build: drop the redundant Failsafe version pin in token-sheriff-client

[cuioss-oliver]

Removes the locally pinned <version.maven.failsafe>. This is the line that turned the last parent bump into a deadlock.

The comment was wrong

The property justified itself with:

"token-sheriff-client inherits no maven-failsafe-plugin pluginManagement from cui-java-parent or token-sheriff-parent, so the IT tier binding below must pin its own version."

cui-parent-pom does declare it, in build/pluginManagement/plugins/plugin (lines 308–312):

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-failsafe-plugin</artifactId>
    <version>${maven.failsafe.plugin.version}</version>
</plugin>

<build> spans lines 156–563 and <profiles> starts at 565, so this is outside any profile — inherited unconditionally. And it is present in 1.5.11, 1.6.0 and 1.6.1 alike, so the claim was untrue when written, not merely stale.

Why it mattered

The enforcer's RequireSameVersions rule compares Surefire against Failsafe. A locally pinned Failsafe turns any parent-driven Surefire move into a build break until the pin is hand-edited to match. That is precisely what happened last cycle:

	Surefire	Failsafe	Enforcer
#707 alone (parent 1.6.1)	3.6.0 (parent)	3.5.6 (pin)	fail
#703 alone (failsafe bump)	3.5.6 (parent)	3.6.0 (pin)	fail
#708 (both, by hand)	3.6.0	3.6.0	pass

Two PRs that each looked individually broken, neither fixable by rebasing — an interlock manufactured entirely by this pin. With the version inherited, the two plugins move in lockstep by construction and this failure mode cannot recur.

Counter-example

API-Sheriff declares maven-surefire-plugin / maven-failsafe-plugin in seven places across pom.xml, api-sheriff/, integration-tests/ and benchmarks/, and pins a version in none of them. TokenSheriff's token-sheriff-client was the only pin in either repo.

Scope

Only the <version> is removed. The <executions> binding stays — that is what makes the wired-flow *IT tier run under mvn verify, and it is genuinely local (no Failsafe binding is inherited, only the version). The stale comment is replaced with one recording why the version is deliberately absent.

Verification

./mvnw clean verify -pl token-sheriff-client → BUILD SUCCESS:

• failsafe:3.6.0:integration-test — version resolves from the parent
• Wired-flow scaffold — 7 ITs execute, so the binding is intact
• failsafe:3.6.0:verify runs
• jacoco:check (refresh-path-coverage-check) — All coverage checks have been met
• enforcer RequireSameVersions passes (Surefire 3.6.0 / Failsafe 3.6.0)

Effective-POM check confirms both plugins resolve to 3.6.0 with no local property.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Excluded labels (none allowed) (1)

• skip-bot-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: cuioss/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: f04a1b0d-fe4a-41ad-9d9f-d0d5e1e3037f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Sorry @cuioss-oliver, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 1 day and 3 hours by commenting @sourcery-ai review. Upgrade to get a review now.