensions>true</extensions>
                <configuration>
                    <productVersion>${bamboo.version}</productVersion>
                    <productDataVersion>${bamboo.data.version}</productDataVersion>
                    <enableQuickReload>true</enableQuickReload>
                    <bannedDependenciesCheck>false</bannedDependenciesCheck>
                    <instructions>
                        <Bundle-SymbolicName>${atlassian.plugin.key}</Bundle-SymbolicName>
                        <!--
                            No Export-Package or Import-Package exclusions needed for
                            org.glassfish.jersey.* / org.glassfish.hk2.* — those packages
                            no longer exist in our bundle. All Jersey/HK2 classes are now
                            under com.codedx.shaded.jersey.* / com.codedx.shaded.hk2.*
                            which are NOT in Atlassian's parent-first package list.
                        -->
                        <Import-Package>
                            !org.hibernate*,
                            !org.apache.avalon*,
                            !org.apache.logging*,
                            !com.sun.jdi*,
                            !com.sun.tools*,
                            !java.applet*,
                            !jdk.internal*,
                            !sun.misc*,
                            !javassist*,
                            !org.aopalliance*,
                            !com.opensymphony*,
                            jakarta.*;resolution:=optional,
                            *;resolution:=optional
                        </Import-Package>
                        <DynamicImport-Package></DynamicImport-Package>
                        <Embed-Dependency>
                            jersey-shaded,
                            jackson-core,
                            jackson-annotations,
                            jackson-databind,
                            jackson-databind-nullable,
                            jackson-datatype-jsr310,
                            jackson-module-jakarta-xmlbind-annotations,
                            migbase64,
                            swagger-annotations
                        </Embed-Dependency>
                        <Embed-Transitive>false</Embed-Transitive>
                    </instructions>
                </configuration>
            </plugin>

            <plugin>
                <groupId>com.atlassian.plugin</groupId>
                <artifactId>atlassian-spring-scanner-maven-plugin</artifactId>
                <version>${atlassian.spring.scanner.version}</version>
                <executions>
                    <execution>
                        <goals>
                            <goal>atlassian-spring-scanner</goal>
                        </goals>
                        <phase>process-classes</phase>
                    </execution>
                </executions>
                <configuration>
                    <verbose>false</verbose>
                    <scannedPackages>
                        <scannedPackage>com.codedx</scannedPackage>
                    </scannedPackages>
                </configuration>
            </plugin>

            <!--
                The Spring Scanner picks up HK2 inhabitant files from embedded Jersey JARs and
                registers their internal classes in META-INF/plugin-components/component, causing
                "Class name must not be empty" errors at runtime. Truncate the file to 0 bytes
                after scanning since all plugin components are declared in atlassian-plugin.xml.
            -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-antrun-plugin</artifactId>
                <version>3.1.0</version>
                <executions>
                    <execution>
                        <id>clear-hk2-spring-component-index</id>
                        <phase>prepare-package</phase>
                        <goals>
                            <goal>run</goal>
                        </goals>
                        <configuration>
                            <target>
                                <echo message="Clearing META-INF/plugin-components/component to remove HK2/Jersey internal classes registered by Spring Scanner"/>
                                <mkdir dir="${project.build.outputDirectory}/META-INF/plugin-components"/>
                                <truncate file="${project.build.outputDirectory}/META-INF/plugin-components/component" create="true" length="0"/>
                            </target>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>

</project>