pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
  The Java analyzer that runs *inside* jdt.ls.

  This is an OSGi bundle (Tycho `eclipse-plugin` packaging), not a plain jar:
  jdt.ls loads it through `contributes.javaExtensions` in the VS Code manifest,
  and it registers a delegate command handler so the TypeScript side can invoke
  it via `java.execute.workspaceCommand`.

  Dependencies come from META-INF/MANIFEST.MF resolved against the p2 target
  platform below — there is no <dependencies> section.

  Build:  mvn -B verify           (from this directory; no wrapper is checked in
                                   yet — add one with `mvn -N wrapper:wrapper`)
  Output: target/org.leplus.catchme.jdt-1.0.0-SNAPSHOT.jar
-->
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>org.leplus</groupId>
  <!-- Tycho requires artifactId == Bundle-SymbolicName. -->
  <artifactId>org.leplus.catchme.jdt</artifactId>
  <!-- Must track Bundle-Version (1.0.0.qualifier) in META-INF/MANIFEST.MF. -->
  <version>1.0.0-SNAPSHOT</version>
  <packaging>eclipse-plugin</packaging>
  <name>CatchMe JDT Analyzer</name>
  <url>https://github.com/leplusorg/catchme</url>
  <licenses>
    <license>
      <name>The Apache Software License, Version 2.0</name>
      <url>https://www.apache.org/licenses/LICENSE-2.0.txt</url>
      <distribution>repo</distribution>
    </license>
  </licenses>
  <scm>
    <url>https://github.com/leplusorg/catchme/tree/main</url>
    <connection>scm:git:https://github.com/leplusorg/catchme.git</connection>
    <developerConnection>scm:git:ssh://git@github.com/leplusorg/catchme.git</developerConnection>
    <tag>HEAD</tag>
  </scm>
  <organization>
    <name>Leplus.org</name>
    <url>https://www.leplus.org</url>
  </organization>
  <issueManagement>
    <system>GitHub</system>
    <url>https://github.com/leplusorg/catchme/issues</url>
  </issueManagement>
  <developers>
    <developer>
      <email>thomas@leplus.org</email>
      <name>Thomas Leplus</name>
      <url>https://www.leplus.org</url>
      <id>leplusorg</id>
      <roles>
        <role>Project Lead</role>
      </roles>
      <organization>Leplus.org</organization>
      <organizationUrl>https://www.leplus.org</organizationUrl>
    </developer>
  </developers>

  <properties>
    <!-- Reproducible builds; CI overrides via the source-date-epoch profile. -->
    <project.build.outputTimestamp>2026-01-01T00:00:00Z</project.build.outputTimestamp>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
    <tycho.version>5.0.4</tycho.version>
    <java.minVersion>21</java.minVersion>
    <maven.javadoc.version>3.12.0</maven.javadoc.version>
    <dependencyCheck.version>13.0.0</dependencyCheck.version>
    <dependencyCheck.threshold>7</dependencyCheck.threshold>
    <!-- Off unless an NVD API key reaches the build; the nvd-api-key profile
         below turns it on. The scan genuinely cannot run without one: the NVD
         API rejects an empty key outright rather than falling back to
         anonymous access ("Invalid API Key, length of 0 too short"), and
         keyless access is throttled to 5 requests per rolling 30s, which is
         far too slow to populate the vulnerability cache from cold. Skipping
         is the honest default - a scan that cannot fetch data proves nothing,
         and failOnError below would otherwise break every build that has no
         key. Get one (free) at https://nvd.nist.gov/developers/request-an-api-key
         and see the profile for how to supply it.

         This default is for humans, not for CI. Skipping is fine on a laptop,
         where whoever ran the build knows what they got; it is not fine in a
         pipeline, where a skipped scan and a clean one are the same shade of
         green. So ci.yml refuses to build at all without the key rather than
         relying on this. -->
    <dependencyCheck.skip>true</dependencyCheck.skip>
    <!-- Empty on purpose, and only ever read when the scan is skipped: the
         profiles below supply the real values from the environment. An empty
         key is worse than no key at all, which is what the NVD error above
         was - so nothing here ever hands the plugin a blank credential. -->
    <dependencyCheck.NVDApiKey></dependencyCheck.NVDApiKey>
    <dependencyCheck.ossIndexPassword></dependencyCheck.ossIndexPassword>
    <cyclonedx.skip>false</cyclonedx.skip>
    <sigstore.skip>false</sigstore.skip>
  </properties>

  <repositories>
    <!-- Eclipse platform + JDT. Recent trains require JavaSE-21 as the minimum EE. -->
    <repository>
      <id>eclipse-release</id>
      <layout>p2</layout>
      <url>https://download.eclipse.org/releases/2026-06/</url>
    </repository>
    <!-- jdt.ls, for org.eclipse.jdt.ls.core (the delegate-command extension point).
         Pinned to a dated, immutable repository rather than .../repository/latest/,
         which is a moving target that can break the build with no commit on our
         side and makes old builds unreproducible.

         This timestamp is the released jdt.ls 1.60.0 build
         (jdt-language-server-1.60.0-202606262232), which pairs with the Eclipse
         2026-06 platform pinned above. Note that jdt.ls publishes milestones as
         tarballs only; the dated snapshot repositories are the sole p2 form, so
         "snapshot" here denotes the layout, not an unstable build.

         To bump: list https://download.eclipse.org/jdtls/snapshots/repository/
         and pick the dated directory matching the jdt.ls release you want. -->
    <repository>
      <id>jdt-ls</id>
      <layout>p2</layout>
      <url>https://download.eclipse.org/jdtls/snapshots/repository/1.60.0.202606262232/</url>
    </repository>
  </repositories>

  <build>
    <plugins>
      <plugin>
        <groupId>org.eclipse.tycho</groupId>
        <artifactId>tycho-maven-plugin</artifactId>
        <version>${tycho.version}</version>
        <extensions>true</extensions>
      </plugin>
      <plugin>
        <groupId>org.eclipse.tycho</groupId>
        <artifactId>target-platform-configuration</artifactId>
        <version>${tycho.version}</version>
        <configuration>
          <executionEnvironment>JavaSE-21</executionEnvironment>
          <environments>
            <environment><os>macosx</os><ws>cocoa</ws><arch>aarch64</arch></environment>
            <environment><os>macosx</os><ws>cocoa</ws><arch>x86_64</arch></environment>
            <environment><os>linux</os><ws>gtk</ws><arch>x86_64</arch></environment>
            <environment><os>linux</os><ws>gtk</ws><arch>aarch64</arch></environment>
            <environment><os>win32</os><ws>win32</ws><arch>x86_64</arch></environment>
          </environments>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.eclipse.tycho</groupId>
        <artifactId>tycho-compiler-plugin</artifactId>
        <version>${tycho.version}</version>
        <configuration>
          <source>${java.minVersion}</source>
          <target>${java.minVersion}</target>
          <showWarnings>true</showWarnings>
          <showDeprecation>true</showDeprecation>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <version>3.16.0</version>
        <configuration>
          <release>${java.minVersion}</release>
          <showDeprecation>true</showDeprecation>
          <showWarnings>true</showWarnings>
          <compilerArgs>
            <arg>-Xlint:all</arg>
            <arg>-Xdoclint:all</arg>
            <arg>-Werror</arg>
          </compilerArgs>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-source-plugin</artifactId>
        <version>3.4.0</version>
        <executions>
          <execution>
            <id>attach-sources</id>
            <goals>
              <goal>jar-no-fork</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-javadoc-plugin</artifactId>
        <version>${maven.javadoc.version}</version>
        <executions>
          <execution>
            <id>attach-javadocs</id>
            <goals>
              <goal>jar</goal>
            </goals>
            <configuration>
              <source>${java.minVersion}</source>
              <show>private</show>
              <nohelp>true</nohelp>
            </configuration>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.owasp</groupId>
        <artifactId>dependency-check-maven</artifactId>
        <version>${dependencyCheck.version}</version>
        <configuration>
          <failBuildOnCVSS>${dependencyCheck.threshold}</failBuildOnCVSS>
          <failOnError>true</failOnError>
          <nvdApiKey>${dependencyCheck.NVDApiKey}</nvdApiKey>
          <ossIndexPassword>${dependencyCheck.ossIndexPassword}</ossIndexPassword>
          <skip>${dependencyCheck.skip}</skip>
        </configuration>
        <executions>
          <execution>
            <goals>
              <goal>check</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-pmd-plugin</artifactId>
        <version>3.28.0</version>
        <configuration>
            <printFailingErrors>true</printFailingErrors>
        </configuration>
        <executions>
          <execution>
            <goals>
              <goal>check</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>com.github.spotbugs</groupId>
        <artifactId>spotbugs-maven-plugin</artifactId>
        <version>4.10.4.1</version>
        <configuration>
        <effort>max</effort>
        <threshold>Low</threshold>
        <failOnError>true</failOnError>
          <plugins>
            <plugin>
              <groupId>com.h3xstream.findsecbugs</groupId>
              <artifactId>findsecbugs-plugin</artifactId>
              <version>1.14.0</version>
            </plugin>
          </plugins>
        </configuration>
        <executions>
          <execution>
            <goals>
              <goal>check</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>

  <reporting>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-javadoc-plugin</artifactId>
        <version>${maven.javadoc.version}</version>
        <configuration>
          <source>${java.minVersion}</source>
          <show>public</show>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-project-info-reports-plugin</artifactId>
        <version>3.9.0</version>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-jxr-plugin</artifactId>
        <version>3.6.0</version>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-checkstyle-plugin</artifactId>
        <version>3.6.0</version>
        <reportSets>
          <reportSet>
            <reports>
              <report>checkstyle</report>
            </reports>
          </reportSet>
        </reportSets>
      <configuration>
          <configLocation>google_checks.xml</configLocation>
          <includeTestSourceDirectory>true</includeTestSourceDirectory>
          <consoleOutput>true</consoleOutput>
          <failsOnError>true</failsOnError>
        <violationSeverity>info</violationSeverity>
        </configuration>
      </plugin>
    </plugins>
  </reporting>

  <profiles>
    <profile>
      <id>source-date-epoch</id>
      <activation>
        <property><name>env.SOURCE_DATE_EPOCH</name></property>
      </activation>
      <properties>
        <project.build.outputTimestamp>${env.SOURCE_DATE_EPOCH}</project.build.outputTimestamp>
      </properties>
    </profile>
    <!-- Enables the dependency-check scan, reading the key from the
         environment so the secret is never passed on the command line, where
         the process list would show it.

         Activation is by presence rather than value, and the empty case is
         the point: Maven activates a valueless <property> only when the
         property is non-empty, and GitHub Actions expands an unconfigured
         `${{ secrets.NVD_API_KEY }}` to the empty string. So a fork, or a
         repository where the secret was never added, leaves the scan off
         instead of failing the build with a blank credential.

         To run it locally: NVD_API_KEY=... mvn verify. To force it on with
         the key supplied some other way (a settings.xml server entry, say):
         -DdependencyCheck.skip=false. -->
    <profile>
      <id>nvd-api-key</id>
      <activation>
        <property><name>env.NVD_API_KEY</name></property>
      </activation>
      <properties>
        <dependencyCheck.skip>false</dependencyCheck.skip>
        <dependencyCheck.NVDApiKey>${env.NVD_API_KEY}</dependencyCheck.NVDApiKey>
      </properties>
    </profile>
    <!-- Sonatype OSS Index credentials, on the same terms. Independent of the
         profile above because OSS Index is a separate analyzer: it only raises
         the anonymous rate limit, so leaving this unset degrades the scan
         rather than disabling it. -->
    <profile>
      <id>oss-index-password</id>
      <activation>
        <property><name>env.OSS_INDEX_PASSWORD</name></property>
      </activation>
      <properties>
        <dependencyCheck.ossIndexPassword>${env.OSS_INDEX_PASSWORD}</dependencyCheck.ossIndexPassword>
      </properties>
    </profile>
  </profiles>
</project>