Release Version 2.0.0 on Maven Central

.github/workflows/maven.yml

@@ -32,3 +32,7 @@ jobs:
       run: mvn -B compile --file pom.xml
     - name: Run unit tests
       run: mvn -B test --file pom.xml
+    - name: Generate JavaDoc
+      run: mvn -B javadoc:javadoc --file pom.xml
+    - name: Update dependency graph
+      uses: advanced-security/maven-dependency-submission-action@v5

.gitignore

@@ -37,4 +37,6 @@ settings.xml
 
 #maven resolution files
 maven-resolution-files
-.DS_Store
+.DS_Store
+.mvn
+marin-progress

docs/RELEASE.md

@@ -0,0 +1,39 @@
+# Creating a MARIN release
+
+1. Make sure the last CI build on `develop` was successful
+2. Checkout branch `develop` locally, and create a new branch `feature/prepare-release-X.X.X` off of `develop`
+3. Check [the dependabot logs](https://github.com/sse-labs/marin/security/dependabot) for vulnerabilities in the current build. If relevant vulnerabilities exist:
+    * Update dependencies according to security advisories.
+    * Run `mvn clean package` and make sure the dependency updates did not break compilation or tests
+    * If the update breaks the MARIN build or tests, postpone release and implement dependency updates on `develop`
+    * Add dependency updates as a commit to the release preparation branch
+4. Verify that all code snippets in the README file actually work. To do so:
+    * Run `mvn clean install -DskipTests` to install the current snapshot version locally
+    * Create a demo client project that depends on the current snapshot version of MARIN
+    * Copy-Paste all snippets from the MARIN README to the client project
+    * Ensure the client projects builds successfully, and all executable code can in fact be executed.
+    * Update README snippets if necessary, and add a commit to the release preparation branch
+5. If the release preparation branch contains at least one new commit, push it to the remote repo and create a PR on GitHub to merge your changes **back into develop**
+6. Update your local version of MARIN with the last changes: `git checkout develop` and `git pull`
+7. Create a new branch `release/X.X.X` off of develop
+8. Update the `<version>` tag within `pom.xml` to contain the actual version you want to release (i.e., remove `-SNAPSHOT`)
+9. Perform a dry run for deployment:
+    * Ensure `<skipPublishing>` is set to `true` in `pom.xml`
+    * Ensure `settings.xml` with the publishing credentials is located in your current user's `.m2` directory
+    * Ensure you have the GPG signing key installed and the passphrase is available
+    * Run `mvn clean deploy -DskipTests -P release`, enter the GPG passphrase when prompted
+    * If everything is configured correctly, Maven will report `BUILD SUCCESS` without actually publishing anything yet
+10. Deploy the new version to Maven Central:
+    * Set `<skipPublihsing>` to `false` in `pom.xml`
+    * Run `mvn clean deploy -DskipTests -P release`, enter the GPG passphrase when prompted
+    * Set `<skipPublihsing>` to back to `true` in `pom.xml`
+11. Publish the deployment:
+    * Go to the [Sonatype Website](https://central.sonatype.com/publishing/deployments) and log in to the publishing account
+    * Select the recent deployment, assert that the status says `Validated`
+    * Click on "Publish"
+    * Publishing can take a few minutes - check back periodically until status says "Published"
+12. Change current MARIN version in README.md to newly released version
+13. Push your `release/X.X.X` branch and create a PR merging you changes **into the main branch**.
+14. Merge your `main` branch back into `develop`, increase `<version>` attribute in `pom.xml` (either minor or patch version), and add a `-SNAPSHOT` suffix
+15. Create a GitHub release on the `main` branch
+16. Update your local repo with `git fetch` and delete the release branch

pom.xml

@@ -6,7 +6,7 @@
 
     <groupId>eu.sse-labs</groupId>
     <artifactId>marin</artifactId>
-    <version>1.0.0</version>
+    <version>2.0.0</version>
 
     <packaging>jar</packaging>
 
@@ -37,36 +37,56 @@
     </scm>
 
     <properties>
-        <maven.compiler.source>11</maven.compiler.source>
-        <maven.compiler.target>11</maven.compiler.target>
+        <maven.compiler.release>11</maven.compiler.release>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <scala.binary.version>3</scala.binary.version>
     </properties>
+
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>org.apache.pekko</groupId>
+                <artifactId>pekko-bom_${scala.binary.version}</artifactId>
+                <version>1.3.0</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
     <dependencies>
         <dependency>
-            <groupId>com.typesafe.akka</groupId>
-            <artifactId>akka-actor_2.13</artifactId>
-            <version>2.9.0-M2</version>
+            <groupId>org.apache.pekko</groupId>
+            <artifactId>pekko-actor-typed_${scala.binary.version}</artifactId>
         </dependency>
         <dependency>
             <groupId>org.junit.jupiter</groupId>
             <artifactId>junit-jupiter</artifactId>
             <version>5.10.0</version>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.jsoup</groupId>
+            <artifactId>jsoup</artifactId>
+            <version>1.22.1</version>
+            <scope>compile</scope>
+        </dependency>
         <dependency>
             <groupId>org.apache.maven.indexer</groupId>
             <artifactId>indexer-reader</artifactId>
             <version>7.1.3</version>
         </dependency>
         <dependency>
-            <groupId>org.apache.logging.log4j</groupId>
-            <artifactId>log4j-api</artifactId>
-            <version>2.17.2</version>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-api</artifactId>
+            <version>2.0.17</version>
+            <scope>compile</scope>
         </dependency>
         <dependency>
-            <groupId>org.apache.logging.log4j</groupId>
-            <artifactId>log4j-core</artifactId>
-            <version>2.17.2</version>
+            <groupId>ch.qos.logback</groupId>
+            <artifactId>logback-classic</artifactId>
+            <version>1.5.25</version>
+            <scope>test</scope>
         </dependency>
         <!-- https://mvnrepository.com/artifact/com.google.code.gson/gson -->
         <dependency>
@@ -77,7 +97,7 @@
         <dependency>
             <groupId>org.apache.maven</groupId>
             <artifactId>maven-model</artifactId>
-            <version>3.9.9</version>
+            <version>3.9.14</version>
         </dependency>
         <!-- https://mvnrepository.com/artifact/commons-io/commons-io -->
         <dependency>
@@ -97,8 +117,8 @@
         </dependency>
         <dependency>
             <groupId>de.opal-project</groupId>
-            <artifactId>framework_2.13</artifactId>
-            <version>5.0.0</version>
+            <artifactId>framework_${scala.binary.version}</artifactId>
+            <version>7.0.0</version>
         </dependency>
 
         <!-- The following dependencies are pinned (lower bound) to avoid vulnerabilities in transitive dependencies -->
@@ -136,6 +156,33 @@
                     </includes>
                 </configuration>
             </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <version>3.14.1</version>
+                <configuration>
+                    <compilerArgs>
+                        <arg>-Xlint:all,-serial,-processing</arg>
+                        <arg>-Werror</arg>
+                    </compilerArgs>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-javadoc-plugin</artifactId>
+                <version>3.12.0</version>
+                <executions>
+                    <execution>
+                        <id>attach-sources</id>
+                        <goals>
+                            <goal>jar</goal>
+                        </goals>
+                    </execution>
+                </executions>
+                <configuration>
+                    <failOnWarnings>true</failOnWarnings>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 
@@ -158,19 +205,6 @@
                             </execution>
                         </executions>
                     </plugin>
-                    <plugin>
-                        <groupId>org.apache.maven.plugins</groupId>
-                        <artifactId>maven-javadoc-plugin</artifactId>
-                        <version>3.11.2</version>
-                        <executions>
-                            <execution>
-                                <id>attach-sources</id>
-                                <goals>
-                                    <goal>jar</goal>
-                                </goals>
-                            </execution>
-                        </executions>
-                    </plugin>
                     <plugin>
                         <groupId>org.apache.maven.plugins</groupId>
                         <artifactId>maven-gpg-plugin</artifactId>