pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

	<modelVersion>4.0.0</modelVersion>

	<parent>
		<groupId>com.github.bordertech.common</groupId>
		<artifactId>bordertech-parent</artifactId>
		<version>1.0.22-SNAPSHOT</version>
		<relativePath>../pom.xml</relativePath>
	</parent>

	<artifactId>qa-parent</artifactId>
	<packaging>pom</packaging>

	<properties>

		<!-- SKIP QA -->
		<bt.qa.skip>true</bt.qa.skip>
		<checkstyle.skip>${bt.qa.skip}</checkstyle.skip>
		<pmd.skip>${bt.qa.skip}</pmd.skip>
		<cpd.skip>${bt.qa.skip}</cpd.skip>
		<spotbugs.skip>${bt.qa.skip}</spotbugs.skip>
		<dependency-check.skip>${bt.qa.skip}</dependency-check.skip>
		<bt.convergence.check.skip>${bt.qa.skip}</bt.convergence.check.skip>

		<!-- FAIL QA -->
		<bt.qa.fail>true</bt.qa.fail>
		<checkstyle.failOnViolation>${bt.qa.fail}</checkstyle.failOnViolation>
		<pmd.failOnViolation>${bt.qa.fail}</pmd.failOnViolation>
		<spotbugs.failOnError>${bt.qa.fail}</spotbugs.failOnError>
		<!-- OWASP -->
		<failOnError>${bt.qa.fail}</failOnError>
		<!-- Convergence Check -->
		<bt.convergence.check.fail>${bt.qa.fail}</bt.convergence.check.fail>
		<!-- CPD (Default to report only) -->
		<cpd.failOnViolation>false</cpd.failOnViolation>

		<!--
		These plugin settings are set as properties instead of being included in the default configuration to make it easier for projects to override.
		Property values are ignored if a default value is set in a configuation.
		-->
		<!-- Checkstyle -->
		<!-- Config file -->
		<checkstyle.config.location>bordertech/bt-checkstyle.xml</checkstyle.config.location>
		<!-- Override default to only use main src (ignore generated) -->
		<bt.checkstyle.src>${project.build.sourceDirectory}</bt.checkstyle.src>
		<!-- PMD -->
		<pmd.printFailingErrors>true</pmd.printFailingErrors>
		<!-- Priority: 1 (High) - 5 (Low) -->
		<pmd.failurePriority>2</pmd.failurePriority>
		<!-- Print details of check failures to build output -->
		<pmd.verbose>true</pmd.verbose>
		<!-- Rules file -->
		<bt.pmd.rules.file>bordertech/bt-pmd-rules.xml</bt.pmd.rules.file>
		<!-- Override default to only use main src (ignore generated) -->
		<bt.pmd.src>${project.build.sourceDirectory}</bt.pmd.src>

		<!-- Spotbugs -->
		<!-- Effort -->
		<spotbugs.effort>Max</spotbugs.effort>
		<!-- Threshold Confidence: High, Medium, Low -->
		<spotbugs.threshold>Medium</spotbugs.threshold>
		<!-- Rank: Scariest (1-4), Scary (5-9), Troubling (10-14), Of concern (15-20) -->
		<spotbugs.maxRank>14</spotbugs.maxRank>
		<!-- To ignore generated files Spotbugs is different from checkstyle and PMD as it requires an exclude filter to be configured. -->
		<!-- Exclude files in the generated-sources directory -->
		<spotbugs.excludeFilterFile>bordertech/bt-spotbugs-exclude-generated-files.xml</spotbugs.excludeFilterFile>
		<!-- Need to add sources for source tag in exclude and include filters to work -->
		<spotbugs.addSourceDirs>true</spotbugs.addSourceDirs>

		<!-- OWASP (Default to Critical) -->
		<!-- Check every 12 hours (default is 4) -->
		<cveValidForHours>12</cveValidForHours>
		<!-- Min cvss score to fail on. Range 0-10 : LOW: 0-3.9, MEDIUM: 4-6.9, HIGH: 7.0-8.9, Critical: 9.0-10.0 (Default is 11 which means it never fails) -->
		<failBuildOnCVSS>9</failBuildOnCVSS>
		<!-- If set, owasp uses the proxy id in maven settings to download its db. -->
		<mavenSettingsProxyId />
		<!-- Disable analyzers -->
		<!-- Disable retirejs analyzer -->
		<retireJsAnalyzerEnabled>false</retireJsAnalyzerEnabled>
		<!-- Disable swift analyzer -->
		<swiftPackageManagerAnalyzerEnabled>false</swiftPackageManagerAnalyzerEnabled>
		<!-- Disbale .net analyzers -->
		<nuspecAnalyzerEnabled>false</nuspecAnalyzerEnabled>
		<assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>

		<!-- Versions -->
		<bt.junit.version>5.11.0</bt.junit.version>
		<bt.jacoco.plugin.version>0.8.12</bt.jacoco.plugin.version>
		<bt.surefire.plugin.version>3.5.0</bt.surefire.plugin.version>
		<bt.checkstyle.plugin.version>3.5.0</bt.checkstyle.plugin.version>
		<!-- Checkstyle 10.X requires JDK 11 -->
		<bt.checkstyle.version>9.3</bt.checkstyle.version>
		<bt.pmd.plugin.version>3.25.0</bt.pmd.plugin.version>
		<bt.pmd.version>7.5.0</bt.pmd.version>
		<bt.spotbugs.plugin.version>4.8.6.3</bt.spotbugs.plugin.version>
		<bt.sb-contrib.plugin.version>7.6.4</bt.sb-contrib.plugin.version>
		<bt.spotbugs.version>4.8.6</bt.spotbugs.version>
		<bt.findsecbugs.plugin.version>1.13.0</bt.findsecbugs.plugin.version>
		<bt.owasp.plugin.version>10.0.4</bt.owasp.plugin.version>
		<bt.versions.plugin>2.17.1</bt.versions.plugin>

	</properties>

	<description>
		Quality assurance configuration for BorderTech java projects.
		Note that projects inheriting from this POM also inherit the release
		configuration from bordertech-parent.
	</description>

	<profiles>
		<!-- Quick build profile with testing and QA turned off -->
		<profile>
			<id>quick-build</id>
			<properties>
				<!-- Skip tests -->
				<skipTests>true</skipTests>
				<jacoco.skip>true</jacoco.skip>
				<!-- Skip QA -->
				<bt.qa.skip>true</bt.qa.skip>
				<!-- Skip each plugin individually to handle projects that have set bt.qa.skip to false -->
				<checkstyle.skip>true</checkstyle.skip>
				<pmd.skip>true</pmd.skip>
				<cpd.skip>true</cpd.skip>
				<spotbugs.skip>true</spotbugs.skip>
				<!-- Skip OWASP -->
				<dependency-check.skip>true</dependency-check.skip>
				<!-- Skip convergence check -->
				<bt.convergence.check.skip>true</bt.convergence.check.skip>
				<!-- Skip javadoc -->
				<maven.javadoc.skip>true</maven.javadoc.skip>
			</properties>
		</profile>

		<!-- Profile to display new dependency versions in the build console. -->
		<!-- The versions plugin doesnot honor skip property on the display goals. As this can be an expensive process and cannot be skipped it is not included by default. -->
		<profile>
			<id>display-versions</id>
			<build>
				<plugins>
					<plugin>
						<groupId>org.codehaus.mojo</groupId>
						<artifactId>versions-maven-plugin</artifactId>
						<version>${bt.versions.plugin}</version>
						<executions>
							<execution>
								<id>display-version-updates</id>
								<phase>validate</phase>
								<goals>
									<goal>display-dependency-updates</goal>
									<goal>display-parent-updates</goal>
									<goal>display-plugin-updates</goal>
									<goal>display-property-updates</goal>
								</goals>
							</execution>
						</executions>
					</plugin>
				</plugins>
			</build>
		</profile>

	</profiles>

	<dependencyManagement>
		<dependencies>
			<!-- Junit 5 -->
			<dependency>
				<groupId>org.junit.jupiter</groupId>
				<artifactId>junit-jupiter-engine</artifactId>
				<version>${bt.junit.version}</version>
				<scope>test</scope>
			</dependency>
			<!-- Junit 5 support for Junit 4 -->
			<dependency>
				<groupId>org.junit.vintage</groupId>
				<artifactId>junit-vintage-engine</artifactId>
				<scope>test</scope>
				<version>${bt.junit.version}</version>
			</dependency>
		</dependencies>
	</dependencyManagement>

	<build>
		<plugins>

			<!-- Surefire -->
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-surefire-plugin</artifactId>
				<version>${bt.surefire.plugin.version}</version>
			</plugin>

			<!-- Code coverage. -->
			<plugin>
				<groupId>org.jacoco</groupId>
				<artifactId>jacoco-maven-plugin</artifactId>
				<version>${bt.jacoco.plugin.version}</version>
				<executions>
					<!-- Prepare Jacoco agent. -->
					<execution>
						<id>jacoco-agent</id>
						<goals>
							<goal>prepare-agent</goal>
						</goals>
					</execution>
					<!-- Jacoco Coverage Report -->
					<!-- As this is bound to the same phase as surefire but needs to run after surefire it must be defined after the surefire plugin. -->
					<execution>
						<id>post-unit-test</id>
						<phase>test</phase>
						<goals>
							<goal>report</goal>
						</goals>
					</execution>
				</executions>
			</plugin>

			<!-- Verify: Check the code style. -->
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-checkstyle-plugin</artifactId>
				<version>${bt.checkstyle.plugin.version}</version>
				<configuration>
					<sourceDirectories>
						<sourceDirectory>${bt.checkstyle.src}</sourceDirectory>
					</sourceDirectories>
				</configuration>
				<dependencies>
					<!-- Latest checkstyle version -->
					<dependency>
						<groupId>com.puppycrawl.tools</groupId>
						<artifactId>checkstyle</artifactId>
						<version>${bt.checkstyle.version}</version>
					</dependency>
					<!-- Bordertech config -->
					<dependency>
						<groupId>com.github.bordertech.common</groupId>
						<artifactId>build-tools</artifactId>
						<version>1.0.22-SNAPSHOT</version>
					</dependency>
				</dependencies>
				<executions>
					<execution>
						<id>checkStyle</id>
						<phase>verify</phase>
						<goals>
							<goal>check</goal>
						</goals>
					</execution>
				</executions>
			</plugin>

			<!-- Verify: PMD and CPD Check. -->
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-pmd-plugin</artifactId>
				<version>${bt.pmd.plugin.version}</version>
				<configuration>
					<rulesets>
						<ruleset>${bt.pmd.rules.file}</ruleset>
					</rulesets>
					<compileSourceRoots>${bt.pmd.src}</compileSourceRoots>
				</configuration>
				<dependencies>
					<!-- Latest pmd version -->
					<dependency>
						<groupId>net.sourceforge.pmd</groupId>
						<artifactId>pmd-core</artifactId>
						<version>${bt.pmd.version}</version>
					</dependency>
					<dependency>
						<groupId>net.sourceforge.pmd</groupId>
						<artifactId>pmd-java</artifactId>
						<version>${bt.pmd.version}</version>
					</dependency>
					<dependency>
						<groupId>net.sourceforge.pmd</groupId>
						<artifactId>pmd-javascript</artifactId>
						<version>${bt.pmd.version}</version>
					</dependency>
					<dependency>
						<groupId>net.sourceforge.pmd</groupId>
						<artifactId>pmd-jsp</artifactId>
						<version>${bt.pmd.version}</version>
					</dependency>
					<!-- Bordertech config -->
					<dependency>
						<groupId>com.github.bordertech.common</groupId>
						<artifactId>build-tools</artifactId>
						<version>1.0.22-SNAPSHOT</version>
					</dependency>
				</dependencies>
				<executions>
					<!-- PMD -->
					<execution>
						<id>checkPmd</id>
						<phase>verify</phase>
						<goals>
							<goal>check</goal>
						</goals>
					</execution>
					<!-- CPD (Warning only) -->
					<execution>
						<id>checkCpd</id>
						<phase>verify</phase>
						<goals>
							<goal>cpd-check</goal>
						</goals>
					</execution>
				</executions>
			</plugin>

			<!-- Verify: Spotbugs check (new findbugs). -->
			<plugin>
				<groupId>com.github.spotbugs</groupId>
				<artifactId>spotbugs-maven-plugin</artifactId>
				<version>${bt.spotbugs.plugin.version}</version>
				<configuration>
					<plugins>
						<!-- Auxilary plugin -->
						<plugin>
							<groupId>com.mebigfatguy.sb-contrib</groupId>
							<artifactId>sb-contrib</artifactId>
							<version>${bt.sb-contrib.plugin.version}</version>
						</plugin>
						<!-- Security plugin -->
						<plugin>
							<groupId>com.h3xstream.findsecbugs</groupId>
							<artifactId>findsecbugs-plugin</artifactId>
							<version>${bt.findsecbugs.plugin.version}</version>
						</plugin>
					</plugins>
				</configuration>
				<executions>
					<execution>
						<id>checkSpotBugs</id>
						<phase>verify</phase>
						<goals>
							<goal>check</goal>
						</goals>
					</execution>
				</executions>
				<dependencies>
					<!-- Latest spotbugs version -->
					<dependency>
						<groupId>com.github.spotbugs</groupId>
						<artifactId>spotbugs</artifactId>
						<version>${bt.spotbugs.version}</version>
					</dependency>
					<!-- Bordertech config. -->
					<dependency>
						<groupId>com.github.bordertech.common</groupId>
						<artifactId>build-tools</artifactId>
						<version>1.0.22-SNAPSHOT</version>
					</dependency>
				</dependencies>
			</plugin>

			<!-- Verify: OWASP dependency vulnerability scanner. -->
			<plugin>
				<groupId>org.owasp</groupId>
				<artifactId>dependency-check-maven</artifactId>
				<version>${bt.owasp.plugin.version}</version>
				<executions>
					<execution>
						<id>checkDependencies</id>
						<phase>verify</phase>
						<goals>
							<goal>check</goal>
						</goals>
					</execution>
				</executions>
			</plugin>

			<!-- Verify: Enforcer check for Dependency Convergence -->
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-enforcer-plugin</artifactId>
				<version>3.5.0</version>
				<executions>
					<execution>
						<id>enforcer-convergence-check</id>
						<phase>verify</phase>
						<goals>
							<goal>enforce</goal>
						</goals>
						<configuration>
							<rules>
								<dependencyConvergence />
							</rules>
							<!-- Use a different skip and fail property to not override the enforcer plugin in bordertech_parent. -->
							<skip>${bt.convergence.check.skip}</skip>
							<fail>${bt.convergence.check.fail}</fail>
						</configuration>
					</execution>
				</executions>
			</plugin>

		</plugins>
	</build>

</project>