pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 
         http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <!-- Spring Boot Parent POM for dependency management -->
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>4.1.2</version>
        <relativePath/>
    </parent>

    <groupId>org.greenbuttonalliance.espi</groupId>
    <artifactId>openespi-parent</artifactId>
    <!-- Per-module versioning (#193): the parent and every module carry their own <version>
         so each can be released independently with a <module>-vX.Y.Z tag (see RELEASING.md).
         Inter-module dependency versions are managed ONLY via the openespi-*.version
         properties + <dependencyManagement> below. -->
    <version>4.0.0-SNAPSHOT</version>
    <packaging>pom</packaging>
    
    <name>OpenESPI GreenButton Java</name>
    <description>Complete OpenESPI implementation for Green Button energy data standards</description>

    <url>https://github.com/GreenButtonAlliance/OpenESPI-GreenButton-Java</url>

    <organization>
        <name>Green Button Alliance, Inc.</name>
        <url>http://www.greenbuttonalliance.org</url>
    </organization>

    <developers>
        <developer>
            <id>dcoffin</id>
            <name>Donald F. Coffin</name>
            <email>dcoffin@greenbuttonalliance.org</email>
        </developer>
    </developers>

    <inceptionYear>2025</inceptionYear>

    <licenses>
        <license>
            <name>The Apache Software License, Version 2.0</name>
            <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
        </license>
    </licenses>

    <!-- openespi-handoff is a tiny shared module for the AS↔DC signed-handoff codec.
         Lives outside openespi-common because the auth-server (which can't depend on common's
         ESPI domain types) needs the codec too. Pure infrastructure (HMAC + Jackson + JPA),
         no ESPI domain types. -->
    <modules>
        <module>openespi-handoff</module>
        <module>openespi-common</module>
        <module>openespi-datacustodian</module>
        <module>openespi-thirdparty</module>
        <module>openespi-authserver</module>
    </modules>
    
    <properties>
        <java.version>25</java.version>
        <spring.boot.version>4.1.2</spring.boot.version>
        <project.scm.id>github</project.scm.id>
        <maven.compiler.source>25</maven.compiler.source>
        <maven.compiler.target>25</maven.compiler.target>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

        <!-- Inter-module library versions: the single place consumers' versions are set.
             Keep in step with the <version> in openespi-handoff/pom.xml and openespi-common/pom.xml. -->
        <openespi-handoff.version>4.0.0-SNAPSHOT</openespi-handoff.version>
        <openespi-common.version>4.0.0-SNAPSHOT</openespi-common.version>

        <!-- SonarCloud Configuration -->
        <sonar.projectKey>GreenButtonAlliance_OpenESPI-GreenButton-Java</sonar.projectKey>
        <sonar.organization>greenbuttonalliance</sonar.organization>
        <sonar.host.url>https://sonarcloud.io</sonar.host.url>
        <sonar.java.source>25</sonar.java.source>
        <sonar.coverage.jacoco.xmlReportPaths>${project.basedir}/target/site/jacoco/jacoco.xml</sonar.coverage.jacoco.xmlReportPaths>

        <!-- Plugin Versions -->
        <jacoco.version>0.8.16</jacoco.version>
        <sonar-maven-plugin.version>5.8.0.7211</sonar-maven-plugin.version>
        <maven-compiler-plugin.version>3.16.0</maven-compiler-plugin.version>
        <maven-release-plugin.version>3.3.1</maven-release-plugin.version>
        <maven-site-plugin.version>3.22.0</maven-site-plugin.version>
        <versions-maven-plugin.version>2.25.1</versions-maven-plugin.version>
        <spotbugs-plugin.version>4.10.5.0</spotbugs-plugin.version>
        <!-- Used by .github/workflows/security.yml (mvn org.owasp:dependency-check-maven:aggregate) -->
        <owasp-dependency-check.version>13.0.0</owasp-dependency-check.version>

        <!-- Dependency Versions -->
        <lombok.version>1.18.48</lombok.version>
        <mapstruct.version>1.6.3</mapstruct.version>
        <commons-lang.version>3.20.0</commons-lang.version>
        <commons-codec.version>1.18.0</commons-codec.version>
        <xmlunit.version>1.4</xmlunit.version>
        <jakarta.servlet.version>6.1.0</jakarta.servlet.version>
        <mysql.connector.version>26.10.0</mysql.connector.version>
        <postgres.version>42.7.8</postgres.version>
        <commons-io.version>2.22.0</commons-io.version>
        <swagger-annotations.version>2.2.55</swagger-annotations.version>
        <datafaker.version>2.7.0</datafaker.version>
        <jetbrains-annotations.version>26.1.0</jetbrains-annotations.version>
    </properties>
    
    <profiles>
        <!-- Build only core Spring Boot 4 modules (omits authserver) -->
        <profile>
            <id>spring-boot-only</id>
            <modules>
                <module>openespi-common</module>
                <module>openespi-datacustodian</module>
                <module>openespi-thirdparty</module>
            </modules>
        </profile>
    </profiles>

    <dependencyManagement>
        <dependencies>
            <!-- OpenESPI inter-module libraries -->
            <dependency>
                <groupId>org.greenbuttonalliance.espi</groupId>
                <artifactId>OpenESPI-Handoff</artifactId>
                <version>${openespi-handoff.version}</version>
            </dependency>
            <dependency>
                <groupId>org.greenbuttonalliance.espi</groupId>
                <artifactId>OpenESPI-Common</artifactId>
                <version>${openespi-common.version}</version>
            </dependency>
            <dependency>
                <groupId>commons-io</groupId>
                <artifactId>commons-io</artifactId>
                <version>${commons-io.version}</version>
            </dependency>
            <dependency>
                <groupId>jakarta.servlet</groupId>
                <artifactId>jakarta.servlet-api</artifactId>
                <version>${jakarta.servlet.version}</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>com.mysql</groupId>
                <artifactId>mysql-connector-j</artifactId>
                <version>${mysql.connector.version}</version>
            </dependency>
            <dependency>
                <groupId>io.swagger.core.v3</groupId>
                <artifactId>swagger-annotations-jakarta</artifactId>
                <version>${swagger-annotations.version}</version>
            </dependency>
            <dependency>
                <groupId>net.datafaker</groupId>
                <artifactId>datafaker</artifactId>
                <version>${datafaker.version}</version>
            </dependency>
        </dependencies>
    </dependencyManagement>
    
    <build>
        <resources>
            <resource>
                <directory>src/main/resources</directory>
                <filtering>true</filtering>
                <includes>
                    <include>**/*.yml</include>
                    <include>**/*.yaml</include>
                    <include>**/*.properties</include>
                    <include>**/*.xml</include>
                    <include>**/*.sql</include>
                    <include>**/*.html</include>
                    <include>**/*.js</include>
                    <include>**/*.css</include>
                </includes>
                <excludes>
                    <exclude>/10.xml</exclude>
                </excludes>
            </resource>
            <!-- Everything else (images, XSD schemas, fonts...) is copied as-is. Without this entry
                 the include list above dropped every binary/other resource from the jars: the ESPI
                 XSDs, the DC favicon and the shared GBA logo were never packaged. Binary files must
                 never be filtered, which would corrupt them. *.disabled files stay out. -->
            <resource>
                <directory>src/main/resources</directory>
                <filtering>false</filtering>
                <excludes>
                    <exclude>**/*.yml</exclude>
                    <exclude>**/*.yaml</exclude>
                    <exclude>**/*.properties</exclude>
                    <exclude>**/*.xml</exclude>
                    <exclude>**/*.sql</exclude>
                    <exclude>**/*.html</exclude>
                    <exclude>**/*.js</exclude>
                    <exclude>**/*.css</exclude>
                    <exclude>**/*.disabled</exclude>
                </excludes>
            </resource>
        </resources>

        <testResources>
            <testResource>
                <directory>src/test/resources</directory>
                <filtering>true</filtering>
                <includes>
                    <include>**/*.yml</include>
                    <include>**/*.yaml</include>
                    <include>**/*.properties</include>
                    <include>**/*.xml</include>
                    <include>**/*.sql</include>
                </includes>
            </testResource>
        </testResources>

        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-maven-plugin</artifactId>
                    <version>${spring.boot.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-compiler-plugin</artifactId>
                    <version>${maven-compiler-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.jacoco</groupId>
                    <artifactId>jacoco-maven-plugin</artifactId>
                    <version>${jacoco.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.sonarsource.scanner.maven</groupId>
                    <artifactId>sonar-maven-plugin</artifactId>
                    <version>${sonar-maven-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-site-plugin</artifactId>
                    <version>${maven-site-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-release-plugin</artifactId>
                    <version>${maven-release-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.codehaus.mojo</groupId>
                    <artifactId>versions-maven-plugin</artifactId>
                    <version>${versions-maven-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>com.github.spotbugs</groupId>
                    <artifactId>spotbugs-maven-plugin</artifactId>
                    <version>${spotbugs-plugin.version}</version>
                </plugin>
                <plugin>
                    <groupId>org.owasp</groupId>
                    <artifactId>dependency-check-maven</artifactId>
                    <version>${owasp-dependency-check.version}</version>
                </plugin>
            </plugins>
        </pluginManagement>

        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <configuration>
                    <source>${java.version}</source>
                    <target>${java.version}</target>
                    <excludes>
                        <!-- Exclude testing support classes (should be in src/test) -->
                        <exclude>**/support/**</exclude>
                        <!-- Exclude classes with missing Xerces dependencies -->
                        <exclude>**/utils/DurationImpl.java</exclude>
                        <exclude>**/utils/XMLGregorianCalendarImpl.java</exclude>
                        <!-- Exclude legacy deprecated classes with Spring Security dependencies -->
                        <exclude>**/legacy_deprecated/**</exclude>
                        <!-- Exclude repository interface with Spring Security UserDetails -->
                        <exclude>**/repositories/usage/RetailCustomerRepository.java</exclude>
                    </excludes>
                    <annotationProcessorPaths>
                        <path>
                            <groupId>org.projectlombok</groupId>
                            <artifactId>lombok</artifactId>
                            <version>${lombok.version}</version>
                        </path>
                        <path>
                            <groupId>org.mapstruct</groupId>
                            <artifactId>mapstruct-processor</artifactId>
                            <version>${mapstruct.version}</version>
                        </path>
                        <path>
                            <groupId>org.projectlombok</groupId>
                            <artifactId>lombok-mapstruct-binding</artifactId>
                            <version>0.2.0</version>
                        </path>
                    </annotationProcessorPaths>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <configuration>
                    <includes>
                        <include>**/*Tests.java</include>
                        <include>**/*Test.java</include>
                    </includes>
                    <useSystemClassLoader>false</useSystemClassLoader>
                    <!-- @{argLine} carries the JaCoCo agent set by jacoco:prepare-agent. Without it no
                         jacoco.exec is written and SonarCloud receives no coverage (#193). -->
                    <argLine>
                        @{argLine}
                        -javaagent:${settings.localRepository}/org/mockito/mockito-core/${mockito.version}/mockito-core-${mockito.version}.jar
                        -Xshare:off
                    </argLine>
                </configuration>
            </plugin>
            <!-- JaCoCo Code Coverage Plugin -->
            <plugin>
                <groupId>org.jacoco</groupId>
                <artifactId>jacoco-maven-plugin</artifactId>
                <executions>
                    <execution>
                        <id>prepare-agent</id>
                        <goals>
                            <goal>prepare-agent</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>report</id>
                        <phase>test</phase>
                        <goals>
                            <goal>report</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>jacoco-check</id>
                        <goals>
                            <goal>check</goal>
                        </goals>
                        <configuration>
                            <!-- Advisory: this check never ran before the @{argLine} fix (no
                                 jacoco.exec). Report violations; flip to true once modules meet it. -->
                            <haltOnFailure>false</haltOnFailure>
                            <rules>
                                <rule>
                                    <element>PACKAGE</element>
                                    <limits>
                                        <limit>
                                            <counter>LINE</counter>
                                            <value>COVEREDRATIO</value>
                                            <minimum>0.50</minimum>
                                        </limit>
                                    </limits>
                                </rule>
                            </rules>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-site-plugin</artifactId>
                <dependencies>
                    <dependency>
                        <groupId>org.apache.maven.wagon</groupId>
                        <artifactId>wagon-webdav-jackrabbit</artifactId>
                        <version>3.5.3</version>
                    </dependency>
                </dependencies>
                <configuration>
                    <locales>en</locales>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-release-plugin</artifactId>
            </plugin>
            <!-- Git Build Information -->
            <plugin>
                <groupId>io.github.git-commit-id</groupId>
                <artifactId>git-commit-id-maven-plugin</artifactId>
                <executions>
                    <execution>
                        <id>get-the-git-infos</id>
                        <goals>
                            <goal>revision</goal>
                        </goals>
                        <phase>initialize</phase>
                    </execution>
                </executions>
                <configuration>
                    <generateGitPropertiesFile>true</generateGitPropertiesFile>
                    <generateGitPropertiesFilename>${project.build.outputDirectory}/git.properties</generateGitPropertiesFilename>
                    <includeOnlyProperties>
                        <includeOnlyProperty>^git.build.(time|version)$</includeOnlyProperty>
                        <includeOnlyProperty>^git.commit.id.(abbrev|full)$</includeOnlyProperty>
                    </includeOnlyProperties>
                    <commitIdGenerationMode>full</commitIdGenerationMode>
                </configuration>
            </plugin>

            <!-- SonarCloud Maven Plugin -->
            <plugin>
                <groupId>org.sonarsource.scanner.maven</groupId>
                <artifactId>sonar-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>

    <scm>
        <connection>scm:git:https://github.com/GreenButtonAlliance/OpenESPI-GreenButton-Java</connection>
        <developerConnection>scm:git:git@github.com:greenbuttonalliance/OpenESPI-GreenButton-Java.git</developerConnection>
        <url>https://github.com/greenbuttonalliance/OpenESPI-GreenButton-Java</url>
        <tag>HEAD</tag>
    </scm>

    <issueManagement>
        <system>GitHub</system>
        <url>https://github.com/greenbuttonalliance/OpenESPI-GreenButton-Java/issues</url>
    </issueManagement>

    <!-- No <distributionManagement> / GitHub Packages <repositories>: libraries are not
         published (#193). Releases are GitHub Releases with the jar attached; see RELEASING.md. -->
</project>