pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <groupId>com.github.spotbugs</groupId>
  <artifactId>sonar-findbugs-plugin</artifactId>
  <version>4.3.0-SNAPSHOT</version>
  <packaging>sonar-plugin</packaging>

  <name>SonarQube SpotBugs Plugin</name>
  <description>SpotBugs is a program that uses static analysis to look for bugs in Java code. It can detect a variety of common coding mistakes, including thread synchronization problems, misuse of API methods.</description>
  <url>https://github.com/spotbugs/sonar-findbugs/</url>
  <issueManagement>
    <system>GitHub Issues</system>
    <url>https://github.com/spotbugs/sonar-findbugs/issues</url>
  </issueManagement>
  <inceptionYear>2012</inceptionYear>
  <organization>
    <name>SpotBugs Team</name>
    <url>https://github.com/spotbugs/</url>
  </organization>
  <licenses>
    <license>
      <name>GNU LGPL 3</name>
      <url>http://www.gnu.org/licenses/lgpl.txt</url>
      <distribution>repo</distribution>
    </license>
  </licenses>

  <developers>
    <developer>
      <id>godin</id>
      <name>Evgeny Mandrikov</name>
      <organization>SonarSource</organization>
    </developer>
    <developer>
      <id>benzonico</id>
      <name>Nicolas Peru</name>
      <organization>SonarSource</organization>
    </developer>
  </developers>
  <scm>
    <connection>scm:git:git@github.com:spotbugs/sonar-findbugs.git</connection>
    <developerConnection>scm:git:git@github.com:spotbugs/sonar-findbugs.git</developerConnection>
    <url>https://github.com/spotbugs/sonar-findbugs</url>
    <tag>HEAD</tag>
  </scm>

  <properties>
    <!--
      When update these versions, update description in .github/workflows/build.yml too.
      Also need to update profiles, see ./generate_profiles/README.md for detail.
      Update the version table and the rules count badge in README.md
    -->
    <spotbugs.version>4.8.6</spotbugs.version>
    <sbcontrib.version>7.6.4</sbcontrib.version>
    <findsecbugs.version>1.13.0</findsecbugs.version>

    <jdk.min.version>1.8</jdk.min.version>
    <surefire.version>3.2.5</surefire.version>
    <failsafe.version>3.2.5</failsafe.version>
    <sonar.server.version>9.9.0.65466</sonar.server.version>
    <sonar-plugin-api.version>9.14.0.375</sonar-plugin-api.version>
    <sonar-java.version>8.0.1.36337</sonar-java.version>
    
    <sonar-orchestrator.version>4.9.0.1920</sonar-orchestrator.version>

    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

    <maven.compiler.source>1.8</maven.compiler.source>
    <maven.compiler.target>1.8</maven.compiler.target>
  </properties>

  <dependencies>
    <!--
    !!! ORDER OF DEPENDENCIES IS IMPORTANT !!!
    FindBugs should be first
    -->

    <dependency>
      <groupId>com.github.spotbugs</groupId>
      <artifactId>spotbugs</artifactId>
      <version>${spotbugs.version}</version>
      <exclusions>
        <exclusion>
          <groupId>xml-apis</groupId>
          <artifactId>xml-apis</artifactId>
        </exclusion>
        <exclusion>
          <groupId>org.apache.logging.log4j</groupId>
          <artifactId>log4j-core</artifactId>
        </exclusion>
      </exclusions>
    </dependency>


    <dependency>
      <groupId>org.sonarsource.sslr-squid-bridge</groupId>
      <artifactId>sslr-squid-bridge</artifactId>
      <version>2.7.1.392</version>
      <exclusions>
        <exclusion>
          <groupId>org.codehaus.sonar</groupId>
          <artifactId>sonar-plugin-api</artifactId>
        </exclusion>
      </exclusions>
    </dependency>

    <dependency>
      <groupId>org.slf4j</groupId>
      <artifactId>slf4j-api</artifactId>
      <version>2.0.13</version>
      <scope>provided</scope>
    </dependency>

    <dependency>
      <groupId>commons-io</groupId>
      <artifactId>commons-io</artifactId>
      <version>2.16.1</version>
    </dependency>

    <dependency>
      <groupId>com.mebigfatguy.sb-contrib</groupId>
      <artifactId>sb-contrib</artifactId>
      <version>${sbcontrib.version}</version>
      <scope>provided</scope>
    </dependency>

    <dependency>
      <groupId>com.h3xstream.findsecbugs</groupId>
      <artifactId>findsecbugs-plugin</artifactId>
      <version>${findsecbugs.version}</version>
      <scope>provided</scope>
    </dependency>

    <dependency>
      <groupId>com.thoughtworks.xstream</groupId>
      <artifactId>xstream</artifactId>
      <version>1.4.20</version>
      <exclusions>
        <!-- we use stax -->
        <exclusion>
          <groupId>xmlpull</groupId>
          <artifactId>xmlpull</artifactId>
        </exclusion>
        <!-- we use stax -->
        <exclusion>
          <groupId>xpp3</groupId>
          <artifactId>xpp3_min</artifactId>
        </exclusion>
      </exclusions>
    </dependency>

    <dependency>
      <groupId>org.sonarsource.api.plugin</groupId>
      <artifactId>sonar-plugin-api</artifactId>
      <version>${sonar-plugin-api.version}</version>
      <scope>provided</scope>
      <exclusions>
        <!-- allows to package xstream into plugin -->
        <exclusion>
          <groupId>com.thoughtworks.xstream</groupId>
          <artifactId>xstream</artifactId>
        </exclusion>
      </exclusions>
    </dependency>

    <dependency>
      <groupId>org.sonarsource.java</groupId>
      <artifactId>sonar-java-plugin</artifactId>
      <version>${sonar-java.version}</version>
      <exclusions>
        <exclusion>
          <groupId>org.sonarsource.java</groupId>
          <artifactId>external-reports</artifactId>
        </exclusion>
        <exclusion>
          <groupId>org.sonarsource.java</groupId>
          <artifactId>java-checks</artifactId>
        </exclusion>
        <exclusion>
          <groupId>org.sonarsource.analyzer-commons</groupId>
          <artifactId>sonar-xml-parsing</artifactId>
        </exclusion>
        <exclusion>
          <groupId>org.sonarsource.analyzer-commons</groupId>
          <artifactId>sonar-analyzer-commons</artifactId>
        </exclusion>
        <exclusion>
          <groupId>org.sonarsource.java</groupId>
          <artifactId>java-checks-aws</artifactId>
        </exclusion>
        <exclusion>
          <groupId>org.sonarsource.java</groupId>
          <artifactId>java-jsp</artifactId>
        </exclusion>
        <exclusion>
          <groupId>org.sonarsource.analyzer-commons</groupId>
          <artifactId>sonar-performance-measure</artifactId>
        </exclusion>
        <exclusion>
          <groupId>org.sonarsource.java</groupId>
          <artifactId>java-surefire</artifactId>
        </exclusion>
        <!--<exclusion>
          <groupId>org.sonarsource.java</groupId>
          <artifactId>jdt-package</artifactId>
        </exclusion>-->
      </exclusions>
    </dependency>

    <!-- unit tests -->
    <dependency>
      <groupId>org.junit.jupiter</groupId>
      <artifactId>junit-jupiter</artifactId>
      <version>5.10.2</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.mockito</groupId>
      <artifactId>mockito-core</artifactId>
      <version>5.11.0</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.assertj</groupId>
      <artifactId>assertj-core</artifactId>
      <version>3.25.3</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>xmlunit</groupId>
      <artifactId>xmlunit</artifactId>
      <version>1.6</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>org.sonarsource.orchestrator</groupId>
      <artifactId>sonar-orchestrator</artifactId>
      <version>${sonar-orchestrator.version}</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.sonarsource.orchestrator</groupId>
      <artifactId>sonar-orchestrator-junit5</artifactId>
      <version>${sonar-orchestrator.version}</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>org.sonarsource.sonarqube</groupId>
      <artifactId>sonar-ws</artifactId>
      <version>9.9.5.90363</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.sonarsource.api.plugin</groupId>
      <artifactId>sonar-plugin-api-test-fixtures</artifactId>
      <version>10.7.0.2191</version>
      <scope>test</scope>
    </dependency>
  </dependencies>

  <build>
    <finalName>${project.artifactId}</finalName>
    <resources>
      <resource>
        <directory>src/main/resources</directory>
        <filtering>true</filtering>
      </resource>
    </resources>

    <testResources>
      <testResource>
        <directory>${basedir}/src/main/resources</directory>
      </testResource>
      <testResource>
        <directory>${basedir}/src/test/resources</directory>
      </testResource>
    </testResources>

    <pluginManagement>
      <plugins>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-compiler-plugin</artifactId>
          <version>3.13.0</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-jar-plugin</artifactId>
          <version>3.4.1</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-gpg-plugin</artifactId>
          <version>3.2.4</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-resources-plugin</artifactId>
          <version>3.3.1</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-source-plugin</artifactId>
          <version>3.3.1</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-clean-plugin</artifactId>
          <version>3.3.2</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-release-plugin</artifactId>
          <version>3.0.1</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-deploy-plugin</artifactId>
          <version>3.1.2</version>
        </plugin>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-install-plugin</artifactId>
          <version>3.1.2</version>
        </plugin>
        <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-surefire-plugin</artifactId>
         <version>${surefire.version}</version>
        </plugin>
        <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-failsafe-plugin</artifactId>
         <version>${failsafe.version}</version>
        </plugin>
        <plugin>
         <groupId>org.jacoco</groupId>
         <artifactId>jacoco-maven-plugin</artifactId>
         <version>0.8.12</version>
        </plugin>
        <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-javadoc-plugin</artifactId>
         <version>3.6.3</version>
        </plugin>
      </plugins>
    </pluginManagement>

    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <configuration>
          <source>${jdk.min.version}</source>
          <target>${jdk.min.version}</target>
        </configuration>
      </plugin>

      <plugin>
        <groupId>org.jacoco</groupId>
        <artifactId>jacoco-maven-plugin</artifactId>
        <executions>
          <execution>
            <id>pre-unit-test</id>
            <goals>
              <goal>prepare-agent</goal>
            </goals>
            <configuration>
              <append>true</append>
              <propertyName>surefireArgLine</propertyName>
            </configuration>
          </execution>
          <execution>
            <id>post-unit-test</id>
            <phase>test</phase>
            <goals>
              <goal>report</goal>
            </goals>
          </execution>
        </executions>
        <configuration>
          <excludes>
            <exclude>*.jar</exclude>
          </excludes>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-surefire-plugin</artifactId>
        <configuration>
          <argLine>${surefireArgLine}</argLine>
          <useModulePath>false</useModulePath>
          <!-- Exclude the unit tests from the sample projects -->
          <excludes>
            <exclude>projects/**</exclude>
          </excludes>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-failsafe-plugin</artifactId>
        <configuration>
          <argLine>${failsafeArgLine}</argLine>
          <useModulePath>false</useModulePath>
          <systemPropertyVariables>
            <sonar.server.version>${sonar.server.version}</sonar.server.version>
          </systemPropertyVariables>
        </configuration>
        <executions>
          <execution>
            <goals>
              <goal>integration-test</goal>
              <goal>verify</goal>
            </goals>
          </execution>
        </executions>
      </plugin>


      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-dependency-plugin</artifactId>
        <executions>
          <execution>
            <id>copy-dependencies</id>
            <phase>process-resources</phase>
            <goals>
              <goal>copy-dependencies</goal>
            </goals>
            <configuration>
              <stripVersion>true</stripVersion>
              <outputDirectory>${project.build.outputDirectory}</outputDirectory>
              <includeArtifactIds>annotations,jsr305,sb-contrib,findsecbugs-plugin</includeArtifactIds>
            </configuration>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.sonarsource.sonar-packaging-maven-plugin</groupId>
        <artifactId>sonar-packaging-maven-plugin</artifactId>
        <version>1.23.0.740</version>
        <extensions>true</extensions>
        <configuration>
          <archive>
            <manifestEntries>
              <!-- ${buildNumber} is the svn revision generated by the buildnumber-maven-plugin -->
              <Implementation-Build>${buildNumber}</Implementation-Build>
              <Build-Time>${timestamp}</Build-Time>
            </manifestEntries>
          </archive>
          <pluginName>Findbugs</pluginName>
          <pluginDescription>Analyze Java, Scala, Closure and JSP code with SpotBugs. ${spotbugs.version}</pluginDescription>
          <pluginClass>org.sonar.plugins.findbugs.FindbugsPlugin</pluginClass>
          <useChildFirstClassLoader>false</useChildFirstClassLoader>
          <requiredForLanguages>java,scala,jsp,clojure,kotlin</requiredForLanguages>
          <skipDependenciesPackaging>true</skipDependenciesPackaging>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-enforcer-plugin</artifactId>
        <version>3.4.1</version>
        <executions>
          <execution>
            <id>enforce-plugin-size</id>
            <goals>
              <goal>enforce</goal>
            </goals>
            <phase>verify</phase>
            <configuration>
              <rules>
                <requireFilesSize>
                  <maxsize>42000000</maxsize>
                  <minsize>8000000</minsize>
                  <files>
                    <file>${project.build.directory}/${project.build.finalName}.jar</file>
                  </files>
                </requireFilesSize>
              </rules>
            </configuration>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-shade-plugin</artifactId>
        <version>3.5.3</version>
        <executions>
          <execution>
            <phase>package</phase>
            <goals>
              <goal>shade</goal>
            </goals>
            <configuration>
              <transformers>
                <transformer  implementation="org.apache.maven.plugins.shade.resource.ApacheNoticeResourceTransformer">
                  <addHeader>false</addHeader>
                </transformer>
              </transformers>
              <filters>
                <filter>
                  <artifact>*:*</artifact>
                  <excludes>
                    <exclude>META-INF/*.SF</exclude>
                    <exclude>META-INF/*.DSA</exclude>
                    <exclude>META-INF/*.RSA</exclude>
                  </excludes>
                </filter>
              </filters>
              <createDependencyReducedPom>false</createDependencyReducedPom>
            </configuration>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>
  <distributionManagement>
    <snapshotRepository>
      <id>ossrh</id>
      <url>https://oss.sonatype.org/content/repositories/snapshots</url>
    </snapshotRepository>
  </distributionManagement>
  <profiles>
    <profile>
      <id>deploy</id>
      <build>
        <plugins>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-source-plugin</artifactId>
            <executions>
              <execution>
                <id>attach-sources</id>
                <goals>
                  <goal>jar-no-fork</goal>
                </goals>
              </execution>
            </executions>
          </plugin>
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-gpg-plugin</artifactId>
            <executions>
              <execution>
                <id>sign-artifacts</id>
                <phase>verify</phase>
                <goals>
                  <goal>sign</goal>
                </goals>
                <configuration>
                  <!-- Prevent gpg from using pinentry programs -->
                  <gpgArguments>
                    <arg>--pinentry-mode</arg>
                    <arg>loopback</arg>
                  </gpgArguments>
                </configuration>
              </execution>
            </executions>
          </plugin>
          <plugin>
            <groupId>org.sonatype.plugins</groupId>
            <artifactId>nexus-staging-maven-plugin</artifactId>
            <version>1.6.13</version>
            <extensions>true</extensions>
            <configuration>
               <serverId>ossrh</serverId>
               <nexusUrl>https://oss.sonatype.org/</nexusUrl>
               <autoReleaseAfterClose>true</autoReleaseAfterClose>
            </configuration>
          </plugin>
        </plugins>
      </build>
    </profile>
  </profiles>
</project>