pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
         http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>4.1.0</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>

    <groupId>org.automatize</groupId>
    <artifactId>status</artifactId>
    <version>${revision}</version>
    <name>status</name>
    <description>Status Monitoring Solution</description>

    <properties>
        <revision>0.0.264-SNAPSHOT</revision>
        <java.version>25</java.version>
        <maven.compiler.source>25</maven.compiler.source>
        <maven.compiler.target>25</maven.compiler.target>
        <maven-compiler-plugin.version>3.15.0</maven-compiler-plugin.version>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <timestamp>${maven.build.timestamp}</timestamp>
        <maven.build.timestamp.format>yyyy-MM-dd HH:mm</maven.build.timestamp.format>
        <!-- OWASP Dependency-Check (profile "security" only, see <profiles> below).
             failBuildOnCVSS defaults to 11 = report only, never fail, so the report is
             always written; CI gates with -Ddependency-check.fail-on-cvss=7. -->
        <dependency-check.version>13.0.0</dependency-check.version>
        <dependency-check.fail-on-cvss>11</dependency-check.fail-on-cvss>
    </properties>

    <dependencies>
        <!-- Spring Boot Starters -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-thymeleaf</artifactId>
        </dependency>
        <dependency>
            <groupId>org.thymeleaf.extras</groupId>
            <artifactId>thymeleaf-extras-springsecurity6</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-jpa</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-validation</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-mail</artifactId>
        </dependency>

        <!-- Flyway -->
        <dependency>
            <groupId>org.flywaydb</groupId>
            <artifactId>flyway-core</artifactId>
        </dependency>
        <dependency>
            <groupId>org.flywaydb</groupId>
            <artifactId>flyway-database-postgresql</artifactId>
        </dependency>

        <!-- PostgreSQL -->
        <dependency>
            <groupId>org.postgresql</groupId>
            <artifactId>postgresql</artifactId>
            <scope>runtime</scope>
        </dependency>

        <!-- JWT -->
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-api</artifactId>
            <version>0.13.0</version>
        </dependency>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-impl</artifactId>
            <version>0.13.0</version>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-jackson</artifactId>
            <version>0.13.0</version>
            <scope>runtime</scope>
        </dependency>

        <!-- Swagger/OpenAPI -->
        <dependency>
            <groupId>org.springdoc</groupId>
            <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
            <version>3.1.0</version>
        </dependency>

        <!-- Lombok -->
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <optional>true</optional>
        </dependency>

        <!-- CommonMark (Markdown → HTML) -->
        <dependency>
            <groupId>org.commonmark</groupId>
            <artifactId>commonmark</artifactId>
            <version>0.29.0</version>
        </dependency>
        <dependency>
            <groupId>org.commonmark</groupId>
            <artifactId>commonmark-ext-gfm-tables</artifactId>
            <version>0.29.0</version>
        </dependency>

        <!-- MySQL JDBC driver (for Scheduler SQL jobs) -->
        <dependency>
            <groupId>com.mysql</groupId>
            <artifactId>mysql-connector-j</artifactId>
            <scope>runtime</scope>
        </dependency>

        <!-- MariaDB JDBC driver (for Scheduler SQL jobs) -->
        <dependency>
            <groupId>org.mariadb.jdbc</groupId>
            <artifactId>mariadb-java-client</artifactId>
            <scope>runtime</scope>
        </dependency>

        <!-- H2 embedded database (for Scheduler SQL jobs) -->
        <dependency>
            <groupId>com.h2database</groupId>
            <artifactId>h2</artifactId>
            <scope>runtime</scope>
        </dependency>

        <!-- Test Dependencies -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <!-- Spring Boot 4 extracted the @WebMvcTest slice into its own module -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-webmvc-test</artifactId>
            <scope>test</scope>
        </dependency>
        <!-- Spring Boot 4 extracted the @DataJpaTest slice into its own module -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-data-jpa-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <resources>
            <resource>
                <directory>src/main/resources</directory>
                <filtering>true</filtering>
                <includes>
                    <include>application.properties</include>
                </includes>
            </resource>
            <resource>
                <directory>src/main/resources</directory>
                <filtering>false</filtering>
                <excludes>
                    <exclude>application.properties</exclude>
                </excludes>
            </resource>
            <resource>
                <directory>${project.basedir}</directory>
                <filtering>false</filtering>
                <includes>
                    <include>build.properties</include>
                </includes>
            </resource>
        </resources>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <configuration>
                    <fork>true</fork>
                    <!-- JDK 23+ disables implicit annotation processing; enable it for Lombok -->
                    <proc>full</proc>
                </configuration>
            </plugin>
            <!-- Antrun Plugin - increments build number and writes revision -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-antrun-plugin</artifactId>
                <version>3.2.0</version>
                <executions>
                    <execution>
                        <id>increment-build-number</id>
                        <phase>validate</phase>
                        <goals>
                            <goal>run</goal>
                        </goals>
                        <configuration>
                            <target>
                                <!-- Increment build number -->
                                <propertyfile file="${project.basedir}/build.properties">
                                    <entry key="buildNumber" type="int" default="0" operation="+"/>
                                </propertyfile>
                                <!-- Read the incremented value -->
                                <loadfile property="build.num" srcFile="${project.basedir}/build.properties">
                                    <filterchain>
                                        <linecontainsregexp>
                                            <regexp pattern="^buildNumber="/>
                                        </linecontainsregexp>
                                        <replaceregex pattern="buildNumber=" replace=""/>
                                        <striplinebreaks/>
                                    </filterchain>
                                </loadfile>
                                <!-- Write revision back to properties file -->
                                <propertyfile file="${project.basedir}/build.properties">
                                    <entry key="revision" value="0.0.${build.num}-SNAPSHOT"/>
                                </propertyfile>
                                <!-- Update revision property in pom.xml -->
                                <replaceregexp file="${project.basedir}/pom.xml"
                                               match="&lt;revision&gt;[^&lt;]*&lt;/revision&gt;"
                                               replace="&lt;revision&gt;0.0.${build.num}-SNAPSHOT&lt;/revision&gt;"/>
                                <echo message="Build ${build.num} - Revision: 0.0.${build.num}-SNAPSHOT"/>
                            </target>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <!-- Properties Plugin - reads build.properties after increment -->
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>properties-maven-plugin</artifactId>
                <version>1.3.0</version>
                <executions>
                    <execution>
                        <id>read-build-properties</id>
                        <phase>initialize</phase>
                        <goals>
                            <goal>read-project-properties</goal>
                        </goals>
                        <configuration>
                            <files>
                                <file>${project.basedir}/build.properties</file>
                            </files>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <!-- Flatten Plugin - resolves ${revision} in installed/deployed pom -->
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>flatten-maven-plugin</artifactId>
                <version>1.8.0</version>
                <configuration>
                    <updatePomFile>true</updatePomFile>
                    <flattenMode>resolveCiFriendliesOnly</flattenMode>
                </configuration>
                <executions>
                    <execution>
                        <id>flatten</id>
                        <phase>process-resources</phase>
                        <goals>
                            <goal>flatten</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>flatten.clean</id>
                        <phase>clean</phase>
                        <goals>
                            <goal>clean</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <!-- Copies the build-filtered application.properties next to the jar in
                 ${project.build.directory}. Spring Boot reads "file:./" as a default
                 config location, so running the jar from that directory (or from the
                 Docker image, which copies both) picks up this external file instead of
                 the one inside the jar. SetupService also writes to the working-directory
                 copy at runtime, which is only possible when it exists outside the jar. -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-resources-plugin</artifactId>
                <executions>
                    <execution>
                        <id>copy-external-config</id>
                        <phase>prepare-package</phase>
                        <goals>
                            <goal>copy-resources</goal>
                        </goals>
                        <configuration>
                            <outputDirectory>${project.build.directory}</outputDirectory>
                            <overwrite>true</overwrite>
                            <resources>
                                <resource>
                                    <!-- Already filtered into target/classes; copy verbatim
                                         so placeholders are not expanded twice. -->
                                    <directory>${project.build.outputDirectory}</directory>
                                    <filtering>false</filtering>
                                    <includes>
                                        <include>application.properties</include>
                                    </includes>
                                </resource>
                            </resources>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <configuration>
                    <excludes>
                        <exclude>
                            <groupId>org.projectlombok</groupId>
                            <artifactId>lombok</artifactId>
                        </exclude>
                    </excludes>
                </configuration>
            </plugin>
            <!-- JaCoCo - test coverage reporting (target: 80% line coverage on services + security) -->
            <plugin>
                <groupId>org.jacoco</groupId>
                <artifactId>jacoco-maven-plugin</artifactId>
                <version>0.8.15</version>
                <executions>
                    <execution>
                        <id>prepare-agent</id>
                        <goals>
                            <goal>prepare-agent</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>report</id>
                        <phase>test</phase>
                        <goals>
                            <goal>report</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>

    <profiles>
        <!-- Dependency vulnerability scan. Opt-in: never part of a normal build, because it
             pulls the NVD data feed and takes minutes.

                 NVD_API_KEY=xxxxx mvn -Psecurity validate

             Bound to `validate` (the first phase) on purpose: the scan needs the resolved
             dependency list and nothing else, so it compiles no Java and runs no tests. Any
             longer goal runs it too, just with everything else.

             Reports land in target/, and the JSON is copied to target/security.json — the
             stable path tooling reads regardless of the plugin's own report naming.

             The key is read from the NVD_API_KEY environment variable, not a POM property:
             a key passed as -D leaks into Maven debug logging (GHSA-qqhq-8r2c-c3f5). Without
             a key the feed update is rate-limited to the point of being unusable on a cold
             cache. Free key from
             https://nvd.nist.gov/developers/request-an-api-key. The cache lives in
             ~/.m2/repository/org/owasp/dependency-check-data and is shared across projects,
             so only the first run is slow. -->
        <profile>
            <id>security</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.owasp</groupId>
                        <artifactId>dependency-check-maven</artifactId>
                        <version>${dependency-check.version}</version>
                        <configuration>
                            <!-- Env var, not <nvdApiKey>: a literal key in the POM leaks into
                                 Maven debug logging (GHSA-qqhq-8r2c-c3f5). -->
                            <nvdApiKeyEnvironmentVariable>NVD_API_KEY</nvdApiKeyEnvironmentVariable>
                            <prettyPrint>true</prettyPrint>
                            <formats>
                                <format>JSON</format>
                                <format>HTML</format>
                            </formats>
                            <failBuildOnCVSS>${dependency-check.fail-on-cvss}</failBuildOnCVSS>
                            <suppressionFiles>
                                <suppressionFile>${project.basedir}/dependency-check-suppressions.xml</suppressionFile>
                            </suppressionFiles>
                            <!-- Test-only and build-only artifacts never reach production. -->
                            <skipTestScope>true</skipTestScope>
                            <skipProvidedScope>true</skipProvidedScope>
                            <!-- No .NET assemblies here; the analyzer only warns about missing mono. -->
                            <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
                        </configuration>
                        <executions>
                            <execution>
                                <id>dependency-check</id>
                                <phase>validate</phase>
                                <goals>
                                    <goal>check</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                    <!-- Declared after dependency-check so it runs after it within the same phase. -->
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-antrun-plugin</artifactId>
                        <version>3.2.0</version>
                        <executions>
                            <execution>
                                <id>publish-security-json</id>
                                <phase>validate</phase>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                                <configuration>
                                    <target>
                                        <!-- A fileset rather than file=/tofile= so that a
                                             skipped scan (-Ddependency-check.skip=true) copies
                                             nothing silently, instead of logging an Ant error
                                             about a file that was never meant to exist. -->
                                        <copy todir="${project.build.directory}" overwrite="true">
                                            <fileset dir="${project.build.directory}"
                                                     includes="dependency-check-report.json"
                                                     erroronmissingdir="false"/>
                                            <globmapper from="dependency-check-report.json"
                                                        to="security.json"/>
                                        </copy>
                                        <echo message="Vulnerability report written to ${project.build.directory}/security.json"/>
                                    </target>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>

</project>