pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>io.binarycodes</groupId>
    <artifactId>harbor</artifactId>
    <version>1.0.0-SNAPSHOT</version>
    <packaging>jar</packaging>

    <licenses>
        <license>
            <name>GNU General Public License v3.0</name>
            <url>https://www.gnu.org/licenses/gpl-3.0.txt</url>
            <distribution>repo</distribution>
        </license>
    </licenses>

    <properties>
        <java.version>21</java.version>
        <vaadin.version>25.2.5</vaadin.version>
        <icu4j.version>78.3</icu4j.version>
        <jsoup.version>1.23.1</jsoup.version>
        <ipaddress.version>5.6.2</ipaddress.version>
        <dramafinder.version>1.1.1</dramafinder.version>
        <playwright.version>1.59.0</playwright.version>
        <jacoco.version>0.8.13</jacoco.version>
        <headless>true</headless>
        <!--
            Surefire and failsafe read argLine, and JaCoCo's prepare-agent overwrites it
            with the coverage agent. Both plugins therefore ask for it late, as
            @{argLine}, so the coverage agent survives having the Mockito agent appended.
            This empty default is what keeps that working when JaCoCo does not run
            (-Djacoco.skip=true): with no property to resolve, @{argLine} would reach the
            forked JVM literally and it would refuse to start.
        -->
        <argLine></argLine>
    </properties>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>4.1.0</version>
        <relativePath/>
    </parent>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>com.vaadin</groupId>
                <artifactId>vaadin-bom</artifactId>
                <version>${vaadin.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>com.ibm.icu</groupId>
                <artifactId>icu4j</artifactId>
                <version>${icu4j.version}</version>
            </dependency>
            <dependency>
                <groupId>org.jsoup</groupId>
                <artifactId>jsoup</artifactId>
                <version>${jsoup.version}</version>
            </dependency>
            <dependency>
                <groupId>com.github.seancfoley</groupId>
                <artifactId>ipaddress</artifactId>
                <version>${ipaddress.version}</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <dependencies>
        <!--
            vaadin-core, not vaadin: Harbor's UI is built entirely from the free
            components, so pulling the commercial ones in only to leave them unused
            would put a license check on every build and a secret in every pipeline.
        -->
        <dependency>
            <groupId>com.vaadin</groupId>
            <artifactId>vaadin-core</artifactId>
        </dependency>
        <dependency>
            <groupId>com.vaadin</groupId>
            <artifactId>vaadin-dev</artifactId>
            <optional>true</optional>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-devtools</artifactId>
            <optional>true</optional>
        </dependency>
        <dependency>
            <groupId>com.vaadin</groupId>
            <artifactId>vaadin-spring-boot-starter</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <!--
            Login is OIDC against Keycloak, so Harbor is an OAuth2 *client* rather
            than a resource server: it needs the redirect, the token exchange and
            the OIDC user, not bearer-token validation. The module-aligned Boot 4
            name, for the reason spelled out beside spring-boot-flyway above — the
            starter is what pulls the autoconfiguration module along with the library.
        -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security-oauth2-client</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-jpa</artifactId>
        </dependency>
        <!--
            PostgreSQL is where the library lives. The driver is BSD-2-Clause and
            the server is under the PostgreSQL License, both of which combine into
            this GPL-3.0 project. Runtime scope: nothing here names a driver class,
            the JDBC URL selects it.
        -->
        <dependency>
            <groupId>org.postgresql</groupId>
            <artifactId>postgresql</artifactId>
            <scope>runtime</scope>
        </dependency>
        <!--
            Flyway owns the schema, and Hibernate is told to validate against it
            rather than generate it: a schema that drifts from the entity should
            fail startup, not be silently rewritten under a running deployment.
            flyway-database-postgresql is a separate artifact since Flyway 10 —
            without it the migration fails with "no database support". Apache-2.0.
        -->
        <dependency>
            <groupId>org.flywaydb</groupId>
            <artifactId>flyway-core</artifactId>
        </dependency>
        <dependency>
            <groupId>org.flywaydb</groupId>
            <artifactId>flyway-database-postgresql</artifactId>
        </dependency>
        <!--
            Spring Boot 4 splits auto-configuration into a module per technology,
            so flyway-core alone is the library with nothing wiring it up: the
            migrations never run and Hibernate then fails validation against a
            schema nothing created.
        -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-flyway</artifactId>
        </dependency>
        <dependency>
            <groupId>com.ibm.icu</groupId>
            <artifactId>icu4j</artifactId>
        </dependency>
        <dependency>
            <groupId>org.jsoup</groupId>
            <artifactId>jsoup</artifactId>
        </dependency>
        <!--
            jsoup parses, but it resolves and connects with no hook to intervene.
            Apache's client connects to whatever its DnsResolver returned, which is
            what lets OutboundAddressPolicy vet an address without leaving a window
            for a second, unchecked lookup. Version comes from the Spring Boot BOM.
        -->
        <dependency>
            <groupId>org.apache.httpcomponents.client5</groupId>
            <artifactId>httpclient5</artifactId>
        </dependency>
        <!--
            CIDR arithmetic, not hand-rolled: Spring Security's IpAddressMatcher
            compares raw address bytes with no family check at the version this build
            resolves, so an IPv4 range reports a match for an IPv6 address and a
            16-byte range throws when compared against a 4-byte one. Apache-2.0,
            which combines into this GPL-3.0 project.
        -->
        <dependency>
            <groupId>com.github.seancfoley</groupId>
            <artifactId>ipaddress</artifactId>
        </dependency>
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <optional>true</optional>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>com.vaadin</groupId>
            <artifactId>browserless-test-junit6</artifactId>
            <scope>test</scope>
        </dependency>
        <!--
            The views are Spring beans with constructor injection, so browserless
            tests need the Spring-aware base class; browserless-test-junit6 alone
            only offers the plain one, which cannot build them.
        -->
        <dependency>
            <groupId>com.vaadin</groupId>
            <artifactId>browserless-test-spring</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.vaadin.addons</groupId>
            <artifactId>dramafinder</artifactId>
            <version>${dramafinder.version}</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>com.microsoft.playwright</groupId>
            <artifactId>playwright</artifactId>
            <version>${playwright.version}</version>
            <scope>test</scope>
        </dependency>
        <!--
            A real PostgreSQL for the tests that touch it: the queries carry the
            search and the collation, so an in-memory stand-in would only be
            testing the stand-in. Versions come from the Spring Boot BOM, which
            imports the Testcontainers BOM. MIT.
        -->
        <dependency>
            <groupId>org.testcontainers</groupId>
            <artifactId>testcontainers-postgresql</artifactId>
            <scope>test</scope>
        </dependency>
        <!--
            Reads the text back out of an archived PDF. Asserting on %PDF- and %%EOF is
            not enough: a blank page carries both, so a browser that rendered nothing
            passes. Apache-2.0, and test scope only — nothing in the application reads
            a PDF.
        -->
        <dependency>
            <groupId>org.apache.pdfbox</groupId>
            <artifactId>pdfbox</artifactId>
            <version>3.0.7</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-testcontainers</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <defaultGoal>spring-boot:run</defaultGoal>
        <plugins>
            <!--
                Warnings fail the build. The exclusions are the categories that fire
                on correct code here, so leaving them on would train everyone to
                ignore the output:
                  deprecation - @CssImport(themeFor) is deprecated but is the only
                                way to reach Highcharts internals in shadow DOM
                  serial      - Vaadin components are Serializable without serialVersionUID
                  this-escape - every view calls add()/setWidthFull() from its constructor
                  path        - non-existent classpath entries, environmental not code
                  processing  - Lombok is the only processor, so it never claims the
                                Spring and Vaadin annotations read at runtime
            -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <configuration>
                    <compilerArgs>
                        <arg>-Xlint:all,-deprecation,-serial,-this-escape,-path,-processing</arg>
                        <arg>-Werror</arg>
                    </compilerArgs>
                </configuration>
            </plugin>
            <!--
                The deployed commit SHA is mandatory: every build must be traceable
                to a commit. build.commit has no default, so a build that fails to
                supply -Dbuild.commit=<sha> is rejected here at validate rather than
                silently shipping an unidentifiable build. run.sh supplies it from
                `git rev-parse HEAD`; the Docker build from the GIT_SHA arg; CI from
                github.sha.
            -->
            <!--
                Exposes every resolved dependency's path as a property, which is the only
                way to name the Mockito jar in an argLine without hard-coding a version.
            -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-dependency-plugin</artifactId>
                <executions>
                    <execution>
                        <id>resolve-agent-paths</id>
                        <goals><goal>properties</goal></goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
                <executions>
                    <execution>
                        <id>require-build-commit</id>
                        <goals>
                            <goal>enforce</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <requireProperty>
                                    <property>build.commit</property>
                                    <message>build.commit is required: pass -Dbuild.commit=&lt;git sha&gt;. Build through ./run.sh (which sets it automatically) or, for Docker, supply the GIT_SHA build arg.</message>
                                    <regex>[0-9a-fA-F]{7,40}</regex>
                                    <regexMessage>build.commit must be a git commit SHA (7-40 hex chars).</regexMessage>
                                </requireProperty>
                            </rules>
                            <failFast>true</failFast>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <executions>
                    <execution>
                        <goals>
                            <goal>build-info</goal>
                        </goals>
                        <configuration>
                            <additionalProperties>
                                <commit>${build.commit}</commit>
                            </additionalProperties>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>com.vaadin</groupId>
                <artifactId>vaadin-maven-plugin</artifactId>
                <version>${vaadin.version}</version>
                <executions>
                    <execution>
                        <goals>
                            <goal>build-frontend</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.jacoco</groupId>
                <artifactId>jacoco-maven-plugin</artifactId>
                <version>${jacoco.version}</version>
                <executions>
                    <execution>
                        <id>prepare-agent</id>
                        <goals><goal>prepare-agent</goal></goals>
                    </execution>
                    <execution>
                        <id>report</id>
                        <phase>test</phase>
                        <goals><goal>report</goal></goals>
                    </execution>
                    <execution>
                        <id>coverage-check</id>
                        <phase>test</phase>
                        <goals><goal>check</goal></goals>
                        <configuration>
                            <rules>
                                <rule>
                                    <element>PACKAGE</element>
                                    <includes>
                                        <include>io.binarycodes.harbor.*.service</include>
                                        <include>io.binarycodes.harbor.*.ui.presenter</include>
                                    </includes>
                                    <limits>
                                        <limit>
                                            <counter>INSTRUCTION</counter>
                                            <value>COVEREDRATIO</value>
                                            <minimum>0.80</minimum>
                                        </limit>
                                    </limits>
                                </rule>
                            </rules>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <!--
                Mockito's inline mock maker attaches itself as an agent at runtime, which
                the JDK is in the process of withdrawing; passing it as -javaagent is the
                supported way. Nothing here mocks anything directly — Mockito arrives with
                spring-boot-starter-test and the Spring test infrastructure initialises it
                — so this exists to keep the build quiet on a future JDK rather than to
                enable anything.
            -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <configuration>
                    <argLine>@{argLine} -javaagent:${org.mockito:mockito-core:jar}</argLine>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-failsafe-plugin</artifactId>
                <configuration>
                    <argLine>@{argLine} -javaagent:${org.mockito:mockito-core:jar}</argLine>
                    <systemPropertyVariables>
                        <headless>${headless}</headless>
                    </systemPropertyVariables>
                </configuration>
                <executions>
                    <execution>
                        <goals>
                            <goal>integration-test</goal>
                            <goal>verify</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <!--
                Renders the failsafe (e2e/Playwright) and surefire (unit) XML
                results into a browsable HTML scenario list under
                target/reports/. Not a coverage gate — it's a human-readable
                catalogue of which scenarios ran and passed. @DisplayName on the
                IT classes/methods becomes the scenario text.
            -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-report-plugin</artifactId>
                <version>3.5.5</version>
                <configuration>
                    <outputDirectory>${project.build.directory}/reports</outputDirectory>
                    <showSuccess>true</showSuccess>
                </configuration>
                <executions>
                    <execution>
                        <id>e2e-scenario-report</id>
                        <phase>post-integration-test</phase>
                        <goals><goal>failsafe-report-only</goal></goals>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>

    <profiles>
        <profile>
            <id>it</id>
            <properties>
                <vaadin.productionMode>true</vaadin.productionMode>
                <headless>true</headless>
            </properties>
        </profile>
        <profile>
            <id>debug-ui</id>
            <properties>
                <headless>false</headless>
            </properties>
        </profile>
    </profiles>

    <repositories>
        <repository>
            <id>central</id>
            <url>https://repo.maven.apache.org/maven2</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>
        <repository>
            <id>vaadin-addons</id>
            <url>https://maven.vaadin.com/vaadin-addons</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>
    </repositories>

</project>