pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>systems.riddler</groupId>
  <artifactId>uxid</artifactId>
  <version>1.0.0</version>
  <packaging>jar</packaging>

  <name>uxid</name>
  <description>Prefixed, K-sortable identifiers a person can read, wire-compatible with the Elixir uxid package.</description>
  <url>https://github.com/riddler/uxid-java</url>
  <inceptionYear>2026</inceptionYear>

  <licenses>
    <license>
      <name>MIT License</name>
      <url>https://opensource.org/licenses/MIT</url>
      <distribution>repo</distribution>
    </license>
  </licenses>

  <developers>
    <developer>
      <id>johnnyt</id>
      <name>John Thornton</name>
      <url>https://github.com/johnnyt</url>
    </developer>
  </developers>

  <scm>
    <connection>scm:git:https://github.com/riddler/uxid-java.git</connection>
    <developerConnection>scm:git:git@github.com:riddler/uxid-java.git</developerConnection>
    <url>https://github.com/riddler/uxid-java</url>
    <tag>HEAD</tag>
  </scm>

  <issueManagement>
    <system>GitHub Issues</system>
    <url>https://github.com/riddler/uxid-java/issues</url>
  </issueManagement>

  <properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
    <!-- The oldest Java the jars run on; the gate JDK is the one mise.toml pins. -->
    <maven.compiler.release>17</maven.compiler.release>
    <!-- A fixed timestamp makes the jars byte-reproducible. -->
    <project.build.outputTimestamp>2026-10-21T00:00:00Z</project.build.outputTimestamp>

    <errorprone.version>2.50.0</errorprone.version>
    <!-- 1.37.0 fails to load under spotless-maven-plugin 3.10.4. -->
    <google-java-format.version>1.36.0</google-java-format.version>
    <junit.version>5.14.4</junit.version>
  </properties>

  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>org.junit</groupId>
        <artifactId>junit-bom</artifactId>
        <version>${junit.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
    </dependencies>
  </dependencyManagement>

  <dependencies>
    <dependency>
      <groupId>org.junit.jupiter</groupId>
      <artifactId>junit-jupiter</artifactId>
      <scope>test</scope>
    </dependency>
  </dependencies>

  <build>
    <pluginManagement>
      <plugins>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-clean-plugin</artifactId>
          <version>3.5.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-resources-plugin</artifactId>
          <version>3.5.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-compiler-plugin</artifactId>
          <version>3.16.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-surefire-plugin</artifactId>
          <version>3.6.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-jar-plugin</artifactId>
          <version>3.5.1</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-source-plugin</artifactId>
          <version>3.4.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-javadoc-plugin</artifactId>
          <version>3.12.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-install-plugin</artifactId>
          <version>3.2.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-deploy-plugin</artifactId>
          <version>3.2.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-site-plugin</artifactId>
          <version>3.22.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-enforcer-plugin</artifactId>
          <version>3.6.3</version>
        </plugin>
        <plugin>
          <groupId>org.jacoco</groupId>
          <artifactId>jacoco-maven-plugin</artifactId>
          <version>0.8.15</version>
        </plugin>
        <plugin>
          <groupId>com.diffplug.spotless</groupId>
          <artifactId>spotless-maven-plugin</artifactId>
          <version>3.10.4</version>
        </plugin>
        <!-- The signer and the publisher, used only by the release profile
             below. -->
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-gpg-plugin</artifactId>
          <version>3.2.8</version>
        </plugin>
        <plugin>
          <groupId>org.sonatype.central</groupId>
          <artifactId>central-publishing-maven-plugin</artifactId>
          <version>0.12.0</version>
        </plugin>
      </plugins>
    </pluginManagement>

    <plugins>
      <!-- Every plugin version pinned, Maven 3.9 or later, and no dependency
           outside test scope. -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-enforcer-plugin</artifactId>
        <executions>
          <execution>
            <id>enforce</id>
            <goals>
              <goal>enforce</goal>
            </goals>
            <configuration>
              <rules>
                <requireMavenVersion>
                  <version>[3.9,)</version>
                </requireMavenVersion>
                <requirePluginVersions>
                  <banLatest>true</banLatest>
                  <banRelease>true</banRelease>
                  <banSnapshots>true</banSnapshots>
                </requirePluginVersions>
                <bannedDependencies>
                  <excludes>
                    <exclude>*:*:*:*:compile</exclude>
                    <exclude>*:*:*:*:provided</exclude>
                    <exclude>*:*:*:*:runtime</exclude>
                    <exclude>*:*:*:*:system</exclude>
                  </excludes>
                  <message>uxid has no runtime dependencies: every dependency is test scope.</message>
                </bannedDependencies>
              </rules>
            </configuration>
          </execution>
        </executions>
      </plugin>

      <!-- The format check: google-java-format, checked in the verify phase. -->
      <plugin>
        <groupId>com.diffplug.spotless</groupId>
        <artifactId>spotless-maven-plugin</artifactId>
        <configuration>
          <java>
            <googleJavaFormat>
              <version>${google-java-format.version}</version>
              <style>GOOGLE</style>
            </googleJavaFormat>
          </java>
        </configuration>
        <executions>
          <execution>
            <id>spotless-check</id>
            <goals>
              <goal>check</goal>
            </goals>
          </execution>
        </executions>
      </plugin>

      <!-- Compile for Java 17 with every javac lint and Error Prone; a warning
           fails the build. -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <configuration>
          <release>${maven.compiler.release}</release>
          <failOnWarning>true</failOnWarning>
          <showWarnings>true</showWarnings>
          <compilerArgs>
            <arg>-Xlint:all</arg>
            <arg>-XDcompilePolicy=simple</arg>
            <arg>--should-stop=ifError=FLOW</arg>
            <arg>-Xplugin:ErrorProne</arg>
          </compilerArgs>
          <annotationProcessorPaths>
            <path>
              <groupId>com.google.errorprone</groupId>
              <artifactId>error_prone_core</artifactId>
              <version>${errorprone.version}</version>
            </path>
          </annotationProcessorPaths>
        </configuration>
      </plugin>

      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-surefire-plugin</artifactId>
        <configuration>
          <!-- An empty test run is a failure, so the coverage check below
               always has execution data to read. -->
          <failIfNoTests>true</failIfNoTests>
        </configuration>
      </plugin>

      <!-- Line coverage of at least 90 percent, checked in the verify phase. -->
      <plugin>
        <groupId>org.jacoco</groupId>
        <artifactId>jacoco-maven-plugin</artifactId>
        <executions>
          <execution>
            <id>prepare-agent</id>
            <goals>
              <goal>prepare-agent</goal>
            </goals>
          </execution>
          <execution>
            <id>report</id>
            <goals>
              <goal>report</goal>
            </goals>
          </execution>
          <execution>
            <id>check</id>
            <goals>
              <goal>check</goal>
            </goals>
            <configuration>
              <rules>
                <rule>
                  <element>BUNDLE</element>
                  <limits>
                    <limit>
                      <counter>LINE</counter>
                      <value>COVEREDRATIO</value>
                      <minimum>0.90</minimum>
                    </limit>
                  </limits>
                </rule>
              </rules>
            </configuration>
          </execution>
        </executions>
      </plugin>

      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-source-plugin</artifactId>
        <executions>
          <execution>
            <id>attach-sources</id>
            <goals>
              <goal>jar-no-fork</goal>
            </goals>
          </execution>
        </executions>
      </plugin>

      <!-- The javadoc jar; a doclint warning fails the build. -->
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-javadoc-plugin</artifactId>
        <configuration>
          <doclint>all</doclint>
          <failOnWarnings>true</failOnWarnings>
        </configuration>
        <executions>
          <execution>
            <id>attach-javadocs</id>
            <goals>
              <goal>jar</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>

  <profiles>
    <!-- The release profile. Only the publish job of
         .github/workflows/release.yml activates it (`-P release`, with
         `-DskipTests` and `deploy`); the gate never does, so the gate never
         signs or deploys anything. In the verify phase, after the package
         phase has built the main, sources and javadoc jars, it first refuses
         unless each jar's SHA-256 equals the one the workflow passes in
         (uxid.release.sha256.jar, uxid.release.sha256.sources and
         uxid.release.sha256.javadoc, the sums the workflow's verify job
         recorded; a property left unset never matches), then signs every
         file with the Bouncy Castle signer, which reads the key and its
         passphrase from the environment variables named below. In the deploy
         phase the Central Portal's publishing plugin uploads the signed files
         as one deployment and waits until the Portal has published it. -->
    <profile>
      <id>release</id>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-enforcer-plugin</artifactId>
            <executions>
              <execution>
                <id>release-jar-sums</id>
                <phase>verify</phase>
                <goals>
                  <goal>enforce</goal>
                </goals>
                <configuration>
                  <rules>
                    <requireFileChecksum>
                      <file>${project.build.directory}/${project.build.finalName}.jar</file>
                      <type>sha256</type>
                      <checksum>${uxid.release.sha256.jar}</checksum>
                      <message>The main jar differs from the one the release workflow verified; nothing is signed or published.</message>
                    </requireFileChecksum>
                    <requireFileChecksum>
                      <file>${project.build.directory}/${project.build.finalName}-sources.jar</file>
                      <type>sha256</type>
                      <checksum>${uxid.release.sha256.sources}</checksum>
                      <message>The sources jar differs from the one the release workflow verified; nothing is signed or published.</message>
                    </requireFileChecksum>
                    <requireFileChecksum>
                      <file>${project.build.directory}/${project.build.finalName}-javadoc.jar</file>
                      <type>sha256</type>
                      <checksum>${uxid.release.sha256.javadoc}</checksum>
                      <message>The javadoc jar differs from the one the release workflow verified; nothing is signed or published.</message>
                    </requireFileChecksum>
                  </rules>
                </configuration>
              </execution>
            </executions>
          </plugin>

          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-gpg-plugin</artifactId>
            <executions>
              <execution>
                <id>sign</id>
                <phase>verify</phase>
                <goals>
                  <goal>sign</goal>
                </goals>
                <configuration>
                  <signer>bc</signer>
                  <bestPractices>true</bestPractices>
                  <keyEnvName>MAVEN_GPG_PRIVATE_KEY</keyEnvName>
                  <passphraseEnvName>MAVEN_GPG_PASSPHRASE</passphraseEnvName>
                </configuration>
              </execution>
            </executions>
          </plugin>

          <plugin>
            <groupId>org.sonatype.central</groupId>
            <artifactId>central-publishing-maven-plugin</artifactId>
            <extensions>true</extensions>
            <configuration>
              <publishingServerId>central</publishingServerId>
              <autoPublish>true</autoPublish>
              <waitUntil>published</waitUntil>
              <waitMaxTime>3600</waitMaxTime>
              <deploymentName>${project.groupId}:${project.artifactId}:${project.version}</deploymentName>
            </configuration>
          </plugin>
        </plugins>
      </build>
    </profile>
  </profiles>
</project>